@geekmidas/cli 10.0.0-alpha.67 → 10.0.0-alpha.68

package/dist/{state-DkUStoqJ.mjs → state-Bn5JDMFT.mjs}

@@ -4,7 +4,7 @@ import { d as output, r as discover } from "./discover-BFoJWKGD.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-Be6uBhlF.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-DhZgtvZe.mjs";
+import { c as runtimeOf } from "./resolve-pIvXlZ1h.mjs";
 import { i as DEFAULT_STORAGE, n as DEFAULT_CACHE, r as DEFAULT_EVENTS$1, t as readFakes } from "./fakes-C9RiT6XG.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
@@ -3107,15 +3107,18 @@ function pgClient(port, password = LOCAL_USER$1) {
 		}
 	} };
 }
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
+/** A bucket client pointed at a MinIO on this machine. */
+function bucketClient(port, credentials = {
+	user: LOCAL_USER$1,
+	password: LOCAL_USER$1
+}) {
 	const s3 = new S3Client({
 		region: "us-east-1",
 		endpoint: `http://localhost:${port}`,
 		forcePathStyle: true,
 		credentials: {
-			accessKeyId: LOCAL_USER$1,
-			secretAccessKey: LOCAL_USER$1
+			accessKeyId: credentials.user,
+			secretAccessKey: credentials.password
 		}
 	});
 	return {
@@ -4576,6 +4579,243 @@ function keyFingerprint(masterKey) {
 	return createHash("sha256").update(masterKey).digest("hex").slice(0, 8);
 }
 //#endregion
+//#region src/deploy/devServices.ts
+/**
+* Mail and object storage on a deployed stage: real ones, or — only when
+* someone asked — the dev services the local stage runs.
+*
+* Locally a declared `Email` is Mailpit and a declared bucket is MinIO, and
+* nobody has to configure either. Deployed, the same two containers would be
+* a stage that silently delivers no mail and keeps its files on one
+* container's disk. So a deployed stage on a server target takes both from
+* its secrets — the mail server's URL and sending address, and each bucket's
+* URL — and a stage missing any of them fails before anything is built,
+* provisioned or written, naming every key at once.
+*
+* A bucket's credentials are not checked: they are optional, and come from
+* either of two places. The bucket's URL may carry a key of its own
+* (`s3://KEY:SECRET@uploads`), which wins; otherwise the S3 client's default
+* chain applies — the stage's shared `AWS_ACCESS_KEY_ID`/
+* `AWS_SECRET_ACCESS_KEY` when it set them, or a role.
+*
+* `--allow-dev-services minio,mailpit` is the way out for a stage that is
+* not production — a preview, a demo: the target runs the dev service and
+* derives the keys from it. Keys the stage did set still win. Every run that
+* uses one says so, loudly.
+*
+* Pure: what each target runs is decided here from declarations and the
+* stage's values, and the targets do the running.
+*/
+/** The dev services a deployed stage may be allowed to run. */
+const DEV_SERVICES = ["minio", "mailpit"];
+/**
+* The S3 client's shared key pair. Optional: a bucket whose URL carries its own
+* key (`s3://KEY:SECRET@bucket`) signs with that, and one without signs with
+* this pair when the stage set it, or with whatever else the SDK's default
+* chain finds — a role.
+*/
+const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
+/** A `--allow-dev-services` value that is not a dev service. */
+var UnknownDevService = class extends Error {
+	value;
+	constructor(value) {
+		super(`'${value}' is not a dev service. --allow-dev-services takes a comma-separated list of ${DEV_SERVICES.join(", ")}: --allow-dev-services ${DEV_SERVICES.join(",")}`);
+		this.value = value;
+		this.name = "UnknownDevService";
+	}
+};
+/** Dev services asked of a target that runs no containers. */
+var DevServicesNeedServerTarget = class extends Error {
+	target;
+	services;
+	constructor(target, services) {
+		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services ${services.join(",")}.`);
+		this.target = target;
+		this.services = services;
+		this.name = "DevServicesNeedServerTarget";
+	}
+};
+/**
+* A deployed stage with mail or object storage that its secrets do not
+* configure — every missing key, across every app, at once.
+*/
+var ExternalServicesNotConfigured = class extends Error {
+	stage;
+	missing;
+	constructor(stage, missing) {
+		const services = [...new Set(missing.map((m) => m.service))].sort();
+		const lines = missing.map((m) => {
+			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
+			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "");
+		});
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.`);
+		this.stage = stage;
+		this.missing = missing;
+		this.name = "ExternalServicesNotConfigured";
+	}
+};
+/**
+* The dev services a value names: `'minio,mailpit'`, or a list of them.
+*
+* @throws {UnknownDevService} for anything that is not one
+*/
+function parseDevServices(value) {
+	if (value === void 0) return [];
+	const items = (typeof value === "string" ? [value] : value).flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+	const services = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!DEV_SERVICES.includes(item)) throw new UnknownDevService(item);
+		services.add(item);
+	}
+	return [...services].sort();
+}
+/**
+* Every mail and storage construct a manifest declares, with the apps that
+* depend on each — what a target that provisions the whole manifest checks.
