@geekmidas/cli 10.0.0-alpha.65 → 10.0.0-alpha.66

package/dist/{compose-DprE3ASm.mjs → compose-CNQL8BnO.mjs}

@@ -1,21 +1,18 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { c as runOutput, s as run, t as LocalSandbox } from "./local-CWR4Y_kW.mjs";
-import { r as discover } from "./discover-LMrqsWSU.mjs";
+import { r as discover } from "./discover-BFoJWKGD.mjs";
 import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { t as initStageSecrets } from "./storage-BzaUxmqe.mjs";
-import { f as imageRef } from "./store-CLiHnqOY.mjs";
-import { $ as portKeys, B as networkEnv, C as isMainFrontendApp, D as constructGlobs, F as postgresStatements, G as hostFor, H as localRolePassword, L as composeFor, N as applyPostgres, R as pgClient, S as validateImageRef, U as planFor, V as envFor, X as DEFAULT_IMAGES, b as generateDockerignore, et as primaryPortKey, f as DeployJournal, g as appPackageName, p as withGeneratedSecrets, s as setDeployedImage, t as createEmptyState, v as siteDockerfile, w as resolveHost, x as generateSlimDockerfile, y as detectPackageManager, z as appEnvKeys } from "./state-B8YwmUZU.mjs";
+import { B as appEnvKeys, C as validateImageRef, Et as initStageSecrets, G as planFor, H as networkEnv, I as postgresStatements, O as constructGlobs, P as applyPostgres, Q as DEFAULT_IMAGES, R as composeFor, S as generateSlimDockerfile, T as resolveHost, U as envFor, W as localRolePassword, _ as appPackageName, a as recordRelease, b as detectPackageManager, m as withGeneratedSecrets, nt as primaryPortKey, p as DeployJournal, q as hostFor, t as createEmptyState, tt as portKeys, w as isMainFrontendApp, x as generateDockerignore, xt as imageRef, y as siteDockerfile, z as pgClient } from "./state-uuYqnRVO.mjs";
 import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
-import { createRequire } from "node:module";
-import { dirname, extname, join } from "node:path";
+import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
+import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
-import { appendFile, chmod, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { DATABASE_FOLDERS, MIGRATIONS_ROOT, canonicalId, migrationTargets, provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { appendFile, chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
+import { fileURLToPath } from "node:url";
 import { spawn } from "node:child_process";
-import pg from "pg";
 import { stringify } from "yaml";
 import { request } from "node:https";
 //#region src/compose/docker.ts
@@ -710,474 +707,6 @@ function envFile(env) {
 	return `${Object.entries(env).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `${key}=${value}`).join("\n")}\n`;
 }
 //#endregion
-//#region src/migrate/provider.ts
-/**
-* One construct's migrations and seeds, read from its folders.
-*
-* Two kinds of file, told apart by extension rather than by configuration: a
-* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
-* `seeds/` — and a
-* `.sql` file is run whole. The second is what makes a folder independent of
-* the client the app uses — Better Auth's schema is SQL whatever the
-* application queries with.
-*/
-const SCRIPTS = /* @__PURE__ */ new Set([
-	".ts",
-	".mts",
-	".js",
-	".mjs"
-]);
-/** Two files in one folder that would be one migration. */
-var DuplicateMigration = class extends Error {
-	folder;
-	migration;
-	constructor(folder, migration) {
-		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
-		this.folder = folder;
-		this.migration = migration;
-		this.name = "DuplicateMigration";
-	}
-};
-/** A script in a migrations folder that exports no `up`. */
-var MigrationHasNoUp = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
-		this.file = file;
-		this.name = "MigrationHasNoUp";
-	}
-};
-/** A script in a seeds folder that exports no `seed`. */
-var SeedHasNoSeed = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
-		this.file = file;
-		this.name = "SeedHasNoSeed";
-	}
-};
-/**
-* The migration files in a folder, by name, without reading them.
-*
-* Also what `gkm dev` compares against a construct's history to report what
-* is pending, which is why it is separate from loading them.
