@geekmidas/cli 1.2.3 → 1.4.0

package/dist/{openapi-react-query-DGEkD39r.mjs → openapi-react-query-DaTMSPD5.mjs}

@@ -164,4 +164,4 @@ function capitalize(str) {
 
 //#endregion
 export { generateReactQueryCommand };
-//# sourceMappingURL=openapi-react-query-DGEkD39r.mjs.map
+//# sourceMappingURL=openapi-react-query-DaTMSPD5.mjs.map

package/dist/{openapi-react-query-DGEkD39r.mjs.map → openapi-react-query-DaTMSPD5.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"openapi-react-query-DGEkD39r.mjs","names":["options: ReactQueryOptions","spec: OpenAPISpec","operations: OperationInfo[]","operation: any","schema: any","_spec: OpenAPISpec","apiName: string","op: OperationInfo","paramParts: string[]","str: string"],"sources":["../src/openapi-react-query.ts"],"sourcesContent":["#!/usr/bin/env -S npx tsx\n\nimport { exec } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\n\nconst execAsync = promisify(exec);\n\ninterface ReactQueryOptions {\n\tinput?: string;\n\toutput?: string;\n\tname?: string;\n}\n\ninterface OpenAPISpec {\n\topenapi: string;\n\tinfo?: {\n\t\ttitle?: string;\n\t\tversion?: string;\n\t};\n\tpaths: Record<string, Record<string, any>>;\n}\n\nexport async function generateReactQueryCommand(\n\toptions: ReactQueryOptions = {},\n): Promise<void> {\n\tconst logger = console;\n\n\ttry {\n\t\t// Read OpenAPI spec\n\t\tconst inputPath = options.input || join(process.cwd(), 'openapi.json');\n\n\t\tif (!existsSync(inputPath)) {\n\t\t\tthrow new Error(\n\t\t\t\t`OpenAPI spec not found at ${inputPath}. Run 'npx @geekmidas/cli openapi' first.`,\n\t\t\t);\n\t\t}\n\n\t\tconst specContent = await readFile(inputPath, 'utf-8');\n\t\tconst spec: OpenAPISpec = JSON.parse(specContent);\n\n\t\t// Generate TypeScript types from OpenAPI spec\n\t\tconst outputDir = dirname(\n\t\t\toptions.output || join(process.cwd(), 'src', 'api', 'hooks.ts'),\n\t\t);\n\t\tconst typesPath = join(outputDir, 'openapi-types.d.ts');\n\n\t\tlogger.log('Generating TypeScript types from OpenAPI spec...');\n\n\t\ttry {\n\t\t\t// Use npx to run openapi-typescript\n\t\t\tawait execAsync(\n\t\t\t\t`npx openapi-typescript \"${inputPath}\" -o \"${typesPath}\"`,\n\t\t\t\t{ cwd: process.cwd() },\n\t\t\t);\n\t\t\tlogger.log(`TypeScript types generated: ${typesPath}`);\n\t\t} catch (_error) {\n\t\t\tlogger.warn(\n\t\t\t\t'Could not generate types with openapi-typescript. Install it for better type inference.',\n\t\t\t);\n\t\t\tlogger.warn('Run: npm install -D openapi-typescript');\n\n\t\t\t// Generate basic types file\n\t\t\tawait mkdir(dirname(typesPath), { recursive: true });\n\t\t\tawait writeFile(\n\t\t\t\ttypesPath,\n\t\t\t\t`// Auto-generated placeholder types\nexport interface paths {\n  [path: string]: {\n    [method: string]: {\n      operationId?: string;\n      parameters?: any;\n      requestBody?: any;\n      responses?: any;\n    };\n  };\n}\n`,\n\t\t\t);\n\t\t}\n\n\t\t// Extract operation info\n\t\tconst operations = extractOperations(spec);\n\n\t\t// Generate TypeScript code\n\t\tconst code = generateReactQueryCode(\n\t\t\tspec,\n\t\t\toperations,\n\t\t\toptions.name || 'API',\n\t\t);\n\n\t\t// Write output\n\t\tconst outputPath =\n\t\t\toptions.output || join(process.cwd(), 'src', 'api', 'hooks.ts');\n\t\tawait mkdir(dirname(outputPath), { recursive: true });\n\t\tawait writeFile(outputPath, code);\n\n\t\tlogger.log(`React Query hooks generated: ${outputPath}`);\n\t\tlogger.log(`Generated ${operations.length} hooks`);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`React Query generation failed: ${(error as Error).message}`,\n\t\t);\n\t}\n}\n\ninterface OperationInfo {\n\toperationId: string;\n\tpath: string;\n\tmethod: string;\n\tendpoint: string; // Full endpoint like 'GET /users/{id}'\n\tparameters?: Array<{ name: string; in: string; required?: boolean }>;\n\trequestBody?: boolean;\n\tresponseType?: string;\n}\n\nfunction extractOperations(spec: OpenAPISpec): OperationInfo[] {\n\tconst operations: OperationInfo[] = [];\n\n\tObject.entries(spec.paths).forEach(([path, methods]) => {\n\t\tObject.entries(methods).forEach(([method, operation]) => {\n\t\t\tif (operation.operationId) {\n\t\t\t\toperations.push({\n\t\t\t\t\toperationId: operation.operationId,\n\t\t\t\t\tpath,\n\t\t\t\t\tmethod: method.toUpperCase(),\n\t\t\t\t\tendpoint: `${method.toUpperCase()} ${path}`,\n\t\t\t\t\tparameters: operation.parameters,\n\t\t\t\t\trequestBody: !!operation.requestBody,\n\t\t\t\t\tresponseType: extractResponseType(operation),\n\t\t\t\t});\n\t\t\t}\n\t\t});\n\t});\n\n\treturn operations;\n}\n\nfunction extractResponseType(operation: any): string {\n\tconst responses = operation.responses;\n\tif (!responses) return 'unknown';\n\n\tconst successResponse = responses['200'] || responses['201'];\n\tif (!successResponse?.content?.['application/json']?.schema) {\n\t\treturn 'unknown';\n\t}\n\n\t// Basic type inference from schema\n\tconst schema = successResponse.content['application/json'].schema;\n\treturn schemaToTypeString(schema);\n}\n\nfunction schemaToTypeString(schema: any): string {\n\tif (!schema) return 'unknown';\n\n\tswitch (schema.type) {\n\t\tcase 'string':\n\t\t\treturn 'string';\n\t\tcase 'number':\n\t\tcase 'integer':\n\t\t\treturn 'number';\n\t\tcase 'boolean':\n\t\t\treturn 'boolean';\n\t\tcase 'array':\n\t\t\treturn `Array<${schemaToTypeString(schema.items)}>`;\n\t\tcase 'object':\n\t\t\tif (schema.properties) {\n\t\t\t\tconst props = Object.entries(schema.properties)\n\t\t\t\t\t.map(\n\t\t\t\t\t\t([key, value]: [string, any]) =>\n\t\t\t\t\t\t\t`${key}: ${schemaToTypeString(value)}`,\n\t\t\t\t\t)\n\t\t\t\t\t.join('; ');\n\t\t\t\treturn `{ ${props} }`;\n\t\t\t}\n\t\t\treturn 'Record<string, unknown>';\n\t\tdefault:\n\t\t\treturn 'unknown';\n\t}\n}\n\nfunction generateReactQueryCode(\n\t_spec: OpenAPISpec,\n\toperations: OperationInfo[],\n\tapiName: string,\n): string {\n\tconst imports = `import { createTypedQueryClient } from '@geekmidas/client';\nimport type { paths } from './openapi-types';\n\n// Create typed query client\nexport const ${apiName.toLowerCase()} = createTypedQueryClient<paths>({\n  baseURL: process.env.NEXT_PUBLIC_API_URL || '/api',\n});\n\n// Export individual hooks for better DX\n`;\n\n\tconst queryHooks = operations\n\t\t.filter((op) => op.method === 'GET')\n\t\t.map((op) => generateQueryHook(op, apiName))\n\t\t.join('\\n\\n');\n\n\tconst mutationHooks = operations\n\t\t.filter((op) => op.method !== 'GET')\n\t\t.map((op) => generateMutationHook(op, apiName))\n\t\t.join('\\n\\n');\n\n\tconst typeExports = generateTypeExports(operations);\n\n\treturn `${imports}\n// Query Hooks\n${queryHooks}\n\n// Mutation Hooks\n${mutationHooks}\n\n// Type exports for convenience\n${typeExports}\n\n// Re-export the api for advanced usage\nexport { ${apiName.toLowerCase()} };\n`;\n}\n\nfunction generateQueryHook(op: OperationInfo, apiName: string): string {\n\tconst hookName = `use${capitalize(op.operationId)}`;\n\tconst endpoint = op.endpoint;\n\tconst hasParams = op.parameters?.some((p) => p.in === 'path');\n\tconst hasQuery = op.parameters?.some((p) => p.in === 'query');\n\n\t// Generate properly typed hook\n\tlet params = '';\n\tlet args = '';\n\n\tif (hasParams || hasQuery) {\n\t\tconst paramParts: string[] = [];\n\t\tif (hasParams) {\n\t\t\tconst pathParams =\n\t\t\t\top.parameters?.filter((p) => p.in === 'path').map((p) => p.name) || [];\n\t\t\tparamParts.push(\n\t\t\t\t`params: { ${pathParams.map((p) => `${p}: string`).join('; ')} }`,\n\t\t\t);\n\t\t}\n\t\tif (hasQuery) {\n\t\t\tparamParts.push(`query?: Record<string, any>`);\n\t\t}\n\t\tparams = `config: { ${paramParts.join('; ')} }, `;\n\t\targs = ', config';\n\t}\n\n\treturn `export const ${hookName} = (\n  ${params}options?: Parameters<typeof ${apiName.toLowerCase()}.useQuery>[2]\n) => {\n  return ${apiName.toLowerCase()}.useQuery('${endpoint}' as any${args}, options);\n};`;\n}\n\nfunction generateMutationHook(op: OperationInfo, apiName: string): string {\n\tconst hookName = `use${capitalize(op.operationId)}`;\n\tconst endpoint = op.endpoint;\n\n\treturn `export const ${hookName} = (\n  options?: Parameters<typeof ${apiName.toLowerCase()}.useMutation>[1]\n) => {\n  return ${apiName.toLowerCase()}.useMutation('${endpoint}' as any, options);\n};`;\n}\n\nfunction generateTypeExports(operations: OperationInfo[]): string {\n\tconst exports = operations.map((op) => {\n\t\tconst typeName = capitalize(op.operationId);\n\t\tconst isQuery = op.method === 'GET';\n\n\t\tif (isQuery) {\n\t\t\treturn `export type ${typeName}Response = Awaited<ReturnType<ReturnType<typeof use${typeName}>['data']>>;`;\n\t\t} else {\n\t\t\treturn `export type ${typeName}Response = Awaited<ReturnType<ReturnType<typeof use${typeName}>['mutateAsync']>>;`;\n\t\t}\n\t});\n\n\treturn exports.join('\\n');\n}\n\nfunction capitalize(str: string): string {\n\treturn str.charAt(0).toUpperCase() + str.slice(1);\n}\n"],"mappings":";;;;;;;AAQA,MAAM,YAAY,UAAU,KAAK;AAiBjC,eAAsB,0BACrBA,UAA6B,CAAE,GACf;CAChB,MAAM,SAAS;AAEf,KAAI;EAEH,MAAM,YAAY,QAAQ,SAAS,KAAK,QAAQ,KAAK,EAAE,eAAe;AAEtE,OAAK,WAAW,UAAU,CACzB,OAAM,IAAI,OACR,4BAA4B,UAAU;EAIzC,MAAM,cAAc,MAAM,SAAS,WAAW,QAAQ;EACtD,MAAMC,OAAoB,KAAK,MAAM,YAAY;EAGjD,MAAM,YAAY,QACjB,QAAQ,UAAU,KAAK,QAAQ,KAAK,EAAE,OAAO,OAAO,WAAW,CAC/D;EACD,MAAM,YAAY,KAAK,WAAW,qBAAqB;AAEvD,SAAO,IAAI,mDAAmD;AAE9D,MAAI;AAEH,SAAM,WACJ,0BAA0B,UAAU,QAAQ,UAAU,IACvD,EAAE,KAAK,QAAQ,KAAK,CAAE,EACtB;AACD,UAAO,KAAK,8BAA8B,UAAU,EAAE;EACtD,SAAQ,QAAQ;AAChB,UAAO,KACN,0FACA;AACD,UAAO,KAAK,yCAAyC;AAGrD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,KAAM,EAAC;AACpD,SAAM,UACL,YACC;;;;;;;;;;;EAYD;EACD;EAGD,MAAM,aAAa,kBAAkB,KAAK;EAG1C,MAAM,OAAO,uBACZ,MACA,YACA,QAAQ,QAAQ,MAChB;EAGD,MAAM,aACL,QAAQ,UAAU,KAAK,QAAQ,KAAK,EAAE,OAAO,OAAO,WAAW;AAChE,QAAM,MAAM,QAAQ,WAAW,EAAE,EAAE,WAAW,KAAM,EAAC;AACrD,QAAM,UAAU,YAAY,KAAK;AAEjC,SAAO,KAAK,+BAA+B,WAAW,EAAE;AACxD,SAAO,KAAK,YAAY,WAAW,OAAO,QAAQ;CAClD,SAAQ,OAAO;AACf,QAAM,IAAI,OACR,iCAAkC,MAAgB,QAAQ;CAE5D;AACD;AAYD,SAAS,kBAAkBA,MAAoC;CAC9D,MAAMC,aAA8B,CAAE;AAEtC,QAAO,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,QAAQ,KAAK;AACvD,SAAO,QAAQ,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,UAAU,KAAK;AACxD,OAAI,UAAU,YACb,YAAW,KAAK;IACf,aAAa,UAAU;IACvB;IACA,QAAQ,OAAO,aAAa;IAC5B,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,KAAK;IAC1C,YAAY,UAAU;IACtB,eAAe,UAAU;IACzB,cAAc,oBAAoB,UAAU;GAC5C,EAAC;EAEH,EAAC;CACF,EAAC;AAEF,QAAO;AACP;AAED,SAAS,oBAAoBC,WAAwB;CACpD,MAAM,YAAY,UAAU;AAC5B,MAAK,UAAW,QAAO;CAEvB,MAAM,kBAAkB,UAAU,UAAU,UAAU;AACtD,MAAK,iBAAiB,UAAU,qBAAqB,OACpD,QAAO;CAIR,MAAM,SAAS,gBAAgB,QAAQ,oBAAoB;AAC3D,QAAO,mBAAmB,OAAO;AACjC;AAED,SAAS,mBAAmBC,QAAqB;AAChD,MAAK,OAAQ,QAAO;AAEpB,SAAQ,OAAO,MAAf;EACC,KAAK,SACJ,QAAO;EACR,KAAK;EACL,KAAK,UACJ,QAAO;EACR,KAAK,UACJ,QAAO;EACR,KAAK,QACJ,SAAQ,QAAQ,mBAAmB,OAAO,MAAM,CAAC;EAClD,KAAK;AACJ,OAAI,OAAO,YAAY;IACtB,MAAM,QAAQ,OAAO,QAAQ,OAAO,WAAW,CAC7C,IACA,CAAC,CAAC,KAAK,MAAqB,MAC1B,EAAE,IAAI,IAAI,mBAAmB,MAAM,CAAC,EACtC,CACA,KAAK,KAAK