@geekmidas/cli 10.0.0-alpha.75 → 10.0.0-alpha.77

package/dist/{compose-UKyv_1yU.cjs → compose-CePlrbUw.cjs}

@@ -2,9 +2,9 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-vdrcRI-m.cjs");
+const require_workspace = require("./workspace-DOm81oUo.cjs");
 const require_define = require("./define-DzRz8FgH.cjs");
-const require_state = require("./state-kA4Fkufx.cjs");
+const require_stale = require("./stale-yu2FkH3G.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 const require_drivers = require("./drivers-BdvtCKc7.cjs");
 const require_databases = require("./databases-C2p5LGAp.cjs");
@@ -496,9 +496,9 @@ function otlpHeaders(email, password) {
 /** The stack's OpenObserve for one stage. */
 function stackLogs(options) {
 	const { config, stage, local, custom } = options;
-	const conflicting = Object.keys(custom).filter(require_state.isOtlpDestination).sort();
+	const conflicting = Object.keys(custom).filter(require_stale.isOtlpDestination).sort();
 	if (conflicting.length > 0) throw new LogsEndpointConflict(stage, conflicting);
-	if (!local && !options.domain) throw new require_state.NoDomainForStage(stage);
+	if (!local && !options.domain) throw new require_stale.NoDomainForStage(stage);
 	const email = custom["ZO_ROOT_USER_EMAIL"] ?? (local ? "admin@gkm.localhost" : `admin@${options.domain}`);
 	const set = custom[LOGS_PASSWORD_KEY];
 	if (!set && !local) throw new LogsPasswordMissing(stage);
@@ -596,7 +596,7 @@ const REDIS_SERVICE = "redis";
 /** The port it answers on, inside the network. */
 const REDIS_PORT = 6379;
 /** Reconcile's pin, so `gkm dev` and the stack run one Redis. */
-const REDIS_IMAGE = require_state.DEFAULT_IMAGES.redis;
+const REDIS_IMAGE = require_stale.DEFAULT_IMAGES.redis;
 /**
 * How much it may hold before it evicts. A cache that grows until the box
 * runs out of memory takes the apps with it; 256 MB is a lot of sessions and
@@ -907,7 +907,7 @@ function composeStack(input) {
 	const custom = input.secrets?.custom ?? {};
 	const https = input.ports?.https ?? 443;
 	const http = input.ports?.http ?? 80;
-	const plan = require_state.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
+	const plan = require_stale.planFor(manifest, stage, (0, _geekmidas_manifest.provisionOrder)(manifest), {
 		localStage: workspace.stages.local,
 		events: require_SubscriberGenerator.DEFAULT_EVENTS.server,
 		cache: STACK_CACHE,
@@ -917,7 +917,7 @@ function composeStack(input) {
 	const seed = local ? void 0 : input.secrets?.seed;
 	if (!local && !seed) throw new StageSeedMissing(stage);
 	const credential = {
-		master: local ? "geekmidas" : require_state.localRolePassword(workspace.name, plan, "master", seed),
+		master: local ? "geekmidas" : require_stale.localRolePassword(workspace.name, plan, "master", seed),
 		...seed ? { seed } : {}
 	};
 	const apps = stackApps(workspace, manifest, plan, {
@@ -927,7 +927,7 @@ function composeStack(input) {
 		identity,
 		images: input.images
 	});
-	const workers = stackWorkers(require_state.workerUnits(workspace, manifest, input.background ?? {}), {
+	const workers = stackWorkers(require_stale.workerUnits(workspace, manifest, input.background ?? {}), {
 		stage,
 		identity,
 		images: input.images
@@ -945,9 +945,9 @@ function composeStack(input) {
 	const reads = /* @__PURE__ */ new Map();
 	for (const app of apps) {
 		const site = manifest[app.id];
-		reads.set(app.name, site?.kind === "site" ? Object.values((0, _geekmidas_manifest.publicEnvFor)(site, manifest)) : [...require_state.appEnvKeys(manifest, app.name, input.runnables) ?? []]);
