@geekmidas/cli 10.0.0-alpha.76 → 10.0.0-alpha.78

package/dist/{state-CUecOCNJ.mjs → stale-C5FqIVc8.mjs}

@@ -2,10 +2,10 @@ import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-BPelzeGW.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { F as UnknownSecretsStoreProvider, O as TEST_STAGE, h as getPublicEnvPrefix, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs } from "./workspace-QUTqYmVy.mjs";
+import { O as TEST_STAGE, R as UnknownSecretsStoreProvider, h as getPublicEnvPrefix, m as PUBLIC_ENV_PREFIXES, n as allConstructGlobs } from "./workspace-BBdqmkch.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
 import { n as runtimeFor, r as generateTelemetryModule } from "./EndpointGenerator-DftalLYg.mjs";
-import { c as runtimeOf } from "./resolve-C1muFos5.mjs";
+import { c as runtimeOf } from "./resolve-mvaystiE.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-5looQ3gB.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
@@ -91,10 +91,6 @@ function toEmbeddableSecrets(secrets) {
 			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
 			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
 			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
-		},
-		...secrets.services.pgboss && {
-			PGBOSS_DB_USER: secrets.services.pgboss.username,
-			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
 		}
 	};
 }
@@ -661,24 +657,18 @@ async function savePortState(workspaceRoot, ports) {
 	await writeFile(join(workspaceRoot, PORT_STATE_PATH), `${JSON.stringify(ports, null, 2)}\n`);
 }
 /**
-* Load and flatten secrets for an app from encrypted storage.
-* For workspace app: maps {APP}_DATABASE_URL → DATABASE_URL.
+* Load and flatten a stage's secrets from its store.
+*
+* Every key as stored — nothing renamed. An app's database URL is its
+* construct's key, derived by reconcile, and never a stored per-app value
+* mapped onto `DATABASE_URL`.
 * @internal Exported for testing
 */
-async function loadSecretsForApp(store, stage, appName) {
-	let secrets = {};
+async function loadSecretsForApp(store, stage) {
 	const stageSecrets = await store.read(stage);
-	if (stageSecrets) {
-		logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
-		secrets = toEmbeddableSecrets(stageSecrets);
-	}
-	if (Object.keys(secrets).length === 0) return {};
-	if (!appName) return secrets;
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) mapped.DATABASE_URL = appDbUrl;
-	return mapped;
+	if (!stageSecrets) return {};
+	logger$1.log(`🔐 Loading secrets from stage: ${stage}`);
+	return toEmbeddableSecrets(stageSecrets);
 }
 /**
 * Walk up the directory tree to find the root containing .gkm/secrets/.
@@ -786,7 +776,7 @@ async function prepareEntryCredentials(options) {
 	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
 	const stage = options.stage ?? workspace?.stages.local;
 	const store = stage ? workspace ? await secretsStoreFor(workspace, stage) : new FileSecretsStore(secretsRoot) : void 0;
-	const credentials = store && stage ? await loadSecretsForApp(store, stage, appName) : {};
+	const credentials = store && stage ? await loadSecretsForApp(store, stage) : {};
 	credentials.PORT = String(resolvedPort);
 	if (appInfo?.app.type === "mobile") credentials.RCT_METRO_PORT = String(resolvedPort);
 	const declaredKeys = [];
@@ -3098,13 +3088,13 @@ function sitePublicArgs(manifest, appName, env) {
 * network for a service another service calls, public for what a browser is
 * handed. `gkm compose` asks twice, once for each.
