@geekmidas/cli 10.0.0-alpha.85 → 10.0.0-alpha.87

package/dist/{workspace-Bic_R3tz.cjs → workspace-CT0JM3Y8.cjs}

@@ -117,6 +117,237 @@ function checkComposeStages(config, stages) {
 	}
 }
 //#endregion
+//#region src/providers/s3/errors.ts
+/** What the `s3` provider refuses, and how each is put right. */
+/** An `objects` entry for `s3` with a field it does not take or cannot use. */
+var S3ProviderConfigInvalid = class extends Error {
+	stage;
+	field;
+	value;
+	expected;
+	constructor(stage, field, value, expected) {
+		super(`deploy.objects.${stage}.${field} is ${JSON.stringify(value)}; ${expected}.`);
+		this.stage = stage;
+		this.field = field;
+		this.value = value;
+		this.expected = expected;
+		this.name = "S3ProviderConfigInvalid";
+	}
+};
+/** No region anywhere to create the stage's buckets in. */
+var S3RegionRequired = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The s3 provider has no region for the stage '${stage}'. Name one in gkm.config.ts: deploy: { objects: { ${stage}: { provider: 's3', region: 'eu-west-1' } } } — or set AWS_REGION.`);
+		this.stage = stage;
+		this.name = "S3RegionRequired";
+	}
+};
+/** The good name and every suffixed one are taken by other accounts. */
+var BucketNameUnavailable = class extends Error {
+	id;
+	tried;
+	constructor(id, tried) {
+		super(`Every name tried for the bucket '${id}' is taken by another AWS account: ${tried.join(", ")}. Set deploy.namespace in gkm.config.ts to something more particular to you, and run the provision again.`);
+		this.id = id;
+		this.tried = tried;
+		this.name = "BucketNameUnavailable";
+	}
+};
+/** A bucket in this account carries another project's tag. */
+var BucketOwnedByAnotherProject = class extends Error {
+	bucket;
+	owner;
+	project;
+	constructor(bucket, owner, project) {
+		super(`The bucket '${bucket}' is in this account and tagged gkm:project=${owner}, not ${project}: another project's. gkm never adopts it. Set deploy.namespace in gkm.config.ts so this project names its buckets differently.`);
+		this.bucket = bucket;
+		this.owner = owner;
+		this.project = project;
+		this.name = "BucketOwnedByAnotherProject";
+	}
+};
+/** The bucket the stage's state names exists, and this account cannot reach it. */
+var RecordedBucketUnreachable = class extends Error {
+	id;
+	bucket;
+	constructor(id, bucket) {
+		super(`The stage's state records '${bucket}' as the bucket for '${id}', and this account cannot reach it — it is in another account, or the credentials are not the stage account's. Run with the account that created it (--profile).`);
+		this.id = id;
+		this.bucket = bucket;
+		this.name = "RecordedBucketUnreachable";
+	}
+};
+/** An IAM user by gkm's name exists, and gkm did not create it for this stage. */
+var IamUserNotOwned = class extends Error {
+	user;
+	project;
+	stage;
+	constructor(user, project, stage) {
+		super(`The IAM user '${user}' exists and is not tagged gkm:project=${project}, gkm:stage=${stage}, so gkm leaves it alone. Rename or delete it, or set deploy.namespace in gkm.config.ts so gkm names its users differently.`);
+		this.user = user;
+		this.project = project;
+		this.stage = stage;
+		this.name = "IamUserNotOwned";
+	}
+};
+/** The user already has the two access keys IAM allows. */
+var AccessKeyLimit = class extends Error {
+	user;
+	keys;
+	constructor(user, keys) {
+		super(`The IAM user '${user}' already has two access keys (${keys.join(", ")}), the most IAM allows, and gkm needs to issue one. Delete the one the stage does not use (aws iam delete-access-key --user-name ${user} --access-key-id …), then run the provision again.`);