+		reads.set(app.name, site?.kind === "site" ? Object.values((0, _geekmidas_manifest.publicEnvFor)(site, manifest)) : [...require_stale.appEnvKeys(manifest, app.name, input.runnables) ?? []]);
 	}
-	for (const worker of workers) reads.set(worker.name, [...require_state.workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
+	for (const worker of workers) reads.set(worker.name, [...require_stale.workerEnvKeys(manifest, worker.id, input.runnables) ?? []]);
 	const domain = workspace.deploy?.domains?.[stage];
 	const logsConfig = require_workspace.resolveLogs(workspace.deploy?.compose?.logs);
 	const logs = logsConfig ? stackLogs({
@@ -963,7 +963,7 @@ function composeStack(input) {
 		missing: [],
 		minio: plan.resources.filter((r) => r.kind === "objects").map((r) => r.id),
 		mailpit: plan.resources.filter((r) => r.kind === "email").map((r) => r.id)
-	} : require_state.assertExternalServices({
+	} : require_stale.assertExternalServices({
 		stage,
 		declarations: serviceDeclarations(plan, reads, owners),
 		supplied: custom,
@@ -981,9 +981,9 @@ function composeStack(input) {
 		const buckets = services.minio.map((id) => byId.get(id)?.name).filter((name) => Boolean(name)).sort();
 		return {
 			user: custom.AWS_ACCESS_KEY_ID ?? (local ? "geekmidas" : `${workspace.name}-minio`),
-			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : require_state.localRolePassword(workspace.name, plan, "minio", seed)),
+			password: custom.AWS_SECRET_ACCESS_KEY ?? (local ? "geekmidas" : require_stale.localRolePassword(workspace.name, plan, "minio", seed)),
 			buckets,
-			policies: require_state.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
+			policies: require_stale.bucketPolicies(plan).filter((p) => buckets.includes(p.bucket))
 		};
 	})() : void 0;
 	const derivation = {
@@ -992,11 +992,11 @@ function composeStack(input) {
 		...credential.seed ? { seed: credential.seed } : {},
 		...!local && domain ? { mailFrom: `noreply@${domain}` } : {}
 	};
-	const outside = require_state.networkEnv(plan, {
+	const outside = require_stale.networkEnv(plan, {
 		...derivation,
 		addresses: Object.fromEntries(apps.map((app) => [app.id, app.url]))
 	});
-	const inside = require_state.networkEnv(plan, {
+	const inside = require_stale.networkEnv(plan, {
 		...derivation,
 		addresses: Object.fromEntries(apps.map((app) => [app.id, `http://${app.name}:${app.port}`]))
 	});
@@ -1008,9 +1008,9 @@ function composeStack(input) {
 		const bucket = byId.get(resource.of);
 		if (!bucket) continue;
 		let host;
-		if (local) host = require_state.hostFor(resource, workspace.name);
+		if (local) host = require_stale.hostFor(resource, workspace.name);
 		else {
-			if (!domain) throw new require_state.NoDomainForStage(stage);
+			if (!domain) throw new require_stale.NoDomainForStage(stage);
 			host = `${resource.subdomain ?? require_derive.appKey(resource.id)}.${domain}`;
 		}
 		fileServers.set(resource.id, {
@@ -1034,7 +1034,7 @@ function composeStack(input) {
 			if (owner.kind === "file-server") return fileServers.get(owner.id)?.url;
 			return outside[key];
 		}
-		if (owner && require_state.suppliedOnly(owner.kind, owner.id, key, local)) {
+		if (owner && require_stale.suppliedOnly(owner.kind, owner.id, key, local)) {
 			const value = custom[key];
 			if (value === void 0) throw new StageSecretMissing(app.name, key, stage);
 			return value;
@@ -1074,7 +1074,7 @@ function composeStack(input) {
 			continue;
 		}
 		if (input.buildOnly) continue;