-*/
-async function migrationFiles(folder) {
-	const entries = await readdir(folder, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	});
-	const files = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		if (!entry.isFile() || !isMigration(entry.name)) continue;
-		const name = entry.name.slice(0, -extname(entry.name).length);
-		if (files.has(name)) throw new DuplicateMigration(folder, name);
-		files.set(name, join(folder, entry.name));
-	}
-	return files;
-}
-/** A Kysely provider over one construct's folder. */
-function folderProvider(folder, raw) {
-	return { async getMigrations() {
-		const migrations = {};
-		for (const [name, file] of await migrationFiles(folder)) migrations[name] = extname(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
-		return migrations;
-	} };
-}
-/**
-* The seeds in a folder, loaded, in name order.
-*
-* Every one runs on every pass — there is no history to consult — so the order
-* is the only thing between two seeds where one reads what another writes.
-* Name them to sort that way.
-*/
-async function loadSeeds(folder, raw) {
-	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	const seeds = [];
-	for (const [name, file] of files) seeds.push({
-		name,
-		run: extname(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
-	});
-	return seeds;
-}
-/**
-* A seed script, imported as it is on disk now.
-*
-* Keyed by its modification time: a seed is run again after it is edited, and
-* a process that has imported it once would otherwise run the old one.
-*/
-async function scriptSeed(file) {
-	const url = pathToFileURL(file);
-	url.searchParams.set("mtime", String((await stat(file)).mtimeMs));
-	const module = await import(url.href);
-	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
-	return module.seed;
-}
-function isMigration(file) {
-	if (file.endsWith(".d.ts")) return false;
-	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
-	const extension = extname(file);
-	return extension === ".sql" || SCRIPTS.has(extension);
-}
-async function scriptMigration(file) {
-	const module = await import(pathToFileURL(file).href);
-	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
-	return {
-		up: module.up,
-		...typeof module.down === "function" ? { down: module.down } : {}
-	};
-}
-/**
-* A `.sql` file, run whole.
-*
-* One query rather than split on `;`: with no parameters, Postgres takes
-* several statements in one message, and splitting by hand breaks on the first
-* `;` inside a string or a function body. There is no `down` — a generated
-* schema is rolled back by a migration that says how, not by guessing.
-*/
-async function sqlMigration(file, raw) {
-	const statements = await readFile(file, "utf-8");
-	return { up: async (db) => {
-		await raw.raw(statements).execute(db);
-	} };
-}
-//#endregion
-//#region src/migrate/databases.ts
-/**
-* Bring each construct's schema up to its migrations folder.
-*
-* Which constructs, in what order, from which folder, is `migrationTargets`'
-* answer and nobody else's. What is decided here is only how one target is
-* run: as its owner, in its own schema, with a history of its own.
-*/
-/** A folder under `db/` that names no construct. */
-var UnknownMigrationFolder = class extends Error {
-	folder;
-	known;
-	constructor(folder, known) {
-		super(`${folder} names no database construct, so its migrations would never run. ${known.length > 0 ? `The folders that do: ${known.join(", ")}.` : "This project declares no database."} Rename the folder after the construct it belongs to.`);
-		this.folder = folder;
-		this.known = known;
-		this.name = "UnknownMigrationFolder";
-	}
-};
-/** A construct was asked for by a name that takes no migrations. */
-var NoSuchMigrationTarget = class extends Error {
-	construct;
-	known;
-	constructor(construct, known) {
-		super(`'${construct}' is not a database construct. ` + (known.length > 0 ? `The ones with migrations: ${known.join(", ")}.` : "This project declares no database."));
-		this.construct = construct;
-		this.known = known;
-		this.name = "NoSuchMigrationTarget";
-	}
-};
-/**
-* A migration left directly in a construct's folder, where nothing reads it.
-*
-* Migrations moved into `migrations/` so seeds could sit beside them. A file
-* still at the old level would otherwise never run, and nothing would say so.
