@geekmidas/cli 10.0.0-alpha.46 → 10.0.0-alpha.48

package/dist/{workspace-CHEC80sp.mjs → workspace-cb6U29EL.mjs}

@@ -4,7 +4,8 @@ import { c as loadWorkspaceAppInfo, f as appKey, l as loadWorkspaceConfig, r as
 import { E as TEST_STAGE, t as allConstructGlobs } from "./workspace-DNzWgM1J.mjs";
 import { i as toEmbeddableSecrets } from "./storage-BzaUxmqe.mjs";
 import { i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { d as DEFAULT_EVENTS$1, f as DEFAULT_STORAGE, l as readFakes, u as DEFAULT_CACHE } from "./ready-V6Ou6-B6.mjs";
+import { l as readFakes, u as DEFAULT_CACHE } from "./ready-WfT-eWlm.mjs";
+import { n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CSuLl0YP.mjs";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { networkInterfaces } from "node:os";
@@ -14,6 +15,7 @@ import { DEFAULT_POSTGRES_VERSION, cacheTable, cookieDomain, dependenciesOf, dep
 import { createServer } from "node:net";
 import { config } from "dotenv";
 import { createHash } from "node:crypto";
+import { formatKeyring } from "@geekmidas/constructs/encryption";
 import { ownerRole, readerRole, roleStatements } from "@geekmidas/db/pg/roles";
 import * as snsUrl from "@geekmidas/events/sns/url";
 import * as sqsUrl from "@geekmidas/events/sqs/url";
@@ -246,61 +248,6 @@ async function prepareEntryCredentials(options) {
 	};
 }
 //#endregion
-//#region src/workspace/backends.ts
-/**
-* Which backend each declared kind resolves to — decided by where the project
-* deploys, and by nothing else.
-*
-* These used to be read out of a `services:` block, where one key answered two
-* questions: *does this exist* and *what backs it*. The first is the manifest's
-* — a declared `Cache` is why there is a cache — and the second is the deploy
-* target's, because the right cache for a Lambda is not the right cache for a
-* box already running Postgres. With both answered elsewhere there was nothing
-* left for the block to say, so it is gone and these read the target.
-*
-* Mail has no answer here at all: every provider speaks SMTP, so the provider
-* is whichever one the stage's mail URL points at.
-*/
-/**
-* Which family of defaults a workspace's deploy target belongs to.
-*
-* One question, asked once: **does this target run containers the project
-* controls?** Dokploy and a bare server do, so a bucket or a cache can live
-* beside the app; AWS, Vercel and Cloudflare do not, so the default has to be
-* something managed. That is the whole of the distinction, and it is why
-* `MainProvider` is the right axis rather than the deploy target's own name —
-* three targets share one answer.
-*
-* An AWS deploy names `deploy.default: 'sst'`, because it goes through SST.
-*/
-function providerOf(workspace) {
-	const target = workspace.deploy?.default;
-	return target === "dokploy" || target === "server" ? "server" : "aws";
-}
-/**
-* The cache backend a target implies.
-*
-* The same answer locally and deployed: a local `gkm dev` for an AWS app still
-* uses the Upstash protocol, because a backend that differed between the two
-* would be worse than a slower one.
-*/
-function cacheBackendFor(on) {
-	return DEFAULT_CACHE[on];
-}
-/** Where a declared bucket lives on a target. */
-function storageBackendFor(on) {
-	return DEFAULT_STORAGE[on];
-}
-/**
-* Which broker carries declared queues and topics on a target.
-*
-* Only consulted when something declares one; a project with no `Topic` or
-* `Queue` has no events at all, whatever the target.
-*/
-function eventsBackendFor(on) {
-	return DEFAULT_EVENTS$1[on];
-}
-//#endregion
 //#region src/reconcile/containers.ts
 /**
 * What gkm knows about each container it can derive.
@@ -360,7 +307,8 @@ const PORTS = {
 	}, {
 		key: "minio-console",
 		inside: 9001,
-		label: "minio console"
+		label: "minio console",
+		web: true
 	}],
 	mailpit: [{
 		key: "mailpit",
@@ -369,7 +317,8 @@ const PORTS = {
 	}, {
 		key: "mailpit-web",
 		inside: 8025,
-		label: "mailpit inbox"
+		label: "mailpit inbox",
+		web: true
 	}],
 	redis: [{
 		key: "redis",
@@ -388,7 +337,8 @@ const PORTS = {
 	}, {
 		key: "rabbitmq-management",
 		inside: 15672,
-		label: "rabbitmq console"
+		label: "rabbitmq console",
+		web: true
 	}],
 	localstack: [{
 		key: "localstack",
@@ -420,6 +370,29 @@ function portsOf(container, fakes = {}) {
 	}];
 	return PORTS[container] ?? [];
 }
+/**
+* Every port the containers publish — not only the one an app connects to.
+*
+* The consoles and the inbox are most of why these are real containers, and an
+* inbox nobody can find is an inbox nobody opens: a sign-in link gets fished
+* out of `docker ps` instead.
+*/
+function serviceAddresses(containers, ports, fakes = {}) {
+	return containers.flatMap((container) => portsOf(container, fakes).flatMap((port) => {
+		const assigned = ports[port.key];
+		if (assigned === void 0) return [];
