@geekmidas/cli 10.0.0-alpha.67 → 10.0.0-alpha.69

package/dist/{compose-BjToENzG.mjs → compose-CZtinmtw.mjs}

@@ -1,11 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { a as runOutput, i as run } from "./run-BJLIerMM.mjs";
-import { r as discover } from "./discover-BFoJWKGD.mjs";
+import { r as discover } from "./discover-Buwf1z4P.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
 import { t as defineTarget } from "./define-DR8xGYfL.mjs";
-import { B as pgClient, C as resolveHost, Et as imageRef, F as applyPostgres, G as planFor, H as networkEnv, J as composeBuildPaths, L as postgresStatements, Q as findBuildRoot, S as isMainFrontendApp, U as envFor, V as appEnvKeys, W as localRolePassword, X as TURBO_VERSION, Y as imageLayout, a as recordRelease, b as ensureDockerignore, g as credentialsFileContent, h as credentialsBuildArg, jt as initStageSecrets, k as constructGlobs, m as withGeneratedSecrets, ot as portKeys, p as DeployJournal, q as hostFor, rt as DEFAULT_IMAGES, st as primaryPortKey, t as createEmptyState, v as appDockerfile, w as encryptSecrets, x as validateImageRef, z as composeFor } from "./state-DkUStoqJ.mjs";
+import { A as assertExternalServices, C as isMainFrontendApp, F as reportDevServices, L as suppliedOnly, Q as bucketPolicies, R as encryptSecrets, S as NoDomainForStage, Tt as primaryPortKey, U as constructGlobs, Wt as imageRef, X as applyPolicies, Y as applyBuckets, Yt as initStageSecrets, Z as applyPostgres, a as recordRelease, at as appEnvKeys, b as ensureDockerignore, ct as localRolePassword, dt as hostFor, et as postgresStatements, ft as composeBuildPaths, g as credentialsFileContent, gt as findBuildRoot, h as credentialsBuildArg, it as pgClient, j as devServicesUsed, lt as planFor, m as withGeneratedSecrets, mt as TURBO_VERSION, nt as composeFor, ot as networkEnv, p as DeployJournal, pt as imageLayout, rt as bucketClient, st as envFor, t as createEmptyState, v as appDockerfile, w as resolveHost, wt as portKeys, x as validateImageRef, xt as DEFAULT_IMAGES } from "./state-DClnPZt5.mjs";
 import { n as DEFAULT_CACHE, r as DEFAULT_EVENTS } from "./fakes-C9RiT6XG.mjs";
 import { u as migrateDatabases } from "./databases-hUHTuwhx.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-BmYxnEz_.mjs";
 import { dirname, join } from "node:path";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { provideKey, provisionOrder, publicEnvFor } from "@geekmidas/manifest";
@@ -261,22 +262,29 @@ function edgeCaddyfile(sites, options) {
 }` : options.email ? `{
 	email ${options.email}
 }` : "";
-	const blocks = sites.map(({ host, upstream }) => `https://${host} {${options.local ? `
+	const blocks = sites.map(({ host, upstream, rewrite }) => `https://${host} {${options.local ? `
 	tls internal
-` : ""}
+` : ""}${rewrite ? `
+	# A bucket, served at a host of its own: the bucket is a prefix on MinIO,
+	# which routes and signs on the Host header — so it is sent the upstream's.
+	reverse_proxy ${upstream} {
+		rewrite ${rewrite}
+		header_up Host {upstream_hostport}
+	}` : `
 	# Host and X-Forwarded-* are passed through as Caddy does by default, so
 	# an app builds redirects, cookies and links on the address a caller used.
 	reverse_proxy ${upstream} {
 		# Never buffer: a streamed response — server-sent events, a Next.js
 		# RSC payload — reaches the client as each chunk is written.
 		flush_interval -1
-	}
+	}`}
 }`);
 	return `${HEADER}${global ? `${global}\n\n` : ""}${blocks.join("\n\n")}\n`;
 }
 const HEADER = `# Generated by gkm compose from the construct manifest — do not edit.