-		const keys = require_state.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
+		const keys = require_stale.appEnvKeys(manifest, app.name, input.runnables) ?? /* @__PURE__ */ new Set();
 		const values = valuesFor(app, keys);
 		const trusted = (0, _geekmidas_manifest.provideKey)(app.id, "trustedOrigins");
 		if (keys.has(trusted)) {
@@ -1084,7 +1084,7 @@ function composeStack(input) {
 		}
 		app.env = {
 			...values,
-			...require_state.otelEnv({
+			...require_stale.otelEnv({
 				...custom,
 				...logs?.appEnv
 			}, app.name),
@@ -1095,14 +1095,14 @@ function composeStack(input) {
 		for (const [key, value] of Object.entries(app.env)) if (/[\r\n]/.test(value)) throw new EnvValueMultiline(app.name, key);
 	}
 	for (const worker of input.buildOnly ? [] : workers) {
-		const keys = require_state.workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
+		const keys = require_stale.workerEnvKeys(manifest, worker.id, input.runnables) ?? /* @__PURE__ */ new Set();
 		worker.env = {
 			...valuesFor({
 				name: worker.name,
 				id: worker.id,
 				kind: "rest-api"
 			}, keys),
-			...require_state.otelEnv({
+			...require_stale.otelEnv({
 				...custom,
 				...logs?.appEnv
 			}, worker.name),
@@ -1145,16 +1145,17 @@ function composeStack(input) {
 	const dockerfiles = {};
 	for (const app of apps) {
 		if (!app.build) continue;
-		dockerfiles[app.build.dockerfile] = require_state.appDockerfile(app.name, workspace.apps[app.name], {
+		dockerfiles[app.build.dockerfile] = require_stale.appDockerfile(app.name, workspace.apps[app.name], {
 			layout,
 			workspaceRoot: workspace.root,
+			apps: workspace.apps,
 			manifest,
 			cache: STACK_CACHE
 		});
 	}
 	for (const worker of workers) {
 		if (!worker.build) continue;
-		dockerfiles[worker.build.dockerfile] = require_state.workerDockerfile({
+		dockerfiles[worker.build.dockerfile] = require_stale.workerDockerfile({
 			id: worker.id,
 			name: worker.name,
 			app: worker.host
@@ -1177,7 +1178,7 @@ function composeStack(input) {
 		plan,
 		credential,
 		...storage ? { storage } : {},
-		devServices: local ? [] : require_state.devServicesUsed(services),
+		devServices: local ? [] : require_stale.devServicesUsed(services),
 		...logs ? { logs } : {},
 		...redis ? { redis } : {}
 	};
@@ -1238,7 +1239,7 @@ function stackApps(workspace, manifest, plan, options) {
 		if (!app || !resource || !app.port) continue;
 		const host = hostOf(name, app, workspace, resource, options);
 		const tag = declaration.kind === "site" ? siteTag(options.images.tag, options.stage) : options.images.tag;
-		const ref = require_state.validateImageRef(require_state.imageRef(options.identity, name, options.images.registry, tag));
+		const ref = require_stale.validateImageRef(require_stale.imageRef(options.identity, name, options.images.registry, tag));
 		apps.push({
 			app: name,
 			name,
@@ -1262,8 +1263,8 @@ function stackWorkers(units, options) {
 		name: unit.name,
 		id: unit.id,
 		host: unit.app,
-		port: require_state.WORKER_PORT,
-		ref: require_state.validateImageRef(require_state.imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
+		port: require_stale.WORKER_PORT,
+		ref: require_stale.validateImageRef(require_stale.imageRef(options.identity, unit.name, options.images.registry, options.images.tag)),
 		tag: options.images.tag,
 		...options.images.mode === "build" ? { build: { dockerfile: `${stackDir(options.stage)}/Dockerfile.${unit.name}` } } : {}
 	}));
@@ -1274,19 +1275,19 @@ function stackWorkers(units, options) {
 * same rule a deploy follows — for any other.
