@geekmidas/cli 10.0.0-alpha.46 → 10.0.0-alpha.47

package/dist/index.mjs

@@ -5,10 +5,11 @@ import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as Not
 import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-DNzWgM1J.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
 import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { C as createEntryWrapper, D as loadSecretsForApp, E as loadEnvFiles, O as prepareEntryCredentials, S as createCredentialsPreload, T as isPortAvailable, _ as primaryPortKey, a as reconcileWorkspace, b as providerOf, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as fakeKey, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as cacheBackendFor, w as findAvailablePort, x as storageBackendFor, y as eventsBackendFor } from "./workspace-CHEC80sp.mjs";
+import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-cb6U29EL.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BzIGy8KE.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-V6Ou6-B6.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-WfT-eWlm.mjs";
+import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CSuLl0YP.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
@@ -24,6 +25,7 @@ import fg from "fast-glob";
 import chokidar from "chokidar";
 import { createCipheriv, createHash, randomBytes } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { parse as parse$1, parseDocument } from "yaml";
@@ -40,7 +42,7 @@ import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.46";
+var version = "10.0.0-alpha.47";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1196,9 +1198,9 @@ async function devCommand(options) {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {}
 		});
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
+		if (reconciled.services.length > 0) {
+			logger$9.log("🐳 Services");
+			for (const line of describeServices(reconciled.services)) logger$9.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && appKey(r.id) === workspaceAppName);
@@ -1479,9 +1481,9 @@ async function workspaceDevCommand(workspace, options) {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {}
 	});
-	if (reconciled.changed && reconciled.plan.containers.length > 0) {
-		logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-		for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
+	if (reconciled.services.length > 0) {
+		logger$9.log("🐳 Services");
+		for (const line of describeServices(reconciled.services)) logger$9.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
@@ -1490,9 +1492,9 @@ async function workspaceDevCommand(workspace, options) {
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-B3opyC3o.mjs");
+		const { prepareDevDatabases } = await import("./migrate-DhxTIA0z.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-B3opyC3o.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-DhxTIA0z.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3370,6 +3372,19 @@ const PROVISIONERS = {
 		return { provides: { [key]: supplied(declaration.id, key, context) } };
 	},
 	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
 	* A third party's credentials, as the stage was given them.
 	*
 	* Nothing is created and nothing derived: the value was issued by somebody
@@ -6373,6 +6388,8 @@ function validateEnvVars(requiredVars, context) {
 *   who could read the repo.
 * - **Each `secret` construct's value** — an auth server's signing secret —
 *   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
 * Both are generated on the first deploy that needs them and written to the
 * stage's store, so every later deploy reads the same values: sessions survive
@@ -6388,10 +6405,10 @@ function withGeneratedSecrets(secrets, manifest) {
 	const generated = [];
 	const custom = { ...secrets.custom };
 	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret") continue;
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
 		const key = declaration.provides?.[0];
 		if (!key || custom[key]) continue;
-		custom[key] = random();
+		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
 		generated.push(key);
 	}
 	const seed = secrets.seed ?? random();
@@ -9065,26 +9082,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.46",
-	"@geekmidas/auth": "~10.0.0-alpha.46",
-	"@geekmidas/cache": "~10.0.0-alpha.46",
-	"@geekmidas/client": "~10.0.0-alpha.46",
-	"@geekmidas/cloud": "~10.0.0-alpha.46",
-	"@geekmidas/constructs": "~10.0.0-alpha.46",