+*/
+function manifestServiceDeclarations(manifest) {
+	return Object.entries(manifest).flatMap(([id, declaration]) => {
+		const { kind } = declaration;
+		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
+		const apps = dependentsOf(manifest, id).filter((caller) => {
+			const callerKind = manifest[caller]?.kind;
+			return callerKind === "rest-api" || callerKind === "site";
+		}).map(appKey);
+		return [{
+			id,
+			kind,
+			...declaration.kind === "file-server" ? { of: declaration.of } : {},
+			...apps.length ? { apps } : {}
+		}];
+	});
+}
+/**
+* Where a deployed stage's mail and storage come from, and what it lacks.
+*
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
+*/
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const domain = input.domain ?? "example.com";
+	const missing = [];
+	const minio = [];
+	const mailpit = [];
+	const add = (entry) => {
+		if (!missing.some((m) => m.key === entry.key)) missing.push(entry);
+	};
+	const declarations = [...input.declarations].sort((a, b) => a.id.localeCompare(b.id));
+	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
+	for (const d of declarations.filter((d) => d.kind === "email")) {
+		const url = provideKey(d.id, "url");
+		const from = provideKey(d.id, "from");
+		if (!has(url) && allow.includes("mailpit")) {
+			mailpit.push(d.id);
+			continue;
+		}
+		if (!has(url)) add({
+			key: url,
+			id: d.id,
+			what: `where '${d.id}' sends mail — any SMTP server`,
+			example: `smtp://user:password@smtp.${domain}:587`,
+			service: "mailpit",
+			...apps(d)
+		});
+		if (!has(from)) add({
+			key: from,
+			id: d.id,
+			what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+			example: `noreply@${domain}`,
+			service: "mailpit",
+			...apps(d)
+		});
+	}
+	for (const d of declarations.filter((d) => d.kind === "objects")) {
+		const url = provideKey(d.id, "url");
+		if (has(url)) continue;
+		if (allow.includes("minio")) {
+			minio.push(d.id);
+			continue;
+		}
+		add({
+			key: url,
+			id: d.id,
+			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
+			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
+			example: `s3://${appKey(d.id)}?region=eu-west-1`,
+			service: "minio",
+			...apps(d)
+		});
+	}
+	for (const d of declarations.filter((d) => d.kind === "file-server")) {
+		const url = provideKey(d.id, "url");
+		if (has(url)) continue;
+		if (d.of && minio.includes(d.of)) continue;
+		add({
+			key: url,
+			id: d.id,
+			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
+			example: `https://${appKey(d.id)}.${domain}`,
+			service: "minio",
+			...apps(d)
+		});
+	}
+	return {
+		missing,
+		minio,
+		mailpit
+	};
+}
+/**
+* `externalServices`, refusing a stage that lacks anything.
+*
+* @throws {ExternalServicesNotConfigured} naming every missing key
+*/
+function assertExternalServices(input) {
+	const services = externalServices(input);
+	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
+	return services;
+}
+/** The dev services a run uses, one entry per service it runs. */
+function devServicesUsed(services) {
+	const used = [];
+	if (services.mailpit.length > 0) used.push({
+		service: "mailpit",
+		ids: services.mailpit
+	});
+	if (services.minio.length > 0) used.push({
+		service: "minio",
+		ids: services.minio
+	});
+	return used;
+}
+/** The line a run prints for each dev service a deployed stage uses. */
+function devServiceWarning(stage, use) {
+	return `⚠️  DEV SERVICE ON A DEPLOYED STAGE (${stage}): ${use.service === "mailpit" ? `Mailpit is catching mail for ${use.ids.join(", ")}. It delivers NO mail: nobody receives a sign-in link, a receipt or a reset` : `MinIO is storing ${use.ids.join(", ")}. Every object is on one container's disk, with no replication and no backup`}. It is not production-grade — set the stage's own keys in its secrets for that.`;
+}
+/**
+* Report each dev service a run uses: a loud line, and a `dev-service.used`
+* event a host can act on.
