@geekmidas/cli 10.0.0-alpha.67 → 10.0.0-alpha.69

package/dist/{state-DkUStoqJ.mjs → state-DClnPZt5.mjs}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { a as runOutput, i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
-import { d as output, r as discover } from "./discover-BFoJWKGD.mjs";
+import { d as output, r as discover } from "./discover-Buwf1z4P.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-Be6uBhlF.mjs";
+import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-B2UK_rVP.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-DhZgtvZe.mjs";
+import { c as runtimeOf } from "./resolve-Dn5wGf1r.mjs";
 import { i as DEFAULT_STORAGE, n as DEFAULT_CACHE, r as DEFAULT_EVENTS$1, t as readFakes } from "./fakes-C9RiT6XG.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
@@ -3107,15 +3107,18 @@ function pgClient(port, password = LOCAL_USER$1) {
 		}
 	} };
 }
-/** A bucket client pointed at the local MinIO. */
-function bucketClient(port) {
+/** A bucket client pointed at a MinIO on this machine. */
+function bucketClient(port, credentials = {
+	user: LOCAL_USER$1,
+	password: LOCAL_USER$1
+}) {
 	const s3 = new S3Client({
 		region: "us-east-1",
 		endpoint: `http://localhost:${port}`,
 		forcePathStyle: true,
 		credentials: {
-			accessKeyId: LOCAL_USER$1,
-			secretAccessKey: LOCAL_USER$1
+			accessKeyId: credentials.user,
+			secretAccessKey: credentials.password
 		}
 	});
 	return {
@@ -4576,6 +4579,285 @@ function keyFingerprint(masterKey) {
 	return createHash("sha256").update(masterKey).digest("hex").slice(0, 8);
 }
 //#endregion
+//#region src/deploy/devServices.ts
+/**
+* Mail and object storage on a deployed stage: real ones, or — only when
+* someone asked — the dev services the local stage runs.
+*
+* Locally a declared `Email` is Mailpit and a declared bucket is MinIO, and
+* nobody has to configure either. Deployed, the same two containers would be
+* a stage that silently delivers no mail and keeps its files on one
+* container's disk. So a deployed stage on a server target takes both from
+* its secrets — the mail server's URL and sending address, and each bucket's
+* URL — and a stage missing any of them fails before anything is built,
+* provisioned or written, naming every key at once.
+*
+* A bucket's credentials are not checked: they are optional, and come from
+* either of two places. The bucket's URL may carry a key of its own
+* (`s3://KEY:SECRET@uploads`), which wins; otherwise the S3 client's default
+* chain applies — the stage's shared `AWS_ACCESS_KEY_ID`/
+* `AWS_SECRET_ACCESS_KEY` when it set them, or a role.
+*
+* `--allow-dev-services minio,mailpit` is the way out for a stage that is
+* not production — a preview, a demo: the target runs the dev service and
+* derives the keys from it. Keys the stage did set still win. Every run that
+* uses one says so, loudly.
+*
+* Pure: what each target runs is decided here from declarations and the
+* stage's values, and the targets do the running.
+*/
+/** The dev services a deployed stage may be allowed to run. */
+const DEV_SERVICES = ["minio", "mailpit"];
+/**
+* The S3 client's shared key pair. Optional: a bucket whose URL carries its own
+* key (`s3://KEY:SECRET@bucket`) signs with that, and one without signs with
+* this pair when the stage set it, or with whatever else the SDK's default
+* chain finds — a role.
+*/
+const STORAGE_KEY_PAIR = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"];
+/** A `--allow-dev-services` value that is not a dev service. */
+var UnknownDevService = class extends Error {
+	value;
+	constructor(value) {
+		super(`'${value}' is not a dev service. --allow-dev-services takes a comma-separated list of ${DEV_SERVICES.join(", ")}: --allow-dev-services ${DEV_SERVICES.join(",")}`);
+		this.value = value;
+		this.name = "UnknownDevService";
+	}
+};
+/** Dev services asked of a target that runs no containers. */
+var DevServicesNeedServerTarget = class extends Error {
+	target;
+	services;
+	constructor(target, services) {
+		super(`--allow-dev-services applies to server targets only, and '${target}' deploys to AWS, where a bucket is S3 and mail is the stage's own. Drop --allow-dev-services ${services.join(",")}.`);
+		this.target = target;
+		this.services = services;
+		this.name = "DevServicesNeedServerTarget";
+	}
+};
+/**
+* A deployed stage with mail or object storage that its secrets do not
+* configure — every missing key, across every app, at once.