-*/
-var MigrationsOutsideFolder = class extends Error {
-	folder;
-	files;
-	constructor(folder, files) {
-		super(`${folder} has ${files.join(", ")} directly inside it, where nothing runs them. Migrations live in ${folder}/migrations/ and seeds in ${folder}/seeds/ — move ${files.length === 1 ? "it" : "them"} there.`);
-		this.folder = folder;
-		this.files = files;
-		this.name = "MigrationsOutsideFolder";
-	}
-};
-/** A folder inside a construct's folder that is neither `migrations` nor `seeds`. */
-var UnknownDatabaseFolder = class extends Error {
-	folder;
-	constructor(folder) {
-		super(`${folder} is neither migrations/ nor seeds/, so nothing in it would ever run. A construct's folder holds those two; rename or remove it.`);
-		this.folder = folder;
-		this.name = "UnknownDatabaseFolder";
-	}
-};
-/** A seed failed; its own writes are rolled back, the ones before it stay. */
-var SeedFailed = class extends Error {
-	construct;
-	seed;
-	cause;
-	constructor(construct, seed, cause) {
-		super(`${construct}: seed '${seed}' failed — ${cause instanceof Error ? cause.message : String(cause)}. Its writes were rolled back; fix it and run it again.`);
-		this.construct = construct;
-		this.seed = seed;
-		this.cause = cause;
-		this.name = "SeedFailed";
-	}
-};
-/** A construct with roles has no owner URL to migrate with. */
-var NoOwnerCredential = class extends Error {
-	construct;
-	key;
-	constructor(construct, key) {
-		super(`${construct} has no ${key} to migrate with. Migrations run as the owner role — the runtime one cannot create a table — and nothing resolved its URL. Is the stage reconciled?`);
-		this.construct = construct;
-		this.key = key;
-		this.name = "NoOwnerCredential";
-	}
-};
-/** A migration failed; the ones before it in the run stay applied. */
-var MigrationFailed = class extends Error {
-	construct;
-	migration;
-	cause;
-	constructor(construct, migration, cause) {
-		super(`${construct}: migration ${migration ? `'${migration}' ` : ""}failed — ${cause instanceof Error ? cause.message : String(cause)}`);
-		this.construct = construct;
-		this.migration = migration;
-		this.cause = cause;
-		this.name = "MigrationFailed";
-	}
-};
-/** The project's Kysely could not be found from where a database is declared. */
-var KyselyNotFound = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not resolve 'kysely' from ${from}. Migrations run with the project's own Kysely — install it where the database is declared.`);
-		this.from = from;
-		this.name = "KyselyNotFound";
-	}
-};
-/** Apply every pending migration, construct by construct, parents first. */
-async function migrateDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) {
-			runs.push({
-				target,
-				applied: []
-			});
-			continue;
-		}
-		const applied = await withMigrator(options, target, async (migrator) => {
-			const { error, results = [] } = await migrator.migrateToLatest();
-			if (error) {
-				const failed = results.find((result) => result.status === "Error");
-				throw new MigrationFailed(target.id, failed?.migrationName, error);
-			}
-			return results.filter((result) => result.status === "Success").map((result) => result.migrationName);
-		});
-		runs.push({
-			target,
-			applied
-		});
-	}
-	return runs;
-}
-/**
-* Run every construct's seeds, parents first — each one, every time, on every
-* stage, production included. Each is handed the stage, so a seed decides
-* what belongs where.
-*
-* Seeds are reference data kept up to date by being run again, so there is no
-* history: a seed is an upsert, and a changed one is applied by the next run.
-* Each runs in its own transaction, as the construct's owner, so a failure
-* leaves nothing half-written. Assumes the schema is migrated —
-* {@link migrateAndSeed} is what makes that true.
-*/
-async function seedDatabases(options) {
-	const runs = [];
-	for (const target of await targetsFor(options)) {
-		const folder = join(options.root, target.seeds);
-		if ((await migrationFiles(folder)).size === 0) {
-			runs.push({
-				target,
-				seeded: []
-			});
-			continue;
-		}
-		const seeded = await withOwner(options, target, async (db, kysely) => {
-			const names = [];
-			for (const seed of await loadSeeds(folder, kysely.sql)) {
-				try {
-					await db.transaction().execute((trx) => seed.run(trx, { stage: options.stage }));
-				} catch (error) {
-					throw new SeedFailed(target.id, seed.name, error);
-				}
-				names.push(seed.name);
-			}
-			return names;
-		});
-		runs.push({
-			target,
-			seeded
-		});
-	}
-	return runs;
-}
-/**
-* Migrate, then seed: a seed only ever runs against the schema it was written
-* for.
