@geekmidas/cli 10.0.0-alpha.67 → 10.0.0-alpha.69

package/dist/{state-DgmM4EKq.cjs → state-8RgXeX5Y.cjs}

@@ -1,10 +1,10 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
-const require_discover = require("./discover-OEfZ9OkA.cjs");
+const require_discover = require("./discover-B4VjaFJk.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-ON-bqiJz.cjs");
+const require_workspace = require("./workspace-8NuAjaXJ.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-BexmDcsN.cjs");
+const require_resolve = require("./resolve-BDsMffvz.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -3109,15 +3109,18 @@ function pgClient(port, password = LOCAL_USER$1) {
 		}
 	} };
 }
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
+/** A bucket client pointed at a MinIO on this machine. */
+function bucketClient(port, credentials = {
+	user: LOCAL_USER$1,
+	password: LOCAL_USER$1
+}) {
 	const s3 = new _aws_sdk_client_s3.S3Client({
 		region: "us-east-1",
 		endpoint: `http://localhost:${port}`,
 		forcePathStyle: true,
 		credentials: {
-			accessKeyId: LOCAL_USER$1,
-			secretAccessKey: LOCAL_USER$1
+			accessKeyId: credentials.user,
+			secretAccessKey: credentials.password
 		}
 	});
 	return {
@@ -4578,6 +4581,285 @@ function keyFingerprint(masterKey) {
 	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
 }
 //#endregion
+//#region src/deploy/devServices.ts
+/**
+* Mail and object storage on a deployed stage: real ones, or — only when
+* someone asked — the dev services the local stage runs.
+*
+* Locally a declared `Email` is Mailpit and a declared bucket is MinIO, and
+* nobody has to configure either. Deployed, the same two containers would be
+* a stage that silently delivers no mail and keeps its files on one
+* container's disk. So a deployed stage on a server target takes both from
+* its secrets — the mail server's URL and sending address, and each bucket's
+* URL — and a stage missing any of them fails before anything is built,
+* provisioned or written, naming every key at once.
+*
+* A bucket's credentials are not checked: they are optional, and come from
+* either of two places. The bucket's URL may carry a key of its own
+* (`s3://KEY:SECRET@uploads`), which wins; otherwise the S3 client's default
+* chain applies — the stage's shared `AWS_ACCESS_KEY_ID`/
+* `AWS_SECRET_ACCESS_KEY` when it set them, or a role.
+*
+* `--allow-dev-services minio,mailpit` is the way out for a stage that is
+* not production — a preview, a demo: the target runs the dev service and
+* derives the keys from it. Keys the stage did set still win. Every run that
+* uses one says so, loudly.
+*
+* Pure: what each target runs is decided here from declarations and the
+* stage's values, and the targets do the running.
+*/
+/** The dev services a deployed stage may be allowed to run. */
+const DEV_SERVICES = ["minio", "mailpit"];
+/**
+* The S3 client's shared key pair. Optional: a bucket whose URL carries its own
+* key (`s3://KEY:SECRET@bucket`) signs with that, and one without signs with
+* this pair when the stage set it, or with whatever else the SDK's default
+* chain finds — a role.
+*/
+const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
+/** A `--allow-dev-services` value that is not a dev service. */
+var UnknownDevService = class extends Error {
+	value;
+	constructor(value) {
+		super(`'${value}' is not a dev service. --allow-dev-services takes a comma-separated list of ${DEV_SERVICES.join(", ")}: --allow-dev-services ${DEV_SERVICES.join(",")}`);
+		this.value = value;
+		this.name = "UnknownDevService";
+	}
+};
+/** Dev services asked of a target that runs no containers. */
+var DevServicesNeedServerTarget = class extends Error {
+	target;
+	services;
+	constructor(target, services) {
+		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services ${services.join(",")}.`);
+		this.target = target;
+		this.services = services;
+		this.name = "DevServicesNeedServerTarget";
+	}
+};
+/**
+* A deployed stage with mail or object storage that its secrets do not
+* configure — every missing key, across every app, at once.
+*/
+var ExternalServicesNotConfigured = class extends Error {
+	stage;
+	missing;
+	constructor(stage, missing) {
+		const services = [...new Set(missing.map((m) => m.service))].sort();
+		const lines = missing.map((m) => {
+			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
+			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "");
+		});
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.\n\nOr run: gkm secrets:add --stage ${stage}`);
+		this.stage = stage;
+		this.missing = missing;
+		this.name = "ExternalServicesNotConfigured";
+	}
+};
+/**
+* The dev services a value names: `'minio,mailpit'`, or a list of them.