+		this.user = user;
+		this.keys = keys;
+		this.name = "AccessKeyLimit";
+	}
+};
+/** `--rotate-keys` while the last rotation's old key is still active. */
+var RotationInProgress = class extends Error {
+	id;
+	previous;
+	stage;
+	constructor(id, previous, stage) {
+		super(`The bucket '${id}' is mid-rotation: its old key ${previous} is still active. Deploy '${stage}', then run gkm setup --stage ${stage} — or pass --retire-old-keys to delete it now — before rotating again.`);
+		this.id = id;
+		this.previous = previous;
+		this.stage = stage;
+		this.name = "RotationInProgress";
+	}
+};
+/** The stage's secrets point the bucket's key at a bucket gkm did not provision. */
+var BucketKeySetElsewhere = class extends Error {
+	key;
+	bucket;
+	found;
+	stage;
+	constructor(key, bucket, found, stage) {
+		super(`${key} in the stage '${stage}' points at the bucket '${found}', and the s3 provider manages '${bucket}' for it. Remove the key (gkm secrets:unset ${key} --stage ${stage}) to have the provider write its own, or set deploy.objects.${stage} to 'external' to keep yours.`);
+		this.key = key;
+		this.bucket = bucket;
+		this.found = found;
+		this.stage = stage;
+		this.name = "BucketKeySetElsewhere";
+	}
+};
+/** `verify()`: a provisioned bucket the stage's key cannot reach. */
+var ProvisionedBucketUnreachable = class extends Error {
+	id;
+	bucket;
+	stage;
+	reason;
+	constructor(id, bucket, stage, reason) {
+		super(`The bucket '${bucket}' (${id}) cannot be reached with the key in the stage '${stage}''s secrets: ${reason}. Run gkm setup --stage ${stage} with the stage account's credentials to create or repair it, then deploy again.`);
+		this.id = id;
+		this.bucket = bucket;
+		this.stage = stage;
+		this.reason = reason;
+		this.name = "ProvisionedBucketUnreachable";
+	}
+};
+//#endregion
+//#region src/providers/s3/config.ts
+const FIELDS = [
+	"provider",
+	"region",
+	"versioning"
+];
+/** An AWS region code: `eu-west-1`, `us-gov-west-1`, `ap-southeast-4`. */
+const REGION = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function checkS3Config(stage, config) {
+	const entry = config;
+	for (const field of Object.keys(entry)) if (!FIELDS.includes(field)) throw new S3ProviderConfigInvalid(stage, field, entry[field], `the s3 provider takes ${FIELDS.slice(1).join(" and ")} only`);
+	if (entry.region !== void 0) {
+		if (typeof entry.region !== "string" || !REGION.test(entry.region)) throw new S3ProviderConfigInvalid(stage, "region", entry.region, "set it to an AWS region code, like 'eu-west-1'");
+	}
+	if (entry.versioning !== void 0 && typeof entry.versioning !== "boolean") throw new S3ProviderConfigInvalid(stage, "versioning", entry.versioning, "set it to true to keep previous versions of every object, or leave it out");
+	return entry;
+}
+/** How the s3 provider's provisioning credentials are supplied. */
+const S3_PROVISIONING = {
+	env: [
+		"AWS_PROFILE",
+		"AWS_ACCESS_KEY_ID",
+		"AWS_SECRET_ACCESS_KEY",
+		"AWS_SESSION_TOKEN"
+	],
+	describe: "the stage's AWS account — --profile <name>, AWS_PROFILE, or AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY (in CI, what aws-actions/configure-aws-credentials exports)"
+};
+//#endregion
+//#region src/providers/config.ts
+/**
+* `deploy.<kind>.<stage>`, read: what backs one kind of construct on a stage.
+*
+* Kept free of the providers themselves — of the AWS SDK and the graph — so
+* the workspace schema can check an entry with the words a deploy would use,
+* the way `checkStageTelemetry` does for `deploy.telemetry`.
