@geekmidas/cli 10.0.0-alpha.75 → 10.0.0-alpha.76

package/dist/{state-kA4Fkufx.cjs → state-C2qi0iQw.cjs}

@@ -2,10 +2,10 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-vdrcRI-m.cjs");
+const require_workspace = require("./workspace-DOm81oUo.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CP6sBvQV.cjs");
-const require_resolve = require("./resolve-fevXn-wZ.cjs");
+const require_resolve = require("./resolve-Fa1Ii0BK.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -529,7 +529,8 @@ function decrypt(data, keyHex) {
 var store_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	FileSecretsStore: () => FileSecretsStore,
 	isRemoteStore: () => isRemoteStore,
-	secretsStoreFor: () => secretsStoreFor
+	secretsStoreFor: () => secretsStoreFor,
+	storeFromConfig: () => storeFromConfig
 });
 /**
 * The store a stage's secrets are kept in — what every command reads and
@@ -541,13 +542,41 @@ var store_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 async function secretsStoreFor(workspace, stage, options = {}) {
 	const configured = workspace.secrets.store ?? "file";
 	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
-	if (configured.provider !== "ssm") return configured.provider;
-	const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-DkHdTV-p.cjs"));
-	return new AwsSecretsStore({
-		project: workspace.name,
-		region: configured.region,
-		...options.profile ? { profile: options.profile } : {}
-	});
+	return storeFromConfig(workspace, configured, options);
+}
+/**
+* The store a `secrets.store` value describes, for any stage — what
+* {@link secretsStoreFor} answers for a deployed stage, and what
+* `gkm secrets:migrate` builds for the store it copies to.
+*/
+async function storeFromConfig(workspace, config, options = {}) {
+	if (config === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	const profile = options.profile ? { profile: options.profile } : {};
+	switch (config.provider) {
+		case "ssm": {
+			const { AwsSecretsStore } = await Promise.resolve().then(() => require("./aws-CQAuluiu.cjs"));
+			return new AwsSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...profile
+			});
+		}
+		case "secrets-manager": {
+			const { kmsKeyId } = config;
+			const { SecretsManagerSecretsStore } = await Promise.resolve().then(() => require("./secretsManager-DUXW3fQt.cjs"));
+			return new SecretsManagerSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...kmsKeyId ? { kmsKeyId } : {},
+				...profile
+			});
+		}
+		default: {
+			const provider = config.provider;
+			if (typeof provider === "object" && provider !== null) return provider;
+			throw new require_workspace.UnknownSecretsStoreProvider(provider);
+		}
+	}
 }
 /** Whether a stage's secrets live somewhere other than this machine. */
 function isRemoteStore(workspace, stage) {
@@ -1024,6 +1053,36 @@ function eventsBackendFor(on) {
 	return require_SubscriberGenerator.DEFAULT_EVENTS[on];
 }
 //#endregion
+//#region src/exec/imageBuild.ts
+/**
+* Set by a site's Dockerfile in its builder stage: this process is building
+* an image.
+*
+* Inside an image there is no stage to load secrets for and no local
+* container to resolve an address from — the public URLs the bundle inlines
+* arrived as the Dockerfile's build args, already in the environment. So
+* `gkm exec -- next build` there injects exactly those, and never the
+* `localhost` addresses a workspace resolves on a developer's machine.
+*/
+const IMAGE_BUILD_ENV = "GKM_IMAGE_BUILD";
+/** Whether this process is building an image. */
+function isImageBuild(env = process.env) {
+	return env[IMAGE_BUILD_ENV] === "1";
+}
+/**