 #
-# One host per API and site, each in front of its own container.
+# One host per API and site, each in front of its own container, and one per
+# file server in front of the stack's MinIO.
 `;
 //#endregion
 //#region src/compose/stack.ts
@@ -317,42 +325,32 @@ const EDGE_PORT_ENV = {
 /**
 * Containers this target does not run.
 *
-* Object storage is the stage's own — an externally hosted bucket whose URL
-* the stage's secrets hold — and so is a deployed stage's mail. The AWS
-* emulator never applies: a stack is a server target, whose events are
-* pg-boss.
+* The AWS emulator never applies: a stack is a server target, whose events
+* are pg-boss. Reconcile's Caddy fronts `gkm dev`'s host processes; the stack
+* brings its own edge.
+*
+* MinIO and Mailpit run on the local stage always, and on a deployed stage
+* only where `--allow-dev-services` allowed them and its secrets configure no
+* real bucket or mail server — see `devServices.ts`.
 */
 const NOT_RUN = {
-	minio: true,
 	localstack: true,
 	caddy: true
 };
-/** Kinds whose `<ID>_URL` a stage must be given, because nothing here runs them. */
-const EXTERNAL_KINDS = {
-	objects: true,
-	"file-server": true
+/** The kinds a deployed stage takes from its secrets, or a dev service. */
+const SERVICE_KINDS = {
+	email: "email",
+	objects: "objects",
+	"file-server": "file-server"
 };
+/** The region MinIO is addressed with. It has no regions; the SDK wants one. */
+const MINIO_REGION = "us-east-1";
 /** The S3 client's credentials, read beside a bucket's URL when it has them. */
 const STORAGE_KEYS = [
 	"AWS_ACCESS_KEY_ID",
 	"AWS_SECRET_ACCESS_KEY",
 	"AWS_REGION"
 ];
-/** A bucket the stack needs and the stage was not given. */
-var BucketNotConfigured = class extends Error {
-	app;
-	id;
-	key;
-	stage;
-	constructor(app, id, key, stage) {
-		super(`'${app}' uses the bucket '${id}', and gkm compose runs no object storage: the stage needs an externally hosted bucket. Set its URL in the stage's secrets: gkm secrets:set ${key} 's3://…' --stage ${stage}`);
-		this.app = app;
-		this.id = id;
-		this.key = key;
-		this.stage = stage;
-		this.name = "BucketNotConfigured";
-	}
-};
 /** A value only the stage's secrets can hold, and they do not. */
 var StageSecretMissing = class extends Error {
 	app;
@@ -370,7 +368,7 @@ var StageSecretMissing = class extends Error {
 var StageSeedMissing = class extends Error {
 	stage;
 	constructor(stage) {
-		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose without --dry-run once, or gkm deploy, to generate it.`);
+		super(`The stage '${stage}' has no seed in its secrets, and a deployed stage's database passwords are derived from it. Run gkm compose --stage ${stage} without --dry-run once, or gkm deploy, to generate it.`);
 		this.stage = stage;
 		this.name = "StageSeedMissing";
 	}
@@ -439,7 +437,6 @@ function composeStack(input) {
 		master: local ? "geekmidas" : localRolePassword(workspace.name, plan, "master", seed),
 		...seed ? { seed } : {}
 	};
-	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => local || c !== "mailpit").sort();
 	const apps = stackApps(workspace, manifest, plan, {
 		local,
 		stage,
@@ -448,10 +445,47 @@ function composeStack(input) {
 		images: input.images
 	});
 	if (apps.length === 0) throw new NothingToCompose(workspace.root);
+	const owners = /* @__PURE__ */ new Map();
+	for (const resource of plan.resources) {
+		owners.set(resource.envKey, resource);