-*
-* With `only`, the constructs it lives in are migrated too — a tenant's seed
-* cannot run before the database that owns its schema exists — and only it is
-* seeded.
-*/
-async function migrateAndSeed(options) {
-	const migrations = [];
-	for (const target of await withParents(options)) migrations.push(...await migrateDatabases({
-		...options,
-		only: target.id
-	}));
-	return {
-		migrations,
-		seeds: await seedDatabases(options)
-	};
-}
-/** The targets `only` names, after the ones it lives in; all without it. */
-async function withParents(options) {
-	const chosen = await targetsFor(options);
-	if (!options.only) return chosen;
-	const all = migrationTargets(options.manifest);
-	const ids = /* @__PURE__ */ new Set();
-	for (const target of chosen) {
-		let current = target;
-		while (current) {
-			ids.add(current.id);
-			const parent = current.of;
-			current = parent ? all.find((t) => t.id === parent) : void 0;
-		}
-	}
-	return all.filter((target) => ids.has(target.id));
-}
-/**
-* What each construct's folder has that its history does not — without
-* applying any of it. What `gkm dev` reports.
-*/
-async function pendingMigrations(options) {
-	const found = [];
-	for (const target of await targetsFor(options)) {
-		if ((await migrationFiles(join(options.root, target.migrations))).size === 0) continue;
-		const pending = await withMigrator(options, target, async (migrator) => (await migrator.getMigrations()).filter((migration) => migration.executedAt === void 0).map((migration) => migration.name));
-		if (pending.length > 0) found.push({
-			target,
-			pending
-		});
-	}
-	return found;
-}
-/**
-* The targets this run covers, with every folder under `db/` accounted for.
-*
-* A folder that names no construct is an error rather than something to skip:
-* a typo in its name is otherwise a migration that silently never runs.
-*/
-async function targetsFor(options) {
-	const targets = migrationTargets(options.manifest);
-	const folders = targets.map((target) => target.folder);
-	for (const folder of await foldersIn(join(options.root, MIGRATIONS_ROOT))) {
-		const relative = `${MIGRATIONS_ROOT}/${folder}`;
-		if (!folders.includes(relative)) throw new UnknownMigrationFolder(relative, folders);
-		await checkLayout(options.root, relative);
-	}
-	if (!options.only) return targets;
-	const id = canonicalId(options.only);
-	const chosen = targets.filter((target) => target.id === id);
-	if (chosen.length === 0) throw new NoSuchMigrationTarget(options.only, targets.map((target) => target.id));
-	return chosen;
-}
-/**
-* A construct's folder holds `migrations/` and `seeds/`, and nothing else —
-* anything beside them is a file or folder nothing would ever run.
-*/
-async function checkLayout(root, folder) {
-	const entries = await readdir(join(root, folder), { withFileTypes: true });
-	const loose = entries.filter((entry) => entry.isFile() && !entry.name.startsWith(".")).map((entry) => entry.name);
-	if (loose.length > 0) throw new MigrationsOutsideFolder(folder, loose);
-	for (const entry of entries) if (entry.isDirectory() && !DATABASE_FOLDERS.includes(entry.name)) throw new UnknownDatabaseFolder(`${folder}/${entry.name}`);
-}
-async function foldersIn(dir) {
-	return (await readdir(dir, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	})).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-}
-/**
-* A migrator for one target, connected as its owner.
-*
-* No `migrationTableSchema`: the owner role's `search_path` is pinned to the
-* construct's schema, so the history lands there — `app.kysely_migration` for
-* the database, `auth_database.kysely_migration` for its tenant — and two
-* constructs in one Postgres never share one.
-*
-* Unordered migrations are allowed. Files are timestamped, so a branch merged
-* after another's migration ran carries an older one; refusing it would make
-* every such merge a manual repair.
-*/
-async function withMigrator(options, target, run) {
-	return withOwner(options, target, (db, { Migrator, sql }) => run(new Migrator({
-		db,
-		provider: folderProvider(join(options.root, target.migrations), sql),
-		allowUnorderedMigrations: true
-	})));
-}
-/**
-* One target's database, connected as its owner and closed afterwards — what
-* migrations and seeds both run as.