+*/
+var ExternalServicesNotConfigured = class extends Error {
+	stage;
+	missing;
+	constructor(stage, missing) {
+		const services = [...new Set(missing.map((m) => m.service))].sort();
+		const lines = missing.map((m) => {
+			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
+			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "");
+		});
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.\n\nOr run: gkm secrets:add --stage ${stage}`);
+		this.stage = stage;
+		this.missing = missing;
+		this.name = "ExternalServicesNotConfigured";
+	}
+};
+/**
+* The dev services a value names: `'minio,mailpit'`, or a list of them.
+*
+* @throws {UnknownDevService} for anything that is not one
+*/
+function parseDevServices(value) {
+	if (value === void 0) return [];
+	const items = (typeof value === "string" ? [value] : value).flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+	const services = /* @__PURE__ */ new Set();
+	for (const item of items) {
+		if (!DEV_SERVICES.includes(item)) throw new UnknownDevService(item);
+		services.add(item);
+	}
+	return [...services].sort();
+}
+/**
+* Every mail and storage construct a manifest declares, with the apps that
+* depend on each — what a target that provisions the whole manifest checks.
+*/
+function manifestServiceDeclarations(manifest) {
+	return Object.entries(manifest).flatMap(([id, declaration]) => {
+		const { kind } = declaration;
+		if (kind !== "email" && kind !== "objects" && kind !== "file-server") return [];
+		const apps = dependentsOf(manifest, id).filter((caller) => {
+			const callerKind = manifest[caller]?.kind;
+			return callerKind === "rest-api" || callerKind === "site";
+		}).map(appKey);
+		return [{
+			id,
+			kind,
+			...declaration.kind === "file-server" ? { of: declaration.of } : {},
+			...apps.length ? { apps } : {}
+		}];
+	});
+}
+/**
+* Every key a stage must be given rather than derive — the one list both a
+* deploy's checks and `gkm secrets:add` read, so what a deploy refuses and
+* what the builder offers cannot drift.
+*
+* - Deployed, mail is its URL and its sending address, a bucket its URL, and
+*   a file server its public URL. Locally all of it is Mailpit and MinIO.
+* - On every stage, a third party's credentials: nobody but the third party
+*   can issue them.
+*
+* Never a derived value: a database URL, a generated secret, the seed.
+*/
+function requiredStageKeys(input) {
+	const domain = input.domain ?? "example.com";
+	const keys = [];
+	const add = (entry) => {
+		if (!keys.some((k) => k.key === entry.key)) keys.push(entry);
+	};
+	const byId = (list) => [...list ?? []].sort((a, b) => a.id.localeCompare(b.id));
+	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
+	if (!input.local) {
+		const services = byId(input.services);
+		for (const d of services.filter((d) => d.kind === "email")) {
+			add({
+				key: provideKey(d.id, "url"),
+				id: d.id,
+				kind: "email",
+				what: `where '${d.id}' sends mail — any SMTP server`,
+				example: `smtp://user:password@smtp.${domain}:587`,
+				service: "mailpit",
+				...apps(d)
+			});
+			add({
+				key: provideKey(d.id, "from"),
+				id: d.id,
+				kind: "email",
+				what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+				example: `noreply@${domain}`,
+				service: "mailpit",
+				...apps(d)
+			});
+		}
+		for (const d of services.filter((d) => d.kind === "objects")) add({
+			key: provideKey(d.id, "url"),
+			id: d.id,
+			kind: "bucket",
+			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
+			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
+			example: `s3://${appKey(d.id)}?region=eu-west-1`,
+			service: "minio",
+			...apps(d)
+		});
+		for (const d of services.filter((d) => d.kind === "file-server")) add({
+			key: provideKey(d.id, "url"),
+			id: d.id,
+			kind: "file-server",
+			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
+			example: `https://${appKey(d.id)}.${domain}`,
+			service: "minio",
+			...d.of ? { of: d.of } : {},
+			...apps(d)
+		});
+	}
+	for (const d of byId(input.credentials)) add({
+		key: provideKey(d.id, "credentials"),
+		id: d.id,
+		kind: d.kind,
+		what: d.kind === "external-api" ? `the credentials '${d.id}' was issued for this stage, as its schema describes them` : `the credential '${d.id}', as its schema describes it`,
+		example: "{\"apiKey\":\"…\"}",
+		...apps(d)
+	});
+	return keys;
+}
+/**
+* Whether only the stage's secrets can supply `key` to a construct of `kind`
+* — what nothing on the stage derives.
