@geekmidas/cli 10.0.0-alpha.67 → 10.0.0-alpha.68

package/dist/{state-DgmM4EKq.cjs → state-CHZqCDRC.cjs}

@@ -4,7 +4,7 @@ const require_discover = require("./discover-OEfZ9OkA.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
 const require_workspace = require("./workspace-ON-bqiJz.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-BexmDcsN.cjs");
+const require_resolve = require("./resolve-BymzGtuT.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -3109,15 +3109,18 @@ function pgClient(port, password = LOCAL_USER$1) {
 		}
 	} };
 }
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
+/** A bucket client pointed at a MinIO on this machine. */
+function bucketClient(port, credentials = {
+	user: LOCAL_USER$1,
+	password: LOCAL_USER$1
+}) {
 	const s3 = new _aws_sdk_client_s3.S3Client({
 		region: "us-east-1",
 		endpoint: `http://localhost:${port}`,
 		forcePathStyle: true,
 		credentials: {
-			accessKeyId: LOCAL_USER$1,
-			secretAccessKey: LOCAL_USER$1
+			accessKeyId: credentials.user,
+			secretAccessKey: credentials.password
 		}
 	});
 	return {
@@ -4578,6 +4581,243 @@ function keyFingerprint(masterKey) {
 	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
 }
 //#endregion
+//#region src/deploy/devServices.ts
+/**
+* Mail and object storage on a deployed stage: real ones, or — only when
+* someone asked — the dev services the local stage runs.
+*
+* Locally a declared `Email` is Mailpit and a declared bucket is MinIO, and
+* nobody has to configure either. Deployed, the same two containers would be
+* a stage that silently delivers no mail and keeps its files on one
+* container's disk. So a deployed stage on a server target takes both from
+* its secrets — the mail server's URL and sending address, and each bucket's
+* URL — and a stage missing any of them fails before anything is built,
+* provisioned or written, naming every key at once.
+*
+* A bucket's credentials are not checked: they are optional, and come from
+* either of two places. The bucket's URL may carry a key of its own
+* (`s3://KEY:SECRET@uploads`), which wins; otherwise the S3 client's default
+* chain applies — the stage's shared `AWS_ACCESS_KEY_ID`/
+* `AWS_SECRET_ACCESS_KEY` when it set them, or a role.
+*
+* `--allow-dev-services minio,mailpit` is the way out for a stage that is
+* not production — a preview, a demo: the target runs the dev service and
+* derives the keys from it. Keys the stage did set still win. Every run that
+* uses one says so, loudly.
+*
+* Pure: what each target runs is decided here from declarations and the
+* stage's values, and the targets do the running.
+*/
+/** The dev services a deployed stage may be allowed to run. */
+const DEV_SERVICES = ["minio", "mailpit"];
+/**
+* The S3 client's shared key pair. Optional: a bucket whose URL carries its own
+* key (`s3://KEY:SECRET@bucket`) signs with that, and one without signs with
+* this pair when the stage set it, or with whatever else the SDK's default
+* chain finds — a role.
+*/
+const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
+/** A `--allow-dev-services` value that is not a dev service. */
+var UnknownDevService = class extends Error {
+	value;
+	constructor(value) {
+		super(`'${value}' is not a dev service. --allow-dev-services takes a comma-separated list of ${DEV_SERVICES.join(", ")}: --allow-dev-services ${DEV_SERVICES.join(",")}`);
+		this.value = value;
+		this.name = "UnknownDevService";
+	}
+};
+/** Dev services asked of a target that runs no containers. */
+var DevServicesNeedServerTarget = class extends Error {
+	target;
+	services;
+	constructor(target, services) {
+		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services ${services.join(",")}.`);
+		this.target = target;
+		this.services = services;
+		this.name = "DevServicesNeedServerTarget";
+	}
+};
+/**
+* A deployed stage with mail or object storage that its secrets do not
+* configure — every missing key, across every app, at once.
+*/
+var ExternalServicesNotConfigured = class extends Error {
+	stage;
+	missing;
+	constructor(stage, missing) {
+		const services = [...new Set(missing.map((m) => m.service))].sort();
+		const lines = missing.map((m) => {
+			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
+			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "");
+		});
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.`);
+		this.stage = stage;
+		this.missing = missing;
+		this.name = "ExternalServicesNotConfigured";
+	}
+};
+/**
+* The dev services a value names: `'minio,mailpit'`, or a list of them.
+*
+* @throws {UnknownDevService} for anything that is not one
+*/
+function parseDevServices(value) {
+	if (value === void 0) return [];
+	const items = (typeof value === "string" ? [value] : value).flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+	const services = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!DEV_SERVICES.includes(item)) throw new UnknownDevService(item);
+		services.add(item);
+	}
+	return [...services].sort();
+}
+/**
+* Every mail and storage construct a manifest declares, with the apps that
+* depend on each — what a target that provisions the whole manifest checks.