+*/
+/** Each provider's config check, by kind and name. */
+const CHECKS = { objects: { s3: checkS3Config } };
+/** How each provider's provisioning credentials are supplied, by kind and name. */
+const PROVISIONING = { objects: { s3: S3_PROVISIONING } };
+/** How `name`'s provisioning credentials are supplied, for messages. */
+function provisioningOf(kind, name) {
+	return Object.hasOwn(PROVISIONING[kind], name) ? PROVISIONING[kind][name] : void 0;
+}
+/** The `provider:` names a kind accepts. */
+function providerNamesOf(kind) {
+	return Object.keys(CHECKS[kind]).sort();
+}
+/** What `deploy.<kind>.<stage>` may be, for messages. */
+function accepted(kind) {
+	return [
+		"'external'",
+		...providerNamesOf(kind).map((name) => `{ provider: '${name}' }`),
+		"false"
+	].join(", ");
+}
+/** An entry that names no provider gkm has, or is not an entry at all. */
+var UnknownStageProvider = class extends Error {
+	kind;
+	stage;
+	value;
+	constructor(kind, stage, value) {
+		super(`deploy.${kind}.${stage} is ${JSON.stringify(value)}, which is not a provider gkm has for ${kind}. It takes ${accepted(kind)}.`);
+		this.kind = kind;
+		this.stage = stage;
+		this.value = value;
+		this.name = "UnknownStageProvider";
+	}
+};
+/**
+* One stage's entry checked: `'external'`, `false`, or a provider's object
+* that its own check accepts.
+*
+* @throws {UnknownStageProvider} for anything else — `'minio'` included
+*/
+function checkStageProvider(kind, stage, value) {
+	if (value === "external" || value === false) return value;
+	if (value && typeof value === "object" && !Array.isArray(value)) {
+		const name = value.provider;
+		const check = typeof name === "string" && Object.hasOwn(CHECKS[kind], name) ? CHECKS[kind][name] : void 0;
+		if (check) return check(stage, value);
+	}
+	throw new UnknownStageProvider(kind, stage, value);
+}
+/**
+* What backs `kind` on `stage`: the local stage is always `external` here —
+* `gkm dev` runs its own — and a deployed stage that names nothing is too.
+*/
+function stageProvider(workspace, kind, stage) {
+	if (stage === workspace.stages?.local) return { mode: "external" };
+	const value = workspace.deploy?.[kind]?.[stage];
+	if (value === void 0) return { mode: "external" };
+	const entry = checkStageProvider(kind, stage, value);
+	if (entry === "external") return { mode: "external" };
+	if (entry === false) return { mode: "none" };
+	return {
+		mode: "provider",
+		name: entry.provider,
+		config: entry
+	};
+}
+//#endregion
 //#region src/compose/logsConfig.ts
 /**
 * The self-hosted telemetry provider's options, read: how the stack's
@@ -814,6 +1045,22 @@ const TelemetryConfigSchema = require_schemas.record(require_schemas.string(), r
 	}
 });
 /**
+* `deploy.objects` — what backs each deployed stage's buckets. The rules are
+* `checkStageProvider`'s, so the schema and a provision run refuse the same
+* entries with the same words.
+*/
+const ObjectsConfigSchema = require_schemas.record(require_schemas.string(), require_schemas.unknown()).superRefine((entries, ctx) => {
+	for (const [stage, value] of Object.entries(entries)) try {
+		checkStageProvider("objects", stage, value);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: [stage]
+		});
+	}
+});
+/**
 * Deploy configuration schema.