+*
+* @throws {UnknownDevService} for anything that is not one
+*/
+function parseDevServices(value) {
+	if (value === void 0) return [];
+	const items = (typeof value === "string" ? [value] : value).flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+	const services = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!DEV_SERVICES.includes(item)) throw new UnknownDevService(item);
+		services.add(item);
+	}
+	return [...services].sort();
+}
+/**
+* Every mail and storage construct a manifest declares, with the apps that
+* depend on each — what a target that provisions the whole manifest checks.
+*/
+function manifestServiceDeclarations(manifest) {
+	return Object.entries(manifest).flatMap(([id, declaration]) => {
+		const { kind } = declaration;
+		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
+		const apps = (0, _geekmidas_manifest.dependentsOf)(manifest, id).filter((caller) => {
+			const callerKind = manifest[caller]?.kind;
+			return callerKind === "rest-api" || callerKind === "site";
+		}).map(require_derive.appKey);
+		return [{
+			id,
+			kind,
+			...declaration.kind === "file-server" ? { of: declaration.of } : {},
+			...apps.length ? { apps } : {}
+		}];
+	});
+}
+/**
+* Every key a stage must be given rather than derive — the one list both a
+* deploy's checks and `gkm secrets:add` read, so what a deploy refuses and
+* what the builder offers cannot drift.
+*
+* - Deployed, mail is its URL and its sending address, a bucket its URL, and
+*   a file server its public URL. Locally all of it is Mailpit and MinIO.
+* - On every stage, a third party's credentials: nobody but the third party
+*   can issue them.
+*
+* Never a derived value: a database URL, a generated secret, the seed.
+*/
+function requiredStageKeys(input) {
+	const domain = input.domain ?? "example.com";
+	const keys = [];
+	const add = (entry) => {
+		if (!keys.some((k) => k.key === entry.key)) keys.push(entry);
+	};
+	const byId = (list) => [...list ?? []].sort((a, b) => a.id.localeCompare(b.id));
+	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
+	if (!input.local) {
+		const services = byId(input.services);
+		for (const d of services.filter((d) => d.kind === "email")) {
+			add({
+				key: (0, _geekmidas_manifest.provideKey)(d.id, "url"),
+				id: d.id,
+				kind: "email",
+				what: `where '${d.id}' sends mail — any SMTP server`,
+				example: `smtp://user:password@smtp.${domain}:587`,
+				service: "mailpit",
+				...apps(d)
+			});
+			add({
+				key: (0, _geekmidas_manifest.provideKey)(d.id, "from"),
+				id: d.id,
+				kind: "email",
+				what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+				example: `noreply@${domain}`,
+				service: "mailpit",
+				...apps(d)
+			});
+		}
+		for (const d of services.filter((d) => d.kind === "objects")) add({
+			key: (0, _geekmidas_manifest.provideKey)(d.id, "url"),
+			id: d.id,
+			kind: "bucket",
+			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
+			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${require_derive.appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
+			example: `s3://${require_derive.appKey(d.id)}?region=eu-west-1`,
+			service: "minio",
+			...apps(d)
+		});
+		for (const d of services.filter((d) => d.kind === "file-server")) add({
+			key: (0, _geekmidas_manifest.provideKey)(d.id, "url"),
+			id: d.id,
+			kind: "file-server",
+			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
+			example: `https://${require_derive.appKey(d.id)}.${domain}`,
+			service: "minio",
+			...d.of ? { of: d.of } : {},
+			...apps(d)
+		});
+	}
+	for (const d of byId(input.credentials)) add({
+		key: (0, _geekmidas_manifest.provideKey)(d.id, "credentials"),
+		id: d.id,
+		kind: d.kind,
+		what: d.kind === "external-api" ? `the credentials '${d.id}' was issued for this stage, as its schema describes them` : `the credential '${d.id}', as its schema describes it`,
+		example: "{\"apiKey\":\"…\"}",
+		...apps(d)
+	});
+	return keys;
+}
+/**
+* Whether only the stage's secrets can supply `key` to a construct of `kind`
+* — what nothing on the stage derives.
+*
+* A third party's credentials, always. Deployed, also each generated secret
+* and keyring: the stage generated each one once, and every run reads the
+* same value back.
+*/
+function suppliedOnly(kind, id, key, local) {
+	if (kind === "credential") return true;
+	if (kind === "external-api") return key === (0, _geekmidas_manifest.provideKey)(id, "credentials");
+	if (local) return false;
+	return kind === "secret" || kind === "encryption";
+}
+/**
+* Where a deployed stage's mail and storage come from, and what it lacks.