+		if (resource.kind === "email") {
+			owners.set(provideKey(resource.id, "from"), resource);
+			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+		}
+		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+	}
+	const reads = /* @__PURE__ */ new Map();
+	for (const app of apps) {
+		const site = manifest[app.id];
+		reads.set(app.name, site?.kind === "site" ? Object.values(publicEnvFor(site, manifest)) : [...appEnvKeys(manifest, app.name, input.runnables) ?? []]);
+	}
+	const domain = workspace.deploy?.domains?.[stage];
+	const services = local ? {
+		missing: [],
+		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
+		mailpit: plan.resources.filter((r) => r.kind === "email").map((r) => r.id)
+	} : assertExternalServices({
+		stage,
+		declarations: serviceDeclarations(plan, reads, owners),
+		supplied: custom,
+		allow: input.allowDevServices ?? [],
+		...domain ? { domain } : {}
+	});
+	const infra = plan.containers.filter((c) => !NOT_RUN[c]).filter((c) => c !== "minio" || services.minio.length > 0).filter((c) => c !== "mailpit" || services.mailpit.length > 0).sort();
+	const storage = infra.includes("minio") ? (() => {
+		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
+		return {
+			user: custom.AWS_ACCESS_KEY_ID ?? (local ? "geekmidas" : `${workspace.name}-minio`),
+			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : localRolePassword(workspace.name, plan, "minio", seed)),
+			buckets,
+			policies: bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
+		};
+	})() : void 0;
 	const derivation = {
 		project: workspace.name,
 		master: credential.master,
-		...credential.seed ? { seed: credential.seed } : {}
+		...credential.seed ? { seed: credential.seed } : {},
+		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
 	};
 	const outside = networkEnv(plan, {
 		...derivation,
@@ -461,14 +495,27 @@ function composeStack(input) {
 		...derivation,
 		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
 	});
-	const owners = /* @__PURE__ */ new Map();
-	for (const resource of plan.resources) {
-		owners.set(resource.envKey, resource);
-		if (resource.kind === "email") {
-			owners.set(provideKey(resource.id, "from"), resource);
-			owners.set(provideKey(resource.id, "inboxUrl"), resource);
+	const fileServers = /* @__PURE__ */ new Map();
+	if (storage) for (const resource of plan.resources) {
+		if (resource.kind !== "file-server" || !resource.of) continue;
+		if (!services.minio.includes(resource.of)) continue;
+		if (custom[resource.envKey] !== void 0) continue;
+		const bucket = byId.get(resource.of);
+		if (!bucket) continue;
+		let host;
+		if (local) host = hostFor(resource, workspace.name);
+		else {
+			if (!domain) throw new NoDomainForStage(stage);
+			host = `${resource.subdomain ?? appKey(resource.id)}.${domain}`;
 		}
-		if (resource.kind === "external-api") owners.set(provideKey(resource.id, "credentials"), resource);
+		fileServers.set(resource.id, {
+			url: `https://${host}${local && https !== 443 ? `:${https}` : ""}`,
+			site: {
+				host,
+				upstream: "minio:9000",
+				rewrite: `/${bucket.name}{uri}`
+			}
+		});
 	}
 	const surfaceUrls = new Map(plan.resources.filter((r) => r.kind === "rest-api" || r.kind === "site").map((r) => [r.envKey, r.id]));
 	const appById = new Map(apps.map((app) => [app.id, app]));
@@ -477,12 +524,12 @@ function composeStack(input) {
 	* they can hold it, and the derivations otherwise.