;AACZ,YAAQ,IAAI,MAAM;GAClB;AACD,UAAO;EACR,QACC,QAAO;CACR;AACD;AAED,SAAS,uBACRC,OACAH,YACAI,SACS;CACT,MAAM,WAAW;;;;eAIH,QAAQ,aAAa,CAAC;;;;;;CAOpC,MAAM,aAAa,WACjB,OAAO,CAAC,OAAO,GAAG,WAAW,MAAM,CACnC,IAAI,CAAC,OAAO,kBAAkB,IAAI,QAAQ,CAAC,CAC3C,KAAK,OAAO;CAEd,MAAM,gBAAgB,WACpB,OAAO,CAAC,OAAO,GAAG,WAAW,MAAM,CACnC,IAAI,CAAC,OAAO,qBAAqB,IAAI,QAAQ,CAAC,CAC9C,KAAK,OAAO;CAEd,MAAM,cAAc,oBAAoB,WAAW;AAEnD,SAAQ,EAAE,QAAQ;;EAEjB,WAAW;;;EAGX,cAAc;;;EAGd,YAAY;;;WAGH,QAAQ,aAAa,CAAC;;AAEhC;AAED,SAAS,kBAAkBC,IAAmBD,SAAyB;CACtE,MAAM,YAAY,KAAK,WAAW,GAAG,YAAY,CAAC;CAClD,MAAM,WAAW,GAAG;CACpB,MAAM,YAAY,GAAG,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;CAC7D,MAAM,WAAW,GAAG,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ;CAG7D,IAAI,SAAS;CACb,IAAI,OAAO;AAEX,KAAI,aAAa,UAAU;EAC1B,MAAME,aAAuB,CAAE;AAC/B,MAAI,WAAW;GACd,MAAM,aACL,GAAG,YAAY,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAE;AACvE,cAAW,MACT,YAAY,WAAW,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,IAC9D;EACD;AACD,MAAI,SACH,YAAW,MAAM,6BAA6B;AAE/C,YAAU,YAAY,WAAW,KAAK,KAAK,CAAC;AAC5C,SAAO;CACP;AAED,SAAQ,eAAe,SAAS;IAC7B,OAAO,8BAA8B,QAAQ,aAAa,CAAC;;WAEpD,QAAQ,aAAa,CAAC,aAAa,SAAS,UAAU,KAAK;;AAErE;AAED,SAAS,qBAAqBD,IAAmBD,SAAyB;CACzE,MAAM,YAAY,KAAK,WAAW,GAAG,YAAY,CAAC;CAClD,MAAM,WAAW,GAAG;AAEpB,SAAQ,eAAe,SAAS;gCACD,QAAQ,aAAa,CAAC;;WAE3C,QAAQ,aAAa,CAAC,gBAAgB,SAAS;;AAEzD;AAED,SAAS,oBAAoBJ,YAAqC;CACjE,MAAM,UAAU,WAAW,IAAI,CAAC,OAAO;EACtC,MAAM,WAAW,WAAW,GAAG,YAAY;EAC3C,MAAM,UAAU,GAAG,WAAW;AAE9B,MAAI,QACH,SAAQ,cAAc,SAAS,qDAAqD,SAAS;MAE7F,SAAQ,cAAc,SAAS,qDAAqD,SAAS;CAE9F,EAAC;AAEF,QAAO,QAAQ,KAAK,KAAK;AACzB;AAED,SAAS,WAAWO,KAAqB;AACxC,QAAO,IAAI,OAAO,EAAE,CAAC,aAAa,GAAG,IAAI,MAAM,EAAE;AACjD"}
+{"version":3,"file":"openapi-react-query-DaTMSPD5.mjs","names":["options: ReactQueryOptions","spec: OpenAPISpec","operations: OperationInfo[]","operation: any","schema: any","_spec: OpenAPISpec","apiName: string","op: OperationInfo","paramParts: string[]","str: string"],"sources":["../src/openapi-react-query.ts"],"sourcesContent":["#!/usr/bin/env -S npx tsx\n\nimport { exec } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\n\nconst execAsync = promisify(exec);\n\ninterface ReactQueryOptions {\n\tinput?: string;\n\toutput?: string;\n\tname?: string;\n}\n\ninterface OpenAPISpec {\n\topenapi: string;\n\tinfo?: {\n\t\ttitle?: string;\n\t\tversion?: string;\n\t};\n\tpaths: Record<string, Record<string, any>>;\n}\n\nexport async function generateReactQueryCommand(\n\toptions: ReactQueryOptions = {},\n): Promise<void> {\n\tconst logger = console;\n\n\ttry {\n\t\t// Read OpenAPI spec\n\t\tconst inputPath = options.input || join(process.cwd(), 'openapi.json');\n\n\t\tif (!existsSync(inputPath)) {\n\t\t\tthrow new Error(\n\t\t\t\t`OpenAPI spec not found at ${inputPath}. Run 'npx @geekmidas/cli openapi' first.