@geekmidas/cli 10.0.0-alpha.75 → 10.0.0-alpha.76

package/dist/{state-BrWIOce_.mjs → state-CUecOCNJ.mjs}

@@ -2,10 +2,10 @@ import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { O as TEST_STAGE, h as getPublicEnvPrefix, n as allConstructGlobs } from "./workspace-C7NqCsQF.mjs";
+import { F as UnknownSecretsStoreProvider, O as TEST_STAGE, h as getPublicEnvPrefix, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs } from "./workspace-QUTqYmVy.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { n as runtimeFor, r as generateTelemetryModule } from "./EndpointGenerator-DftalLYg.mjs";
-import { c as runtimeOf } from "./resolve-DZNx7rLy.mjs";
+import { c as runtimeOf } from "./resolve-C1muFos5.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
@@ -527,7 +527,8 @@ function decrypt(data, keyHex) {
 var store_exports = /* @__PURE__ */ __exportAll({
 	FileSecretsStore: () => FileSecretsStore,
 	isRemoteStore: () => isRemoteStore,
-	secretsStoreFor: () => secretsStoreFor
+	secretsStoreFor: () => secretsStoreFor,
+	storeFromConfig: () => storeFromConfig
 });
 /**
 * The store a stage's secrets are kept in — what every command reads and
@@ -539,13 +540,41 @@ var store_exports = /* @__PURE__ */ __exportAll({
 async function secretsStoreFor(workspace, stage, options = {}) {
 	const configured = workspace.secrets.store ?? "file";
 	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
-	if (configured.provider !== "ssm") return configured.provider;
-	const { AwsSecretsStore } = await import("./aws-DojzQnLd.mjs");
-	return new AwsSecretsStore({
-		project: workspace.name,
-		region: configured.region,
-		...options.profile ? { profile: options.profile } : {}
-	});
+	return storeFromConfig(workspace, configured, options);
+}
+/**
+* The store a `secrets.store` value describes, for any stage — what
+* {@link secretsStoreFor} answers for a deployed stage, and what
+* `gkm secrets:migrate` builds for the store it copies to.
+*/
+async function storeFromConfig(workspace, config, options = {}) {
+	if (config === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
+	const profile = options.profile ? { profile: options.profile } : {};
+	switch (config.provider) {
+		case "ssm": {
+			const { AwsSecretsStore } = await import("./aws-Bja4zGSs.mjs");
+			return new AwsSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...profile
+			});
+		}
+		case "secrets-manager": {
+			const { kmsKeyId } = config;
+			const { SecretsManagerSecretsStore } = await import("./secretsManager-Ti0oZwsS.mjs");
+			return new SecretsManagerSecretsStore({
+				project: workspace.name,
+				region: config.region,
+				...kmsKeyId ? { kmsKeyId } : {},
+				...profile
+			});
+		}
+		default: {
+			const provider = config.provider;
+			if (typeof provider === "object" && provider !== null) return provider;
+			throw new UnknownSecretsStoreProvider(provider);
+		}
+	}
 }
 /** Whether a stage's secrets live somewhere other than this machine. */
 function isRemoteStore(workspace, stage) {
@@ -1022,6 +1051,36 @@ function eventsBackendFor(on) {
 	return DEFAULT_EVENTS$1[on];
 }
 //#endregion
+//#region src/exec/imageBuild.ts
+/**
+* Set by a site's Dockerfile in its builder stage: this process is building
+* an image.
+*
+* Inside an image there is no stage to load secrets for and no local
+* container to resolve an address from — the public URLs the bundle inlines
+* arrived as the Dockerfile's build args, already in the environment. So
+* `gkm exec -- next build` there injects exactly those, and never the
+* `localhost` addresses a workspace resolves on a developer's machine.
+*/
+const IMAGE_BUILD_ENV = "GKM_IMAGE_BUILD";
+/** Whether this process is building an image. */
+function isImageBuild(env = process.env) {
+	return env[IMAGE_BUILD_ENV] === "1";
+}
+/**
+* What `gkm exec` injects inside an image build: the public values its build
