@geekmidas/cli 10.0.0-alpha.97 → 10.0.0-alpha.99

package/dist/{workspace-C1M-S4al.cjs → workspace-DRjdu1OY.cjs}

@@ -12,7 +12,8 @@ let node_net = require("node:net");
 const SECRETS_STORE_PROVIDERS = [
 	"file",
 	"ssm",
-	"secrets-manager"
+	"secrets-manager",
+	"s3"
 ];
 /**
 * `secrets.store` names a provider this package does not ship — a typo such
@@ -22,7 +23,7 @@ const SECRETS_STORE_PROVIDERS = [
 var UnknownSecretsStoreProvider = class extends require_errors.GkmError {
 	provider;
 	constructor(provider) {
-		super(`secrets.store names the provider ${JSON.stringify(provider)}, which is not one gkm ships. Use 'file', { provider: 'ssm', region }, { provider: 'secrets-manager', region }, or { provider: <an object with name, read() and write()> } in gkm.config.ts.`);
+		super(`secrets.store names the provider ${JSON.stringify(provider)}, which is not one gkm ships. Use 'file', { provider: 's3' }, { provider: 'ssm', region }, { provider: 'secrets-manager', region }, or { provider: <an object with name, read() and write()> } in gkm.config.ts.`);
 		this.provider = provider;
 		this.name = "UnknownSecretsStoreProvider";
 	}
@@ -36,6 +37,38 @@ function assertKnownSecretsStore(store) {
 	const provider = typeof store === "object" && store !== null && "provider" in store ? store.provider : store;
 	if (typeof provider === "string" && !SECRETS_STORE_PROVIDERS.includes(provider)) throw new UnknownSecretsStoreProvider(provider);
 }
+/**
+* An `s3` secrets store names no region, and the deploy state is not in S3 to
+* take one from.
+*/
+var S3SecretsStoreNeedsRegion = class extends require_errors.GkmError {
+	constructor() {
+		super("secrets.store is { provider: 's3' } with no region, and the deploy state is not in S3 to take one from. Name it — secrets: { store: { provider: 's3', region: '<region>' } } — or keep the state beside it: state: { provider: 's3', region: '<region>' }.");
+		this.name = "S3SecretsStoreNeedsRegion";
+	}
+};
+/**
+* Where an `s3` store keeps a stage's secrets. With no bucket named it is the
+* project bucket, beside the deploy state; region and prefix default to the
+* state's when that is in S3 too, so the two are written once.
+*
+* @throws {S3SecretsStoreNeedsRegion} when no region is named or inherited
+*/
+function s3SecretsLocation(store, state) {
+	const s3State = typeof state === "object" && state !== null && state.provider === "s3" ? state : void 0;
+	const region = store.region ?? s3State?.region;
+	if (!region) throw new S3SecretsStoreNeedsRegion();
+	return {
+		bucket: store.bucket,
+		region,
+		prefix: (store.prefix ?? s3State?.prefix ?? "gkm").replace(/\/+$/, "")
+	};
+}
+/** The key a stage's secrets are kept at: `<prefix>/<project>/<stage>/secrets.json`. */
+function s3SecretsKey(prefix, project, stage) {
+	const path = `${project}/${stage}/secrets.json`;
+	return prefix ? `${prefix}/${path}` : path;
+}
 //#endregion
 //#region src/compose/dnsConfig.ts
 /**
@@ -136,6 +169,17 @@ var ComposeTlsOnLocalStage = class extends require_errors.GkmError {
 		this.name = "ComposeTlsOnLocalStage";
 	}
 };
+/**
+* A server for the local stage, which always runs on this machine's Docker.
+*/
+var ComposeServerOnLocalStage = class extends require_errors.GkmError {
+	stage;
+	constructor(stage) {
+		super(`deploy.compose.server names '${stage}', the local stage, which always runs on this machine's Docker. Remove it, or set it for a deployed stage.`);
+		this.stage = stage;
+		this.name = "ComposeServerOnLocalStage";
+	}
+};
 /** The stage's certificate or key file is not there to read. */
 var ComposeTlsFileMissing = class extends require_errors.GkmError {
 	stage;
