@geekmidas/cli 10.0.0-alpha.68 → 10.0.0-alpha.69

package/dist/{state-CHZqCDRC.cjs → state-8RgXeX5Y.cjs}

@@ -1,10 +1,10 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
-const require_discover = require("./discover-OEfZ9OkA.cjs");
+const require_discover = require("./discover-B4VjaFJk.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-ON-bqiJz.cjs");
+const require_workspace = require("./workspace-8NuAjaXJ.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-BymzGtuT.cjs");
+const require_resolve = require("./resolve-BDsMffvz.cjs");
 const require_fakes = require("./fakes-zW-jNAbQ.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -4650,7 +4650,7 @@ var ExternalServicesNotConfigured = class extends Error {
 			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
 			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "");
 		});
-		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.`);
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.\n\nOr run: gkm secrets:add --stage ${stage}`);
 		this.stage = stage;
 		this.missing = missing;
 		this.name = "ExternalServicesNotConfigured";
@@ -4692,85 +4692,127 @@ function manifestServiceDeclarations(manifest) {
 	});
 }
 /**
-* Where a deployed stage's mail and storage come from, and what it lacks.
+* Every key a stage must be given rather than derive — the one list both a
+* deploy's checks and `gkm secrets:add` read, so what a deploy refuses and
+* what the builder offers cannot drift.
 *
-* - Mail is external once its URL is set, and then needs its sending
-*   address too. Unset, it is Mailpit where allowed — the address derived
-*   unless set — and missing otherwise.
-* - A bucket is external once its URL is set; its credentials, in the URL or
-*   the shared pair, are optional. Unset, it is MinIO where allowed, and
-*   missing otherwise.
-* - A file server's URL is derived where its bucket is MinIO, unless set;
-*   over an external bucket the stage must set it.
+* - Deployed, mail is its URL and its sending address, a bucket its URL, and
+*   a file server its public URL. Locally all of it is Mailpit and MinIO.
+* - On every stage, a third party's credentials: nobody but the third party
+*   can issue them.
+*
+* Never a derived value: a database URL, a generated secret, the seed.
 */
-function externalServices(input) {
-	const { supplied, allow } = input;
-	const has = (key) => supplied[key] !== void 0;
+function requiredStageKeys(input) {
 	const domain = input.domain ?? "example.com";
-	const missing = [];
-	const minio = [];
-	const mailpit = [];
+	const keys = [];
 	const add = (entry) => {
-		if (!missing.some((m) => m.key === entry.key)) missing.push(entry);
+		if (!keys.some((k) => k.key === entry.key)) keys.push(entry);
 	};
-	const declarations = [...input.declarations].sort((a, b) => a.id.localeCompare(b.id));
+	const byId = (list) => [...list ?? []].sort((a, b) => a.id.localeCompare(b.id));
 	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
-	for (const d of declarations.filter((d) => d.kind === "email")) {
-		const url = (0, _geekmidas_manifest.provideKey)(d.id, "url");
-		const from = (0, _geekmidas_manifest.provideKey)(d.id, "from");
-		if (!has(url) && allow.includes("mailpit")) {
-			mailpit.push(d.id);
-			continue;
-		}
-		if (!has(url)) add({
-			key: url,
-			id: d.id,
-			what: `where '${d.id}' sends mail — any SMTP server`,
-			example: `smtp://user:password@smtp.${domain}:587`,
-			service: "mailpit",
-			...apps(d)
-		});
-		if (!has(from)) add({
-			key: from,
-			id: d.id,
-			what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
-			example: `noreply@${domain}`,
-			service: "mailpit",
-			...apps(d)
-		});
-	}
-	for (const d of declarations.filter((d) => d.kind === "objects")) {
-		const url = (0, _geekmidas_manifest.provideKey)(d.id, "url");
-		if (has(url)) continue;
-		if (allow.includes("minio")) {
-			minio.push(d.id);
-			continue;
+	if (!input.local) {
+		const services = byId(input.services);
+		for (const d of services.filter((d) => d.kind === "email")) {
+			add({
+				key: (0, _geekmidas_manifest.provideKey)(d.id, "url"),
+				id: d.id,
+				kind: "email",
+				what: `where '${d.id}' sends mail — any SMTP server`,
+				example: `smtp://user:password@smtp.${domain}:587`,
+				service: "mailpit",
+				...apps(d)
+			});
+			add({