+*
+* A third party's credentials, always. Deployed, also each generated secret
+* and keyring: the stage generated each one once, and every run reads the
+* same value back.
+*/
+function suppliedOnly(kind, id, key, local) {
+	if (kind === "credential") return true;
+	if (kind === "external-api") return key === provideKey(id, "credentials");
+	if (local) return false;
+	return kind === "secret" || kind === "encryption";
+}
+/**
+* Where a deployed stage's mail and storage come from, and what it lacks.
+*
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
+*
+* The keys themselves are {@link requiredStageKeys}'s.
+*/
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const required = requiredStageKeys({
+		local: false,
+		services: input.declarations,
+		...input.domain ? { domain: input.domain } : {}
+	});
+	const mailpit = required.filter((k) => k.kind === "email" && k.key === provideKey(k.id, "url")).filter((k) => !has(k.key) && allow.includes("mailpit")).map((k) => k.id);
+	const minio = required.filter((k) => k.kind === "bucket").filter((k) => !has(k.key) && allow.includes("minio")).map((k) => k.id);
+	const covered = (k) => k.kind === "email" && mailpit.includes(k.id) || k.kind === "bucket" && minio.includes(k.id) || k.kind === "file-server" && k.of !== void 0 && minio.includes(k.of);
+	return {
+		missing: required.filter((k) => !has(k.key) && !covered(k)).map(({ key, id, what, note, example, service, apps }) => ({
+			key,
+			id,
+			what,
+			...note ? { note } : {},
+			example,
+			service,
+			...apps ? { apps } : {}
+		})),
+		minio,
+		mailpit
+	};
+}
+/**
+* `externalServices`, refusing a stage that lacks anything.
+*
+* @throws {ExternalServicesNotConfigured} naming every missing key
+*/
+function assertExternalServices(input) {
+	const services = externalServices(input);
+	if (services.missing.length > 0) throw new ExternalServicesNotConfigured(input.stage, services.missing);
+	return services;
+}
+/** The dev services a run uses, one entry per service it runs. */
+function devServicesUsed(services) {
+	const used = [];
+	if (services.mailpit.length > 0) used.push({
+		service: "mailpit",
+		ids: services.mailpit
+	});
+	if (services.minio.length > 0) used.push({
+		service: "minio",
+		ids: services.minio
+	});
+	return used;
+}
+/** The line a run prints for each dev service a deployed stage uses. */
+function devServiceWarning(stage, use) {
+	return `⚠️  DEV SERVICE ON A DEPLOYED STAGE (${stage}): ${use.service === "mailpit" ? `Mailpit is catching mail for ${use.ids.join(", ")}. It delivers NO mail: nobody receives a sign-in link, a receipt or a reset` : `MinIO is storing ${use.ids.join(", ")}. Every object is on one container's disk, with no replication and no backup`}. It is not production-grade — set the stage's own keys in its secrets for that.`;
+}
+/**
+* Report each dev service a run uses: a loud line, and a `dev-service.used`
+* event a host can act on.
