@geekmidas/cli 10.0.0-alpha.68 → 10.0.0-alpha.69

package/dist/index.mjs

@@ -2,20 +2,21 @@
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { r as DEFAULT_TIMEOUT_MS, t as CommandFailed } from "./run-BJLIerMM.mjs";
 import { c as getDokployCredentials, f as removeDokployCredentials, i as LocalSandbox, l as getDokployRegistryId, m as storeHostingerToken, p as storeDokployCredentials, s as getCredentialsPath, u as getDokployToken } from "./credentials-pAtB70k3.mjs";
-import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-BFoJWKGD.mjs";
+import { l as withOwningTsconfigJsx, r as discover, u as ConstructGenerator } from "./discover-Buwf1z4P.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-Be6uBhlF.mjs";
+import { A as deployedProblems, D as InvalidStages, O as TEST_STAGE, c as getAppGkmConfig, j as stageProblems, n as allConstructGlobs, s as getAppBuildOrder } from "./workspace-B2UK_rVP.mjs";
 import { ConfigNotFound, NotABackendApp, NotInAnApp, loadAppConfig, loadConfig, loadWorkspaceConfig, loadWorkspaceSettings, parseModuleConfig } from "./config.mjs";
-import { $ as quoteIdentifier, At as prepareEntryCredentials, B as backendsOf$1, Bt as deployIdentity, Ct as primaryPortKey, Dt as isPortAvailable, Et as findAvailablePort, Ft as getKeyPath, G as LOCAL_CA_PATH, H as derivedContainers, Jt as maskPassword, K as forgetState, Lt as projectKey, Mt as secretsStoreFor, Ot as loadEnvFiles, P as parseDevServices, Pt as FileSecretsStore, R as keyFingerprint, Tt as createEntryWrapper, U as reconcileWorkspace, V as constructGlobs, Xt as toEmbeddableSecrets, Z as postgresDatabaseNames, Zt as withCustomSecret, _t as providerOf, bt as describeServices, ht as cacheBackendFor, kt as loadSecretsForApp, nt as pgClient, wt as createCredentialsPreload, xt as fakeKey, y as dockerCommand, z as FAKE_ENV } from "./state-Bn5JDMFT.mjs";
-import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-BmUAcR7d.mjs";
-import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-BdFeLSmA.mjs";
+import { $ as postgresDatabaseNames, $t as withCustomSecret, At as loadEnvFiles, B as keyFingerprint, Ct as fakeKey, Dt as createEntryWrapper, Et as createCredentialsPreload, G as reconcileWorkspace, H as backendsOf$1, Ht as deployIdentity, It as FileSecretsStore, J as forgetState, Lt as getKeyPath, Mt as prepareEntryCredentials, Ot as findAvailablePort, P as parseDevServices, Pt as secretsStoreFor, Qt as toEmbeddableSecrets, St as describeServices, Tt as primaryPortKey, U as constructGlobs, V as FAKE_ENV, W as derivedContainers, Xt as maskPassword, _t as cacheBackendFor, it as pgClient, jt as loadSecretsForApp, kt as isPortAvailable, q as LOCAL_CA_PATH, tt as quoteIdentifier, y as dockerCommand, yt as providerOf, zt as projectKey } from "./state-DClnPZt5.mjs";
+import { i as telemetryFor, n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-CSaXs-dB.mjs";
+import { g as createStateStore, n as sniffAppEnvironment, o as DokployApi } from "./sniffer-DMqi2b1q.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as describeHolder, i as assignAppPorts, o as holderOf, r as appTag, s as withAppPorts, t as APP_TAG_ENV } from "./appPorts-C9z9Pzn9.mjs";
-import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-2s3-CndS.mjs";
