@geekmidas/cli 10.0.0-alpha.50 → 10.0.0-alpha.52

package/dist/index.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as ConstructGenerator, t as discover } from "./discover-Cf2jAcgF.mjs";
-import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-D8J5rrTb.mjs";
-import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-DNzWgM1J.mjs";
+import { d as parseModuleConfig, f as appKey, l as loadWorkspaceConfig, n as NotABackendApp, o as loadAppConfig, p as derivedApps, r as NotInAnApp, s as loadConfig, t as ConfigNotFound, u as loadWorkspaceSettings } from "./config-SOkDH-n1.mjs";
+import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-bOsks1uk.mjs";
 import { a as withCustomSecret, i as toEmbeddableSecrets, n as maskPassword, t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
 import { a as getKeyPath, i as FileSecretsStore, n as secretsStoreFor } from "./store-DeGATCS-.mjs";
-import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-BsbxbqV-.mjs";
+import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as fakeKey, a as reconcileWorkspace, b as createEntryWrapper, c as LOCAL_CA_PATH, d as postgresDatabaseNames, f as quoteIdentifier, g as describeServices, h as rootSite, i as derivedContainers, l as forgetState, m as resourceName, n as backendsOf$1, p as pgClient, r as constructGlobs, s as COMPOSE_PATH, t as FAKE_ENV, u as applyPostgres, v as primaryPortKey, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-fa5H6l7D.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BzIGy8KE.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-WfT-eWlm.mjs";
-import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CSuLl0YP.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-tQLNHNya.mjs";
+import { i as storageBackendFor, n as eventsBackendFor, r as providerOf, t as cacheBackendFor } from "./backends-CLq1wlQf.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
@@ -42,7 +42,7 @@ import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.50";
+var version = "10.0.0-alpha.52";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1725,9 +1725,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$9.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$9.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-B00XpVaO.mjs");
+		const { prepareDevDatabases } = await import("./migrate-DmabhO_N.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-B00XpVaO.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-DmabhO_N.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$9.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -2310,7 +2310,7 @@ var CronGenerator = class extends ConstructGenerator {
  */
 import type { EnvironmentParser } from '@geekmidas/envkit';
 import type { Logger } from '@geekmidas/logger';
-import { toCronExpression } from '@geekmidas/constructs/crons';
+import { runCron, scheduleInProcess, toCronExpression } from '@geekmidas/constructs/crons';
 import { ServiceDiscovery } from '@geekmidas/services';
 ${Array.from(importsByFile.entries()).map(([importPath, exports]) => `import { ${exports.join(", ")} } from '${importPath}';`).join("\n")}
 
@@ -2351,11 +2351,10 @@ export async function setupCrons(
 
   const run = async (entry: (typeof prepared)[number]) => {
     try {
-      await entry.cron.handler({
-        input: undefined,
-        services: entry.services,
-        logger: entry.cron.logger,
-      });
+      // The cron's own function, the way its Lambda would run it — services,
+      // the worker's database as \`db\`, its events. It used to call a
+      // \`handler\` a Cron does not have, so every firing logged a failure.
+      await runCron(entry.cron, serviceDiscovery);
     } catch (error) {
       logger.error({ error, cron: entry.name }, 'Cron failed');
     }
@@ -2366,13 +2365,28 @@ export async function setupCrons(
   // memory fires each job once per replica — so the schedule lives in
   // Postgres. It used to be a second pg-boss on the worker's database, as the
   // runtime role, which can neither create a schema nor use the broker's.
-  const { url } = envParser
+  const { url, devPid } = envParser
     .create((get) => ({
       url: get('EVENT_PUBLISHER_CONNECTION_STRING').string().optional(),
+      // Set by \`gkm dev\` on the server it starts, and by nothing deployed.
+      devPid: get('GKM_DEV_PID').string().optional(),
     }))
     .parse();
 
   if (!url?.startsWith('pgboss://')) {
+    // \`gkm dev\` on a target whose crons are infrastructure once deployed —
+    // EventBridge rules on AWS — has no broker to keep a schedule in. It is one
+    // process, so a timer fires each job once, which is all pg-boss is for
+    // here. Only there: a deployed server firing by timer fires once per
+    // replica, so outside dev this stays the error below.
