@geekmidas/cli 10.0.0-alpha.84 → 10.0.0-alpha.86

package/dist/{workspace-Drz4jsvy.mjs → workspace-D2CYLMCW.mjs}

@@ -118,6 +118,237 @@ function checkComposeStages(config, stages) {
 	}
 }
 //#endregion
+//#region src/providers/s3/errors.ts
+/** What the `s3` provider refuses, and how each is put right. */
+/** An `objects` entry for `s3` with a field it does not take or cannot use. */
+var S3ProviderConfigInvalid = class extends Error {
+	stage;
+	field;
+	value;
+	expected;
+	constructor(stage, field, value, expected) {
+		super(`deploy.objects.${stage}.${field} is ${JSON.stringify(value)}; ${expected}.`);
+		this.stage = stage;
+		this.field = field;
+		this.value = value;
+		this.expected = expected;
+		this.name = "S3ProviderConfigInvalid";
+	}
+};
+/** No region anywhere to create the stage's buckets in. */
+var S3RegionRequired = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The s3 provider has no region for the stage '${stage}'. Name one in gkm.config.ts: deploy: { objects: { ${stage}: { provider: 's3', region: 'eu-west-1' } } } — or set AWS_REGION.`);
+		this.stage = stage;
+		this.name = "S3RegionRequired";
+	}
+};
+/** The good name and every suffixed one are taken by other accounts. */
+var BucketNameUnavailable = class extends Error {
+	id;
+	tried;
+	constructor(id, tried) {
+		super(`Every name tried for the bucket '${id}' is taken by another AWS account: ${tried.join(", ")}. Set deploy.namespace in gkm.config.ts to something more particular to you, and run the provision again.`);
+		this.id = id;
+		this.tried = tried;
+		this.name = "BucketNameUnavailable";
+	}
+};
+/** A bucket in this account carries another project's tag. */
+var BucketOwnedByAnotherProject = class extends Error {
+	bucket;
+	owner;
+	project;
+	constructor(bucket, owner, project) {
+		super(`The bucket '${bucket}' is in this account and tagged gkm:project=${owner}, not ${project}: another project's. gkm never adopts it. Set deploy.namespace in gkm.config.ts so this project names its buckets differently.`);
+		this.bucket = bucket;
+		this.owner = owner;
+		this.project = project;
+		this.name = "BucketOwnedByAnotherProject";
+	}
+};
+/** The bucket the stage's state names exists, and this account cannot reach it. */
+var RecordedBucketUnreachable = class extends Error {
+	id;
+	bucket;
+	constructor(id, bucket) {
+		super(`The stage's state records '${bucket}' as the bucket for '${id}', and this account cannot reach it — it is in another account, or the credentials are not the stage account's. Run with the account that created it (--profile).`);
+		this.id = id;
+		this.bucket = bucket;
+		this.name = "RecordedBucketUnreachable";
+	}
+};
+/** An IAM user by gkm's name exists, and gkm did not create it for this stage. */
+var IamUserNotOwned = class extends Error {
+	user;
+	project;
+	stage;
+	constructor(user, project, stage) {
+		super(`The IAM user '${user}' exists and is not tagged gkm:project=${project}, gkm:stage=${stage}, so gkm leaves it alone. Rename or delete it, or set deploy.namespace in gkm.config.ts so gkm names its users differently.`);
+		this.user = user;
+		this.project = project;
+		this.stage = stage;
+		this.name = "IamUserNotOwned";
+	}
+};
+/** The user already has the two access keys IAM allows. */
+var AccessKeyLimit = class extends Error {
+	user;
+	keys;
+	constructor(user, keys) {
+		super(`The IAM user '${user}' already has two access keys (${keys.join(", ")}), the most IAM allows, and gkm needs to issue one. Delete the one the stage does not use (aws iam delete-access-key --user-name ${user} --access-key-id …), then run the provision again.`);
+		this.user = user;
+		this.keys = keys;
+		this.name = "AccessKeyLimit";
+	}
+};
+/** `--rotate-keys` while the last rotation's old key is still active. */
+var RotationInProgress = class extends Error {
+	id;
+	previous;
+	stage;
+	constructor(id, previous, stage) {
+		super(`The bucket '${id}' is mid-rotation: its old key ${previous} is still active. Deploy '${stage}', then run gkm setup --stage ${stage} — or pass --retire-old-keys to delete it now — before rotating again.`);
+		this.id = id;
+		this.previous = previous;
+		this.stage = stage;
+		this.name = "RotationInProgress";
+	}
+};
+/** The stage's secrets point the bucket's key at a bucket gkm did not provision. */
+var BucketKeySetElsewhere = class extends Error {
+	key;
+	bucket;
+	found;
+	stage;
+	constructor(key, bucket, found, stage) {