+*/
+function manifestServiceDeclarations(manifest) {
+	return Object.entries(manifest).flatMap(([id, declaration]) => {
+		const { kind } = declaration;
+		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
+		const apps = (0, _geekmidas_manifest.dependentsOf)(manifest, id).filter((caller) => {
+			const callerKind = manifest[caller]?.kind;
+			return callerKind === "rest-api" || callerKind === "site";
+		}).map(require_derive.appKey);
+		return [{
+			id,
+			kind,
+			...declaration.kind === "file-server" ? { of: declaration.of } : {},
+			...apps.length ? { apps } : {}
+		}];
+	});
+}
+/**
+* Where a deployed stage's mail and storage come from, and what it lacks.
+*
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
+*/
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const domain = input.domain ?? "example.com";
+	const missing = [];
+	const minio = [];
+	const mailpit = [];
+	const add = (entry) => {
+		if (!missing.some((m) => m.key === entry.key)) missing.push(entry);
+	};
+	const declarations = [...input.declarations].sort((a, b) => a.id.localeCompare(b.id));
+	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
+	for (const d of declarations.filter((d) => d.kind === "email")) {
+		const url = (0, _geekmidas_manifest.provideKey)(d.id, "url");
+		const from = (0, _geekmidas_manifest.provideKey)(d.id, "from");
+		if (!has(url) && allow.includes("mailpit")) {
+			mailpit.push(d.id);
+			continue;
+		}
+		if (!has(url)) add({
+			key: url,
+			id: d.id,
+			what: `where '${d.id}' sends mail — any SMTP server`,
+			example: `smtp://user:password@smtp.${domain}:587`,
+			service: "mailpit",
+			...apps(d)
+		});
+		if (!has(from)) add({
+			key: from,
+			id: d.id,
+			what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+			example: `noreply@${domain}`,
+			service: "mailpit",
+			...apps(d)
+		});
+	}
+	for (const d of declarations.filter((d) => d.kind === "objects")) {
+		const url = (0, _geekmidas_manifest.provideKey)(d.id, "url");
+		if (has(url)) continue;
+		if (allow.includes("minio")) {
+			minio.push(d.id);
+			continue;
+		}
+		add({
+			key: url,
+			id: d.id,
+			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
+			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${require_derive.appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
+			example: `s3://${require_derive.appKey(d.id)}?region=eu-west-1`,
+			service: "minio",
+			...apps(d)
+		});
+	}
+	for (const d of declarations.filter((d) => d.kind === "file-server")) {
+		const url = (0, _geekmidas_manifest.provideKey)(d.id, "url");
+		if (has(url)) continue;
+		if (d.of && minio.includes(d.of)) continue;
+		add({
+			key: url,
+			id: d.id,
+			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
+			example: `https://${require_derive.appKey(d.id)}.${domain}`,
+			service: "minio",
+			...apps(d)
+		});
+	}
+	return {
+		missing,
+		minio,
+		mailpit
+	};
+}
+/**
+* `externalServices`, refusing a stage that lacks anything.
+*
+* @throws {ExternalServicesNotConfigured} naming every missing key
+*/
+function assertExternalServices(input) {
+	const services = externalServices(input);
+	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
+	return services;
+}
+/** The dev services a run uses, one entry per service it runs. */
+function devServicesUsed(services) {
+	const used = [];
+	if (services.mailpit.length > 0) used.push({
+		service: "mailpit",
+		ids: services.mailpit
+	});
+	if (services.minio.length > 0) used.push({
+		service: "minio",
+		ids: services.minio
+	});
+	return used;
+}
+/** The line a run prints for each dev service a deployed stage uses. */
+function devServiceWarning(stage, use) {
+	return `⚠️  DEV SERVICE ON A DEPLOYED STAGE (${stage}): ${use.service === "mailpit" ? `Mailpit is catching mail for ${use.ids.join(", ")}. It delivers NO mail: nobody receives a sign-in link, a receipt or a reset` : `MinIO is storing ${use.ids.join(", ")}. Every object is on one container's disk, with no replication and no backup`}. It is not production-grade — set the stage's own keys in its secrets for that.`;
+}
+/**
+* Report each dev service a run uses: a loud line, and a `dev-service.used`
+* event a host can act on.