 */
-function networkEnv(plan, options) {
+function networkEnv(plan, options, hostOf = (container) => container) {
 	const placeholders = {};
 	const targets = /* @__PURE__ */ new Map();
 	let next = 49152;
 	for (const container of [...plan.containers].sort()) for (const port of portsOf(container, plan.fakes)) {
 		placeholders[port.key] = next;
-		targets.set(next, `${container}:${port.inside}`);
+		targets.set(next, `${hostOf(container)}:${port.inside}`);
 		next += 1;
 	}
 	for (const key of portKeys(plan.containers, plan.fakes)) placeholders[key] ??= next++;
@@ -6497,6 +6487,96 @@ function setPostgresBackupId(state, backupId) {
 	if (state.backups) state.backups.postgresBackupId = backupId;
 }
 //#endregion
-export { LOCAL_CA_PATH as $, applicationName as $t, ExternalServicesNotConfigured as A, providerOf as At, suppliedOnly as B, isPortAvailable as Bt, NoDomainForStage as C, WORKER_PORT as Ct, otelEnv as D, isImageBuild as Dt, isOtlpDestination as E, imageBuildCredentials as Et, externalServices as F, portKeys as Ft, QueueGenerator as G, secretsStoreFor as Gt, WorkerGenerator as H, loadSecretsForApp as Ht, manifestServiceDeclarations as I, primaryPortKey as It, backendsOf as J, FileSecretsStore as Jt, CronGenerator as K, storeFromConfig as Kt, parseDevServices as L, createCredentialsPreload as Lt, UnknownDevService as M, DEFAULT_IMAGES as Mt, assertExternalServices as N, describeServices as Nt, DEV_SERVICES as O, cacheBackendFor as Ot, devServicesUsed as P, fakeKey as Pt, workspace_exports as Q, readKey as Qt, reportDevServices as R, createEntryWrapper as Rt, validateImageRef as S, TURBO_VERSION as St, resolveHost as T, findBuildRoot as Tt, workerBundleName as U, prepareEntryCredentials as Ut, workerUnits as V, loadEnvFiles as Vt, workerEntryDir as W, isRemoteStore as Wt, derivedContainers as X, keystoreProject as Xt, constructGlobs as Y, getKeyPath as Yt, reconcileWorkspace as Z, projectKey as Zt, appDockerfile as _, planFor as _t, recordRelease as a, ownershipMarker as an, postgresDatabaseNames as at, workerDockerfile as b, composeBuildPaths as bt, setBackupState as c, maskPassword as cn, composeFor as ct, setGeneratedSecret as d, withCustomSecret as dn, appEnvKeys as dt, deployIdentity as en, forgetState as et, setPostgresBackupId as f, dockerfileOf as ft, DockerPushFailed as g, localRolePassword as gt, DockerBuildFailed as h, envFor as ht, isDnsVerified as i, markerOf as in, bucketPolicies as it, STORAGE_KEY_PAIR as j, storageBackendFor as jt, DevServicesNeedServerTarget as k, eventsBackendFor as kt, setDnsRecord as l, storage_exports as ln, bucketClient as lt, withGeneratedSecrets as m, workerEnvKeys as mt, getBackupState as n, imageRef as nn, applyPolicies as nt, recordRollback as o, projectName as on, postgresStatements as ot, DeployJournal as p, networkEnv as pt, FAKE_ENV as q, store_exports as qt, getGeneratedSecret as r, isOwnedBy as rn, applyPostgres as rt, setApplicationId as s, initStageSecrets as sn, quoteIdentifier as st, createEmptyState as t, imageName as tn, applyBuckets as tt, setDnsVerification as u, toEmbeddableSecrets as un, pgClient as ut, dockerCommand as v, resourceName as vt, isMainFrontendApp as w, detectPackageManager as wt, workerDockerfileOf as x, imageLayout as xt, ensureDockerignore as y, hostFor as yt, requiredStageKeys as z, findAvailablePort as zt };
+//#region src/secrets/stale.ts
+/**
+* Stored secrets an older gkm generated that now shadow a derived value.
+*
+* Before constructs, initialising a stage wrote an address for each app into
+* its custom secrets: `<APP>_DATABASE_URL` as a `postgresql://…@localhost`
+* URL with a password of its own, and `http://localhost:<port>` for a site or
+* an auth server. Those keys are now a construct's — `database.schema('AuthDatabase')`
+* provides `AUTH_DATABASE_URL`, `new BetterAuth('Auth')` provides `AUTH_URL`
+* — and a deploy derives them. A value the stage holds is a value set by hand,
+* and set by hand wins: the container is handed `localhost`, where nothing
+* answers, with a password no role has.
+*
+* So a deploy refuses such a stage rather than run it, naming each key and
+* the command that removes it. Nothing is deleted for the user: the value is
+* theirs, and only they can say it is stale. A URL that names a real host — a
+* managed database — is a deliberate choice and still wins.
+*/
+/** The kinds whose URL an older gkm wrote into a stage's secrets. */
+const ADDRESSED = /* @__PURE__ */ new Set([
+	"database",
+	"database-reader",
+	"database-schema",
+	"rest-api",
+	"site"
+]);
+/** Hosts that are this machine — never anything, inside a container. */
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+/**
+* A stage holds a construct's address as a custom secret, pointing at
+* `localhost` — what an older `gkm secrets:init`, `gkm setup` or `gkm init`
+* generated. Set by hand wins over derived, so the app would be handed it.
+*/
+var StaleStageSecrets = class extends Error {
+	stage;
+	stale;
+	constructor(stage, stale) {
+		const one = stale.length === 1;
+		super(`The stage '${stage}' holds ${one ? "a value" : "values"} an older gkm generated for ${one ? "an address a construct" : "addresses constructs"} now ${one ? "provides" : "provide"}:\n` + stale.map((s) => `  ${s.key}: ${s.construct}'s, stored pointing at ${s.host}`).join("\n") + `
+A stored value wins over the derived one, so the app would be handed an address where nothing answers inside its container. Remove ${one ? "it" : "each"}, and the construct's own value is used:\n` + stale.map((s) => `  gkm secrets:unset ${s.key} --stage ${stage}`).join("\n") + "\nA managed service set with its real host is not affected.");
+		this.stage = stage;
+		this.stale = stale;
+		this.name = "StaleStageSecrets";
+	}
+};
+/** The host a stored value names, if it is a URL. */
+function hostOf(value) {
+	try {
+		return new URL(value).hostname;
+	} catch {
+		return;
+	}
+}
+/**
+* Each stored key that a construct provides an address for, holding an
+* address on this machine.
