@geekmidas/cli 10.0.0-alpha.46 → 10.0.0-alpha.48

package/dist/index.mjs

@@ -5,10 +5,11 @@ import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as Not
 import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-DNzWgM1J.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
 import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { C as createEntryWrapper, D as loadSecretsForApp, E as loadEnvFiles, O as prepareEntryCredentials, S as createCredentialsPreload, T as isPortAvailable, _ as primaryPortKey, a as reconcileWorkspace, b as providerOf, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as fakeKey, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as cacheBackendFor, w as findAvailablePort, x as storageBackendFor, y as eventsBackendFor } from "./workspace-CHEC80sp.mjs";
+import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-cb6U29EL.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BzIGy8KE.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-V6Ou6-B6.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-WfT-eWlm.mjs";
+import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CSuLl0YP.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
@@ -24,6 +25,7 @@ import fg from "fast-glob";
 import chokidar from "chokidar";
 import { createCipheriv, createHash, randomBytes } from "node:crypto";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { generateKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import { Client } from "pg";
 import { parse as parse$1, parseDocument } from "yaml";
@@ -40,7 +42,7 @@ import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.46";
+var version = "10.0.0-alpha.48";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -336,6 +338,45 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
+//#region src/owningTsconfigJsx.ts
+const REGISTER = "owning-tsconfig-jsx-register.mjs";
+/** The CLI's `bin/` was not found above the module looking for it. */
+var OwningTsconfigJsxHookMissing = class extends Error {
+	from;
+	constructor(from) {
+		super(`Could not find bin/${REGISTER} in any directory above '${from}'. It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the package if it is missing.`);
+		this.from = from;
+		this.name = "OwningTsconfigJsxHookMissing";
+	}
+};
+/**
+* The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched
+* upward because this module runs from `src/` in the repo and from a chunk in
+* `dist/` once built, and `bin/` sits beside both.
+*/
+function registerUrl() {
+	const from = dirname(fileURLToPath(import.meta.url));
+	for (let dir = from;; dir = dirname(dir)) {
+		const candidate = join(dir, "bin", REGISTER);
+		if (existsSync(candidate)) return pathToFileURL(candidate).href;
+		if (dirname(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);
+	}
+}
+/**
+* `NODE_OPTIONS` for a process that runs app code through tsx, with the hook
+* that compiles each `.tsx` with its own tsconfig's JSX settings (see
+* `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it
+* is registered before tsx and reads the source on tsx's behalf.
+*
+* `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;
+* this is for those that set `NODE_OPTIONS` themselves, or whose CLI was
+* started with tsx already imported.
+*/
+function withOwningTsconfigJsx(nodeOptions = "") {
+	if (nodeOptions.includes(REGISTER)) return nodeOptions;
+	return [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(" ");
+}
+//#endregion
 //#region src/trust/index.ts
 /**
 * Installing the local edge's certificate authority into the OS trust store.
@@ -1196,9 +1237,9 @@ async function devCommand(options) {
 			stage: workspace.stages.local,
 			...options.fake ? { fake: true } : {}
 		});
-		if (reconciled.changed && reconciled.plan.containers.length > 0) {
-			logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-			for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
+		if (reconciled.services.length > 0) {
+			logger$9.log("🐳 Services");
+			for (const line of describeServices(reconciled.services)) logger$9.log(line);
 		}
 		Object.assign(appSecrets, reconciled.env);
 		const own = reconciled.plan.resources.find((r) => (r.kind === "rest-api" || r.kind === "site") && appKey(r.id) === workspaceAppName);
@@ -1479,9 +1520,9 @@ async function workspaceDevCommand(workspace, options) {
 		stage: workspace.stages.local,