 */
 const DeployConfigSchema = require_schemas.object({
@@ -834,6 +1081,7 @@ const DeployConfigSchema = require_schemas.object({
 	dokploy: DokployWorkspaceConfigSchema.optional(),
 	compose: ComposeWorkspaceConfigSchema.optional(),
 	telemetry: TelemetryConfigSchema.optional(),
+	objects: ObjectsConfigSchema.optional(),
 	dns: DnsConfigWithLegacySchema.optional(),
 	backups: BackupsConfigSchema.optional()
 });
@@ -1504,6 +1752,30 @@ function getEndpointForStage(dokployConfig, stage) {
 	return dokployConfig.endpoint;
 }
 //#endregion
+Object.defineProperty(exports, "AccessKeyLimit", {
+	enumerable: true,
+	get: function() {
+		return AccessKeyLimit;
+	}
+});
+Object.defineProperty(exports, "BucketKeySetElsewhere", {
+	enumerable: true,
+	get: function() {
+		return BucketKeySetElsewhere;
+	}
+});
+Object.defineProperty(exports, "BucketNameUnavailable", {
+	enumerable: true,
+	get: function() {
+		return BucketNameUnavailable;
+	}
+});
+Object.defineProperty(exports, "BucketOwnedByAnotherProject", {
+	enumerable: true,
+	get: function() {
+		return BucketOwnedByAnotherProject;
+	}
+});
 Object.defineProperty(exports, "ComposeTlsFileMissing", {
 	enumerable: true,
 	get: function() {
@@ -1516,6 +1788,12 @@ Object.defineProperty(exports, "DokployRegistryMoved", {
 		return DokployRegistryMoved;
 	}
 });
+Object.defineProperty(exports, "IamUserNotOwned", {
+	enumerable: true,
+	get: function() {
+		return IamUserNotOwned;
+	}
+});
 Object.defineProperty(exports, "InvalidStages", {
 	enumerable: true,
 	get: function() {
@@ -1546,6 +1824,36 @@ Object.defineProperty(exports, "PUBLIC_ENV_PREFIXES", {
 		return PUBLIC_ENV_PREFIXES;
 	}
 });
+Object.defineProperty(exports, "ProvisionedBucketUnreachable", {
+	enumerable: true,
+	get: function() {
+		return ProvisionedBucketUnreachable;
+	}
+});
+Object.defineProperty(exports, "RecordedBucketUnreachable", {
+	enumerable: true,
+	get: function() {
+		return RecordedBucketUnreachable;
+	}
+});
+Object.defineProperty(exports, "RotationInProgress", {
+	enumerable: true,
+	get: function() {
+		return RotationInProgress;
+	}
+});
+Object.defineProperty(exports, "S3RegionRequired", {
+	enumerable: true,
+	get: function() {
+		return S3RegionRequired;
+	}
+});
+Object.defineProperty(exports, "S3_PROVISIONING", {
+	enumerable: true,
+	get: function() {
+		return S3_PROVISIONING;
+	}
+});
 Object.defineProperty(exports, "SECRETS_STORE_PROVIDERS", {
 	enumerable: true,
 	get: function() {
@@ -1576,6 +1884,12 @@ Object.defineProperty(exports, "UnknownSecretsStoreProvider", {
 		return UnknownSecretsStoreProvider;
 	}
 });
+Object.defineProperty(exports, "UnknownStageProvider", {
+	enumerable: true,
+	get: function() {
+		return UnknownStageProvider;
+	}
+});
 Object.defineProperty(exports, "WorkspaceConfigSchema", {
 	enumerable: true,
 	get: function() {
@@ -1612,6 +1926,12 @@ Object.defineProperty(exports, "certificateFor", {
 		return certificateFor;
 	}
 });
+Object.defineProperty(exports, "checkS3Config", {
+	enumerable: true,
+	get: function() {
+		return checkS3Config;
+	}
+});
 Object.defineProperty(exports, "constructPatterns", {
 	enumerable: true,
 	get: function() {
@@ -1702,6 +2022,12 @@ Object.defineProperty(exports, "processConfig", {
 		return processConfig;
 	}
 });
+Object.defineProperty(exports, "provisioningOf", {
+	enumerable: true,
+	get: function() {
+		return provisioningOf;
+	}
+});
 Object.defineProperty(exports, "proxyFor", {
 	enumerable: true,
 	get: function() {
@@ -1726,6 +2052,12 @@ Object.defineProperty(exports, "stageProblems", {
 		return stageProblems;
 	}
 });
+Object.defineProperty(exports, "stageProvider", {
+	enumerable: true,
+	get: function() {
+		return stageProvider;
+	}
+});
 Object.defineProperty(exports, "stageSampleRate", {
 	enumerable: true,
 	get: function() {
@@ -1763,4 +2095,4 @@ Object.defineProperty(exports, "wrapSingleAppAsWorkspace", {
 	}
 });
 
-//# sourceMappingURL=workspace-Bic_R3tz.cjs.map
+//# sourceMappingURL=workspace-CT0JM3Y8.cjs.map