-*/
-async function withOwner(options, target, run) {
-	const kysely = await kyselyFrom(options.sources?.[target.id]?.file ?? (target.of ? options.sources?.[target.of]?.file : void 0) ?? join(options.root, "package.json"));
-	const db = new kysely.Kysely({ dialect: new kysely.PostgresDialect({ pool: new pg.Pool(poolConfig(ownerUrl(options, target))) }) });
-	try {
-		return await run(db, kysely);
-	} finally {
-		await db.destroy();
-	}
-}
-/**
-* The owner's URL, with no fallback to the runtime one.
-*
-* The runtime role can create nothing, so falling back would only move the
-* failure to the first `CREATE TABLE` and make it read like a permissions
-* bug. The one exception is a database declared `roles: false`, where there is
-* no owner — both URLs are the master credential by design.
-*/
-function ownerUrl(options, target) {
-	const key = provideKey(target.id, "ownerUrl");
-	const owner = options.env[key];
-	if (owner) return owner;
-	const database = options.manifest[target.of ?? target.id];
-	if (database?.kind === "database" && database.roles === false) {
-		const url = options.env[provideKey(target.id, "url")];
-		if (url) return url;
-	}
-	throw new NoOwnerCredential(target.id, key);
-}
-/**
-* Pool settings for a URL, with `?search_path=` as the startup option Postgres
-* reads. Only a `roles: false` URL carries it — a role pins its own.
-*/
-function poolConfig(url) {
-	const parsed = new URL(url);
-	const searchPath = parsed.searchParams.get("search_path");
-	if (!searchPath) return { connectionString: url };
-	parsed.searchParams.delete("search_path");
-	return {
-		connectionString: parsed.toString(),
-		options: `-c search_path=${searchPath}`
-	};
-}
-/** Kysely as the project resolves it from `from`. */
-async function kyselyFrom(from) {
-	const require = createRequire(from);
-	try {
-		const [main, migration] = await Promise.all([import(pathToFileURL(require.resolve("kysely")).href), import(pathToFileURL(require.resolve("kysely/migration")).href)]);
-		return {
-			Kysely: main.Kysely,
-			PostgresDialect: main.PostgresDialect,
-			sql: main.sql,
-			Migrator: migration.Migrator
-		};
-	} catch {
-		throw new KyselyNotFound(from);
-	}
-}
-//#endregion
 //#region src/target/compose/health.ts
 /**
 * Asking each app of a stack whether it answers — through Caddy, over HTTPS,
@@ -1417,7 +946,14 @@ async function validateCompose(ctx, deps, forced) {
 	});
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, stack.apps);
 	const dir = join(root, stackDir(stage));
-	const previous = (await ctx.state.read(stage))?.state.images ?? {};
+	const previous = Object.fromEntries(Object.entries((await ctx.state.read(stage))?.state.releases ?? {}).map(([name, releases]) => {
+		const { ref, tag, digest } = releases.current;
+		return [name, {
+			ref,
+			...tag ? { tag } : {},
+			...digest ? { digest } : {}
+		}];
+	}));
 	return {
 		mode,
 		stack,
@@ -1636,7 +1172,7 @@ async function recordImages(ctx, run) {
 			ref: app.ref,
 			tag: app.tag
 		};
-		setDeployedImage(journal.state, app.name, image);
+		recordRelease(journal.state, app.name, image);
 	}
 	journal.state.identity = ctx.identity.key;
 	await journal.save();
@@ -1857,6 +1393,6 @@ function composeTarget(options = {}) {
 	});
 }
 //#endregion
-export { SeedHasNoSeed as _, MigrationsOutsideFolder as a, dockerCompose as b, SeedFailed as c, migrateAndSeed as d, migrateDatabases as f, MigrationHasNoUp as g, DuplicateMigration as h, MigrationFailed as i, UnknownDatabaseFolder as l, seedDatabases as m, compose_exports as n, NoOwnerCredential as o, pendingMigrations as p, KyselyNotFound as r, NoSuchMigrationTarget as s, composeTarget as t, UnknownMigrationFolder as u, composeProject as v, stackDir as y };
+export { dockerCompose as a, stackDir as i, compose_exports as n, composeProject as r, composeTarget as t };
 
-//# sourceMappingURL=compose-DprE3ASm.mjs.map
+//# sourceMappingURL=compose-CNQL8BnO.mjs.map