+import { a as writeTestHarness, c as driversFor, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as SubscriberGenerator, s as cacheBackendsIn, t as TEST_READY_ENV } from "./ready-DeYaSoNN.mjs";
 import { n as withCompute, r as withRoutes, t as manifestModule } from "./emit-C1e8qD08.mjs";
-import { t as deploy$1 } from "./deploy-D-EVOWvu.mjs";
-import { a as dockerCompose, i as stackDir, r as composeProject, t as composeTarget } from "./compose-DFxuYhn6.mjs";
-import { t as LocalStateStore } from "./LocalStateStore-Dk3Wbvzk.mjs";
+import { t as deploy$1 } from "./deploy-BzqbkJ3o.mjs";
+import { a as dockerCompose, i as stackDir, r as composeProject, t as composeTarget } from "./compose-CZtinmtw.mjs";
+import { o as loadCredentialSchemas, t as CredentialsInvalid } from "./credentialSchemas-BmYxnEz_.mjs";
+import { t as LocalStateStore } from "./LocalStateStore-DAnFc708.mjs";
 import { a as getExecCommand, c as validateProjectName, i as findWorkspaceRoot, n as detectPackageManager$1, o as getInstallCommand, r as findWorkspacePackages, s as getRunCommand, t as checkDirectoryExists } from "./utils-D_fxUqvU.mjs";
 import { createRequire } from "node:module";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -46,7 +47,7 @@ import { Function } from "@geekmidas/constructs/functions";
 import { Queue } from "@geekmidas/constructs/queue";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.68";
+var version = "10.0.0-alpha.69";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -129,7 +130,7 @@ const logger$8 = console;
 * Validate Dokploy token by making a test API call
 */
 async function validateDokployToken(endpoint, token) {
-	const { DokployApi } = await import("./sniffer-BdFeLSmA.mjs").then((n) => n.c);
+	const { DokployApi } = await import("./sniffer-DMqi2b1q.mjs").then((n) => n.c);
 	return new DokployApi({
 		baseUrl: endpoint,
 		token
@@ -2035,9 +2036,9 @@ async function workspaceDevCommand(configured, options) {
 	for (const { id, port } of fakes) logger$5.log(`🎭 ${id} fake: http://localhost:${port}`);
 	logger$5.log(options.migrate || options.seed ? "🗄️  Migrating the databases" : "🗄️  Checking for pending migrations");
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-BWPuwiXk.mjs");
+		const { prepareDevDatabases } = await import("./migrate-CEzq6DjL.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-BWPuwiXk.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-CEzq6DjL.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$5.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -3417,7 +3418,7 @@ async function buildApp(input) {
 		if (production?.bundle && !input.skipBundle) {
 			const outputDir = join(appRoot, ".gkm", "server");
 			const entryPoint = await writeSurfaceServer(outputDir, production);
-			const { bundleServer } = await import("./bundler-C-w7aGoZ.mjs");
+			const { bundleServer } = await import("./bundler-Cn0JF5G0.mjs");
 			await bundleServer({
 				entryPoint,
 				outputDir: join(outputDir, "dist"),
@@ -3555,7 +3556,7 @@ async function buildForTarget(target, context, appRoot, workspaceRoot, endpointG
 		let masterKey;
 		if (context.production?.bundle && !skipBundle) {
 			logger$4.log(`\n📦 Bundling production server...`);
-			const { bundleServer } = await import("./bundler-C-w7aGoZ.mjs");