+* args set — every `NEXT_PUBLIC_*`, `VITE_*` and `EXPO_PUBLIC_*` — and
+* nothing read from a secrets store, a file or a container.
+*/
+function imageBuildCredentials(env = process.env) {
+	const credentials = {};
+	for (const [key, value] of Object.entries(env)) {
+		if (value === void 0) continue;
+		if (PUBLIC_ENV_PREFIXES.some((prefix) => key.startsWith(prefix))) credentials[key] = value;
+	}
+	return credentials;
+}
+//#endregion
 //#region src/docker/templates.ts
 /**
 * The turbo every image prunes and builds with when the build root resolves
@@ -1319,7 +1378,48 @@ function binPath(options) {
 * were installed.
 */
 function gkmCommand(args) {
-	return `GKM_BIN="$(node -e 'let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}')" && node "$GKM_BIN" ${args}`;
+	return `GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && node "$GKM_BIN" ${args}`;
+}
+/** Prints the `bin/gkm.mjs` Node resolves from the cwd, or fails saying so. */
+const FIND_GKM_BIN = `let d=process.cwd();const{existsSync:e}=require("fs"),{dirname:u,join:j}=require("path");for(;;){const p=j(d,"node_modules/@geekmidas/cli/bin/gkm.mjs");if(e(p)){console.log(p);break}if(u(d)===d){console.error("@geekmidas/cli is not installed where the app can resolve it");process.exit(1)}d=u(d)}`;
+/**
+* What a site's builder does with the gkm workspace it carries, before its
+* framework builds it — all of it inside the image, nothing from the host:
+*
+* - `gkm` on the PATH: the CLI the workspace installs, so a build script that
+*   is `gkm exec -- next build` runs. Resolved from the gkm root rather than
+*   through `node_modules/.bin`, where a CLI that is a workspace package has
+*   no bin linked.
+* - `GKM_IMAGE_BUILD`, which has `gkm exec` inject the build args above — the
+*   stage's public URLs — and never load a secret or resolve a local address.
+* - each backend's typed client, generated from its endpoints at the
+*   workspace root's `.gkm/client/`, where the site's tsconfig paths point.
+*/
+function siteWorkspaceSteps(options) {
+	const { gkmRoot } = layout(options);
+	const root = `/app/${gkmRoot}`.replace(/\/\.$/, "");
+	const clients = options.clients ?? [];
+	const generate = clients.length ? `
+
+# The typed client of each API this site calls, generated from its endpoints
+# into ${gkmRoot === "." ? "" : `${gkmRoot}/`}.gkm/client/ — offline, with no secret and no container.
+RUN ${clients.map(({ app, path }) => `cd /app/${path} && gkm openapi --app ${app}`).join(" && \\\n    ")}` : "";
+	return `# The gkm CLI the workspace installs, as \`gkm\`
+RUN cd ${root} && GKM_BIN="$(node -e '${FIND_GKM_BIN}')" && \\
+    { echo '#!/bin/sh'; echo "exec node \\"$GKM_BIN\\" \\"\\$@\\""; } > /usr/local/bin/gkm && \\
+    chmod +x /usr/local/bin/gkm
+
+# \`gkm exec\` in this build injects the build args, never a stage's secrets
+ENV ${IMAGE_BUILD_ENV}=1${generate}`;
+}
+/**
+* Build the site with turbo. Loose env mode, so the task sees what the
+* Dockerfile set — the build args and `GKM_IMAGE_BUILD` — whatever the
+* project's turbo.json declares: the image's environment holds nothing else.
+*/
+function siteBuild(options) {
+	const { turbo } = layout(options);
+	return `RUN ${turbo} run build --filter='${options.turboPackage}' --env-mode=loose`;
 }
 /**
 * The encrypted credentials, from a build secret — never an ARG, which is
@@ -1473,8 +1573,7 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \\
 * @internal Exported for testing
 */
 function generateNextjsDockerfile(options) {
-	const { port, appPath, turboPackage, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
-	const { turbo } = layout(options);
+	const { port, appPath, publicUrlArgs = ["NEXT_PUBLIC_API_URL", "NEXT_PUBLIC_AUTH_URL"] } = options;
 	return `# syntax=docker/dockerfile:1
 # Next.js standalone Dockerfile, built from a turbo-pruned slice
 