 	*/
 	const valueFor = (app, key, owner) => {
-		if (owner && EXTERNAL_KINDS[owner.kind] && key === owner.envKey) {
-			const value = custom[key];
-			if (value === void 0) throw new BucketNotConfigured(app.name, owner.id, key, stage);
-			return value;
+		if (owner && SERVICE_KINDS[owner.kind]) {
+			if (custom[key] !== void 0) return custom[key];
+			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
+			return outside[key];
 		}
-		if (owner && suppliedBy(owner, key, local)) {
+		if (owner && suppliedOnly(owner.kind, owner.id, key, local)) {
 			const value = custom[key];
 			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
 			return value;
@@ -510,7 +557,8 @@ function composeStack(input) {
 			const owner = owners.get(key) ?? storageOwner(key, plan);
 			if (!local && owner?.kind === "email" && key.endsWith("_INBOX_URL")) continue;
 			if (STORAGE_KEYS.includes(key)) {
-				if (custom[key] !== void 0) values[key] = custom[key];
+				const value = custom[key] ?? storageValue(key, storage);
+				if (value !== void 0) values[key] = value;
 				continue;
 			}
 			const value = valueFor(app, key, owner);
@@ -537,16 +585,17 @@ function composeStack(input) {
 		infra,
 		apps,
 		master: credential.master,
+		...storage ? { storage } : {},
 		https,
 		http,
 		composeDir: join(workspace.root, stackDir(stage)),
 		buildRoot: layout.buildRoot,
 		workspaceRoot: workspace.root
 	});
-	const caddyfile = edgeCaddyfile(apps.map((app) => ({
+	const caddyfile = edgeCaddyfile([...apps.map((app) => ({
 		host: app.host,
 		upstream: `${app.name}:${app.port}`
-	})), { local });
+	})), ...[...fileServers.values()].map(({ site }) => site)], { local });
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
@@ -566,16 +615,49 @@ function composeStack(input) {
 		caddyfile,
 		dockerfiles,
 		plan,
-		credential
+		credential,
+		...storage ? { storage } : {},
+		devServices: local ? [] : devServicesUsed(services)
+	};
+}
+/**
+* The mail and storage constructs a deployed stage's apps read, with who
+* reads each — and every file server's bucket, which serves it whether or
+* not an app reads it directly.
+*/
+function serviceDeclarations(plan, reads, owners) {
+	const byId = new Map(plan.resources.map((r) => [r.id, r]));
+	const readers = /* @__PURE__ */ new Map();
+	const add = (id, app) => {
+		const set = readers.get(id) ?? /* @__PURE__ */ new Set();
+		if (app) set.add(app);
+		readers.set(id, set);
 	};
-	/** Whether only the stage's secrets can supply `key` to `owner`. */
-	function suppliedBy(owner, key, isLocal) {
-		if (owner.kind === "credential") return true;
-		if (owner.kind === "external-api") return key === provideKey(owner.id, "credentials");
-		if (isLocal) return false;
-		if (owner.kind === "secret" || owner.kind === "encryption") return true;
-		return owner.kind === "email" && !key.endsWith("_INBOX_URL");
+	for (const [app, keys] of reads) for (const key of keys) {
+		const owner = owners.get(key);
+		if (!owner || !SERVICE_KINDS[owner.kind]) continue;
+		if (owner.kind === "email" && key.endsWith("_INBOX_URL")) continue;
+		add(owner.id, app);
+		if (owner.kind === "file-server" && owner.of) add(owner.of);
 	}
+	return [...readers].flatMap(([id, apps]) => {
+		const resource = byId.get(id);
+		const kind = resource && SERVICE_KINDS[resource.kind];
+		if (!resource || !kind) return [];
+		return [{
+			id,
+			kind,
+			...resource.of ? { of: resource.of } : {},
+			apps: [...apps].sort()
+		}];
+	});
+}
+/** The stack's MinIO's value for one of the S3 client's keys. */
+function storageValue(key, storage) {
+	if (!storage) return void 0;