+*
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
+*
+* The keys themselves are {@link requiredStageKeys}'s.
+*/
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const required = requiredStageKeys({
+		local: false,
+		services: input.declarations,
+		...input.domain ? { domain: input.domain } : {}
+	});
+	const mailpit = required.filter((k) => k.kind === "email" && k.key === (0, _geekmidas_manifest.provideKey)(k.id, "url")).filter((k) => !has(k.key) && allow.includes("mailpit")).map((k) => k.id);
+	const minio = required.filter((k) => k.kind === "bucket").filter((k) => !has(k.key) && allow.includes("minio")).map((k) => k.id);
+	const covered = (k) => k.kind === "email" && mailpit.includes(k.id) || k.kind === "bucket" && minio.includes(k.id) || k.kind === "file-server" && k.of !== void 0 && minio.includes(k.of);
+	return {
+		missing: required.filter((k) => !has(k.key) && !covered(k)).map(({ key, id, what, note, example, service, apps }) => ({
+			key,
+			id,
+			what,
+			...note ? { note } : {},
+			example,
+			service,
+			...apps ? { apps } : {}
+		})),
+		minio,
+		mailpit
+	};
+}
+/**
+* `externalServices`, refusing a stage that lacks anything.
+*
+* @throws {ExternalServicesNotConfigured} naming every missing key
+*/
+function assertExternalServices(input) {
+	const services = externalServices(input);
+	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
+	return services;
+}
+/** The dev services a run uses, one entry per service it runs. */
+function devServicesUsed(services) {
+	const used = [];
+	if (services.mailpit.length > 0) used.push({
+		service: "mailpit",
+		ids: services.mailpit
+	});
+	if (services.minio.length > 0) used.push({
+		service: "minio",
+		ids: services.minio
+	});
+	return used;
+}
+/** The line a run prints for each dev service a deployed stage uses. */
+function devServiceWarning(stage, use) {
+	return `⚠️  DEV SERVICE ON A DEPLOYED STAGE (${stage}): ${use.service === "mailpit" ? `Mailpit is catching mail for ${use.ids.join(", ")}. It delivers NO mail: nobody receives a sign-in link, a receipt or a reset` : `MinIO is storing ${use.ids.join(", ")}. Every object is on one container's disk, with no replication and no backup`}. It is not production-grade — set the stage's own keys in its secrets for that.`;
+}
+/**
+* Report each dev service a run uses: a loud line, and a `dev-service.used`
+* event a host can act on.
+*/
+function reportDevServices(ctx, uses) {
+	for (const use of uses) {
+		ctx.logger.warn(`\n${devServiceWarning(ctx.stage, use)}`);
+		ctx.emit({
+			type: "dev-service.used",
+			service: use.service,
+			stage: ctx.stage,
+			constructs: use.ids
+		});
+	}
+}
+//#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `deploy.domains` gives no domain. */
 var NoDomainForStage = class extends Error {
@@ -5402,12 +5684,30 @@ Object.defineProperty(exports, "DEFAULT_IMAGES", {
 		return DEFAULT_IMAGES;
 	}
 });
+Object.defineProperty(exports, "DEV_SERVICES", {
+	enumerable: true,
+	get: function() {
+		return DEV_SERVICES;
+	}
+});
 Object.defineProperty(exports, "DeployJournal", {
 	enumerable: true,
 	get: function() {
 		return DeployJournal;
 	}
 });
+Object.defineProperty(exports, "DevServicesNeedServerTarget", {
+	enumerable: true,
+	get: function() {
+		return DevServicesNeedServerTarget;
+	}
+});
+Object.defineProperty(exports, "ExternalServicesNotConfigured", {
+	enumerable: true,
+	get: function() {
+		return ExternalServicesNotConfigured;
+	}
+});
 Object.defineProperty(exports, "FAKE_ENV", {
 	enumerable: true,
 	get: function() {
@@ -5426,12 +5726,30 @@ Object.defineProperty(exports, "LOCAL_CA_PATH", {
 		return LOCAL_CA_PATH;
 	}
 });
+Object.defineProperty(exports, "NoDomainForStage", {
+	enumerable: true,
+	get: function() {
+		return NoDomainForStage;
+	}
+});