+			const { bundleServer } = await import("./bundler-Cn0JF5G0.mjs");
 			const allConstructs = [
 				...endpoints.map((e) => e.construct),
 				...functions.map((f) => f.construct),
@@ -5252,25 +5253,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.68",
-	"@geekmidas/auth": "~10.0.0-alpha.68",
-	"@geekmidas/cache": "~10.0.0-alpha.68",
-	"@geekmidas/client": "~10.0.0-alpha.68",
-	"@geekmidas/cloud": "~10.0.0-alpha.68",
-	"@geekmidas/constructs": "~10.0.0-alpha.68",
-	"@geekmidas/db": "~10.0.0-alpha.68",
-	"@geekmidas/emailkit": "~10.0.0-alpha.68",
-	"@geekmidas/envkit": "~10.0.0-alpha.68",
-	"@geekmidas/errors": "~10.0.0-alpha.68",
-	"@geekmidas/events": "~10.0.0-alpha.68",
-	"@geekmidas/logger": "~10.0.0-alpha.68",
-	"@geekmidas/manifest": "~10.0.0-alpha.68",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.68",
-	"@geekmidas/schema": "~10.0.0-alpha.68",
-	"@geekmidas/services": "~10.0.0-alpha.68",
-	"@geekmidas/storage": "~10.0.0-alpha.68",
-	"@geekmidas/telescope": "~10.0.0-alpha.68",
-	"@geekmidas/testkit": "~10.0.0-alpha.68",
+	"@geekmidas/audit": "~10.0.0-alpha.69",
+	"@geekmidas/auth": "~10.0.0-alpha.69",
+	"@geekmidas/cache": "~10.0.0-alpha.69",
+	"@geekmidas/client": "~10.0.0-alpha.69",
+	"@geekmidas/cloud": "~10.0.0-alpha.69",
+	"@geekmidas/constructs": "~10.0.0-alpha.69",
+	"@geekmidas/db": "~10.0.0-alpha.69",
+	"@geekmidas/emailkit": "~10.0.0-alpha.69",
+	"@geekmidas/envkit": "~10.0.0-alpha.69",
+	"@geekmidas/errors": "~10.0.0-alpha.69",
+	"@geekmidas/events": "~10.0.0-alpha.69",
+	"@geekmidas/logger": "~10.0.0-alpha.69",
+	"@geekmidas/manifest": "~10.0.0-alpha.69",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.69",
+	"@geekmidas/schema": "~10.0.0-alpha.69",
+	"@geekmidas/services": "~10.0.0-alpha.69",
+	"@geekmidas/storage": "~10.0.0-alpha.69",
+	"@geekmidas/telescope": "~10.0.0-alpha.69",
+	"@geekmidas/testkit": "~10.0.0-alpha.69",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10501,10 +10502,37 @@ async function secretsSetCommand(key, value, options) {
 		logger$2.error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 		process.exit(1);
 	}
+	await assertCredentialValue(key, secretValue, stage);
 	await store.write(stage, withCustomSecret(secrets, key, secretValue));
 	logger$2.log(`\n✓ Secret "${key}" set for stage "${stage}" (${store.name})`);
 }
 /**
+* A third party's credentials, checked against the schema of the construct
+* that reads them before they are stored — what the app would otherwise
+* refuse as it starts. Only a `<ID>_CREDENTIALS` key in a workspace is
+* looked at, so setting anything else loads no construct.
+*
+* @throws {CredentialsInvalid} listing each issue; nothing is saved
+*/
+async function assertCredentialValue(key, value, stage) {
+	if (!key.endsWith("_CREDENTIALS")) return;
+	let workspace;
+	try {
+		workspace = await loadWorkspaceSettings();
+	} catch (error) {
+		if (error instanceof ConfigNotFound) return;
+		throw error;
+	}
+	const check = await (await loadCredentialSchemas({
+		root: workspace.root,
+		patterns: constructGlobs(workspace)
+	})).check(key, value);
+	if (!check.ok) throw new CredentialsInvalid(stage, [{
+		key,
+		issues: check.issues
+	}], "set");
+}
+/**
 * Show secrets for a stage.
