@geekmidas/cli 10.0.0-alpha.50 → 10.0.0-alpha.51

package/dist/index.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as ConstructGenerator, t as discover } from "./discover-Cf2jAcgF.mjs";
-import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-D8J5rrTb.mjs";
-import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-DNzWgM1J.mjs";
+import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-SOkDH-n1.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-bOsks1uk.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
 import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-BsbxbqV-.mjs";
+import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-Dp2zK_Nk.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BzIGy8KE.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-WfT-eWlm.mjs";
@@ -42,7 +42,7 @@ import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.50";
+var version = "10.0.0-alpha.51";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1725,9 +1725,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-B00XpVaO.mjs");
+		const { prepareDevDatabases } = await import("./migrate-soUQtku3.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-B00XpVaO.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-soUQtku3.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3991,7 +3991,7 @@ async function provisionDeclared(options) {
 		cache: cacheBackendFor(providerOf(workspace)),
 		events: eventsBackendFor(providerOf(workspace)),
 		storage: storageBackendFor(providerOf(workspace)),
-		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
+		addresses: surfaceAddresses(manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
 		deferred: [],
@@ -4053,25 +4053,20 @@ function carriersLast(ordered, manifest) {
 	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
 }
 /**
-* Where each declared surface answers.
+* Where each declared surface answers: its own app's address.
 *
-* Every `rest-api` in a process answers on that process's address, so an app
-* serving both its own API and an auth server publishes one address twice —
-* which is exactly what it does at runtime, and the same rule the local target
-* applies.
-*
-* A workspace with two backends is the case this does not answer, and the
-* manifest cannot yet: which surface belongs to which app is what §2's endpoint
-* merge would record. Until then the first backend's address is used, and a
-* second backend's surfaces would be wrong rather than missing — worth knowing
-* before relying on it.
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
 */
-function surfaceAddresses(workspace, manifest, appUrls) {
+function surfaceAddresses(manifest, appUrls) {
 	const addresses = {};
-	const backend = Object.entries(workspace.apps).find(([, app]) => app.type === "backend");
-	const url = backend ? appUrls[backend[0]] : void 0;
-	if (!url) return addresses;
-	for (const [id, declaration] of Object.entries(manifest)) if (declaration.kind === "rest-api") addresses[id] = url;
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[appKey(id)];
+		if (url) addresses[id] = url;
+	}
 	return addresses;
 }
 //#endregion
@@ -4550,32 +4545,34 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 }
 //#endregion
 //#region src/deploy/domain.ts
+/** A stage was deployed that `deploy.domains` gives no domain. */
+var NoDomainForStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		this.stage = stage;
+		this.name = "NoDomainForStage";
+	}
+};
 /**
-* Resolve the hostname for an app based on stage configuration.
+* The hostname an app answers on for a stage.
 *
-* Domain resolution priority:
-* 1. Explicit app.domain override (string or stage-specific)
-* 2. Default pattern based on app type:
-*    - Main frontend app gets base domain (e.g., 'myapp.com')
-*    - Other apps get prefixed domain (e.g., 'api.myapp.com')
+* 1. An explicit `app.domain` — a string, or one per stage — wins.
+* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+*    answers on the domain itself, and every other app on
+*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
 *
-* @param appName - The name of the app
-* @param app - The normalized app configuration
-* @param stage - The deployment stage (e.g., 'production', 'development')
-* @param dokployConfig - Dokploy workspace configuration with domain mappings
-* @param isMainFrontend - Whether this is the main frontend app
-* @returns The resolved hostname for the app
-* @throws Error if no domain configuration is found for the stage
+* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
 */
-function resolveHost(appName, app, stage, dokployConfig, isMainFrontend) {
+function resolveHost(appName, app, stage, domains, isMainFrontend) {
 	if (app.domain) {
 		if (typeof app.domain === "string") return app.domain;
 		if (app.domain[stage]) return app.domain[stage];
 	}
-	const baseDomain = dokployConfig?.domains?.[stage];
-	if (!baseDomain) throw new Error(`No domain configured for stage "${stage}". Add deploy.dokploy.domains.${stage} to gkm.config.ts`);
+	const baseDomain = domains?.[stage];
+	if (!baseDomain) throw new NoDomainForStage(stage);
 	if (isMainFrontend) return baseDomain;
-	return `${appName}.${baseDomain}`;
+	return `${app.subdomain ?? appName}.${baseDomain}`;
 }
 /**
 * Whether this app is the site the base domain points at — see `rootSite`,
@@ -7600,7 +7597,6 @@ async function workspaceDeployCommand(configured, options) {
 	if (skippedMobileApps.length > 0) logger$4.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
-	const dokployConfig = workspace.deploy.dokploy;
 	let declaredEnv = {};
 	let declaredClusters = {};
 	{
@@ -7609,7 +7605,7 @@ async function workspaceDeployCommand(configured, options) {
 		for (const appName of backendApps) {