+    if (devPid) {
+      for (const entry of prepared) {
+        running.push(scheduleInProcess(entry.schedule, () => run(entry)));
+        logger.info({ cron: entry.name, schedule: entry.schedule }, 'Cron scheduled in this process');
+      }
+      return;
+    }
+
     logger.error(
       { crons: prepared.map(({ name }) => name) },
       'These crons have nowhere to keep their schedule. On a server they are ' +
@@ -3991,7 +4005,7 @@ async function provisionDeclared(options) {
 		cache: cacheBackendFor(providerOf(workspace)),
 		events: eventsBackendFor(providerOf(workspace)),
 		storage: storageBackendFor(providerOf(workspace)),
-		addresses: surfaceAddresses(workspace, manifest, options.appUrls),
+		addresses: surfaceAddresses(manifest, options.appUrls),
 		seed: options.seed,
 		...options.supplied ? { supplied: options.supplied } : {},
 		deferred: [],
@@ -4053,25 +4067,20 @@ function carriersLast(ordered, manifest) {
 	return [...ordered.filter((id) => !carries(id)), ...ordered.filter(carries)];
 }
 /**
-* Where each declared surface answers.
-*
-* Every `rest-api` in a process answers on that process's address, so an app
-* serving both its own API and an auth server publishes one address twice —
-* which is exactly what it does at runtime, and the same rule the local target
-* applies.
+* Where each declared surface answers: its own app's address.
 *
-* A workspace with two backends is the case this does not answer, and the
-* manifest cannot yet: which surface belongs to which app is what §2's endpoint
-* merge would record. Until then the first backend's address is used, and a
-* second backend's surfaces would be wrong rather than missing — worth knowing
-* before relying on it.
+* Every surface is an app of its own, keyed by its id the way the derivation
+* keyed it — `Api` is `api`, `Webhooks` is `webhooks` — and answers on that
+* app's host, `{subdomain}.{domain}`. It used to be handed the first backend's
+* address, so a workspace with two APIs pointed both at the same one.
 */
-function surfaceAddresses(workspace, manifest, appUrls) {
+function surfaceAddresses(manifest, appUrls) {
 	const addresses = {};
-	const backend = Object.entries(workspace.apps).find(([, app]) => app.type === "backend");
-	const url = backend ? appUrls[backend[0]] : void 0;
-	if (!url) return addresses;
-	for (const [id, declaration] of Object.entries(manifest)) if (declaration.kind === "rest-api") addresses[id] = url;
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (declaration.kind !== "rest-api") continue;
+		const url = appUrls[appKey(id)];
+		if (url) addresses[id] = url;
+	}
 	return addresses;
 }
 //#endregion
@@ -4550,32 +4559,34 @@ async function verifyDnsRecords(appHostnames, serverIp, state) {
 }
 //#endregion
 //#region src/deploy/domain.ts
+/** A stage was deployed that `deploy.domains` gives no domain. */
+var NoDomainForStage = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No domain for stage "${stage}". Add it to gkm.config.ts: deploy: { domains: { ${stage}: 'example.com' } }.`);
+		this.stage = stage;
+		this.name = "NoDomainForStage";
+	}
+};
 /**
-* Resolve the hostname for an app based on stage configuration.
+* The hostname an app answers on for a stage.
 *
-* Domain resolution priority:
-* 1. Explicit app.domain override (string or stage-specific)
-* 2. Default pattern based on app type:
-*    - Main frontend app gets base domain (e.g., 'myapp.com')
-*    - Other apps get prefixed domain (e.g., 'api.myapp.com')
+* 1. An explicit `app.domain` — a string, or one per stage — wins.
+* 2. Otherwise from the stage's base domain in `deploy.domains`: the root site
+*    answers on the domain itself, and every other app on
+*    `{subdomain}.{domain}` — its declaration's `subdomain`, or its own name.