@@ -1484,13 +1583,15 @@ ${depsStage(options)}
 
 ${builderStage(options, { args: publicUrlArgs })}
 
+${siteWorkspaceSteps(options)}
+
 # Ensure public directory exists (may be empty for scaffolded projects)
 RUN mkdir -p ${appPath}/public
 
 ENV NEXT_TELEMETRY_DISABLED=1
 
 # Build the application
-RUN ${turbo} run build --filter='${turboPackage}'
+${siteBuild(options)}
 
 # The runner needs the standalone server; without it there is nothing to run.
 RUN if [ ! -d ${appPath}/.next/standalone ]; then \\
@@ -1678,8 +1779,7 @@ CMD ["node", "index.mjs"]
 * @internal Exported for testing
 */
 function generateNodeWebDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Node SSR web Dockerfile (TanStack Start / Remix), from a turbo-pruned slice
 
@@ -1688,7 +1788,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${options.baseImage} AS runner
 WORKDIR /app
@@ -1722,8 +1825,7 @@ CMD ["sh", "-c", "cd ${appPath} && npm start"]
 * @internal Exported for testing
 */
 function generateViteStaticDockerfile(options) {
-	const { port, appPath, turboPackage } = options;
-	const { turbo } = layout(options);
+	const { port, appPath } = options;
 	return `# syntax=docker/dockerfile:1
 # Vite SPA Dockerfile — a turbo-pruned slice built to static files, served by Caddy
 
@@ -1732,7 +1834,10 @@ ${prunerStage(options)}
 ${depsStage(options)}
 
 ${builderStage(options, { args: options.publicUrlArgs ?? [] })}
-RUN ${turbo} run build --filter='${turboPackage}'
+
+${siteWorkspaceSteps(options)}
+
+${siteBuild(options)}
 