 			const app = workspace.apps[appName];
 			if (!app) continue;
-			appUrls[appName] = `https://${resolveHost(appName, app, stage, dokployConfig, false)}`;
+			appUrls[appName] = `https://${resolveHost(appName, app, stage, workspace.deploy?.domains, false)}`;
 		}
 		const declared = await provisionDeclared({
 			api,
@@ -7673,7 +7669,8 @@ async function workspaceDeployCommand(configured, options) {
 	const frontendUrls = [];
 	for (const appName of frontendApps) {
 		const app = workspace.apps[appName];
-		const hostname = resolveHost(appName, app, stage, dokployConfig, isMainFrontendApp(appName, app, workspace.apps));
+		const isMainFrontend = isMainFrontendApp(appName, app, workspace.apps);
+		const hostname = resolveHost(appName, app, stage, workspace.deploy?.domains, isMainFrontend);
 		frontendUrls.push(`https://${hostname}`);
 	}
 	if (backendApps.length > 0) {
@@ -7719,7 +7716,7 @@ async function workspaceDeployCommand(configured, options) {
 					},
 					buildArgs
 				});
-				const backendHost = resolveHost(appName, app, stage, dokployConfig, false);
+				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
@@ -7824,7 +7821,8 @@ async function workspaceDeployCommand(configured, options) {
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
 				}
-				const frontendHost = resolveHost(appName, app, stage, dokployConfig, isMainFrontendApp(appName, app, workspace.apps));
+				const isMainFrontend = isMainFrontendApp(appName, app, workspace.apps);
+				const frontendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, isMainFrontend);
 				const envContext = {
 					app,
 					appName,
@@ -9316,26 +9314,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.50",
-	"@geekmidas/auth": "~10.0.0-alpha.50",
-	"@geekmidas/cache": "~10.0.0-alpha.50",
-	"@geekmidas/client": "~10.0.0-alpha.50",
-	"@geekmidas/cloud": "~10.0.0-alpha.50",
-	"@geekmidas/constructs": "~10.0.0-alpha.50",
-	"@geekmidas/db": "~10.0.0-alpha.50",
-	"@geekmidas/emailkit": "~10.0.0-alpha.50",
-	"@geekmidas/envkit": "~10.0.0-alpha.50",
-	"@geekmidas/errors": "~10.0.0-alpha.50",
-	"@geekmidas/events": "~10.0.0-alpha.50",
-	"@geekmidas/logger": "~10.0.0-alpha.50",
-	"@geekmidas/manifest": "~10.0.0-alpha.50",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.50",
-	"@geekmidas/schema": "~10.0.0-alpha.50",
-	"@geekmidas/services": "~10.0.0-alpha.50",
-	"@geekmidas/storage": "~10.0.0-alpha.50",
-	"@geekmidas/studio": "~10.0.0-alpha.50",
-	"@geekmidas/telescope": "~10.0.0-alpha.50",
-	"@geekmidas/testkit": "~10.0.0-alpha.50",
+	"@geekmidas/audit": "~10.0.0-alpha.51",
+	"@geekmidas/auth": "~10.0.0-alpha.51",
+	"@geekmidas/cache": "~10.0.0-alpha.51",
+	"@geekmidas/client": "~10.0.0-alpha.51",
+	"@geekmidas/cloud": "~10.0.0-alpha.51",
+	"@geekmidas/constructs": "~10.0.0-alpha.51",
+	"@geekmidas/db": "~10.0.0-alpha.51",
+	"@geekmidas/emailkit": "~10.0.0-alpha.51",
+	"@geekmidas/envkit": "~10.0.0-alpha.51",
+	"@geekmidas/errors": "~10.0.0-alpha.51",
+	"@geekmidas/events": "~10.0.0-alpha.51",
+	"@geekmidas/logger": "~10.0.0-alpha.51",
+	"@geekmidas/manifest": "~10.0.0-alpha.51",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.51",
+	"@geekmidas/schema": "~10.0.0-alpha.51",
+	"@geekmidas/services": "~10.0.0-alpha.51",
+	"@geekmidas/storage": "~10.0.0-alpha.51",
+	"@geekmidas/studio": "~10.0.0-alpha.51",
+	"@geekmidas/telescope": "~10.0.0-alpha.51",
+	"@geekmidas/testkit": "~10.0.0-alpha.51",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10890,7 +10888,7 @@ function generateDeployFiles(options) {
         // VPC with NAT is a monthly cost in an account that may already
         // have one — replace it with \`sst.aws.Vpc.get(…)\` if so.
         ${db.id}: { vpc },`] : [], ...options.constructs.mail ? [`        // Every provider rejects an unverified sender, so there is no
-        // default; the synth stops with \`EmailNeedsSender\` until it is set.
+        // default — \`fromManifest\` requires it, by the manifest's types.
         ${mail.id}: { from: process.env.MAIL_FROM as string },`] : []];
 	return [{
 		path: "sst.config.ts",
@@ -16078,7 +16076,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-B00XpVaO.mjs");
+	const { migrateAndSeed } = await import("./migrate-soUQtku3.mjs");
 	const { discover } = await import("./discover-Cf2jAcgF.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -16509,7 +16507,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-B00XpVaO.mjs");
+		const { migrateCommand } = await import("./migrate-soUQtku3.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16523,7 +16521,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-B00XpVaO.mjs");
+		const { seedCommand } = await import("./migrate-soUQtku3.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16537,7 +16535,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-B00XpVaO.mjs");
+		const { migrationCommand } = await import("./migrate-soUQtku3.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16635,7 +16633,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DyQnPsZN.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-DRCXp-U4.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16646,7 +16644,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DyQnPsZN.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-DRCXp-U4.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16698,7 +16696,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-BsbxbqV-.mjs").then((n) => n.o);
+		const { derivedContainers } = await import("./workspace-Dp2zK_Nk.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16757,7 +16755,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BfpadQWQ.mjs");
+		const { deployGithubCommand } = await import("./github-U_frvZgD.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));