+*/
+function reportDevServices(ctx, uses) {
+	for (const use of uses) {
+		ctx.logger.warn(`\n${devServiceWarning(ctx.stage, use)}`);
+		ctx.emit({
+			type: "dev-service.used",
+			service: use.service,
+			stage: ctx.stage,
+			constructs: use.ids
+		});
+	}
+}
+//#endregion
 //#region src/target/dokploy/domain.ts
 /** A stage was deployed that `deploy.domains` gives no domain. */
 var NoDomainForStage = class extends Error {
@@ -5388,6 +5670,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { cacheBackendFor as $, derivedContainers as A, projectName as At, pgClient as B, resolveHost as C, applicationName as Ct, FAKE_ENV as D, isOwnedBy as Dt, keyFingerprint as E, imageRef as Et, applyPostgres as F, withCustomSecret as Ft, planFor as G, networkEnv as H, postgresDatabaseNames as I, composeBuildPaths as J, resourceName as K, postgresStatements as L, workspace_exports as M, maskPassword as Mt, LOCAL_CA_PATH as N, storage_exports as Nt, backendsOf as O, markerOf as Ot, forgetState as P, toEmbeddableSecrets as Pt, findBuildRoot as Q, quoteIdentifier as R, isMainFrontendApp as S, readKey as St, encryption_exports as T, imageName as Tt, envFor as U, appEnvKeys as V, localRolePassword as W, TURBO_VERSION as X, imageLayout as Y, detectPackageManager as Z, deployDocker as _, store_exports as _t, recordRelease as a, fakeKey as at, ensureDockerignore as b, keystoreProject as bt, setBackupState as c, createCredentialsPreload as ct, setGeneratedSecret as d, isPortAvailable as dt, eventsBackendFor as et, setPostgresBackupId as f, loadEnvFiles as ft, credentialsFileContent as g, secretsStoreFor as gt, credentialsBuildArg as h, isRemoteStore as ht, isDnsVerified as i, describeServices as it, reconcileWorkspace as j, initStageSecrets as jt, constructGlobs as k, ownershipMarker as kt, setDnsRecord as l, createEntryWrapper as lt, withGeneratedSecrets as m, prepareEntryCredentials as mt, getBackupState as n, storageBackendFor as nt, recordRollback as o, portKeys as ot, DeployJournal as p, loadSecretsForApp as pt, hostFor as q, getGeneratedSecret as r, DEFAULT_IMAGES as rt, setApplicationId as s, primaryPortKey as st, createEmptyState as t, providerOf as tt, setDnsVerification as u, findAvailablePort as ut, appDockerfile as v, FileSecretsStore as vt, encryptSecrets as w, deployIdentity as wt, validateImageRef as x, projectKey as xt, dockerCommand as y, getKeyPath as yt, composeFor as z };
+export { postgresDatabaseNames as $, withCustomSecret as $t, assertExternalServices as A, loadEnvFiles as At, keyFingerprint as B, readKey as Bt, isMainFrontendApp as C, fakeKey as Ct, ExternalServicesNotConfigured as D, createEntryWrapper as Dt, DevServicesNeedServerTarget as E, createCredentialsPreload as Et, reportDevServices as F, store_exports as Ft, reconcileWorkspace as G, isOwnedBy as Gt, backendsOf as H, deployIdentity as Ht, requiredStageKeys as I, FileSecretsStore as It, forgetState as J, projectName as Jt, workspace_exports as K, markerOf as Kt, suppliedOnly as L, getKeyPath as Lt, externalServices as M, prepareEntryCredentials as Mt, manifestServiceDeclarations as N, isRemoteStore as Nt, STORAGE_KEY_PAIR as O, findAvailablePort as Ot, parseDevServices as P, secretsStoreFor as Pt, bucketPolicies as Q, toEmbeddableSecrets as Qt, encryptSecrets as R, keystoreProject as Rt, NoDomainForStage as S, describeServices as St, DEV_SERVICES as T, primaryPortKey as Tt, constructGlobs as U, imageName as Ut, FAKE_ENV as V, applicationName as Vt, derivedContainers as W, imageRef as Wt, applyPolicies as X, maskPassword as Xt, applyBuckets as Y, initStageSecrets as Yt, applyPostgres as Z, storage_exports as Zt, deployDocker as _, cacheBackendFor as _t, recordRelease as a, appEnvKeys as at, ensureDockerignore as b, storageBackendFor as bt, setBackupState as c, localRolePassword as ct, setGeneratedSecret as d, hostFor as dt, postgresStatements as et, setPostgresBackupId as f, composeBuildPaths as ft, credentialsFileContent as g, findBuildRoot as gt, credentialsBuildArg as h, detectPackageManager as ht, isDnsVerified as i, pgClient as it, devServicesUsed as j, loadSecretsForApp as jt, UnknownDevService as k, isPortAvailable as kt, setDnsRecord as l, planFor as lt, withGeneratedSecrets as m, TURBO_VERSION as mt, getBackupState as n, composeFor as nt, recordRollback as o, networkEnv as ot, DeployJournal as p, imageLayout as pt, LOCAL_CA_PATH as q, ownershipMarker as qt, getGeneratedSecret as r, bucketClient as rt, setApplicationId as s, envFor as st, createEmptyState as t, quoteIdentifier as tt, setDnsVerification as u, resourceName as ut, appDockerfile as v, eventsBackendFor as vt, resolveHost as w, portKeys as wt, validateImageRef as x, DEFAULT_IMAGES as xt, dockerCommand as y, providerOf as yt, encryption_exports as z, projectKey as zt };
 
-//# sourceMappingURL=state-DkUStoqJ.mjs.map
+//# sourceMappingURL=state-DClnPZt5.mjs.map