+* What `gkm exec` injects inside an image build: the public values its build
+* args set — every `NEXT_PUBLIC_*`, `VITE_*` and `EXPO_PUBLIC_*` — and
+* nothing read from a secrets store, a file or a container.
+*/
+function imageBuildCredentials(env = process.env) {
+	const credentials = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (require_workspace.PUBLIC_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) credentials[key] = value;
+	}
+	return credentials;
+}
+//#endregion
 //#region src/docker/templates.ts
 /**
 * The turbo every image prunes and builds with when the build root resolves
@@ -1321,7 +1380,48 @@ function binPath(options) {
 * were installed.
 */
 function gkmCommand(args) {
-	return `GKM_BIN="$(node -e 'let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}')" && node "$GKM_BIN" ${args}`;
+	return `GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && node "$GKM_BIN" ${args}`;
+}
+/** Prints the `bin/gkm.mjs` Node resolves from the cwd, or fails saying so. */
+const FIND_GKM_BIN = `let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}`;
+/**
+* What a site's builder does with the gkm workspace it carries, before its
+* framework builds it — all of it inside the image, nothing from the host:
+*
+* - `gkm` on the PATH: the CLI the workspace installs, so a build script that
+*   is `gkm exec -- next build` runs. Resolved from the gkm root rather than
+*   through `node_modules/.bin`, where a CLI that is a workspace package has
+*   no bin linked.
+* - `GKM_IMAGE_BUILD`, which has `gkm exec` inject the build args above — the
+*   stage's public URLs — and never load a secret or resolve a local address.
+* - each backend's typed client, generated from its endpoints at the
+*   workspace root's `.gkm/client/`, where the site's tsconfig paths point.
+*/
+function siteWorkspaceSteps(options) {
+	const { gkmRoot } = layout(options);
+	const root = `/app/${gkmRoot}`.replace(/\/\.$/, "");
+	const clients = options.clients ?? [];
+	const generate = clients.length ? `
+
+# The typed client of each API this site calls, generated from its endpoints
+# into ${gkmRoot === "." ? "" : `${gkmRoot}/`}.gkm/client/ — offline, with no secret and no container.
+RUN ${clients.map(({ app, path }) => `cd /app/${path} && gkm openapi --app ${app}`).join(" && \\\n    ")}` : "";
+	return `# The gkm CLI the workspace installs, as \`gkm\`
+RUN cd ${root} && GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && \\
+    { echo '#!/bin/sh'; echo "exec node \\"$GKM_BIN\\" \\"\\$@\\""; } > /usr/local/bin/gkm && \\
+    chmod +x /usr/local/bin/gkm
+
+# \`gkm exec\` in this build injects the build args, never a stage's secrets
+ENV ${IMAGE_BUILD_ENV}=1${generate}`;
+}
+/**
+* Build the site with turbo. Loose env mode, so the task sees what the
+* Dockerfile set — the build args and `GKM_IMAGE_BUILD` — whatever the
+* project's turbo.json declares: the image's environment holds nothing else.
+*/
+function siteBuild(options) {
+	const { turbo } = layout(options);
+	return `RUN ${turbo} run build --filter='${options.turboPackage}' --env-mode=loose`;
 }
 /**
 * The encrypted credentials, from a build secret — never an ARG, which is
@@ -1475,8 +1575,7 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
 * @internal Exported for testing
 */
 function generateNextjsDockerfile(options) {
-	const { port, appPath, turboPackage, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
-	const { turbo } = layout(options);
+	const { port, appPath, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
 	return `# syntax=docker/dockerfile:1
 # Next.js standalone Dockerfile, built from a turbo-pruned slice
 