+*/
+function staleStageSecrets(manifest, supplied) {
+	const stale = [];
+	for (const [id, declaration] of Object.entries(manifest)) {
+		if (!ADDRESSED.has(declaration.kind)) continue;
+		const key = providedKeyFor(id, declaration.kind, "url");
+		const value = supplied[key];
+		if (value === void 0) continue;
+		const host = hostOf(value);
+		if (host === void 0 || !LOOPBACK.has(host)) continue;
+		stale.push({
+			key,
+			construct: id,
+			host
+		});
+	}
+	return stale.sort((a, b) => a.key.localeCompare(b.key));
+}
+/**
+* Refuse a stage whose stored secrets would shadow a construct's address with
+* `localhost`.
+*
+* @throws {StaleStageSecrets} naming each key and the command removing it
+*/
+function assertNoStaleSecrets(options) {
+	const stale = staleStageSecrets(options.manifest, options.supplied);
+	if (stale.length > 0) throw new StaleStageSecrets(options.stage, stale);
+}
+//#endregion
+export { workspace_exports as $, readKey as $t, DevServicesNeedServerTarget as A, eventsBackendFor as At, requiredStageKeys as B, findAvailablePort as Bt, validateImageRef as C, TURBO_VERSION as Ct, isOtlpDestination as D, imageBuildCredentials as Dt, resolveHost as E, findBuildRoot as Et, devServicesUsed as F, fakeKey as Ft, workerEntryDir as G, isRemoteStore as Gt, workerUnits as H, loadEnvFiles as Ht, externalServices as I, portKeys as It, FAKE_ENV as J, store_exports as Jt, QueueGenerator as K, secretsStoreFor as Kt, manifestServiceDeclarations as L, primaryPortKey as Lt, STORAGE_KEY_PAIR as M, storageBackendFor as Mt, UnknownDevService as N, DEFAULT_IMAGES as Nt, otelEnv as O, isImageBuild as Ot, assertExternalServices as P, describeServices as Pt, reconcileWorkspace as Q, projectKey as Qt, parseDevServices as R, createCredentialsPreload as Rt, workerDockerfileOf as S, imageLayout as St, isMainFrontendApp as T, detectPackageManager as Tt, WorkerGenerator as U, loadSecretsForApp as Ut, suppliedOnly as V, isPortAvailable as Vt, workerBundleName as W, prepareEntryCredentials as Wt, constructGlobs as X, getKeyPath as Xt, backendsOf as Y, FileSecretsStore as Yt, derivedContainers as Z, keystoreProject as Zt, DockerPushFailed as _, localRolePassword as _t, isDnsVerified as a, markerOf as an, bucketPolicies as at, ensureDockerignore as b, hostFor as bt, setApplicationId as c, initStageSecrets as cn, quoteIdentifier as ct, setDnsVerification as d, toEmbeddableSecrets as dn, pgClient as dt, applicationName as en, LOCAL_CA_PATH as et, setGeneratedSecret as f, withCustomSecret as fn, appEnvKeys as ft, DockerBuildFailed as g, envFor as gt, withGeneratedSecrets as h, workerEnvKeys as ht, getGeneratedSecret as i, isOwnedBy as in, applyPostgres as it, ExternalServicesNotConfigured as j, providerOf as jt, DEV_SERVICES as k, cacheBackendFor as kt, setBackupState as l, maskPassword as ln, composeFor as lt, DeployJournal as m, networkEnv as mt, createEmptyState as n, imageName as nn, applyBuckets as nt, recordRelease as o, ownershipMarker as on, postgresDatabaseNames as ot, setPostgresBackupId as p, dockerfileOf as pt, CronGenerator as q, storeFromConfig as qt, getBackupState as r, imageRef as rn, applyPolicies as rt, recordRollback as s, projectName as sn, postgresStatements as st, assertNoStaleSecrets as t, deployIdentity as tn, forgetState as tt, setDnsRecord as u, storage_exports as un, bucketClient as ut, appDockerfile as v, planFor as vt, NoDomainForStage as w, WORKER_PORT as wt, workerDockerfile as x, composeBuildPaths as xt, dockerCommand as y, resourceName as yt, reportDevServices as z, createEntryWrapper as zt };
 
-//# sourceMappingURL=state-CUecOCNJ.mjs.map
+//# sourceMappingURL=stale-C5FqIVc8.mjs.map