+		super(`${key} in the stage '${stage}' points at the bucket '${found}', and the s3 provider manages '${bucket}' for it. Remove the key (gkm secrets:unset ${key} --stage ${stage}) to have the provider write its own, or set deploy.objects.${stage} to 'external' to keep yours.`);
+		this.key = key;
+		this.bucket = bucket;
+		this.found = found;
+		this.stage = stage;
+		this.name = "BucketKeySetElsewhere";
+	}
+};
+/** `verify()`: a provisioned bucket the stage's key cannot reach. */
+var ProvisionedBucketUnreachable = class extends Error {
+	id;
+	bucket;
+	stage;
+	reason;
+	constructor(id, bucket, stage, reason) {
+		super(`The bucket '${bucket}' (${id}) cannot be reached with the key in the stage '${stage}''s secrets: ${reason}. Run gkm setup --stage ${stage} with the stage account's credentials to create or repair it, then deploy again.`);
+		this.id = id;
+		this.bucket = bucket;
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "ProvisionedBucketUnreachable";
+	}
+};
+//#endregion
+//#region src/providers/s3/config.ts
+const FIELDS = [
+	"provider",
+	"region",
+	"versioning"
+];
+/** An AWS region code: `eu-west-1`, `us-gov-west-1`, `ap-southeast-4`. */
+const REGION = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function checkS3Config(stage, config) {
+	const entry = config;
+	for (const field of Object.keys(entry)) if (!FIELDS.includes(field)) throw new S3ProviderConfigInvalid(stage, field, entry[field], `the s3 provider takes ${FIELDS.slice(1).join(" and ")} only`);
+	if (entry.region !== void 0) {
+		if (typeof entry.region !== "string" || !REGION.test(entry.region)) throw new S3ProviderConfigInvalid(stage, "region", entry.region, "set it to an AWS region code, like 'eu-west-1'");
+	}
+	if (entry.versioning !== void 0 && typeof entry.versioning !== "boolean") throw new S3ProviderConfigInvalid(stage, "versioning", entry.versioning, "set it to true to keep previous versions of every object, or leave it out");
+	return entry;
+}
+/** How the s3 provider's provisioning credentials are supplied. */
+const S3_PROVISIONING = {
+	env: [
+		"AWS_PROFILE",
+		"AWS_ACCESS_KEY_ID",
+		"AWS_SECRET_ACCESS_KEY",
+		"AWS_SESSION_TOKEN"
+	],
+	describe: "the stage's AWS account — --profile <name>, AWS_PROFILE, or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (in CI, what aws-actions/configure-aws-credentials exports)"
+};
+//#endregion
+//#region src/providers/config.ts
+/**
+* `deploy.<kind>.<stage>`, read: what backs one kind of construct on a stage.
+*
+* Kept free of the providers themselves — of the AWS SDK and the graph — so
+* the workspace schema can check an entry with the words a deploy would use,
+* the way `checkStageTelemetry` does for `deploy.telemetry`.
+*/
+/** Each provider's config check, by kind and name. */
+const CHECKS = { objects: { s3: checkS3Config } };
+/** How each provider's provisioning credentials are supplied, by kind and name. */
+const PROVISIONING = { objects: { s3: S3_PROVISIONING } };
+/** How `name`'s provisioning credentials are supplied, for messages. */
+function provisioningOf(kind, name) {
+	return Object.hasOwn(PROVISIONING[kind], name) ? PROVISIONING[kind][name] : void 0;
+}
+/** The `provider:` names a kind accepts. */
+function providerNamesOf(kind) {
+	return Object.keys(CHECKS[kind]).sort();
+}
+/** What `deploy.<kind>.<stage>` may be, for messages. */
+function accepted(kind) {
+	return [
+		"'external'",
+		...providerNamesOf(kind).map((name) => `{ provider: '${name}' }`),
+		"false"
+	].join(", ");
+}
+/** An entry that names no provider gkm has, or is not an entry at all. */
+var UnknownStageProvider = class extends Error {
+	kind;
+	stage;
+	value;
+	constructor(kind, stage, value) {
+		super(`deploy.${kind}.${stage} is ${JSON.stringify(value)}, which is not a provider gkm has for ${kind}. It takes ${accepted(kind)}.`);
+		this.kind = kind;
+		this.stage = stage;
+		this.value = value;
+		this.name = "UnknownStageProvider";
+	}
+};
+/**
+* One stage's entry checked: `'external'`, `false`, or a provider's object
+* that its own check accepts.
+*
+* @throws {UnknownStageProvider} for anything else — `'minio'` included
+*/
+function checkStageProvider(kind, stage, value) {
+	if (value === "external" || value === false) return value;
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const name = value.provider;
+		const check = typeof name === "string" && Object.hasOwn(CHECKS[kind], name) ? CHECKS[kind][name] : void 0;
+		if (check) return check(stage, value);
+	}
+	throw new UnknownStageProvider(kind, stage, value);
+}
+/**
+* What backs `kind` on `stage`: the local stage is always `external` here —
+* `gkm dev` runs its own — and a deployed stage that names nothing is too.