 */
 async function secretsShowCommand(options) {
@@ -11033,8 +11061,8 @@ function testDatabases(reconciled) {
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-BWPuwiXk.mjs");
-	const { discover } = await import("./discover-BFoJWKGD.mjs").then((n) => n.i);
+	const { migrateAndSeed } = await import("./migrate-CEzq6DjL.mjs");
+	const { discover } = await import("./discover-Buwf1z4P.mjs").then((n) => n.i);
 	const sources = {};
 	const manifest = await discover({
 		patterns: constructGlobs(workspace),
@@ -11464,7 +11492,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-BWPuwiXk.mjs");
+		const { migrateCommand } = await import("./migrate-CEzq6DjL.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11478,7 +11506,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-BWPuwiXk.mjs");
+		const { seedCommand } = await import("./migrate-CEzq6DjL.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -11492,7 +11520,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-BWPuwiXk.mjs");
+		const { migrationCommand } = await import("./migrate-CEzq6DjL.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -11582,11 +11610,22 @@ program.command("secrets:set").description("Set a custom secret for a stage").ar
 		process.exit(1);
 	}
 });
+program.command("secrets:add").description("Build the keys a stage must be given — buckets, mail, file servers, third parties' credentials — across every app").requiredOption("--stage <stage>", "Stage name").option("--missing", "Only the keys the stage has not set").option("--json", "Print the keys as JSON and ask nothing").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { secretsAddCommand } = await import("./add-Dzk23476.mjs");
+		await secretsAddCommand(options);
+	} catch (error) {
+		console.error(formatError(error));
+		process.exit(1);
+	}
+});
 program.command("encryption:rotate").description("Add a new current key to an Encryption construct's keyring on a server stage").argument("<construct>", "The Encryption construct (e.g. Pii)").requiredOption("--stage <stage>", "A deployed stage").action(async (construct, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRotateCommand } = await import("./encryption-DSiLau1-.mjs");
+		const { encryptionRotateCommand } = await import("./encryption-7m1mKcRy.mjs");
 		await encryptionRotateCommand(construct, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11597,7 +11636,7 @@ program.command("encryption:retire").description("Remove an old key from an Encr
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { encryptionRetireCommand } = await import("./encryption-DSiLau1-.mjs");
+		const { encryptionRetireCommand } = await import("./encryption-7m1mKcRy.mjs");
 		await encryptionRetireCommand(construct, key, options);
 	} catch (error) {
 		console.error(formatError(error));
@@ -11640,7 +11679,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
 		const { reconcileMissingSecrets } = await import("./reconcile--I7V4Klj.mjs");
-		const { secretsStoreFor } = await import("./state-Bn5JDMFT.mjs").then((n) => n.Nt);
+		const { secretsStoreFor } = await import("./state-DClnPZt5.mjs").then((n) => n.Ft);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
 		const store = await secretsStoreFor(workspace, stage);
@@ -11649,7 +11688,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./state-Bn5JDMFT.mjs").then((n) => n.W);
+		const { derivedContainers } = await import("./state-DClnPZt5.mjs").then((n) => n.K);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -11664,7 +11703,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 	}
 });
 program.command("deploy").description("Deploy a stage through its target").option("--target <name>", "Deploy target: dokploy, compose, sst, or one named in deploy.targets (default: deploy.default)").option("--provider <provider>", "[DEPRECATED] Use --target instead").requiredOption("--stage <stage>", "Deployment stage (e.g., production, staging)").option("--tag <tag>", "Image tag (default: stage-timestamp; compose: the commit). Compose pulls a given tag").option("--skip-push", "Skip pushing image to registry").option("--skip-build", "Skip build step (use existing build)").option("--json", "Write events as JSON lines instead of progress; never prompts").option("--dry-run", "Show what would be created or reused; change, build and push nothing").option("--atomic", "If the release fails, roll back every app it released, not only the failed ones").option("--allow-dev-services <list>", "Server targets: run MinIO and/or Mailpit (minio,mailpit) for mail and buckets the stage's secrets don't configure. Not production-grade").action(async (options) => {
-	const { deployCli } = await import("./cli-Ce4pLL5O.mjs");
+	const { deployCli } = await import("./cli-ij8Lwlww.mjs");
 	const globalOptions = program.opts();
 	const code = await deployCli({
 		cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11681,8 +11720,8 @@ program.command("deploy").description("Deploy a stage through its target").optio
 });
 program.command("deploy:rollback").description("Put a stage's app back on its previous release (Dokploy): one app with --app, every app with --atomic").requiredOption("--stage <stage>", "A deployed stage").option("--app <app>", "The app to roll back").option("--atomic", "Roll back every app that has an earlier release").action(async (options) => {
 	try {
-		const { rollbackStage } = await import("./rollback-ZlsbQOvj.mjs").then((n) => n.a);
-		const { terminalCredentials } = await import("./terminal-C3cv-OQu.mjs");
+		const { rollbackStage } = await import("./rollback-DDfaqv7P.mjs").then((n) => n.a);
+		const { terminalCredentials } = await import("./terminal-C6TBo_SA.mjs");
 		const globalOptions = program.opts();
 		await rollbackStage({
 			cwd: resolve(globalOptions.cwd ?? process.cwd()),
@@ -11717,7 +11756,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-yy6WpHIl.mjs");
+		const { deployGithubCommand } = await import("./github-DtymyOcH.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));