@geekmidas/cli 10.0.0-alpha.68 → 10.0.0-alpha.69

package/dist/{state-Bn5JDMFT.mjs → state-DClnPZt5.mjs}

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { a as runOutput, i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
-import { d as output, r as discover } from "./discover-BFoJWKGD.mjs";
+import { d as output, r as discover } from "./discover-Buwf1z4P.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-Be6uBhlF.mjs";
+import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-B2UK_rVP.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
-import { c as runtimeOf } from "./resolve-pIvXlZ1h.mjs";
+import { c as runtimeOf } from "./resolve-Dn5wGf1r.mjs";
 import { i as DEFAULT_STORAGE, n as DEFAULT_CACHE, r as DEFAULT_EVENTS$1, t as readFakes } from "./fakes-C9RiT6XG.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
@@ -4648,7 +4648,7 @@ var ExternalServicesNotConfigured = class extends Error {
 			const by = m.apps?.length ? `, read by ${m.apps.join(", ")}` : "";
 			return `  gkm secrets:set ${m.key} '${m.example}' --stage ${stage}\n      ${m.what}${by}` + (m.note ? `\n      ${m.note}` : "");
 		});
-		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.`);
+		super(`The stage '${stage}' is deployed, and a deployed stage's mail and object storage are real services: gkm runs no Mailpit or MinIO for it. Set ${missing.length === 1 ? "this key" : `these ${missing.length} keys`} in the stage's secrets:\n\n${lines.join("\n")}\n\nFor a stage that is not production — a preview, a demo — the dev services can run instead, with --allow-dev-services ${services.join(",")}. Mailpit delivers no mail, and MinIO keeps every object on one container's disk.\n\nOr run: gkm secrets:add --stage ${stage}`);
 		this.stage = stage;
 		this.missing = missing;
 		this.name = "ExternalServicesNotConfigured";
@@ -4690,85 +4690,127 @@ function manifestServiceDeclarations(manifest) {
 	});
 }
 /**
-* Where a deployed stage's mail and storage come from, and what it lacks.
+* Every key a stage must be given rather than derive — the one list both a
+* deploy's checks and `gkm secrets:add` read, so what a deploy refuses and
+* what the builder offers cannot drift.
 *
-* - Mail is external once its URL is set, and then needs its sending
-*   address too. Unset, it is Mailpit where allowed — the address derived
-*   unless set — and missing otherwise.
-* - A bucket is external once its URL is set; its credentials, in the URL or
-*   the shared pair, are optional. Unset, it is MinIO where allowed, and
-*   missing otherwise.
-* - A file server's URL is derived where its bucket is MinIO, unless set;
-*   over an external bucket the stage must set it.
+* - Deployed, mail is its URL and its sending address, a bucket its URL, and
+*   a file server its public URL. Locally all of it is Mailpit and MinIO.
+* - On every stage, a third party's credentials: nobody but the third party
+*   can issue them.
+*
+* Never a derived value: a database URL, a generated secret, the seed.
 */
-function externalServices(input) {
-	const { supplied, allow } = input;
-	const has = (key) => supplied[key] !== void 0;
+function requiredStageKeys(input) {
 	const domain = input.domain ?? "example.com";
-	const missing = [];
-	const minio = [];
-	const mailpit = [];
+	const keys = [];
 	const add = (entry) => {
-		if (!missing.some((m) => m.key === entry.key)) missing.push(entry);
+		if (!keys.some((k) => k.key === entry.key)) keys.push(entry);
 	};
-	const declarations = [...input.declarations].sort((a, b) => a.id.localeCompare(b.id));
+	const byId = (list) => [...list ?? []].sort((a, b) => a.id.localeCompare(b.id));
 	const apps = (d) => d.apps?.length ? { apps: [...d.apps].sort() } : {};
-	for (const d of declarations.filter((d) => d.kind === "email")) {
-		const url = provideKey(d.id, "url");
-		const from = provideKey(d.id, "from");
-		if (!has(url) && allow.includes("mailpit")) {
-			mailpit.push(d.id);
-			continue;
-		}
-		if (!has(url)) add({
-			key: url,
-			id: d.id,
-			what: `where '${d.id}' sends mail — any SMTP server`,
-			example: `smtp://user:password@smtp.${domain}:587`,
-			service: "mailpit",
-			...apps(d)
-		});
-		if (!has(from)) add({
-			key: from,
-			id: d.id,
-			what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
-			example: `noreply@${domain}`,
-			service: "mailpit",
-			...apps(d)
-		});
-	}
-	for (const d of declarations.filter((d) => d.kind === "objects")) {
-		const url = provideKey(d.id, "url");
-		if (has(url)) continue;
-		if (allow.includes("minio")) {
-			minio.push(d.id);
-			continue;
+	if (!input.local) {
