@geekmidas/cli 10.0.0-alpha.97 → 10.0.0-alpha.99

package/dist/{seeds-BsJRUL1K.mjs → seeds-C4bZ8L-T.mjs}

@@ -3,11 +3,12 @@ import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { i as run$1, s as gkmHome } from "./run-BJLIerMM.mjs";
 import { d as output, r as discover, u as ConstructGenerator } from "./discover-qjFapetL.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as SERVER_IPV6_KEY, ft as UnknownSecretsStoreProvider, j as TEST_STAGE, st as SERVER_IPV4_KEY, ut as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-Bv4xROeu.mjs";
+import { B as LOGS_PORT, H as provisioningOf, R as stageSampleRate, U as stageProvider, _ as PUBLIC_ENV_PREFIXES, a as allConstructGlobs, ct as SERVER_IPV6_KEY, ft as UnknownSecretsStoreProvider, j as TEST_STAGE, mt as s3SecretsLocation, st as SERVER_IPV4_KEY, ut as isReservedStageKey, v as getPublicEnvPrefix, z as telemetryEnv } from "./workspace-D5CpOp1y.mjs";
 import { ConfigNotFound, NotInAnApp, loadWorkspaceAppInfo, loadWorkspaceConfig } from "./config.mjs";
+import { n as deployIdentity } from "./identity-CBXr4wNi.mjs";
 import { a as telemetryArgs, c as startTelemetryCode, n as runtimeFor, u as writeTelemetryModule } from "./EndpointGenerator-Bor2tZCm.mjs";
 import { a as DEFAULT_STORAGE, i as DEFAULT_EVENTS$1, n as readFakes, o as holdsEveryCache, r as DEFAULT_CACHE, t as SubscriberGenerator } from "./SubscriberGenerator-CyN2VF5X.mjs";
-import { c as runtimeOf } from "./resolve-6EYNqYdr.mjs";
+import { c as runtimeOf } from "./resolve-CNYbGH8g.mjs";
 import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { constants, existsSync, readFileSync } from "node:fs";
 import { appendFile, chmod, copyFile, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
@@ -15,7 +16,7 @@ import { homedir, hostname, networkInterfaces, userInfo } from "node:os";
 import { promisify } from "node:util";
 import { Cron } from "@geekmidas/constructs/crons";
 import { Queue } from "@geekmidas/constructs/queue";
-import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase, scopedName } from "@geekmidas/manifest";
+import { CLIENT_IP_HEADER, DEFAULT_POSTGRES_VERSION, TELEMETRY_KEYS, cacheTable, cookieDomain, dependenciesOf, dependentsOf, externalApiUrl, kebabCase, mobileOrigins, provideKey, providedKeyFor, provisionOrder, publicEnvFor, schemeBase } from "@geekmidas/manifest";
 import { createServer } from "node:net";
 import { execFile, spawn } from "node:child_process";
 import { createCipheriv, createDecipheriv, createHash, randomBytes, randomInt } from "node:crypto";
@@ -294,7 +295,7 @@ function logsAccess(logs, ctx) {
 	return [
 		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
 		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
-		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
+		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}${ctx.known ? "" : "   (user and host are guesses: this machine's)"}`,
 		`     then open http://localhost:${logs.port}  (${login})`,
 		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
 	];
@@ -421,116 +422,6 @@ function validateEnvironmentVariables(requiredVars, secrets) {
 	};
 }
 //#endregion
-//#region src/deploy/identity.ts
-/**
-* Who a deploy is, on a target it shares with other workspaces.
-*
-* A Dokploy server is one flat namespace of projects, images and Docker
-* service names. Deploys used to identify everything they made by the
-* workspace name alone, so two workspaces called `shop` — or `Shop` and
-* `shop` — deploying to one server landed in the same project, pushed over
-* each other's images and redeployed each other's applications. A
-* `DeployIdentity` is what a deploy names and claims its resources by instead.
-*/
-/** A namespace that cannot be part of a Dokploy name or an image path. */
-var DeployNamespaceInvalid = class extends GkmError {
-	namespace;
-	constructor(namespace) {
-		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
-		this.namespace = namespace;
-		this.name = "DeployNamespaceInvalid";
-	}
-};
-/** A workspace name with nothing a target can name a resource by. */
-var DeployProjectNameInvalid = class extends GkmError {
-	workspaceName;
-	constructor(workspaceName) {
-		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
-		this.workspaceName = workspaceName;
-		this.name = "DeployProjectNameInvalid";
-	}
-};
-const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-/**
-* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
-* a Docker image path component, a Docker service name and a Dokploy name.