`,\n\t\t\t);\n\t\t}\n\n\t\tconst specContent = await readFile(inputPath, 'utf-8');\n\t\tconst spec: OpenAPISpec = JSON.parse(specContent);\n\n\t\t// Generate TypeScript types from OpenAPI spec\n\t\tconst outputDir = dirname(\n\t\t\toptions.output || join(process.cwd(), 'src', 'api', 'hooks.ts'),\n\t\t);\n\t\tconst typesPath = join(outputDir, 'openapi-types.d.ts');\n\n\t\tlogger.log('Generating TypeScript types from OpenAPI spec...');\n\n\t\ttry {\n\t\t\t// Use npx to run openapi-typescript\n\t\t\tawait execAsync(\n\t\t\t\t`npx openapi-typescript \"${inputPath}\" -o \"${typesPath}\"`,\n\t\t\t\t{ cwd: process.cwd() },\n\t\t\t);\n\t\t\tlogger.log(`TypeScript types generated: ${typesPath}`);\n\t\t} catch (_error) {\n\t\t\tlogger.warn(\n\t\t\t\t'Could not generate types with openapi-typescript. Install it for better type inference.',\n\t\t\t);\n\t\t\tlogger.warn('Run: npm install -D openapi-typescript');\n\n\t\t\t// Generate basic types file\n\t\t\tawait mkdir(dirname(typesPath), { recursive: true });\n\t\t\tawait writeFile(\n\t\t\t\ttypesPath,\n\t\t\t\t`// Auto-generated placeholder types\nexport interface paths {\n  [path: string]: {\n    [method: string]: {\n      operationId?: string;\n      parameters?: any;\n      requestBody?: any;\n      responses?: any;\n    };\n  };\n}\n`,\n\t\t\t);\n\t\t}\n\n\t\t// Extract operation info\n\t\tconst operations = extractOperations(spec);\n\n\t\t// Generate TypeScript code\n\t\tconst code = generateReactQueryCode(\n\t\t\tspec,\n\t\t\toperations,\n\t\t\toptions.name || 'API',\n\t\t);\n\n\t\t// Write output\n\t\tconst outputPath =\n\t\t\toptions.output || join(process.cwd(), 'src', 'api', 'hooks.ts');\n\t\tawait mkdir(dirname(outputPath), { recursive: true });\n\t\tawait writeFile(outputPath, code);\n\n\t\tlogger.log(`React Query hooks generated: ${outputPath}`);\n\t\tlogger.log(`Generated ${operations.length} hooks`);\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`React Query generation failed: ${(error as Error).message}`,\n\t\t);\n\t}\n}\n\ninterface OperationInfo {\n\toperationId: string;\n\tpath: string;\n\tmethod: string;\n\tendpoint: string; // Full endpoint like 'GET /users/{id}'\n\tparameters?: Array<{ name: string; in: string; required?: boolean }>;\n\trequestBody?: boolean;\n\tresponseType?: string;\n}\n\nfunction extractOperations(spec: OpenAPISpec): OperationInfo[] {\n\tconst operations: OperationInfo[] = [];\n\n\tObject.entries(spec.paths).forEach(([path, methods]) => {\n\t\tObject.entries(methods).forEach(([method, operation]) => {\n\t\t\tif (operation.operationId) {\n\t\t\t\toperations.push({\n\t\t\t\t\toperationId: operation.operationId,\n\t\t\t\t\tpath,\n\t\t\t\t\tmethod: method.toUpperCase(),\n\t\t\t\t\tendpoint: `${method.toUpperCase()} ${path}`,\n\t\t\t\t\tparameters: operation.parameters,\n\t\t\t\t\trequestBody: !!operation.requestBody,\n\t\t\t\t\tresponseType: extractResponseType(operation),\n\t\t\t\t});\n\t\t\t}\n\t\t});\n\t});\n\n\treturn operations;\n}\n\nfunction extractResponseType(operation: any): string {\n\tconst responses = operation.responses;\n\tif (!responses) return 'unknown';\n\n\tconst successResponse = responses['200'] || responses['201'];\n\tif (!successResponse?.content?.['application/json']?.schema) {\n\t\treturn 'unknown';\n\t}\n\n\t// Basic type inference from schema\n\tconst schema = successResponse.content['application/json'].schema;\n\treturn schemaToTypeString(schema);\n}\n\nfunction schemaToTypeString(schema: any): string {\n\tif (!schema) return 'unknown';\n\n\tswitch (schema.type) {\n\t\tcase 'string':\n\t\t\treturn 'string';\n\t\tcase 'number':\n\t\tcase 'integer':\n\t\t\treturn 'number';\n\t\tcase 'boolean':\n\t\t\treturn 'boolean';\n\t\tcase 'array':\n\t\t\treturn `Array<${schemaToTypeString(schema.items)}>`;\n\t\tcase 'object':\n\t\t\tif (schema.properties) {\n\t\t\t\tconst props = Object.entries(schema.properties)\n\t\t\t\t\t.map(\n\t\t\t\t\t\t([key, value]: [string, any]) =>\n\t\t\t\t\t\t\t`${key}: ${schemaToTypeString(value)}`,\n\t\t\t\t\t)\n\t\t\t\t\t.join('; ');\n\t\t\t\treturn `{ ${props} }`;\n\t\t\t}\n\t\t\treturn 'Record<string, unknown>';\n\t\tdefault:\n\t\t\treturn 'unknown';\n\t}\n}\n\nfunction generateReactQueryCode(\n\t_spec: OpenAPISpec,\n\toperations: OperationInfo[],\n\tapiName: string,\n): string {\n\tconst imports = `import { createTypedQueryClient } from '@geekmidas/client';\nimport type { paths } from './openapi-types';\n\n// Create typed query client\nexport const ${apiName.toLowerCase()} = createTypedQueryClient<paths>({\n  baseURL: process.env.NEXT_PUBLIC_API_URL || '/api',\n});\n\n// Export individual hooks for better DX\n`;\n\n\tconst queryHooks = operations\n\t\t.filter((op) => op.method === 'GET')\n\t\t.map((op) => generateQueryHook(op, apiName))\n\t\t.join('\\n\\n');\n\n\tconst mutationHooks = operations\n\t\t.filter((op) => op.method !== 'GET')\n\t\t.map((op) => generateMutationHook(op, apiName))\n\t\t.join('\\n\\n');\n\n\tconst typeExports = generateTypeExports(operations);\n\n\treturn `${imports}\n// Query Hooks\n${queryHooks}\n\n// Mutation Hooks\n${mutationHooks}\n\n// Type exports for convenience\n${typeExports}\n\n// Re-export the api for advanced usage\nexport { ${apiName.toLowerCase()} };\n`;\n}\n\nfunction generateQueryHook(op: OperationInfo, apiName: string): string {\n\tconst hookName = `use${capitalize(op.operationId)}`;\n\tconst endpoint = op.endpoint;\n\tconst