@geekmidas/cli 10.0.0-alpha.76 → 10.0.0-alpha.78

package/dist/{state-C2qi0iQw.cjs → stale-BsiPJI7Y.cjs}

@@ -2,10 +2,10 @@ const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-D1It5r_h.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-DOm81oUo.cjs");
+const require_workspace = require("./workspace-Bp8FEkF-.cjs");
 const require_config = require("./config.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-CP6sBvQV.cjs");
-const require_resolve = require("./resolve-Fa1Ii0BK.cjs");
+const require_resolve = require("./resolve-CEaqRBzY.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-CajwOa5W.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
@@ -93,10 +93,6 @@ function toEmbeddableSecrets(secrets) {
 			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
 			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
 			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
-		},
-		...secrets.services.pgboss && {
-			PGBOSS_DB_USER: secrets.services.pgboss.username,
-			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
 		}
 	};
 }
@@ -663,24 +659,18 @@ async function savePortState(workspaceRoot, ports) {
 	await (0, node_fs_promises.writeFile)((0, node_path.join)(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
 }
 /**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* Load and flatten a stage's secrets from its store.
+*
+* Every key as stored — nothing renamed. An app's database URL is its
+* construct's key, derived by reconcile, and never a stored per-app value
+* mapped onto `DATABASE_URL`.
 * @internal Exported for testing
 */
-async function loadSecretsForApp(store, stage, appName) {
-	let secrets = {};
+async function loadSecretsForApp(store, stage) {
 	const stageSecrets = await store.read(stage);
-	if (stageSecrets) {
-		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
-		secrets = toEmbeddableSecrets(stageSecrets);
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
+	if (!stageSecrets) return {};
+	logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
+	return toEmbeddableSecrets(stageSecrets);
 }
 /**
 * Walk up the directory tree to find the root containing .gkm/secrets/.
@@ -788,7 +778,7 @@ async function prepareEntryCredentials(options) {
 	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
 	const stage = options.stage ?? workspace?.stages.local;
 	const store = stage ? workspace ? await secretsStoreFor(workspace, stage) : new FileSecretsStore(secretsRoot) : void 0;
-	const credentials = store && stage ? await loadSecretsForApp(store, stage, appName) : {};
+	const credentials = store && stage ? await loadSecretsForApp(store, stage) : {};
 	credentials.PORT = String(resolvedPort);
 	if (appInfo?.app.type === "mobile") credentials.RCT_METRO_PORT = String(resolvedPort);
 	const declaredKeys = [];
@@ -3100,13 +3090,13 @@ function sitePublicArgs(manifest, appName, env) {
 * network for a service another service calls, public for what a browser is
 * handed. `gkm compose` asks twice, once for each.
 */
-function networkEnv(plan, options) {
+function networkEnv(plan, options, hostOf = (container) => container) {
 	const placeholders = {};
 	const targets = /* @__PURE__ */ new Map();
 	let next = 49152;
 	for (const container of [...plan.containers].sort()) for (const port of portsOf(container, plan.fakes)) {
 		placeholders[port.key] = next;
-		targets.set(next, `${container}:${port.inside}`);
+		targets.set(next, `${hostOf(container)}:${port.inside}`);
 		next += 1;
 	}
 	for (const key of portKeys(plan.containers, plan.fakes)) placeholders[key] ??= next++;
@@ -6505,6 +6495,96 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
+//#region src/secrets/stale.ts
+/**
+* Stored secrets an older gkm generated that now shadow a derived value.
+*
+* Before constructs, initialising a stage wrote an address for each app into
+* its custom secrets: `<APP>_DATABASE_URL` as a `postgresql://…@localhost`
+* URL with a password of its own, and `http://localhost:<port>` for a site or
+* an auth server. Those keys are now a construct's — `database.schema('AuthDatabase')`
+* provides `AUTH_DATABASE_URL`, `new BetterAuth('Auth')` provides `AUTH_URL`
+* — and a deploy derives them. A value the stage holds is a value set by hand,
+* and set by hand wins: the container is handed `localhost`, where nothing
+* answers, with a password no role has.
+*
+* So a deploy refuses such a stage rather than run it, naming each key and
+* the command that removes it. Nothing is deleted for the user: the value is
+* theirs, and only they can say it is stale. A URL that names a real host — a
+* managed database — is a deliberate choice and still wins.
+*/
+/** The kinds whose URL an older gkm wrote into a stage's secrets. */
+const ADDRESSED = /* @__PURE__ */ new Set([
+	"database",
+	"database-reader",
+	"database-schema",
+	"rest-api",
+	"site"
+]);
+/** Hosts that are this machine — never anything, inside a container. */
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+/**
+* A stage holds a construct's address as a custom secret, pointing at
+* `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
+* generated. Set by hand wins over derived, so the app would be handed it.
+*/
+var StaleStageSecrets = class extends Error {
+	stage;
+	stale;
+	constructor(stage, stale) {
+		const one = stale.length === 1;
+		super(`The stage '${stage}' holds ${one ? "a value" : "values"} an older gkm generated for ${one ? "an address a construct" : "addresses constructs"} now ${one ? "provides" : "provide"}:\n` + stale.map((s) => `  ${s.key}: ${s.construct}'s, stored pointing at ${s.host}`).join("\n") + `
+A stored value wins over the derived one, so the app would be handed an address where nothing answers inside its container. Remove ${one ? "it" : "each"}, and the construct's own value is used:\n` + stale.map((s) => `  gkm secrets:unset ${s.key} --stage ${stage}`).join("\n") + "\nA managed service set with its real host is not affected.");
+		this.stage = stage;
+		this.stale = stale;
+		this.name = "StaleStageSecrets";
+	}
+};
+/** The host a stored value names, if it is a URL. */
+function hostOf(value) {
+	try {
+		return new URL(value).hostname;
+	} catch {
+		return;
+	}
+}
+/**
+* Each stored key that a construct provides an address for, holding an
+* address on this machine.
+*/
+function staleStageSecrets(manifest, supplied) {
+	const stale = [];
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!ADDRESSED.has(declaration.kind)) continue;
+		const key = (0, _geekmidas_manifest.providedKeyFor)(id, declaration.kind, "url");
+		const value = supplied[key];
+		if (value === void 0) continue;
+		const host = hostOf(value);
+		if (host === void 0 || !LOOPBACK.has(host)) continue;
+		stale.push({
+			key,
+			construct: id,
+			host
+		});
+	}
+	return stale.sort((a, b) => a.key.localeCompare(b.key));
+}
+/**
+* Refuse a stage whose stored secrets would shadow a construct's address with
+* `localhost`.
+*
+* @throws {StaleStageSecrets} naming each key and the command removing it
+*/
+function assertNoStaleSecrets(options) {
+	const stale = staleStageSecrets(options.manifest, options.supplied);
+	if (stale.length > 0) throw new StaleStageSecrets(options.stage, stale);
+}
+//#endregion
 Object.defineProperty(exports, "CronGenerator", {
 	enumerable: true,
 	get: function() {
@@ -6655,6 +6735,12 @@ Object.defineProperty(exports, "assertExternalServices", {
 		return assertExternalServices;
 	}
 });
+Object.defineProperty(exports, "assertNoStaleSecrets", {
+	enumerable: true,
+	get: function() {
+		return assertNoStaleSecrets;
+	}
+});
 Object.defineProperty(exports, "backendsOf", {
 	enumerable: true,
 	get: function() {
@@ -7220,4 +7306,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=state-C2qi0iQw.cjs.map
+//# sourceMappingURL=stale-BsiPJI7Y.cjs.map