 		...options.fake ? { fake: true } : {}
 	});
-	if (reconciled.changed && reconciled.plan.containers.length > 0) {
-		logger$9.log(`🐳 Services: ${reconciled.plan.containers.join(", ")}`);
-		for (const [container, address] of Object.entries(reconciled.addresses)) logger$9.log(`   ${container}: ${address}`);
+	if (reconciled.services.length > 0) {
+		logger$9.log("🐳 Services");
+		for (const line of describeServices(reconciled.services)) logger$9.log(line);
 	}
 	const secretsEnv = {
 		...rawSecrets,
@@ -1490,9 +1531,9 @@ async function workspaceDevCommand(workspace, options) {
 	const fakes = options.fake ? await serveFakes(reconciled.fakes, reconciled.ports) : [];
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-B3opyC3o.mjs");
+		const { prepareDevDatabases } = await import("./migrate-DhxTIA0z.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-B3opyC3o.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-DhxTIA0z.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -1688,7 +1729,8 @@ var EntryRunner = class {
 	async runProcess() {
 		const env = {
 			...process.env,
-			PORT: String(this.port)
+			PORT: String(this.port),
+			NODE_OPTIONS: withOwningTsconfigJsx(process.env.NODE_OPTIONS)
 		};
 		this.childProcess = spawn(...tsxCommand(dirname(this.wrapperPath), [this.wrapperPath]), {
 			stdio: "inherit",
@@ -1938,7 +1980,8 @@ var DevServer = class {
 			env: {
 				...process.env,
 				NODE_ENV: "development",
-				GKM_DEV_PID: String(process.pid)
+				GKM_DEV_PID: String(process.pid),
+				NODE_OPTIONS: withOwningTsconfigJsx(process.env.NODE_OPTIONS)
 			},
 			detached: true
 		});
@@ -3370,6 +3413,19 @@ const PROVISIONERS = {
 		return { provides: { [key]: supplied(declaration.id, key, context) } };
 	},
 	/**
+	* The keyring the stage keeps in its secrets.
+	*
+	* Generated on the first deploy (`withGeneratedSecrets`) and rotated only
+	* by `gkm encryption:rotate`, so a redeploy never changes a key and nothing
+	* written becomes unreadable. Nothing is created in Dokploy: the process
+	* holds the keyring.
+	*/
+	encryption: async (declaration, context) => {
+		if (declaration.kind !== "encryption") throw new WrongKind(declaration.kind);
+		const key = provideKey(declaration.id, "url");
+		return { provides: { [key]: supplied(declaration.id, key, context) } };
+	},
+	/**
 	* A third party's credentials, as the stage was given them.
 	*
 	* Nothing is created and nothing derived: the value was issued by somebody
@@ -6373,6 +6429,8 @@ function validateEnvVars(requiredVars, context) {
 *   who could read the repo.
 * - **Each `secret` construct's value** — an auth server's signing secret —
 *   random, rather than derived.
+* - **Each `encryption` construct's keyring** — one random key and an index
+*   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
 * Both are generated on the first deploy that needs them and written to the
 * stage's store, so every later deploy reads the same values: sessions survive
@@ -6388,10 +6446,10 @@ function withGeneratedSecrets(secrets, manifest) {
 	const generated = [];
 	const custom = { ...secrets.custom };
 	for (const declaration of Object.values(manifest)) {
-		if (declaration?.kind !== "secret") continue;
+		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
 		const key = declaration.provides?.[0];
 		if (!key || custom[key]) continue;
-		custom[key] = random();
+		custom[key] = declaration.kind === "encryption" ? generateKeyring() : random();
 		generated.push(key);
 	}
 	const seed = secrets.seed ?? random();
@@ -6749,7 +6807,7 @@ async function sniffEntryFile(entryPath, appPath, workspacePath) {
 			],
 			env: {
 				...process.env,
-				NODE_OPTIONS: "--import=tsx"
+				NODE_OPTIONS: withOwningTsconfigJsx("--import=tsx")
 			}
 		});
 		let stdout = "";
@@ -9065,26 +9123,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.46",
-	"@geekmidas/auth": "~10.0.0-alpha.46",
-	"@geekmidas/cache": "~10.0.0-alpha.46",
-	"@geekmidas/client": "~10.0.0-alpha.46",
-	"@geekmidas/cloud": "~10.0.0-alpha.46",
-	"@geekmidas/constructs": "~10.0.0-alpha.46",
-	"@geekmidas/db": "~10.0.0-alpha.46",
-	"@geekmidas/emailkit": "~10.0.0-alpha.46",
-	"@geekmidas/envkit": "~10.0.0-alpha.46",
-	"@geekmidas/errors": "~10.0.0-alpha.46",
-	"@geekmidas/events": "~10.0.0-alpha.46",
-	"@geekmidas/logger": "~10.0.0-alpha.46",