+				key: (0, _geekmidas_manifest.provideKey)(d.id, "from"),
+				id: d.id,
+				kind: "email",
+				what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+				example: `noreply@${domain}`,
+				service: "mailpit",
+				...apps(d)
+			});
 		}
-		add({
-			key: url,
+		for (const d of services.filter((d) => d.kind === "objects")) add({
+			key: (0, _geekmidas_manifest.provideKey)(d.id, "url"),
 			id: d.id,
+			kind: "bucket",
 			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
 			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${require_derive.appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
 			example: `s3://${require_derive.appKey(d.id)}?region=eu-west-1`,
 			service: "minio",
 			...apps(d)
 		});
-	}
-	for (const d of declarations.filter((d) => d.kind === "file-server")) {
-		const url = (0, _geekmidas_manifest.provideKey)(d.id, "url");
-		if (has(url)) continue;
-		if (d.of && minio.includes(d.of)) continue;
-		add({
-			key: url,
+		for (const d of services.filter((d) => d.kind === "file-server")) add({
+			key: (0, _geekmidas_manifest.provideKey)(d.id, "url"),
 			id: d.id,
+			kind: "file-server",
 			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
 			example: `https://${require_derive.appKey(d.id)}.${domain}`,
 			service: "minio",
+			...d.of ? { of: d.of } : {},
 			...apps(d)
 		});
 	}
+	for (const d of byId(input.credentials)) add({
+		key: (0, _geekmidas_manifest.provideKey)(d.id, "credentials"),
+		id: d.id,
+		kind: d.kind,
+		what: d.kind === "external-api" ? `the credentials '${d.id}' was issued for this stage, as its schema describes them` : `the credential '${d.id}', as its schema describes it`,
+		example: "{\"apiKey\":\"…\"}",
+		...apps(d)
+	});
+	return keys;
+}
+/**
+* Whether only the stage's secrets can supply `key` to a construct of `kind`
+* — what nothing on the stage derives.
+*
+* A third party's credentials, always. Deployed, also each generated secret
+* and keyring: the stage generated each one once, and every run reads the
+* same value back.
+*/
+function suppliedOnly(kind, id, key, local) {
+	if (kind === "credential") return true;
+	if (kind === "external-api") return key === (0, _geekmidas_manifest.provideKey)(id, "credentials");
+	if (local) return false;
+	return kind === "secret" || kind === "encryption";
+}
+/**
+* Where a deployed stage's mail and storage come from, and what it lacks.
+*
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
+*
+* The keys themselves are {@link requiredStageKeys}'s.
+*/
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const required = requiredStageKeys({
+		local: false,
+		services: input.declarations,
+		...input.domain ? { domain: input.domain } : {}
+	});
+	const mailpit = required.filter((k) => k.kind === "email" && k.key === (0, _geekmidas_manifest.provideKey)(k.id, "url")).filter((k) => !has(k.key) && allow.includes("mailpit")).map((k) => k.id);
+	const minio = required.filter((k) => k.kind === "bucket").filter((k) => !has(k.key) && allow.includes("minio")).map((k) => k.id);
+	const covered = (k) => k.kind === "email" && mailpit.includes(k.id) || k.kind === "bucket" && minio.includes(k.id) || k.kind === "file-server" && k.of !== void 0 && minio.includes(k.of);
 	return {
-		missing,
+		missing: required.filter((k) => !has(k.key) && !covered(k)).map(({ key, id, what, note, example, service, apps }) => ({
+			key,
+			id,
+			what,
+			...note ? { note } : {},
+			example,
+			service,
+			...apps ? { apps } : {}
+		})),
 		minio,
 		mailpit
 	};
@@ -6164,6 +6206,12 @@ Object.defineProperty(exports, "reportDevServices", {
 		return reportDevServices;
 	}
 });
+Object.defineProperty(exports, "requiredStageKeys", {
+	enumerable: true,
+	get: function() {
+		return requiredStageKeys;
+	}
+});
 Object.defineProperty(exports, "resolveHost", {
 	enumerable: true,
 	get: function() {
@@ -6236,6 +6284,12 @@ Object.defineProperty(exports, "store_exports", {
 		return store_exports;
 	}
 });
+Object.defineProperty(exports, "suppliedOnly", {
+	enumerable: true,
+	get: function() {
+		return suppliedOnly;
+	}
+});
 Object.defineProperty(exports, "toEmbeddableSecrets", {
 	enumerable: true,
 	get: function() {
@@ -6267,4 +6321,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-CHZqCDRC.cjs.map
+//# sourceMappingURL=state-8RgXeX5Y.cjs.map