 *
-* @param appName - The name of the app
-* @param app - The normalized app configuration
-* @param stage - The deployment stage (e.g., 'production', 'development')
-* @param dokployConfig - Dokploy workspace configuration with domain mappings
-* @param isMainFrontend - Whether this is the main frontend app
-* @returns The resolved hostname for the app
-* @throws Error if no domain configuration is found for the stage
+* @throws {NoDomainForStage} when `deploy.domains` names no domain for it
 */
-function resolveHost(appName, app, stage, dokployConfig, isMainFrontend) {
+function resolveHost(appName, app, stage, domains, isMainFrontend) {
 	if (app.domain) {
 		if (typeof app.domain === "string") return app.domain;
 		if (app.domain[stage]) return app.domain[stage];
 	}
-	const baseDomain = dokployConfig?.domains?.[stage];
-	if (!baseDomain) throw new Error(`No domain configured for stage "${stage}". Add deploy.dokploy.domains.${stage} to gkm.config.ts`);
+	const baseDomain = domains?.[stage];
+	if (!baseDomain) throw new NoDomainForStage(stage);
 	if (isMainFrontend) return baseDomain;
-	return `${appName}.${baseDomain}`;
+	return `${app.subdomain ?? appName}.${baseDomain}`;
 }
 /**
 * Whether this app is the site the base domain points at — see `rootSite`,
@@ -7600,7 +7611,6 @@ async function workspaceDeployCommand(configured, options) {
 	if (skippedMobileApps.length > 0) logger$4.log(`\n📱 Skipping ${skippedMobileApps.length} mobile app(s) — deploy via framework toolchain: ${skippedMobileApps.join(", ")}`);
 	const backendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "backend");
 	const frontendApps = appsToDeployNames.filter((name) => workspace.apps[name].type === "web");
-	const dokployConfig = workspace.deploy.dokploy;
 	let declaredEnv = {};
 	let declaredClusters = {};
 	{
@@ -7609,7 +7619,7 @@ async function workspaceDeployCommand(configured, options) {
 		for (const appName of backendApps) {
 			const app = workspace.apps[appName];
 			if (!app) continue;
-			appUrls[appName] = `https://${resolveHost(appName, app, stage, dokployConfig, false)}`;
+			appUrls[appName] = `https://${resolveHost(appName, app, stage, workspace.deploy?.domains, false)}`;
 		}
 		const declared = await provisionDeclared({
 			api,
@@ -7673,7 +7683,8 @@ async function workspaceDeployCommand(configured, options) {
 	const frontendUrls = [];
 	for (const appName of frontendApps) {
 		const app = workspace.apps[appName];
-		const hostname = resolveHost(appName, app, stage, dokployConfig, isMainFrontendApp(appName, app, workspace.apps));
+		const isMainFrontend = isMainFrontendApp(appName, app, workspace.apps);
+		const hostname = resolveHost(appName, app, stage, workspace.deploy?.domains, isMainFrontend);
 		frontendUrls.push(`https://${hostname}`);
 	}
 	if (backendApps.length > 0) {
@@ -7719,7 +7730,7 @@ async function workspaceDeployCommand(configured, options) {
 					},
 					buildArgs
 				});
-				const backendHost = resolveHost(appName, app, stage, dokployConfig, false);
+				const backendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, false);
 				const dependencyUrls = {};
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
@@ -7824,7 +7835,8 @@ async function workspaceDeployCommand(configured, options) {
 				if (app.dependencies) {
 					for (const dep of app.dependencies) if (publicUrls[dep]) dependencyUrls[dep] = publicUrls[dep];
 				}
-				const frontendHost = resolveHost(appName, app, stage, dokployConfig, isMainFrontendApp(appName, app, workspace.apps));
+				const isMainFrontend = isMainFrontendApp(appName, app, workspace.apps);
+				const frontendHost = resolveHost(appName, app, stage, workspace.deploy?.domains, isMainFrontend);
 				const envContext = {
 					app,
 					appName,
@@ -9316,26 +9328,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.50",
-	"@geekmidas/auth": "~10.0.0-alpha.50",
-	"@geekmidas/cache": "~10.0.0-alpha.50",
-	"@geekmidas/client": "~10.0.0-alpha.50",
-	"@geekmidas/cloud": "~10.0.0-alpha.50",