-*/
-function slug(value) {
-	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-/** The namespace a workspace is in when it does not name one. */
-function defaultNamespace(workspaceName) {
-	return slug(kebabCase(workspaceName));
-}
-function deployIdentity(workspace, stage) {
-	const project = slug(workspace.name);
-	if (!project) throw new DeployProjectNameInvalid(workspace.name);
-	const fallback = defaultNamespace(workspace.name);
-	const namespace = workspace.deploy?.namespace ?? fallback;
-	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
-	return {
-		namespace,
-		project,
-		stage,
-		key: `${namespace}/${project}`,
-		scope: namespace === fallback ? project : `${namespace}-${project}`
-	};
-}
-/**
-* The token a Dokploy project's description carries to say which identity
-* created it. A project with the right name and no marker belongs to someone
-* else, and a deploy never adopts it.
-*/
-function ownershipMarker(identity) {
-	return `gkm:${identity.key}`;
-}
-/** Whether a project description carries `identity`'s marker. */
-function isOwnedBy(description, identity) {
-	const marker = ownershipMarker(identity);
-	return (description ?? "").split(/\s+/).includes(marker);
-}
-/** Any `gkm:` marker a description carries — whoever's it is. */
-function markerOf(description) {
-	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
-}
-/** What the Dokploy project is called. */
-function projectName(identity) {
-	return identity.scope;
-}
-/**
-* The repository an app's image is pushed to, below the registry:
-* `<namespace>/<project>-<app>`.
-*
-* The namespace is a path segment of its own so that a registry that maps
-* paths to owners (an organisation's packages, a Harbor project) can grant it
-* as one; the app is joined to the project so the two read as one name.
-*/
-function imageName(identity, app) {
-	return `${identity.namespace}/${identity.project}-${slug(kebabCase(app))}`;
-}
-/** The full image ref an app is built, pushed and deployed as. */
-function imageRef(identity, app, registry, tag) {
-	const name = imageName(identity, app);
-	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
-}
-/**
-* What one application is called on the target.
-*
-* The same rule the constructs use, through the same `scopedName`, scoped by
-* the stage and the identity: the application beside
-* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
-* Dokploy application's name is also its Docker service name, which is unique
-* on the whole server, so the namespace has to be in it too — `acme`'s and
-* `globex`'s `shop` would otherwise both run `production-shop-api`.
-*
-* The app id is dropped when it repeats the project, so a project named for its
-* one application is `production-kitchen-sink` rather than
-* `production-kitchen-sink-kitchen-sink`.
-*/
-function applicationName(identity, app) {
-	return slug(app) === identity.project ? `${identity.stage}-${identity.scope}` : scopedName([identity.stage, identity.scope], app);
-}
-//#endregion
 //#region src/secrets/keystore.ts
 /**
 * The keys that open each stage's encrypted secrets file, kept outside the
@@ -828,8 +719,21 @@ async function storeFromConfig(workspace, config, options = {}) {
 	if (config === "file") return new FileSecretsStore(workspace.root, keystoreProject(workspace, options.home));
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
+		case "s3": {
+			const { S3SecretsStore } = await import("./s3-BwhQk3QM.mjs");
+			const { deployIdentity } = await import("./identity-CBXr4wNi.mjs").then((n) => n.r);
+			const location = s3SecretsLocation(config, workspace.state);
+			return new S3SecretsStore({
+				project: workspace.name,
+				identity: deployIdentity(workspace, ""),
+				region: location.region,
+				prefix: location.prefix,
+				...location.bucket ? { bucket: location.bucket } : {},
+				...profile
+			});
+		}
 		case "ssm": {
-			const { AwsSecretsStore } = await import("./aws-Dz2bYxK1.mjs").then((n) => n.t);
+			const { AwsSecretsStore } = await import("./aws-8QQ8n-t6.mjs").then((n) => n.t);