+		const services = byId(input.services);
+		for (const d of services.filter((d) => d.kind === "email")) {
+			add({
+				key: provideKey(d.id, "url"),
+				id: d.id,
+				kind: "email",
+				what: `where '${d.id}' sends mail — any SMTP server`,
+				example: `smtp://user:password@smtp.${domain}:587`,
+				service: "mailpit",
+				...apps(d)
+			});
+			add({
+				key: provideKey(d.id, "from"),
+				id: d.id,
+				kind: "email",
+				what: `the address '${d.id}' sends from, on a domain the mail server has verified`,
+				example: `noreply@${domain}`,
+				service: "mailpit",
+				...apps(d)
+			});
 		}
-		add({
-			key: url,
+		for (const d of services.filter((d) => d.kind === "objects")) add({
+			key: provideKey(d.id, "url"),
 			id: d.id,
+			kind: "bucket",
 			what: `the bucket '${d.id}' — S3, R2, or any S3-compatible store (add &endpoint=… for one that is not S3)`,
 			note: `credentials are optional: a key for this bucket alone in the URL (s3://KEY:SECRET@${appKey(d.id)}?…) wins; without one, the shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY or a role signs`,
 			example: `s3://${appKey(d.id)}?region=eu-west-1`,
 			service: "minio",
 			...apps(d)
 		});
-	}
-	for (const d of declarations.filter((d) => d.kind === "file-server")) {
-		const url = provideKey(d.id, "url");
-		if (has(url)) continue;
-		if (d.of && minio.includes(d.of)) continue;
-		add({
-			key: url,
+		for (const d of services.filter((d) => d.kind === "file-server")) add({
+			key: provideKey(d.id, "url"),
 			id: d.id,
+			kind: "file-server",
 			what: `the public address '${d.id}' serves its bucket on — a CDN or the bucket's own domain`,
 			example: `https://${appKey(d.id)}.${domain}`,
 			service: "minio",
+			...d.of ? { of: d.of } : {},
 			...apps(d)
 		});
 	}
+	for (const d of byId(input.credentials)) add({
+		key: provideKey(d.id, "credentials"),
+		id: d.id,
+		kind: d.kind,
+		what: d.kind === "external-api" ? `the credentials '${d.id}' was issued for this stage, as its schema describes them` : `the credential '${d.id}', as its schema describes it`,
+		example: "{\"apiKey\":\"…\"}",
+		...apps(d)
+	});
+	return keys;
+}
+/**
+* Whether only the stage's secrets can supply `key` to a construct of `kind`
+* — what nothing on the stage derives.
+*
+* A third party's credentials, always. Deployed, also each generated secret
+* and keyring: the stage generated each one once, and every run reads the
+* same value back.
+*/
+function suppliedOnly(kind, id, key, local) {
+	if (kind === "credential") return true;
+	if (kind === "external-api") return key === provideKey(id, "credentials");
+	if (local) return false;
+	return kind === "secret" || kind === "encryption";
+}
+/**
+* Where a deployed stage's mail and storage come from, and what it lacks.
+*
+* - Mail is external once its URL is set, and then needs its sending
+*   address too. Unset, it is Mailpit where allowed — the address derived
+*   unless set — and missing otherwise.
+* - A bucket is external once its URL is set; its credentials, in the URL or
+*   the shared pair, are optional. Unset, it is MinIO where allowed, and
+*   missing otherwise.
+* - A file server's URL is derived where its bucket is MinIO, unless set;
+*   over an external bucket the stage must set it.
+*
+* The keys themselves are {@link requiredStageKeys}'s.
+*/
+function externalServices(input) {
+	const { supplied, allow } = input;
+	const has = (key) => supplied[key] !== void 0;
+	const required = requiredStageKeys({
+		local: false,
+		services: input.declarations,
+		...input.domain ? { domain: input.domain } : {}
+	});
+	const mailpit = required.filter((k) => k.kind === "email" && k.key === provideKey(k.id, "url")).filter((k) => !has(k.key) && allow.includes("mailpit")).map((k) => k.id);
+	const minio = required.filter((k) => k.kind === "bucket").filter((k) => !has(k.key) && allow.includes("minio")).map((k) => k.id);
+	const covered = (k) => k.kind === "email" && mailpit.includes(k.id) || k.kind === "bucket" && minio.includes(k.id) || k.kind === "file-server" && k.of !== void 0 && minio.includes(k.of);
 	return {
-		missing,
+		missing: required.filter((k) => !has(k.key) && !covered(k)).map(({ key, id, what, note, example, service, apps }) => ({
+			key,
+			id,
+			what,
+			...note ? { note } : {},
+			example,
+			service,
+			...apps ? { apps } : {}
+		})),
 		minio,
 		mailpit
 	};