 FROM ${STATIC_SITE_IMAGE} AS runner
 
@@ -1841,7 +1946,7 @@ function fromBuildRoot(layout, path) {
 	return joined === "" ? "." : joined;
 }
 /** Everything a template needs about one app, relative to the build root. */
-function appImageOptions(layout, appName, app, workspaceRoot) {
+function appImageOptions(layout, appName, app, workspaceRoot, apps = {}) {
 	const turboPackage = packageName(isAbsolute(app.path) ? app.path : join(workspaceRoot, app.path)) ?? appName;
 	return {
 		imageName: appName,
@@ -1857,10 +1962,49 @@ function appImageOptions(layout, appName, app, workspaceRoot) {
 		...app.type === "backend" ? {
 			gkmPaths: layout.gkmPaths,
 			...layout.workspacePackage && layout.workspacePackage !== turboPackage ? { prunePackages: [layout.workspacePackage] } : {}
-		} : {}
+		} : app.type === "web" ? siteWorkspace(layout, app, apps, workspaceRoot, turboPackage) : {}
 	};
 }
 /**
+* What a site's image carries of the gkm workspace: its config and construct
+* directories, the workspace's own package where it is nested in a monorepo
+* (it holds the CLI), and each backend the site calls — whose endpoints its
+* client is generated from, and whose package their imports resolve in.
+*/
+function siteWorkspace(layout, site, apps, workspaceRoot, turboPackage) {
+	const clients = siteClients(site, apps);
+	const packages = /* @__PURE__ */ new Set();
+	if (layout.workspacePackage) packages.add(layout.workspacePackage);
+	for (const { app } of clients) {
+		const backend = apps[app];
+		const name = packageName(isAbsolute(backend.path) ? backend.path : join(workspaceRoot, backend.path));
+		if (name) packages.add(name);
+	}
+	packages.delete(turboPackage);
+	return {
+		gkmPaths: layout.gkmPaths,
+		...packages.size > 0 ? { prunePackages: [...packages].sort() } : {},
+		...clients.length > 0 ? { clients: clients.map(({ app }) => ({
+			app,
+			path: fromBuildRoot(layout, apps[app].path)
+		})) } : {}
+	};
+}
+/**
+* The backends whose clients a site imports: each it depends on that gkm
+* builds from endpoints — not one with an entry of its own, and not one that
+* turned OpenAPI off.
+*/
+function siteClients(site, apps) {
+	return site.dependencies.filter((name) => {
+		const app = apps[name];
+		if (!app || app.type !== "backend" || app.entry) return false;
+		if (app.openapi === false) return false;
+		if (typeof app.openapi === "object" && app.openapi.enabled === false) return false;
+		return true;
+	}).sort().map((app) => ({ app }));
+}
+/**
 * The directories the workspace's construct globs start in, relative to its
 * root: `./constructs/**\/*.ts` reads from `constructs`.
 */
@@ -5883,6 +6027,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 		const dockerfile = appDockerfile(appName, app, {
 			layout,
 			workspaceRoot: workspace.root,
+			apps: workspace.apps,
 			...manifest ? { manifest } : {}
 		});
 		const path = dockerfileOf(appName, app.path);
@@ -5938,7 +6083,7 @@ async function workspaceDockerCommand(workspace, manifest, imageNames = {}, back
 * framework. The one choice every builder of images makes.
 */
 function appDockerfile(appName, app, options) {
-	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot);
+	const image = appImageOptions(options.layout, appName, app, options.workspaceRoot, options.apps);
 	if (app.type === "web") return siteDockerfile(appName, app, {
 		image,
 		...options.manifest ? { manifest: options.manifest } : {},
@@ -6352,6 +6497,6 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { LOCAL_CA_PATH as $, imageRef as $t, ExternalServicesNotConfigured as A, DEFAULT_IMAGES as At, suppliedOnly as B, loadSecretsForApp as Bt, NoDomainForStage as C, WORKER_PORT as Ct, otelEnv as D, eventsBackendFor as Dt, isOtlpDestination as E, cacheBackendFor as Et, externalServices as F, createCredentialsPreload as Ft, QueueGenerator as G, FileSecretsStore as Gt, WorkerGenerator as H, isRemoteStore as Ht, manifestServiceDeclarations as I, createEntryWrapper as It, backendsOf as J, projectKey as Jt, CronGenerator as K, getKeyPath as Kt, parseDevServices as L, findAvailablePort as Lt, UnknownDevService as M, fakeKey as Mt, assertExternalServices as N, portKeys as Nt, DEV_SERVICES as O, providerOf as Ot, devServicesUsed as P, primaryPortKey as Pt, workspace_exports as Q, imageName as Qt, reportDevServices as R, isPortAvailable as Rt, validateImageRef as S, TURBO_VERSION