-	"@geekmidas/manifest": "~10.0.0-alpha.46",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.46",
-	"@geekmidas/schema": "~10.0.0-alpha.46",
-	"@geekmidas/services": "~10.0.0-alpha.46",
-	"@geekmidas/storage": "~10.0.0-alpha.46",
-	"@geekmidas/studio": "~10.0.0-alpha.46",
-	"@geekmidas/telescope": "~10.0.0-alpha.46",
-	"@geekmidas/testkit": "~10.0.0-alpha.46",
+	"@geekmidas/audit": "~10.0.0-alpha.48",
+	"@geekmidas/auth": "~10.0.0-alpha.48",
+	"@geekmidas/cache": "~10.0.0-alpha.48",
+	"@geekmidas/client": "~10.0.0-alpha.48",
+	"@geekmidas/cloud": "~10.0.0-alpha.48",
+	"@geekmidas/constructs": "~10.0.0-alpha.48",
+	"@geekmidas/db": "~10.0.0-alpha.48",
+	"@geekmidas/emailkit": "~10.0.0-alpha.48",
+	"@geekmidas/envkit": "~10.0.0-alpha.48",
+	"@geekmidas/errors": "~10.0.0-alpha.48",
+	"@geekmidas/events": "~10.0.0-alpha.48",
+	"@geekmidas/logger": "~10.0.0-alpha.48",
+	"@geekmidas/manifest": "~10.0.0-alpha.48",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.48",
+	"@geekmidas/schema": "~10.0.0-alpha.48",
+	"@geekmidas/services": "~10.0.0-alpha.48",
+	"@geekmidas/storage": "~10.0.0-alpha.48",
+	"@geekmidas/studio": "~10.0.0-alpha.48",
+	"@geekmidas/telescope": "~10.0.0-alpha.48",
+	"@geekmidas/testkit": "~10.0.0-alpha.48",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -15493,8 +15551,8 @@ async function reconcileLocal(workspace, stage, options) {
 		logger$1.log("🐳 Services already up to date");
 		return;
 	}
-	logger$1.log(`🐳 Services: ${result.plan.containers.join(", ")}`);
-	for (const [container, address] of Object.entries(result.addresses)) logger$1.log(`   ${container}: ${address}`);
+	logger$1.log("🐳 Services");
+	for (const line of describeServices(result.services)) logger$1.log(line);
 	const url = result.plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site" || r.kind === "file-server").map((r) => result.env[r.envKey]).find((address) => address?.startsWith("https://"));
 	if (url) await ensureTrusted(workspace.root, url, { ...options.yes ? { assumeYes: true } : {} });
 }
@@ -15841,7 +15899,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-B3opyC3o.mjs");
+	const { migrateAndSeed } = await import("./migrate-DhxTIA0z.mjs");
 	const { discover } = await import("./discover-Cf2jAcgF.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -16272,7 +16330,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-B3opyC3o.mjs");
+		const { migrateCommand } = await import("./migrate-DhxTIA0z.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16286,7 +16344,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-B3opyC3o.mjs");
+		const { seedCommand } = await import("./migrate-DhxTIA0z.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16300,7 +16358,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-B3opyC3o.mjs");
+		const { migrationCommand } = await import("./migrate-DhxTIA0z.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16394,6 +16452,28 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		process.exit(1);
 	}
 });
+program.command("encryption:rotate").description("Add a new current key to an Encryption construct's keyring on a server stage").argument("<construct>", "The Encryption construct (e.g. Pii)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRotateCommand } = await import("./encryption-DyQnPsZN.mjs");
+		await encryptionRotateCommand(construct, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
+program.command("encryption:retire").description("Remove an old key from an Encryption construct's keyring, once nothing is under it").argument("<construct>", "The Encryption construct (e.g. Pii)").argument("<key>", "The key to retire (e.g. k1)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, key, options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { encryptionRetireCommand } = await import("./encryption-DyQnPsZN.mjs");
+		await encryptionRetireCommand(construct, key, options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("secrets:show").description("Show secrets for a stage").requiredOption("--stage <stage>", "Stage name").option("--reveal", "Show actual secret values (not masked)").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16439,7 +16519,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-CHEC80sp.mjs").then((n) => n.o);
+		const { derivedContainers } = await import("./workspace-cb6U29EL.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);