@@ -1486,13 +1585,15 @@ ${depsStage(options)}
 
 ${builderStage(options, { args: publicUrlArgs })}
 
+${siteWorkspaceSteps(options)}
+
 # Ensure public directory exists (may be empty for scaffolded projects)
 RUN mkdir -p ${appPath}/public
 
 ENV NEXT_TELEMETRY_DISABLED=1
 
 # Build the application
-RUN ${turbo} run build --filter='${turboPackage}'
+${siteBuild(options)}
 
 # The runner needs the standalone server; without it there is nothing to run.
 RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
@@ -1680,8 +1781,7 @@ CMD ["node", "index.mjs"]
 * @internal Exported for testing
 */
 function generateNodeWebDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
 
@@ -1690,7 +1790,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${options.baseImage} AS runner
 WORKDIR /app
@@ -1724,8 +1827,7 @@ CMD ["sh", "-c", "cd ${appPath} && npm start"]
 * @internal Exported for testing
 */
 function generateViteStaticDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
 
@@ -1734,7 +1836,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${STATIC_SITE_IMAGE} AS runner
 
@@ -1843,7 +1948,7 @@ function fromBuildRoot(layout, path) {
 	return joined === "" ? "." : joined;
 }
 /** Everything a template needs about one app, relative to the build root. */
-function appImageOptions(layout, appName, app, workspaceRoot) {
+function appImageOptions(layout, appName, app, workspaceRoot, apps = {}) {
 	const turboPackage = packageName((0, node_path.isAbsolute)(app.path) ? app.path : (0, node_path.join)(workspaceRoot, app.path)) ?? appName;
 	return {
 		imageName: appName,
@@ -1859,10 +1964,49 @@ function appImageOptions(layout, appName, app, workspaceRoot) {
 		...app.type === "backend" ? {
 			gkmPaths: layout.gkmPaths,
 			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
-		} : {}
+		} : app.type === "web" ? siteWorkspace(layout, app, apps, workspaceRoot, turboPackage) : {}
+	};
+}
+/**
+* What a site's image carries of the gkm workspace: its config and construct
+* directories, the workspace's own package where it is nested in a monorepo
+* (it holds the CLI), and each backend the site calls — whose endpoints its
+* client is generated from, and whose package their imports resolve in.
+*/
+function siteWorkspace(layout, site, apps, workspaceRoot, turboPackage) {
+	const clients = siteClients(site, apps);
+	const packages = /* @__PURE__ */ new Set();
+	if (layout.workspacePackage) packages.add(layout.workspacePackage);
+	for (const { app } of clients) {
+		const backend = apps[app];
+		const name = packageName((0, node_path.isAbsolute)(backend.path) ? backend.path : (0, node_path.join)(workspaceRoot, backend.path));
+		if (name) packages.add(name);
+	}
+	packages.delete(turboPackage);
+	return {
+		gkmPaths: layout.gkmPaths,
+		...packages.size > 0 ? { prunePackages: [...packages].sort() } : {},
+		...clients.length > 0 ? { clients: clients.map(({ app }) => ({
+			app,
+			path: fromBuildRoot(layout, apps[app].path)
+		})) } : {}
 	};
 }
 /**
+* The backends whose clients a site imports: each it depends on that gkm
+* builds from endpoints — not one with an entry of its own, and not one that
+* turned OpenAPI off.
+*/
+function siteClients(site, apps) {
+	return site.dependencies.filter((name) => {
+		const app = apps[name];
+		if (!app || app.type !== "backend" || app.entry) return false;
+		if (app.openapi === false) return false;
+		if (typeof app.openapi === "object" && app.openapi.enabled === false) return false;
+		return true;
+	}).sort().map((app) => ({ app }));
+}
+/**
 * The directories the workspace's construct globs start in, relative to its
 * root: `./constructs/**\/*.ts` reads from `constructs`.
 */
@@ -5885,6 +6029,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfile = appDockerfile(appName, app, {
 			layout,
 			workspaceRoot: workspace.root,
+			apps: workspace.apps,
 			...manifest ? { manifest } : {}
 		});
 		const path = dockerfileOf(appName, app.path);
@@ -5940,7 +6085,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 * framework. The one choice every builder of images makes.
 */
 function appDockerfile(appName, app, options) {
-	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot);
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps);
 	if (app.type === "web") return siteDockerfile(appName, app, {
 		image,
 		...options.manifest ? { manifest: options.manifest } : {},
@@ -6684,6 +6829,12 @@ Object.defineProperty(exports, "hostFor", {
 		return hostFor;
 	}
 });
+Object.defineProperty(exports, "imageBuildCredentials", {
+	enumerable: true,
+	get: function() {
+		return imageBuildCredentials;
+	}
+});
 Object.defineProperty(exports, "imageLayout", {
 	enumerable: true,
 	get: function() {
@@ -6714,6 +6865,12 @@ Object.defineProperty(exports, "isDnsVerified", {
 		return isDnsVerified;
 	}
 });
+Object.defineProperty(exports, "isImageBuild", {
+	enumerable: true,
+	get: function() {
+		return isImageBuild;
+	}
+});
 Object.defineProperty(exports, "isMainFrontendApp", {
 	enumerable: true,
 	get: function() {
@@ -6978,6 +7135,12 @@ Object.defineProperty(exports, "storage_exports", {
 		return storage_exports;
 	}
 });
+Object.defineProperty(exports, "storeFromConfig", {
+	enumerable: true,
+	get: function() {
+		return storeFromConfig;
+	}
+});
 Object.defineProperty(exports, "store_exports", {
 	enumerable: true,
 	get: function() {
@@ -7057,4 +7220,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-kA4Fkufx.cjs.map
+//# sourceMappingURL=state-C2qi0iQw.cjs.map