@@ -182,6 +226,10 @@ function checkComposeStages(config, stages) {
 		if (stage === stages.local) throw new ComposeTlsOnLocalStage(stage);
 		if (!known.includes(stage)) throw new ComposeStageUnknown("tls", stage, known);
 	}
+	for (const stage of Object.keys(config?.server ?? {})) {
+		if (stage === stages.local) throw new ComposeServerOnLocalStage(stage);
+		if (!known.includes(stage)) throw new ComposeStageUnknown("server", stage, known);
+	}
 }
 //#endregion
 //#region src/providers/s3/errors.ts
@@ -304,7 +352,7 @@ var ProvisionedBucketUnreachable = class extends require_errors.GkmError {
 	stage;
 	reason;
 	constructor(id, bucket, stage, reason) {
-		super(`The bucket '${bucket}' (${id}) cannot be reached with the key in the stage '${stage}''s secrets: ${reason}. Deploy '${stage}' with the stage account's credentials (gkm deploy --stage ${stage}), which creates or repairs it — a run with --skip-resources does not.`);
+		super(`The bucket '${bucket}' (${id}) cannot be reached with the key in the stage '${stage}''s secrets: ${reason}. Deploy '${stage}' with the stage account's credentials (gkm deploy --stage ${stage}), which creates or repairs it.`);
 		this.id = id;
 		this.bucket = bucket;
 		this.stage = stage;
@@ -1192,6 +1240,11 @@ const ComposeWorkspaceConfigSchema = require_schemas.object({
 	tls: require_schemas.record(require_schemas.string(), require_schemas.object({
 		certFile: require_schemas.string().min(1),
 		keyFile: require_schemas.string().min(1)
+	}).strict()).optional(),
+	server: require_schemas.record(require_schemas.string(), require_schemas.object({
+		user: require_schemas.string().min(1),
+		host: require_schemas.string().min(1).optional(),
+		port: require_schemas.number().int().min(1).max(65535).optional()
 	}).strict()).optional()
 }).strict();
 const TelemetrySampleRate = require_schemas.number().optional();
@@ -1294,6 +1347,15 @@ const StagesConfigSchema = require_schemas.object({
 });
 const SecretsStoreSchema = require_schemas.union([
 	require_schemas.literal("file"),
+	require_schemas.object({
+		provider: require_schemas.literal("s3"),
+		/** A bucket that exists; omitted, the project bucket. */
+		bucket: require_schemas.string().min(1).optional(),
+		/** Omitted, the S3 deploy state's region. */
+		region: AwsRegionSchema.optional(),
+		/** Omitted, the S3 deploy state's prefix, else 'gkm'. */
+		prefix: require_schemas.string().optional()
+	}).strict(),
 	require_schemas.object({
 		provider: require_schemas.literal("ssm"),
 		region: AwsRegionSchema
@@ -1519,6 +1581,16 @@ const WorkspaceConfigSchema = require_schemas.object({
 		});
 		return;
 	}
+	const store = data.secrets?.store;
+	if (typeof store === "object" && store.provider === "s3") try {
+		s3SecretsLocation(store, data.state);
+	} catch (error) {
+		ctx.addIssue({
+			code: "custom",
+			message: error instanceof Error ? error.message : String(error),
+			path: ["secrets", "store"]
+		});
+	}
 	try {
 		checkComposeStages(data.deploy?.compose, data.stages);
 	} catch (error) {
@@ -2372,6 +2444,18 @@ Object.defineProperty(exports, "resolveStageTelemetry", {
 		return resolveStageTelemetry;
 	}
 });
+Object.defineProperty(exports, "s3SecretsKey", {
+	enumerable: true,
+	get: function() {
+		return s3SecretsKey;
+	}
+});
+Object.defineProperty(exports, "s3SecretsLocation", {
+	enumerable: true,
+	get: function() {
+		return s3SecretsLocation;
+	}
+});
 Object.defineProperty(exports, "safeValidateWorkspaceConfig", {
 	enumerable: true,
 	get: function() {
@@ -2427,4 +2511,4 @@ Object.defineProperty(exports, "wrapSingleAppAsWorkspace", {
 	}
 });
 
-//# sourceMappingURL=workspace-C1M-S4al.cjs.map
+//# sourceMappingURL=workspace-DRjdu1OY.cjs.map