 */
 function hostOf(name, app, workspace, resource, options) {
-	if (options.local) return require_state.hostFor(resource, workspace.name);
-	return require_state.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_state.isMainFrontendApp(name, app, workspace.apps));
+	if (options.local) return require_stale.hostFor(resource, workspace.name);
+	return require_stale.resolveHost(name, app, options.stage, workspace.deploy?.domains, require_stale.isMainFrontendApp(name, app, workspace.apps));
 }
 /** The compose document: the infrastructure, the apps, and the edge. */
 function stackFile(options) {
 	const { project, plan, apps } = options;
 	const infra = options.infra.filter((name) => name !== LOGS_SERVICE);
-	const derived = require_state.composeFor({
+	const derived = require_stale.composeFor({
 		...plan,
 		containers: [...infra]
 	}, {
 		project,
-		ports: Object.fromEntries(require_state.portKeys(infra, plan.fakes).map((key) => [key, 0]))
+		ports: Object.fromEntries(require_stale.portKeys(infra, plan.fakes).map((key) => [key, 0]))
 	});
 	const services = {};
 	const volumes = {
@@ -1324,7 +1325,7 @@ function stackFile(options) {
 	for (const app of apps) services[app.name] = {
 		image: app.ref,
 		...app.build ? { build: {
-			...require_state.composeBuildPaths({
+			...require_stale.composeBuildPaths({
 				composeDir: options.composeDir,
 				buildRoot: options.buildRoot,
 				workspaceRoot: options.workspaceRoot,
@@ -1344,7 +1345,7 @@ function stackFile(options) {
 	};
 	for (const worker of options.workers) services[worker.name] = {
 		image: worker.ref,
-		...worker.build ? { build: require_state.composeBuildPaths({
+		...worker.build ? { build: require_stale.composeBuildPaths({
 			composeDir: options.composeDir,
 			buildRoot: options.buildRoot,
 			workspaceRoot: options.workspaceRoot,
@@ -1359,7 +1360,7 @@ function stackFile(options) {
 		healthcheck: probe(worker.port, "/health")
 	};
 	services.caddy = {
-		image: require_state.DEFAULT_IMAGES.caddy,
+		image: require_stale.DEFAULT_IMAGES.caddy,
 		restart: "unless-stopped",
 		ports: [`${options.https}:443`, `${options.http}:80`],
 		volumes: [
@@ -1402,7 +1403,7 @@ function defaultLayout(root) {
 		gkmRoot: ".",
 		tools: {
 			packageManager: "pnpm",
-			turboVersion: require_state.TURBO_VERSION,
+			turboVersion: require_stale.TURBO_VERSION,
 			monorepo: true
 		},
 		gkmPaths: ["gkm.config.*"]
@@ -1582,8 +1583,8 @@ function edgePorts(env = process.env) {
 const defaultDeps = {
 	docker: dockerCompose,
 	revision: gitRevision,
-	sql: require_state.pgClient,
-	buckets: require_state.bucketClient,
+	sql: require_stale.pgClient,
+	buckets: require_stale.bucketClient,
 	migrate: require_databases.migrateDatabases,
 	probe: httpsProbe,
 	healthAttempts: 90,
@@ -1603,24 +1604,31 @@ async function validateCompose(ctx, deps, options = {}) {
 	if (push && mode !== "build") throw new ComposePushNeedsBuild();
 	if (options.pin && mode !== "pull") throw new ComposePinNeedsPull();
 	const registry = workspace.deploy?.registry;
-	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", require_state.imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
+	if (!registry && (push || mode === "pull")) throw new RegistryRequired(push ? "push" : "pull", require_stale.imageRef(identity, ctx.apps[0] ?? workspace.name, void 0, tag));
 	const runnables = {};
 	const background = {};
 	const manifest = await require_discover.discover({
-		patterns: require_state.constructGlobs(workspace),
+		patterns: require_stale.constructGlobs(workspace),
 		cwd: root,
 		runnables,
 		background
 	});
 	const { secrets, generated } = await stageSecrets(ctx, manifest);
-	if (!push) await require_credentialSchemas.assertStageCredentials({
-		root,
-		patterns: require_state.constructGlobs(workspace),
-		manifest,
-		stage,
-		supplied: secrets?.custom ?? {}
-	});
-	const layout = mode === "build" ? require_state.imageLayout(workspace) : void 0;
+	if (!push) {
+		require_stale.assertNoStaleSecrets({
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+		await require_credentialSchemas.assertStageCredentials({
+			root,
+			patterns: require_stale.constructGlobs(workspace),
+			manifest,
+			stage,
+			supplied: secrets?.custom ?? {}
+		});
+	}
+	const layout = mode === "build" ? require_stale.imageLayout(workspace) : void 0;
 	const composed = composeStack({
 		workspace,
 		manifest,
@@ -1639,7 +1647,7 @@ async function validateCompose(ctx, deps, options = {}) {
 		...layout ? { layout } : {},
 		...push ? { buildOnly: true } : {}
 	});