+	if (key === "AWS_ACCESS_KEY_ID") return storage.user;
+	if (key === "AWS_SECRET_ACCESS_KEY") return storage.password;
+	if (key === "AWS_REGION") return MINIO_REGION;
 }
 /** Which bucket an S3 credential key belongs to — the first one declared. */
 function storageOwner(key, plan) {
@@ -651,6 +733,15 @@ function stackFile(options) {
 		};
 		postgres.ports = ["127.0.0.1::5432"];
 	}
+	const minio = services.minio;
+	if (minio && options.storage) {
+		minio.environment = {
+			...minio.environment,
+			MINIO_ROOT_USER: options.storage.user,
+			MINIO_ROOT_PASSWORD: options.storage.password
+		};
+		minio.ports = ["127.0.0.1::9000"];
+	}
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
@@ -925,6 +1016,7 @@ const defaultDeps = {
 	docker: dockerCompose,
 	revision: gitRevision,
 	sql: pgClient,
+	buckets: bucketClient,
 	migrate: migrateDatabases,
 	probe: httpsProbe,
 	healthAttempts: 90,
@@ -947,6 +1039,13 @@ async function validateCompose(ctx, deps, forced) {
 		runnables
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
+	await assertStageCredentials({
+		root,
+		patterns: constructGlobs(workspace),
+		manifest,
+		stage,
+		supplied: secrets?.custom ?? {}
+	});
 	const masterKeys = {};
 	const layout = mode === "build" ? imageLayout(workspace) : void 0;
 	const composed = composeStack({
@@ -961,9 +1060,11 @@ async function validateCompose(ctx, deps, forced) {
 			...workspace.deploy?.registry ? { registry: workspace.deploy.registry } : {}
 		},
 		secrets,
+		allowDevServices: ctx.allowDevServices,
 		ports: edgePorts(deps.env),
 		...layout ? { layout } : {}
 	});
+	reportDevServices(ctx, composed.devServices);
 	const credentials = {};
 	if (mode === "build") for (const app of composed.apps) {
 		if (app.kind !== "rest-api" || !app.env || !app.build) continue;
@@ -1097,6 +1198,20 @@ async function provisionCompose(ctx, run, deps) {
 		});
 	}
 	if (stack.infra.includes("postgres")) await prepareDatabases(ctx, run, deps);
+	if (stack.storage && stack.infra.includes("minio")) await prepareBuckets(ctx, run, deps);
+}
+/**
+* Create each bucket the stack's MinIO serves, and the open paths of each
+* one a file server fronts — from this machine, on MinIO's loopback port,
+* the way `gkm dev` creates them.
+*/
+async function prepareBuckets(ctx, run, deps) {
+	const storage = run.stack.storage;
+	if (storage.buckets.length === 0) return;
+	const port = await deps.docker.port(run.ref, "minio", 9e3);
+	const client = deps.buckets(port, storage);
+	const created = [...await applyBuckets(client, storage.buckets), ...await applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
+	ctx.logger.info(`🪣  Buckets: ${storage.buckets.join(", ")}${created ? ` (${created} change(s))` : ""}`);
 }
 /** Create what the plan names in the stack's Postgres, then migrate it. */
 async function prepareDatabases(ctx, run, deps) {
@@ -1341,7 +1456,7 @@ async function writeStack(root, dir, stack, credentials = {}) {
 	return files;
 }
 function composeYaml(stack) {
-	const stage = stack.local ? "" : ` --stage ${stack.stage}`;
+	const stage = ` --stage ${stack.stage}`;
 	return `# Generated by gkm compose from the construct manifest — do not edit.
 # The ${stack.stage} stage's APIs and sites behind one Caddy. Each backend
 # reads exactly the keys in its own env file beside this one.
@@ -1420,4 +1535,4 @@ function composeTarget(options = {}) {
 //#endregion
 export { dockerCompose as a, stackDir as i, compose_exports as n, composeProject as r, composeTarget as t };
 
-//# sourceMappingURL=compose-BjToENzG.mjs.map
+//# sourceMappingURL=compose-CZtinmtw.mjs.map