+*/
+function reportDevServices(ctx, uses) {
+	for (const use of uses) {
+		ctx.logger.warn(`\n${devServiceWarning(ctx.stage, use)}`);
+		ctx.emit({
+			type: "dev-service.used",
+			service: use.service,
+			stage: ctx.stage,
+			constructs: use.ids
+		});
+	}
+}
+//#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `deploy.domains` gives no domain. */
 var NoDomainForStage = class extends Error {
@@ -5388,6 +5628,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { cacheBackendFor as $, derivedContainers as A, projectName as At, pgClient as B, resolveHost as C, applicationName as Ct, FAKE_ENV as D, isOwnedBy as Dt, keyFingerprint as E, imageRef as Et, applyPostgres as F, withCustomSecret as Ft, planFor as G, networkEnv as H, postgresDatabaseNames as I, composeBuildPaths as J, resourceName as K, postgresStatements as L, workspace_exports as M, maskPassword as Mt, LOCAL_CA_PATH as N, storage_exports as Nt, backendsOf as O, markerOf as Ot, forgetState as P, toEmbeddableSecrets as Pt, findBuildRoot as Q, quoteIdentifier as R, isMainFrontendApp as S, readKey as St, encryption_exports as T, imageName as Tt, envFor as U, appEnvKeys as V, localRolePassword as W, TURBO_VERSION as X, imageLayout as Y, detectPackageManager as Z, deployDocker as _, store_exports as _t, recordRelease as a, fakeKey as at, ensureDockerignore as b, keystoreProject as bt, setBackupState as c, createCredentialsPreload as ct, setGeneratedSecret as d, isPortAvailable as dt, eventsBackendFor as et, setPostgresBackupId as f, loadEnvFiles as ft, credentialsFileContent as g, secretsStoreFor as gt, credentialsBuildArg as h, isRemoteStore as ht, isDnsVerified as i, describeServices as it, reconcileWorkspace as j, initStageSecrets as jt, constructGlobs as k, ownershipMarker as kt, setDnsRecord as l, createEntryWrapper as lt, withGeneratedSecrets as m, prepareEntryCredentials as mt, getBackupState as n, storageBackendFor as nt, recordRollback as o, portKeys as ot, DeployJournal as p, loadSecretsForApp as pt, hostFor as q, getGeneratedSecret as r, DEFAULT_IMAGES as rt, setApplicationId as s, primaryPortKey as st, createEmptyState as t, providerOf as tt, setDnsVerification as u, findAvailablePort as ut, appDockerfile as v, FileSecretsStore as vt, encryptSecrets as w, deployIdentity as wt, validateImageRef as x, projectKey as xt, dockerCommand as y, getKeyPath as yt, composeFor as z };
+export { quoteIdentifier as $, assertExternalServices as A, prepareEntryCredentials as At, backendsOf as B, deployIdentity as Bt, isMainFrontendApp as C, primaryPortKey as Ct, ExternalServicesNotConfigured as D, isPortAvailable as Dt, DevServicesNeedServerTarget as E, findAvailablePort as Et, reportDevServices as F, getKeyPath as Ft, LOCAL_CA_PATH as G, ownershipMarker as Gt, derivedContainers as H, imageRef as Ht, encryptSecrets as I, keystoreProject as It, applyPolicies as J, maskPassword as Jt, forgetState as K, projectName as Kt, encryption_exports as L, projectKey as Lt, externalServices as M, secretsStoreFor as Mt, manifestServiceDeclarations as N, store_exports as Nt, STORAGE_KEY_PAIR as O, loadEnvFiles as Ot, parseDevServices as P, FileSecretsStore as Pt, postgresStatements as Q, keyFingerprint as R, readKey as Rt, NoDomainForStage as S, portKeys as St, DEV_SERVICES as T, createEntryWrapper as Tt, reconcileWorkspace as U, isOwnedBy as Ut, constructGlobs as V, imageName as Vt, workspace_exports as W, markerOf as Wt, bucketPolicies as X, toEmbeddableSecrets as Xt, applyPostgres as Y, storage_exports as Yt, postgresDatabaseNames as Z, withCustomSecret as Zt, deployDocker as _, providerOf as _t, recordRelease as a, envFor as at, ensureDockerignore as b, describeServices as bt, setBackupState as c, resourceName as ct, setGeneratedSecret as d, imageLayout as dt, composeFor as et, setPostgresBackupId as f, TURBO_VERSION as ft, credentialsFileContent as g, eventsBackendFor as gt, credentialsBuildArg as h, cacheBackendFor as ht, isDnsVerified as i, networkEnv as it, devServicesUsed as j, isRemoteStore as jt, UnknownDevService as k, loadSecretsForApp as kt, setDnsRecord as l, hostFor as lt, withGeneratedSecrets as m, findBuildRoot as mt, getBackupState as n, pgClient as nt, recordRollback as o, localRolePassword as ot, DeployJournal as p, detectPackageManager as pt, applyBuckets as q, initStageSecrets as qt, getGeneratedSecret as r, appEnvKeys as rt, setApplicationId as s, planFor as st, createEmptyState as t, bucketClient as tt, setDnsVerification as u, composeBuildPaths as ut, appDockerfile as v, storageBackendFor as vt, resolveHost as w, createCredentialsPreload as wt, validateImageRef as x, fakeKey as xt, dockerCommand as y, DEFAULT_IMAGES as yt, FAKE_ENV as z, applicationName as zt };
 
-//# sourceMappingURL=state-DkUStoqJ.mjs.map
+//# sourceMappingURL=state-Bn5JDMFT.mjs.map