-	"@geekmidas/db": "~10.0.0-alpha.46",
-	"@geekmidas/emailkit": "~10.0.0-alpha.46",
-	"@geekmidas/envkit": "~10.0.0-alpha.46",
-	"@geekmidas/errors": "~10.0.0-alpha.46",
-	"@geekmidas/events": "~10.0.0-alpha.46",
-	"@geekmidas/logger": "~10.0.0-alpha.46",
-	"@geekmidas/manifest": "~10.0.0-alpha.46",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.46",
-	"@geekmidas/schema": "~10.0.0-alpha.46",
-	"@geekmidas/services": "~10.0.0-alpha.46",
-	"@geekmidas/storage": "~10.0.0-alpha.46",
-	"@geekmidas/studio": "~10.0.0-alpha.46",
-	"@geekmidas/telescope": "~10.0.0-alpha.46",
-	"@geekmidas/testkit": "~10.0.0-alpha.46",
+	"@geekmidas/audit": "~10.0.0-alpha.47",
+	"@geekmidas/auth": "~10.0.0-alpha.47",
+	"@geekmidas/cache": "~10.0.0-alpha.47",
+	"@geekmidas/client": "~10.0.0-alpha.47",
+	"@geekmidas/cloud": "~10.0.0-alpha.47",
+	"@geekmidas/constructs": "~10.0.0-alpha.47",
+	"@geekmidas/db": "~10.0.0-alpha.47",
+	"@geekmidas/emailkit": "~10.0.0-alpha.47",
+	"@geekmidas/envkit": "~10.0.0-alpha.47",
+	"@geekmidas/errors": "~10.0.0-alpha.47",
+	"@geekmidas/events": "~10.0.0-alpha.47",
+	"@geekmidas/logger": "~10.0.0-alpha.47",
+	"@geekmidas/manifest": "~10.0.0-alpha.47",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.47",
+	"@geekmidas/schema": "~10.0.0-alpha.47",
+	"@geekmidas/services": "~10.0.0-alpha.47",
+	"@geekmidas/storage": "~10.0.0-alpha.47",
+	"@geekmidas/studio": "~10.0.0-alpha.47",
+	"@geekmidas/telescope": "~10.0.0-alpha.47",
+	"@geekmidas/testkit": "~10.0.0-alpha.47",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -15493,8 +15510,8 @@ async function reconcileLocal(workspace, stage, options) {
 		logger$1.log("🐳 Services already up to date");
 		return;
 	}
-	logger$1.log(`🐳 Services: ${result.plan.containers.join(", ")}`);
-	for (const [container, address] of Object.entries(result.addresses)) logger$1.log(`   ${container}: ${address}`);
+	logger$1.log("🐳 Services");
+	for (const line of describeServices(result.services)) logger$1.log(line);
 	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
@@ -15841,7 +15858,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-B3opyC3o.mjs");
+	const { migrateAndSeed } = await import("./migrate-DhxTIA0z.mjs");
 	const { discover } = await import("./discover-Cf2jAcgF.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -16272,7 +16289,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-B3opyC3o.mjs");
+		const { migrateCommand } = await import("./migrate-DhxTIA0z.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16286,7 +16303,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-B3opyC3o.mjs");
+		const { seedCommand } = await import("./migrate-DhxTIA0z.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16300,7 +16317,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-B3opyC3o.mjs");
+		const { migrationCommand } = await import("./migrate-DhxTIA0z.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16394,6 +16411,28 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		process.exit(1);
 	}
 });
+program.command("encryption:rotate").description("Add a new current key to an Encryption construct's keyring on a server stage").argument("<construct>", "The Encryption construct (e.g. Pii)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRotateCommand } = await import("./encryption-DyQnPsZN.mjs");
+		await encryptionRotateCommand(construct, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
+program.command("encryption:retire").description("Remove an old key from an Encryption construct's keyring, once nothing is under it").argument("<construct>", "The Encryption construct (e.g. Pii)").argument("<key>", "The key to retire (e.g. k1)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, key, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRetireCommand } = await import("./encryption-DyQnPsZN.mjs");
+		await encryptionRetireCommand(construct, key, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("secrets:show").description("Show secrets for a stage").requiredOption("--stage <stage>", "Stage name").option("--reveal", "Show actual secret values (not masked)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16439,7 +16478,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-CHEC80sp.mjs").then((n) => n.o);
+		const { derivedContainers } = await import("./workspace-cb6U29EL.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);