+*/
+function reportDevServices(ctx, uses) {
+	for (const use of uses) {
+		ctx.logger.warn(`\n${devServiceWarning(ctx.stage, use)}`);
+		ctx.emit({
+			type: "dev-service.used",
+			service: use.service,
+			stage: ctx.stage,
+			constructs: use.ids
+		});
+	}
+}
+//#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `deploy.domains` gives no domain. */
 var NoDomainForStage = class extends Error {
@@ -5402,12 +5642,30 @@ Object.defineProperty(exports, "DEFAULT_IMAGES", {
 		return DEFAULT_IMAGES;
 	}
 });
+Object.defineProperty(exports, "DEV_SERVICES", {
+	enumerable: true,
+	get: function() {
+		return DEV_SERVICES;
+	}
+});
 Object.defineProperty(exports, "DeployJournal", {
 	enumerable: true,
 	get: function() {
 		return DeployJournal;
 	}
 });
+Object.defineProperty(exports, "DevServicesNeedServerTarget", {
+	enumerable: true,
+	get: function() {
+		return DevServicesNeedServerTarget;
+	}
+});
+Object.defineProperty(exports, "ExternalServicesNotConfigured", {
+	enumerable: true,
+	get: function() {
+		return ExternalServicesNotConfigured;
+	}
+});
 Object.defineProperty(exports, "FAKE_ENV", {
 	enumerable: true,
 	get: function() {
@@ -5426,12 +5684,30 @@ Object.defineProperty(exports, "LOCAL_CA_PATH", {
 		return LOCAL_CA_PATH;
 	}
 });
+Object.defineProperty(exports, "NoDomainForStage", {
+	enumerable: true,
+	get: function() {
+		return NoDomainForStage;
+	}
+});
+Object.defineProperty(exports, "STORAGE_KEY_PAIR", {
+	enumerable: true,
+	get: function() {
+		return STORAGE_KEY_PAIR;
+	}
+});
 Object.defineProperty(exports, "TURBO_VERSION", {
 	enumerable: true,
 	get: function() {
 		return TURBO_VERSION;
 	}
 });
+Object.defineProperty(exports, "UnknownDevService", {
+	enumerable: true,
+	get: function() {
+		return UnknownDevService;
+	}
+});
 Object.defineProperty(exports, "appDockerfile", {
 	enumerable: true,
 	get: function() {
@@ -5450,18 +5726,48 @@ Object.defineProperty(exports, "applicationName", {
 		return applicationName;
 	}
 });
+Object.defineProperty(exports, "applyBuckets", {
+	enumerable: true,
+	get: function() {
+		return applyBuckets;
+	}
+});
+Object.defineProperty(exports, "applyPolicies", {
+	enumerable: true,
+	get: function() {
+		return applyPolicies;
+	}
+});
 Object.defineProperty(exports, "applyPostgres", {
 	enumerable: true,
 	get: function() {
 		return applyPostgres;
 	}
 });
+Object.defineProperty(exports, "assertExternalServices", {
+	enumerable: true,
+	get: function() {
+		return assertExternalServices;
+	}
+});
 Object.defineProperty(exports, "backendsOf", {
 	enumerable: true,
 	get: function() {
 		return backendsOf;
 	}
 });
+Object.defineProperty(exports, "bucketClient", {
+	enumerable: true,
+	get: function() {
+		return bucketClient;
+	}
+});
+Object.defineProperty(exports, "bucketPolicies", {
+	enumerable: true,
+	get: function() {
+		return bucketPolicies;
+	}
+});
 Object.defineProperty(exports, "cacheBackendFor", {
 	enumerable: true,
 	get: function() {
@@ -5546,6 +5852,12 @@ Object.defineProperty(exports, "detectPackageManager", {
 		return detectPackageManager;
 	}
 });
+Object.defineProperty(exports, "devServicesUsed", {
+	enumerable: true,
+	get: function() {
+		return devServicesUsed;
+	}
+});
 Object.defineProperty(exports, "dockerCommand", {
 	enumerable: true,
 	get: function() {
@@ -5582,6 +5894,12 @@ Object.defineProperty(exports, "eventsBackendFor", {
 		return eventsBackendFor;
 	}
 });
+Object.defineProperty(exports, "externalServices", {
+	enumerable: true,
+	get: function() {
+		return externalServices;
+	}
+});
 Object.defineProperty(exports, "fakeKey", {
 	enumerable: true,
 	get: function() {
@@ -5714,6 +6032,12 @@ Object.defineProperty(exports, "localRolePassword", {
 		return localRolePassword;
 	}
 });
+Object.defineProperty(exports, "manifestServiceDeclarations", {
+	enumerable: true,
+	get: function() {
+		return manifestServiceDeclarations;
+	}
+});
 Object.defineProperty(exports, "markerOf", {
 	enumerable: true,
 	get: function() {
@@ -5738,6 +6062,12 @@ Object.defineProperty(exports, "ownershipMarker", {
 		return ownershipMarker;
 	}
 });
+Object.defineProperty(exports, "parseDevServices", {
+	enumerable: true,
+	get: function() {
+		return parseDevServices;
+	}
+});
 Object.defineProperty(exports, "pgClient", {
 	enumerable: true,
 	get: function() {
@@ -5828,6 +6158,12 @@ Object.defineProperty(exports, "recordRollback", {
 		return recordRollback;
 	}
 });
+Object.defineProperty(exports, "reportDevServices", {
+	enumerable: true,
+	get: function() {
+		return reportDevServices;
+	}
+});
 Object.defineProperty(exports, "resolveHost", {
 	enumerable: true,
 	get: function() {
@@ -5931,4 +6267,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-DgmM4EKq.cjs.map
+//# sourceMappingURL=state-CHZqCDRC.cjs.map