+Object.defineProperty(exports, "STORAGE_KEY_PAIR", {
+	enumerable: true,
+	get: function() {
+		return STORAGE_KEY_PAIR;
+	}
+});
 Object.defineProperty(exports, "TURBO_VERSION", {
 	enumerable: true,
 	get: function() {
 		return TURBO_VERSION;
 	}
 });
+Object.defineProperty(exports, "UnknownDevService", {
+	enumerable: true,
+	get: function() {
+		return UnknownDevService;
+	}
+});
 Object.defineProperty(exports, "appDockerfile", {
 	enumerable: true,
 	get: function() {
@@ -5450,18 +5768,48 @@ Object.defineProperty(exports, "applicationName", {
 		return applicationName;
 	}
 });
+Object.defineProperty(exports, "applyBuckets", {
+	enumerable: true,
+	get: function() {
+		return applyBuckets;
+	}
+});
+Object.defineProperty(exports, "applyPolicies", {
+	enumerable: true,
+	get: function() {
+		return applyPolicies;
+	}
+});
 Object.defineProperty(exports, "applyPostgres", {
 	enumerable: true,
 	get: function() {
 		return applyPostgres;
 	}
 });
+Object.defineProperty(exports, "assertExternalServices", {
+	enumerable: true,
+	get: function() {
+		return assertExternalServices;
+	}
+});
 Object.defineProperty(exports, "backendsOf", {
 	enumerable: true,
 	get: function() {
 		return backendsOf;
 	}
 });
+Object.defineProperty(exports, "bucketClient", {
+	enumerable: true,
+	get: function() {
+		return bucketClient;
+	}
+});
+Object.defineProperty(exports, "bucketPolicies", {
+	enumerable: true,
+	get: function() {
+		return bucketPolicies;
+	}
+});
 Object.defineProperty(exports, "cacheBackendFor", {
 	enumerable: true,
 	get: function() {
@@ -5546,6 +5894,12 @@ Object.defineProperty(exports, "detectPackageManager", {
 		return detectPackageManager;
 	}
 });
+Object.defineProperty(exports, "devServicesUsed", {
+	enumerable: true,
+	get: function() {
+		return devServicesUsed;
+	}
+});
 Object.defineProperty(exports, "dockerCommand", {
 	enumerable: true,
 	get: function() {
@@ -5582,6 +5936,12 @@ Object.defineProperty(exports, "eventsBackendFor", {
 		return eventsBackendFor;
 	}
 });
+Object.defineProperty(exports, "externalServices", {
+	enumerable: true,
+	get: function() {
+		return externalServices;
+	}
+});
 Object.defineProperty(exports, "fakeKey", {
 	enumerable: true,
 	get: function() {
@@ -5714,6 +6074,12 @@ Object.defineProperty(exports, "localRolePassword", {
 		return localRolePassword;
 	}
 });
+Object.defineProperty(exports, "manifestServiceDeclarations", {
+	enumerable: true,
+	get: function() {
+		return manifestServiceDeclarations;
+	}
+});
 Object.defineProperty(exports, "markerOf", {
 	enumerable: true,
 	get: function() {
@@ -5738,6 +6104,12 @@ Object.defineProperty(exports, "ownershipMarker", {
 		return ownershipMarker;
 	}
 });
+Object.defineProperty(exports, "parseDevServices", {
+	enumerable: true,
+	get: function() {
+		return parseDevServices;
+	}
+});
 Object.defineProperty(exports, "pgClient", {
 	enumerable: true,
 	get: function() {
@@ -5828,6 +6200,18 @@ Object.defineProperty(exports, "recordRollback", {
 		return recordRollback;
 	}
 });
+Object.defineProperty(exports, "reportDevServices", {
+	enumerable: true,
+	get: function() {
+		return reportDevServices;
+	}
+});
+Object.defineProperty(exports, "requiredStageKeys", {
+	enumerable: true,
+	get: function() {
+		return requiredStageKeys;
+	}
+});
 Object.defineProperty(exports, "resolveHost", {
 	enumerable: true,
 	get: function() {
@@ -5900,6 +6284,12 @@ Object.defineProperty(exports, "store_exports", {
 		return store_exports;
 	}
 });
+Object.defineProperty(exports, "suppliedOnly", {
+	enumerable: true,
+	get: function() {
+		return suppliedOnly;
+	}
+});
 Object.defineProperty(exports, "toEmbeddableSecrets", {
 	enumerable: true,
 	get: function() {
@@ -5931,4 +6321,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-DgmM4EKq.cjs.map
+//# sourceMappingURL=state-8RgXeX5Y.cjs.map