-	require_state.reportDevServices(ctx, composed.devServices);
+	require_stale.reportDevServices(ctx, composed.devServices);
 	if (mode === "build") assertRedisClient(workspace, composed);
 	const stack = options.pin ? withPinnedImages(composed, options.pin.file, options.pin.digests) : composed;
 	if (mode === "pull" && !ctx.dryRun) await assertImagesExist(deps.docker, tag, [...stack.apps, ...stack.workers]);
@@ -1716,7 +1724,7 @@ async function stageSecrets(ctx, manifest) {
 		secrets: stored,
 		generated: []
 	};
-	const withSeed = require_state.withGeneratedSecrets(stored ?? require_state.initStageSecrets(ctx.stage), manifest);
+	const withSeed = require_stale.withGeneratedSecrets(stored ?? require_stale.initStageSecrets(ctx.stage), manifest);
 	const withLogs = require_workspace.resolveLogs(ctx.workspace.deploy?.compose?.logs) ? withLogsPassword(withSeed.secrets) : {
 		secrets: withSeed.secrets,
 		generated: []
@@ -1854,7 +1862,7 @@ async function prepareBuckets(ctx, run, deps) {
 	if (storage.buckets.length === 0) return;
 	const port = await deps.docker.port(run.ref, "minio", 9e3);
 	const client = deps.buckets(port, storage);
-	const created = [...await require_state.applyBuckets(client, storage.buckets), ...await require_state.applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
+	const created = [...await require_stale.applyBuckets(client, storage.buckets), ...await require_stale.applyPolicies(client, storage.policies)].filter((entry) => entry.created).length;
 	ctx.logger.info(`🪣  Buckets: ${storage.buckets.join(", ")}${created ? ` (${created} change(s))` : ""}`);
 }
 /** Create what the plan names in the stack's Postgres, then migrate it. */
@@ -1862,19 +1870,19 @@ async function prepareDatabases(ctx, run, deps) {
 	const { stack } = run;
 	const workspace = ctx.workspace;
 	const port = await deps.docker.port(run.ref, "postgres", 5432);
-	const statements = require_state.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
+	const statements = require_stale.postgresStatements(stack.plan, workspace.name, stack.credential.seed);
 	if (statements.length > 0) {
 		ctx.logger.info("🗄️  Creating databases, roles and grants…");
-		await require_state.applyPostgres(deps.sql(port, stack.credential.master), statements);
+		await require_stale.applyPostgres(deps.sql(port, stack.credential.master), statements);
 	}
 	const sources = {};
 	const manifest = await require_discover.discover({
-		patterns: require_state.constructGlobs(workspace),
+		patterns: require_stale.constructGlobs(workspace),
 		cwd: workspace.root,
 		sources
 	});
-	const env = require_state.envFor(stack.plan, {
-		ports: { [require_state.primaryPortKey("postgres")]: port },
+	const env = require_stale.envFor(stack.plan, {
+		ports: { [require_stale.primaryPortKey("postgres")]: port },
 		project: workspace.name,
 		master: stack.credential.master,
 		...stack.credential.seed ? { seed: stack.credential.seed } : {}
@@ -1976,13 +1984,13 @@ async function releaseCompose(ctx, run, deps) {
 * the tag resolved to.
 */
 async function recordImages(ctx, run) {
-	const journal = await require_state.DeployJournal.open(ctx.state, ctx.stage, () => require_state.createEmptyState(ctx.stage, "", ""));
+	const journal = await require_stale.DeployJournal.open(ctx.state, ctx.stage, () => require_stale.createEmptyState(ctx.stage, "", ""));
 	for (const app of [...run.stack.apps, ...run.stack.workers]) {
 		const image = run.images[app.app] ?? {
 			ref: app.ref,
 			tag: app.tag
 		};
-		require_state.recordRelease(journal.state, app.app, image);
+		require_stale.recordRelease(journal.state, app.app, image);
 	}
 	journal.state.identity = ctx.identity.key;
 	await journal.save();
@@ -2195,7 +2203,7 @@ async function writeStack(root, dir, stack) {
 	if (stack.redis && stack.compose.services["redis"]?.env_file) await write((0, node_path.join)(dir, `${REDIS_SERVICE}.env`), envFile(stack.redis.env), 384);
 	for (const entry of await (0, node_fs_promises.readdir)(dir)) if (entry.endsWith(".credentials")) await (0, node_fs_promises.rm)((0, node_path.join)(dir, entry));
 	for (const [path, content] of Object.entries(stack.dockerfiles)) await write((0, node_path.join)(root, path), content);
-	await require_state.ensureDockerignore(require_state.findBuildRoot(root));
+	await require_stale.ensureDockerignore(require_stale.findBuildRoot(root));
 	return files;
 }
 function composeYaml(stack) {
@@ -2346,4 +2354,4 @@ Object.defineProperty(exports, "stackOverrideFile", {
 	}
 });
 
-//# sourceMappingURL=compose-UKyv_1yU.cjs.map
+//# sourceMappingURL=compose-CePlrbUw.cjs.map