+*/
+function stageProvider(workspace, kind, stage) {
+	if (stage === workspace.stages?.local) return { mode: "external" };
+	const value = workspace.deploy?.[kind]?.[stage];
+	if (value === void 0) return { mode: "external" };
+	const entry = checkStageProvider(kind, stage, value);
+	if (entry === "external") return { mode: "external" };
+	if (entry === false) return { mode: "none" };
+	return {
+		mode: "provider",
+		name: entry.provider,
+		config: entry
+	};
+}
+//#endregion
 //#region src/compose/logsConfig.ts
 /**
 * The self-hosted telemetry provider's options, read: how the stack's
@@ -815,6 +1046,22 @@ const TelemetryConfigSchema = record(string(), union([
 	}
 });
 /**
+* `deploy.objects` — what backs each deployed stage's buckets. The rules are
+* `checkStageProvider`'s, so the schema and a provision run refuse the same
+* entries with the same words.
+*/
+const ObjectsConfigSchema = record(string(), unknown()).superRefine((entries, ctx) => {
+	for (const [stage, value] of Object.entries(entries)) try {
+		checkStageProvider("objects", stage, value);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
+});
+/**
 * Deploy configuration schema.
 */
 const DeployConfigSchema = object({
@@ -835,6 +1082,7 @@ const DeployConfigSchema = object({
 	dokploy: DokployWorkspaceConfigSchema.optional(),
 	compose: ComposeWorkspaceConfigSchema.optional(),
 	telemetry: TelemetryConfigSchema.optional(),
+	objects: ObjectsConfigSchema.optional(),
 	dns: DnsConfigWithLegacySchema.optional(),
 	backups: BackupsConfigSchema.optional()
 });
@@ -1505,6 +1753,6 @@ function getEndpointForStage(dokployConfig, stage) {
 	return dokployConfig.endpoint;
 }
 //#endregion
-export { UndeclaredStage as A, certificateFor as B, getDeployTargetError as C, validateWorkspaceConfig as D, safeValidateWorkspaceConfig as E, resolveStageTelemetry as F, SECRETS_STORE_PROVIDERS as H, stageSampleRate as I, telemetryEnv as L, deployedProblems as M, stageProblems as N, InvalidStages as O, otlpTelemetryEnv as P, LOGS_PORT as R, formatValidationErrors as S, isPhase2DeployTarget as T, UnknownSecretsStoreProvider as U, proxyFor as V, stripPublicPrefix as _, assertNoMovedDeployKeys as a, SUPPORTED_DEPLOY_TARGETS as b, getAppBuildOrder as c, normalizeWorkspace as d, processConfig as f, getPublicEnvPrefix as g, PUBLIC_ENV_PREFIXES as h, appConstructGlobs as i, assertDeployedStage as j, TEST_STAGE as k, getAppGkmConfig as l, wrapSingleAppAsWorkspace as m, InvalidWorkspaceConfig as n, constructPatterns as o, workspaceConstructGlobs as p, allConstructGlobs as r, defineWorkspace as s, DokployRegistryMoved as t, getEndpointForStage as u, isWorkspaceConfig as v, isDeployTargetSupported as w, WorkspaceConfigSchema as x, PHASE_2_DEPLOY_TARGETS as y, ComposeTlsFileMissing as z };
+export { ComposeTlsFileMissing as $, UndeclaredStage as A, provisioningOf as B, getDeployTargetError as C, validateWorkspaceConfig as D, safeValidateWorkspaceConfig as E, resolveStageTelemetry as F, BucketKeySetElsewhere as G, S3_PROVISIONING as H, stageSampleRate as I, IamUserNotOwned as J, BucketNameUnavailable as K, telemetryEnv as L, deployedProblems as M, stageProblems as N, InvalidStages as O, otlpTelemetryEnv as P, S3RegionRequired as Q, LOGS_PORT as R, formatValidationErrors as S, isPhase2DeployTarget as T, checkS3Config as U, stageProvider as V, AccessKeyLimit as W, RecordedBucketUnreachable as X, ProvisionedBucketUnreachable as Y, RotationInProgress as Z, stripPublicPrefix as _, assertNoMovedDeployKeys as a, SUPPORTED_DEPLOY_TARGETS as b, getAppBuildOrder as c, normalizeWorkspace as d, certificateFor as et, processConfig as f, getPublicEnvPrefix as g, PUBLIC_ENV_PREFIXES as h, appConstructGlobs as i, assertDeployedStage as j, TEST_STAGE as k, getAppGkmConfig as l, wrapSingleAppAsWorkspace as m, InvalidWorkspaceConfig as n, SECRETS_STORE_PROVIDERS as nt, constructPatterns as o, workspaceConstructGlobs as p, BucketOwnedByAnotherProject as q, allConstructGlobs as r, UnknownSecretsStoreProvider as rt, defineWorkspace as s, DokployRegistryMoved as t, proxyFor as tt, getEndpointForStage as u, isWorkspaceConfig as v, isDeployTargetSupported as w, WorkspaceConfigSchema as x, PHASE_2_DEPLOY_TARGETS as y, UnknownStageProvider as z };
 
-//# sourceMappingURL=workspace-Drz4jsvy.mjs.map
+//# sourceMappingURL=workspace-D2CYLMCW.mjs.map