@@ -5628,6 +5670,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { quoteIdentifier as $, assertExternalServices as A, prepareEntryCredentials as At, backendsOf as B, deployIdentity as Bt, isMainFrontendApp as C, primaryPortKey as Ct, ExternalServicesNotConfigured as D, isPortAvailable as Dt, DevServicesNeedServerTarget as E, findAvailablePort as Et, reportDevServices as F, getKeyPath as Ft, LOCAL_CA_PATH as G, ownershipMarker as Gt, derivedContainers as H, imageRef as Ht, encryptSecrets as I, keystoreProject as It, applyPolicies as J, maskPassword as Jt, forgetState as K, projectName as Kt, encryption_exports as L, projectKey as Lt, externalServices as M, secretsStoreFor as Mt, manifestServiceDeclarations as N, store_exports as Nt, STORAGE_KEY_PAIR as O, loadEnvFiles as Ot, parseDevServices as P, FileSecretsStore as Pt, postgresStatements as Q, keyFingerprint as R, readKey as Rt, NoDomainForStage as S, portKeys as St, DEV_SERVICES as T, createEntryWrapper as Tt, reconcileWorkspace as U, isOwnedBy as Ut, constructGlobs as V, imageName as Vt, workspace_exports as W, markerOf as Wt, bucketPolicies as X, toEmbeddableSecrets as Xt, applyPostgres as Y, storage_exports as Yt, postgresDatabaseNames as Z, withCustomSecret as Zt, deployDocker as _, providerOf as _t, recordRelease as a, envFor as at, ensureDockerignore as b, describeServices as bt, setBackupState as c, resourceName as ct, setGeneratedSecret as d, imageLayout as dt, composeFor as et, setPostgresBackupId as f, TURBO_VERSION as ft, credentialsFileContent as g, eventsBackendFor as gt, credentialsBuildArg as h, cacheBackendFor as ht, isDnsVerified as i, networkEnv as it, devServicesUsed as j, isRemoteStore as jt, UnknownDevService as k, loadSecretsForApp as kt, setDnsRecord as l, hostFor as lt, withGeneratedSecrets as m, findBuildRoot as mt, getBackupState as n, pgClient as nt, recordRollback as o, localRolePassword as ot, DeployJournal as p, detectPackageManager as pt, applyBuckets as q, initStageSecrets as qt, getGeneratedSecret as r, appEnvKeys as rt, setApplicationId as s, planFor as st, createEmptyState as t, bucketClient as tt, setDnsVerification as u, composeBuildPaths as ut, appDockerfile as v, storageBackendFor as vt, resolveHost as w, createCredentialsPreload as wt, validateImageRef as x, fakeKey as xt, dockerCommand as y, DEFAULT_IMAGES as yt, FAKE_ENV as z, applicationName as zt };
+export { postgresDatabaseNames as $, withCustomSecret as $t, assertExternalServices as A, loadEnvFiles as At, keyFingerprint as B, readKey as Bt, isMainFrontendApp as C, fakeKey as Ct, ExternalServicesNotConfigured as D, createEntryWrapper as Dt, DevServicesNeedServerTarget as E, createCredentialsPreload as Et, reportDevServices as F, store_exports as Ft, reconcileWorkspace as G, isOwnedBy as Gt, backendsOf as H, deployIdentity as Ht, requiredStageKeys as I, FileSecretsStore as It, forgetState as J, projectName as Jt, workspace_exports as K, markerOf as Kt, suppliedOnly as L, getKeyPath as Lt, externalServices as M, prepareEntryCredentials as Mt, manifestServiceDeclarations as N, isRemoteStore as Nt, STORAGE_KEY_PAIR as O, findAvailablePort as Ot, parseDevServices as P, secretsStoreFor as Pt, bucketPolicies as Q, toEmbeddableSecrets as Qt, encryptSecrets as R, keystoreProject as Rt, NoDomainForStage as S, describeServices as St, DEV_SERVICES as T, primaryPortKey as Tt, constructGlobs as U, imageName as Ut, FAKE_ENV as V, applicationName as Vt, derivedContainers as W, imageRef as Wt, applyPolicies as X, maskPassword as Xt, applyBuckets as Y, initStageSecrets as Yt, applyPostgres as Z, storage_exports as Zt, deployDocker as _, cacheBackendFor as _t, recordRelease as a, appEnvKeys as at, ensureDockerignore as b, storageBackendFor as bt, setBackupState as c, localRolePassword as ct, setGeneratedSecret as d, hostFor as dt, postgresStatements as et, setPostgresBackupId as f, composeBuildPaths as ft, credentialsFileContent as g, findBuildRoot as gt, credentialsBuildArg as h, detectPackageManager as ht, isDnsVerified as i, pgClient as it, devServicesUsed as j, loadSecretsForApp as jt, UnknownDevService as k, isPortAvailable as kt, setDnsRecord as l, planFor as lt, withGeneratedSecrets as m, TURBO_VERSION as mt, getBackupState as n, composeFor as nt, recordRollback as o, networkEnv as ot, DeployJournal as p, imageLayout as pt, LOCAL_CA_PATH as q, ownershipMarker as qt, getGeneratedSecret as r, bucketClient as rt, setApplicationId as s, envFor as st, createEmptyState as t, quoteIdentifier as tt, setDnsVerification as u, resourceName as ut, appDockerfile as v, eventsBackendFor as vt, resolveHost as w, portKeys as wt, validateImageRef as x, DEFAULT_IMAGES as xt, dockerCommand as y, providerOf as yt, encryption_exports as z, projectKey as zt };
 
-//# sourceMappingURL=state-Bn5JDMFT.mjs.map
+//# sourceMappingURL=state-DClnPZt5.mjs.map