 			return new AwsSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -838,7 +742,7 @@ async function storeFromConfig(workspace, config, options = {}) {
 		}
 		case "secrets-manager": {
 			const { kmsKeyId } = config;
-			const { SecretsManagerSecretsStore } = await import("./secretsManager-C6wm-9uZ.mjs").then((n) => n.n);
+			const { SecretsManagerSecretsStore } = await import("./secretsManager-CQORubp9.mjs").then((n) => n.n);
 			return new SecretsManagerSecretsStore({
 				project: workspace.name,
 				region: config.region,
@@ -6680,7 +6584,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await import("./GoDaddyProvider-AqNu60WQ.mjs");
+		const { GoDaddyProvider } = await import("./GoDaddyProvider-206NguW1.mjs");
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8232,6 +8136,6 @@ function reportPlannedSeeds(planned, log) {
 	for (const { folder, seeds } of planned) log(`🌱 ${folder}: would run ${seeds.length} (${seeds.join(", ")})`);
 }
 //#endregion
-export { createDnsProvider as $, stackLogs as $n, storageBackendFor as $t, StageProviderDisabled as A, store_exports as An, postgresStatements as At, verifyDnsRecords as B, isOwnedBy as Bn, envFor as Bt, assertDevServicesFlag as C, loadEnvFiles as Cn, LOCAL_CA_PATH as Ct, requiredStageKeys as D, isRemoteStore as Dn, applyPostgres as Dt, reportDevServices as E, prepareEntryCredentials as En, applyPolicies as Et, DeployJournal as F, readKey as Fn, pgClient as Ft, getGeneratedSecret as G, maskPassword as Gn, WORKER_PORT as Gt, createComposeState as H, ownershipMarker as Hn, composeBuildPaths as Ht, extractSubdomain as I, applicationName as In, appEnvKeys as It, setApplicationId as J, withCustomSecret as Jn, imageBuildCredentials as Jt, recordRelease as K, storage_exports as Kn, detectPackageManager as Kt, findRootDomain as L, deployIdentity as Ln, dockerfileOf as Lt, provisionCommand as M, getKeyPath as Mn, LEGACY_LOCAL_LOGIN as Mt, stageProviderNotes as N, keystoreProject as Nn, ensurePostgresLogin as Nt, stageServiceDeclarations as O, secretsStoreFor as On, bucketPolicies as Ot, PROVIDER_KINDS as P, projectKey as Pn, bucketClient as Pt, DnsRecordsUnreadable as Q, logsService as Qn, providerOf as Qt, normalizeDnsConfig as R, imageName as Rn, networkEnv as Rt, STORAGE_KEY_PAIR as S, isPortAvailable as Sn, withRedisPassword as St, externalServices as T, loadSecretsForApp as Tn, applyBuckets as Tt, createEmptyState as U, projectName as Un, imageLayout as Ut, asDokployState as V, markerOf as Vn, localRolePassword as Vt, getBackupState as W, initStageSecrets as Wn, TURBO_VERSION as Wt, setGeneratedSecret as X, LOGS_SERVICE as Xn, cacheBackendFor as Xt, setBackupState as Y, LOCAL_LOGS_EMAIL as Yn, isImageBuild as Yt, setPostgresBackupId as Z, logsAccess as Zn, eventsBackendFor as Zt, isCi as _, portsOf as _n, REDIS_SERVICE as _t, DockerPushFailed as a, resourceName as an, CronGenerator as at, DevServicesNeedServerTarget as b, createEntryWrapper as bn, runsRedis as bt, ensureDockerignore as c, isTelemetryKey as cn, constructGlobs as ct, validateImageRef as d, telemetryOf as dn, workspace_exports as dt, CLUSTER_DATABASE as en, withLogsPassword as er, workerUnits as et, dnsRecordResource as f, usesTelemetry as fn, LOCAL_RABBITMQ_USER as ft, describeActor as g, portKeys as gn, withGeneratedSecrets as gt, currentActor as h, fakeKey as hn, readLocalCredentials as ht, DockerBuildFailed as i, planFor as in, QueueGenerator as it, assertStageProvidersEnabled as j, FileSecretsStore as jn, quoteIdentifier as jt, suppliedOnly as k, storeFromConfig as kn, postgresDatabaseNames as kt, workerDockerfile as l, scopeTelemetryEnv as ln, derivedContainers as lt, recordDnsChanges as m, describeServices as mn, postgresSuperuser as mt, reportDatabaseRuns as n, EMULATOR_ACCESS_KEY_ID as nn, isMainFrontendApp as nr, workerBundleName as nt, appDockerfile as o, hostFor as on, FAKE_ENV as ot, dnsResources as p, DEFAULT_IMAGES as pn, loadLocalCredentials as pt, recordRollback as q, toEmbeddableSecrets as qn, findBuildRoot as qt, reportPlannedSeeds as r, TELEMETRY_CONTAINER as rn, resolveHost as rr, workerEntryDir as rt, dockerCommand as s, appTelemetry as sn, backendsOf as st, DeploySeedsFailed as t, composeFor as tn, NoDomainForStage as tr, WorkerGenerator as tt, workerDockerfileOf as u, surfaceClientTraced as un, reconcileWorkspace as ut, AllowDevServicesTakesNoValue as v, primaryPortKey as vn, STACK_CACHE as vt, devServicesUsed as w, loadPortState as wn, forgetState as wt, ExternalServicesNotConfigured as x, findAvailablePort as xn, stackRedis as xt, DEV_SERVICES as y, createCredentialsPreload as yn, redisService as yt, orchestrateDns as z, imageRef as zn, workerEnvKeys as zt };