+		return [{
+			container,
+			label: port.label,
+			address: port.web ? `http://localhost:${assigned}` : `localhost:${assigned}`
+		}];
+	}));
+}
+/** The lines `gkm dev` and `gkm setup` print under the services heading. */
+function describeServices(services) {
+	const width = Math.max(0, ...services.map(({ label }) => label.length));
+	return services.map(({ label, address }) => `   ${label.padEnd(width)}  ${address}`);
+}
 /** The key a container's primary port is allocated under. */
 function primaryPortKey(container) {
 	return portsOf(container)[0]?.key ?? container;
@@ -745,6 +718,7 @@ const CACHE_CONTAINERS = {
 const CONTAINERLESS = {
 	secret: true,
 	credential: true,
+	encryption: true,
 	"rest-api": true,
 	site: true,
 	"mobile-app": true,
@@ -1209,6 +1183,7 @@ function workerBroker(plan, ports) {
 */
 function urlFor(resource, plan, ports, project, addresses = {}) {
 	if (resource.kind === "secret") return localSecret(project, plan, resource);
+	if (resource.kind === "encryption") return localKeyring(project, plan, resource);
 	if (resource.kind === "mobile-app") return schemeBase(project, resource.scheme);
 	if (resource.kind === "credential") return void 0;
 	if (resource.kind === "external-api") {
@@ -1384,6 +1359,24 @@ var UnprovisionedEventsBackend = class extends Error {
 	}
 };
 /**
+* The keyring an `Encryption` construct resolves to locally.
+*
+* Derived like a secret — stable across restarts, distinct per project, stage
+* and construct, never written to disk — so what `gkm dev` encrypted yesterday
+* still opens today. One key, because nothing local is worth rotating: a
+* server stage's keyring is generated and rotated in its secrets instead.
+*/
+function localKeyring(project, plan, resource) {
+	const derive = (purpose) => createHash("sha256").update(`${project}:${plan.stage}:${resource.id}:${purpose}`).digest();
+	return formatKeyring({
+		keys: [{
+			id: "k1",
+			key: derive("k1")
+		}],
+		index: derive("index")
+	});
+}
+/**
 * The value a secret resolves to locally.
 *
 * A hash of what identifies it, so it is stable, distinct per project, stage
@@ -2715,7 +2708,7 @@ async function reconcile(options) {
 		caddyfile,
 		postgres: postgresStatements(plan, project).map((statement) => statement.create).join(";\n")
 	});
-	const addresses = addressesFor(plan.containers, ports);
+	const services = serviceAddresses(plan.containers, ports, plan.fakes);
 	const lan = plan.resources.some((r) => r.kind === "mobile-app") ? options.lanAddress === void 0 ? lanAddress() : options.lanAddress ?? void 0 : void 0;
 	const env = envFor(plan, {
 		ports,
@@ -2731,7 +2724,7 @@ async function reconcile(options) {
 		plan,
 		compose,
 		ports,
-		addresses,
+		services,
 		env,
 		provisioned: [],
 		fakes: options.fakes ?? {},
@@ -2803,20 +2796,6 @@ async function observedPorts(docker, composePath, containers, fakes) {
 	}
 	return observed;
 }
-/**
-* Where each container can be reached on this machine.
-*
-* The primary port only — a container's console is for a human to open, not
-* something an app connects to.
-*/
-function addressesFor(containers, ports) {
-	const addresses = {};
-	for (const container of containers) {
-		const port = ports[primaryPortKey(container)];
-		if (port !== void 0) addresses[container] = `localhost:${port}`;
-	}
-	return addresses;
-}
 /** Write a file only when its content would change, so mtimes stay meaningful. */
 /**
 * Remove the routes of stages this project no longer reconciles.
@@ -2989,6 +2968,6 @@ function localAddress(port) {
 	return `http://localhost:${port}`;
 }
 //#endregion
-export { createEntryWrapper as C, loadSecretsForApp as D, loadEnvFiles as E, prepareEntryCredentials as O, createCredentialsPreload as S, isPortAvailable as T, primaryPortKey as _, reconcileWorkspace as a, providerOf as b, LOCAL_CA_PATH as c, postgresDatabaseNames as d, quoteIdentifier as f, fakeKey as g, rootSite as h, derivedContainers as i, forgetState as l, resourceName as m, backendsOf as n, workspace_exports as o, pgClient as p, constructGlobs as r, COMPOSE_PATH as s, FAKE_ENV as t, applyPostgres as u, cacheBackendFor as v, findAvailablePort as w, storageBackendFor as x, eventsBackendFor as y };
+export { loadEnvFiles as C, isPortAvailable as S, prepareEntryCredentials as T, fakeKey as _, reconcileWorkspace as a, createEntryWrapper as b, LOCAL_CA_PATH as c, postgresDatabaseNames as d, quoteIdentifier as f, describeServices as g, rootSite as h, derivedContainers as i, forgetState as l, resourceName as m, backendsOf as n, workspace_exports as o, pgClient as p, constructGlobs as r, COMPOSE_PATH as s, FAKE_ENV as t, applyPostgres as u, primaryPortKey as v, loadSecretsForApp as w, findAvailablePort as x, createCredentialsPreload as y };
 
-//# sourceMappingURL=workspace-CHEC80sp.mjs.map
+//# sourceMappingURL=workspace-cb6U29EL.mjs.map