-	"@geekmidas/constructs": "~10.0.0-alpha.50",
-	"@geekmidas/db": "~10.0.0-alpha.50",
-	"@geekmidas/emailkit": "~10.0.0-alpha.50",
-	"@geekmidas/envkit": "~10.0.0-alpha.50",
-	"@geekmidas/errors": "~10.0.0-alpha.50",
-	"@geekmidas/events": "~10.0.0-alpha.50",
-	"@geekmidas/logger": "~10.0.0-alpha.50",
-	"@geekmidas/manifest": "~10.0.0-alpha.50",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.50",
-	"@geekmidas/schema": "~10.0.0-alpha.50",
-	"@geekmidas/services": "~10.0.0-alpha.50",
-	"@geekmidas/storage": "~10.0.0-alpha.50",
-	"@geekmidas/studio": "~10.0.0-alpha.50",
-	"@geekmidas/telescope": "~10.0.0-alpha.50",
-	"@geekmidas/testkit": "~10.0.0-alpha.50",
+	"@geekmidas/audit": "~10.0.0-alpha.52",
+	"@geekmidas/auth": "~10.0.0-alpha.52",
+	"@geekmidas/cache": "~10.0.0-alpha.52",
+	"@geekmidas/client": "~10.0.0-alpha.52",
+	"@geekmidas/cloud": "~10.0.0-alpha.52",
+	"@geekmidas/constructs": "~10.0.0-alpha.52",
+	"@geekmidas/db": "~10.0.0-alpha.52",
+	"@geekmidas/emailkit": "~10.0.0-alpha.52",
+	"@geekmidas/envkit": "~10.0.0-alpha.52",
+	"@geekmidas/errors": "~10.0.0-alpha.52",
+	"@geekmidas/events": "~10.0.0-alpha.52",
+	"@geekmidas/logger": "~10.0.0-alpha.52",
+	"@geekmidas/manifest": "~10.0.0-alpha.52",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.52",
+	"@geekmidas/schema": "~10.0.0-alpha.52",
+	"@geekmidas/services": "~10.0.0-alpha.52",
+	"@geekmidas/storage": "~10.0.0-alpha.52",
+	"@geekmidas/studio": "~10.0.0-alpha.52",
+	"@geekmidas/telescope": "~10.0.0-alpha.52",
+	"@geekmidas/testkit": "~10.0.0-alpha.52",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10890,7 +10902,7 @@ function generateDeployFiles(options) {
         // VPC with NAT is a monthly cost in an account that may already
         // have one — replace it with \`sst.aws.Vpc.get(…)\` if so.
         ${db.id}: { vpc },`] : [], ...options.constructs.mail ? [`        // Every provider rejects an unverified sender, so there is no
-        // default; the synth stops with \`EmailNeedsSender\` until it is set.
+        // default — \`fromManifest\` requires it, by the manifest's types.
         ${mail.id}: { from: process.env.MAIL_FROM as string },`] : []];
 	return [{
 		path: "sst.config.ts",
@@ -16078,7 +16090,7 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-B00XpVaO.mjs");
+	const { migrateAndSeed } = await import("./migrate-DmabhO_N.mjs");
 	const { discover } = await import("./discover-Cf2jAcgF.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -16509,7 +16521,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-B00XpVaO.mjs");
+		const { migrateCommand } = await import("./migrate-DmabhO_N.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16523,7 +16535,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-B00XpVaO.mjs");
+		const { seedCommand } = await import("./migrate-DmabhO_N.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16537,7 +16549,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-B00XpVaO.mjs");
+		const { migrationCommand } = await import("./migrate-DmabhO_N.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16635,7 +16647,7 @@ program.command("encryption:rotate").description("Add a new current key to an En
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DyQnPsZN.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-Cv-Ej9vR.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16646,7 +16658,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DyQnPsZN.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-Cv-Ej9vR.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -16698,7 +16710,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-BsbxbqV-.mjs").then((n) => n.o);
+		const { derivedContainers } = await import("./workspace-fa5H6l7D.mjs").then((n) => n.o);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -16757,7 +16769,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-BfpadQWQ.mjs");
+		const { deployGithubCommand } = await import("./github-U_frvZgD.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));