as St, resolveHost as T, findBuildRoot as Tt, workerBundleName as U, secretsStoreFor as Ut, workerUnits as V, prepareEntryCredentials as Vt, workerEntryDir as W, store_exports as Wt, derivedContainers as X, applicationName as Xt, constructGlobs as Y, readKey as Yt, reconcileWorkspace as Z, deployIdentity as Zt, appDockerfile as _, planFor as _t, recordRelease as a, maskPassword as an, postgresDatabaseNames as at, workerDockerfile as b, composeBuildPaths as bt, setBackupState as c, withCustomSecret as cn, composeFor as ct, setGeneratedSecret as d, appEnvKeys as dt, isOwnedBy as en, forgetState as et, setPostgresBackupId as f, dockerfileOf as ft, DockerPushFailed as g, localRolePassword as gt, DockerBuildFailed as h, envFor as ht, isDnsVerified as i, initStageSecrets as in, bucketPolicies as it, STORAGE_KEY_PAIR as j, describeServices as jt, DevServicesNeedServerTarget as k, storageBackendFor as kt, setDnsRecord as l, bucketClient as lt, withGeneratedSecrets as m, workerEnvKeys as mt, getBackupState as n, ownershipMarker as nn, applyPolicies as nt, recordRollback as o, storage_exports as on, postgresStatements as ot, DeployJournal as p, networkEnv as pt, FAKE_ENV as q, keystoreProject as qt, getGeneratedSecret as r, projectName as rn, applyPostgres as rt, setApplicationId as s, toEmbeddableSecrets as sn, quoteIdentifier as st, createEmptyState as t, markerOf as tn, applyBuckets as tt, setDnsVerification as u, pgClient as ut, dockerCommand as v, resourceName as vt, isMainFrontendApp as w, detectPackageManager as wt, workerDockerfileOf as x, imageLayout as xt, ensureDockerignore as y, hostFor as yt, requiredStageKeys as z, loadEnvFiles as zt };
+export { LOCAL_CA_PATH as $, applicationName as $t, ExternalServicesNotConfigured as A, providerOf as At, suppliedOnly as B, isPortAvailable as Bt, NoDomainForStage as C, WORKER_PORT as Ct, otelEnv as D, isImageBuild as Dt, isOtlpDestination as E, imageBuildCredentials as Et, externalServices as F, portKeys as Ft, QueueGenerator as G, secretsStoreFor as Gt, WorkerGenerator as H, loadSecretsForApp as Ht, manifestServiceDeclarations as I, primaryPortKey as It, backendsOf as J, FileSecretsStore as Jt, CronGenerator as K, storeFromConfig as Kt, parseDevServices as L, createCredentialsPreload as Lt, UnknownDevService as M, DEFAULT_IMAGES as Mt, assertExternalServices as N, describeServices as Nt, DEV_SERVICES as O, cacheBackendFor as Ot, devServicesUsed as P, fakeKey as Pt, workspace_exports as Q, readKey as Qt, reportDevServices as R, createEntryWrapper as Rt, validateImageRef as S, TURBO_VERSION as St, resolveHost as T, findBuildRoot as Tt, workerBundleName as U, prepareEntryCredentials as Ut, workerUnits as V, loadEnvFiles as Vt, workerEntryDir as W, isRemoteStore as Wt, derivedContainers as X, keystoreProject as Xt, constructGlobs as Y, getKeyPath as Yt, reconcileWorkspace as Z, projectKey as Zt, appDockerfile as _, planFor as _t, recordRelease as a, ownershipMarker as an, postgresDatabaseNames as at, workerDockerfile as b, composeBuildPaths as bt, setBackupState as c, maskPassword as cn, composeFor as ct, setGeneratedSecret as d, withCustomSecret as dn, appEnvKeys as dt, deployIdentity as en, forgetState as et, setPostgresBackupId as f, dockerfileOf as ft, DockerPushFailed as g, localRolePassword as gt, DockerBuildFailed as h, envFor as ht, isDnsVerified as i, markerOf as in, bucketPolicies as it, STORAGE_KEY_PAIR as j, storageBackendFor as jt, DevServicesNeedServerTarget as k, eventsBackendFor as kt, setDnsRecord as l, storage_exports as ln, bucketClient as lt, withGeneratedSecrets as m, workerEnvKeys as mt, getBackupState as n, imageRef as nn, applyPolicies as nt, recordRollback as o, projectName as on, postgresStatements as ot, DeployJournal as p, networkEnv as pt, FAKE_ENV as q, store_exports as qt, getGeneratedSecret as r, isOwnedBy as rn, applyPostgres as rt, setApplicationId as s, initStageSecrets as sn, quoteIdentifier as st, createEmptyState as t, imageName as tn, applyBuckets as tt, setDnsVerification as u, toEmbeddableSecrets as un, pgClient as ut, dockerCommand as v, resourceName as vt, isMainFrontendApp as w, detectPackageManager as wt, workerDockerfileOf as x, imageLayout as xt, ensureDockerignore as y, hostFor as yt, requiredStageKeys as z, findAvailablePort as zt };
 
-//# sourceMappingURL=state-BrWIOce_.mjs.map
+//# sourceMappingURL=state-CUecOCNJ.mjs.map