+export { createDnsProvider as $, storageBackendFor as $t, StageProviderDisabled as A, store_exports as An, postgresStatements as At, verifyDnsRecords as B, withCustomSecret as Bn, envFor as Bt, assertDevServicesFlag as C, loadEnvFiles as Cn, LOCAL_CA_PATH as Ct, requiredStageKeys as D, isRemoteStore as Dn, applyPostgres as Dt, reportDevServices as E, prepareEntryCredentials as En, applyPolicies as Et, DeployJournal as F, readKey as Fn, pgClient as Ft, getGeneratedSecret as G, stackLogs as Gn, WORKER_PORT as Gt, createComposeState as H, LOGS_SERVICE as Hn, composeBuildPaths as Ht, extractSubdomain as I, initStageSecrets as In, appEnvKeys as It, setApplicationId as J, isMainFrontendApp as Jn, imageBuildCredentials as Jt, recordRelease as K, withLogsPassword as Kn, detectPackageManager as Kt, findRootDomain as L, maskPassword as Ln, dockerfileOf as Lt, provisionCommand as M, getKeyPath as Mn, LEGACY_LOCAL_LOGIN as Mt, stageProviderNotes as N, keystoreProject as Nn, ensurePostgresLogin as Nt, stageServiceDeclarations as O, secretsStoreFor as On, bucketPolicies as Ot, PROVIDER_KINDS as P, projectKey as Pn, bucketClient as Pt, DnsRecordsUnreadable as Q, providerOf as Qt, normalizeDnsConfig as R, storage_exports as Rn, networkEnv as Rt, STORAGE_KEY_PAIR as S, isPortAvailable as Sn, withRedisPassword as St, externalServices as T, loadSecretsForApp as Tn, applyBuckets as Tt, createEmptyState as U, logsAccess as Un, imageLayout as Ut, asDokployState as V, LOCAL_LOGS_EMAIL as Vn, localRolePassword as Vt, getBackupState as W, logsService as Wn, TURBO_VERSION as Wt, setGeneratedSecret as X, cacheBackendFor as Xt, setBackupState as Y, resolveHost as Yn, isImageBuild as Yt, setPostgresBackupId as Z, eventsBackendFor as Zt, isCi as _, portsOf as _n, REDIS_SERVICE as _t, DockerPushFailed as a, resourceName as an, CronGenerator as at, DevServicesNeedServerTarget as b, createEntryWrapper as bn, runsRedis as bt, ensureDockerignore as c, isTelemetryKey as cn, constructGlobs as ct, validateImageRef as d, telemetryOf as dn, workspace_exports as dt, CLUSTER_DATABASE as en, workerUnits as et, dnsRecordResource as f, usesTelemetry as fn, LOCAL_RABBITMQ_USER as ft, describeActor as g, portKeys as gn, withGeneratedSecrets as gt, currentActor as h, fakeKey as hn, readLocalCredentials as ht, DockerBuildFailed as i, planFor as in, QueueGenerator as it, assertStageProvidersEnabled as j, FileSecretsStore as jn, quoteIdentifier as jt, suppliedOnly as k, storeFromConfig as kn, postgresDatabaseNames as kt, workerDockerfile as l, scopeTelemetryEnv as ln, derivedContainers as lt, recordDnsChanges as m, describeServices as mn, postgresSuperuser as mt, reportDatabaseRuns as n, EMULATOR_ACCESS_KEY_ID as nn, workerBundleName as nt, appDockerfile as o, hostFor as on, FAKE_ENV as ot, dnsResources as p, DEFAULT_IMAGES as pn, loadLocalCredentials as pt, recordRollback as q, NoDomainForStage as qn, findBuildRoot as qt, reportPlannedSeeds as r, TELEMETRY_CONTAINER as rn, workerEntryDir as rt, dockerCommand as s, appTelemetry as sn, backendsOf as st, DeploySeedsFailed as t, composeFor as tn, WorkerGenerator as tt, workerDockerfileOf as u, surfaceClientTraced as un, reconcileWorkspace as ut, AllowDevServicesTakesNoValue as v, primaryPortKey as vn, STACK_CACHE as vt, devServicesUsed as w, loadPortState as wn, forgetState as wt, ExternalServicesNotConfigured as x, findAvailablePort as xn, stackRedis as xt, DEV_SERVICES as y, createCredentialsPreload as yn, redisService as yt, orchestrateDns as z, toEmbeddableSecrets as zn, workerEnvKeys as zt };
 
-//# sourceMappingURL=seeds-BsJRUL1K.mjs.map
+//# sourceMappingURL=seeds-C4bZ8L-T.mjs.map