hasParams = op.parameters?.some((p) => p.in === 'path');\n\tconst hasQuery = op.parameters?.some((p) => p.in === 'query');\n\n\t// Generate properly typed hook\n\tlet params = '';\n\tlet args = '';\n\n\tif (hasParams || hasQuery) {\n\t\tconst paramParts: string[] = [];\n\t\tif (hasParams) {\n\t\t\tconst pathParams =\n\t\t\t\top.parameters?.filter((p) => p.in === 'path').map((p) => p.name) || [];\n\t\t\tparamParts.push(\n\t\t\t\t`params: { ${pathParams.map((p) => `${p}: string`).join('; ')} }`,\n\t\t\t);\n\t\t}\n\t\tif (hasQuery) {\n\t\t\tparamParts.push(`query?: Record<string, any>`);\n\t\t}\n\t\tparams = `config: { ${paramParts.join('; ')} }, `;\n\t\targs = ', config';\n\t}\n\n\treturn `export const ${hookName} = (\n  ${params}options?: Parameters<typeof ${apiName.toLowerCase()}.useQuery>[2]\n) => {\n  return ${apiName.toLowerCase()}.useQuery('${endpoint}' as any${args}, options);\n};`;\n}\n\nfunction generateMutationHook(op: OperationInfo, apiName: string): string {\n\tconst hookName = `use${capitalize(op.operationId)}`;\n\tconst endpoint = op.endpoint;\n\n\treturn `export const ${hookName} = (\n  options?: Parameters<typeof ${apiName.toLowerCase()}.useMutation>[1]\n) => {\n  return ${apiName.toLowerCase()}.useMutation('${endpoint}' as any, options);\n};`;\n}\n\nfunction generateTypeExports(operations: OperationInfo[]): string {\n\tconst exports = operations.map((op) => {\n\t\tconst typeName = capitalize(op.operationId);\n\t\tconst isQuery = op.method === 'GET';\n\n\t\tif (isQuery) {\n\t\t\treturn `export type ${typeName}Response = Awaited<ReturnType<ReturnType<typeof use${typeName}>['data']>>;`;\n\t\t} else {\n\t\t\treturn `export type ${typeName}Response = Awaited<ReturnType<ReturnType<typeof use${typeName}>['mutateAsync']>>;`;\n\t\t}\n\t});\n\n\treturn exports.join('\\n');\n}\n\nfunction capitalize(str: string): string {\n\treturn str.charAt(0).toUpperCase() + str.slice(1);\n}\n"],"mappings":";;;;;;;AAQA,MAAM,YAAY,UAAU,KAAK;AAiBjC,eAAsB,0BACrBA,UAA6B,CAAE,GACf;CAChB,MAAM,SAAS;AAEf,KAAI;EAEH,MAAM,YAAY,QAAQ,SAAS,KAAK,QAAQ,KAAK,EAAE,eAAe;AAEtE,OAAK,WAAW,UAAU,CACzB,OAAM,IAAI,OACR,4BAA4B,UAAU;EAIzC,MAAM,cAAc,MAAM,SAAS,WAAW,QAAQ;EACtD,MAAMC,OAAoB,KAAK,MAAM,YAAY;EAGjD,MAAM,YAAY,QACjB,QAAQ,UAAU,KAAK,QAAQ,KAAK,EAAE,OAAO,OAAO,WAAW,CAC/D;EACD,MAAM,YAAY,KAAK,WAAW,qBAAqB;AAEvD,SAAO,IAAI,mDAAmD;AAE9D,MAAI;AAEH,SAAM,WACJ,0BAA0B,UAAU,QAAQ,UAAU,IACvD,EAAE,KAAK,QAAQ,KAAK,CAAE,EACtB;AACD,UAAO,KAAK,8BAA8B,UAAU,EAAE;EACtD,SAAQ,QAAQ;AAChB,UAAO,KACN,0FACA;AACD,UAAO,KAAK,yCAAyC;AAGrD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,KAAM,EAAC;AACpD,SAAM,UACL,YACC;;;;;;;;;;;EAYD;EACD;EAGD,MAAM,aAAa,kBAAkB,KAAK;EAG1C,MAAM,OAAO,uBACZ,MACA,YACA,QAAQ,QAAQ,MAChB;EAGD,MAAM,aACL,QAAQ,UAAU,KAAK,QAAQ,KAAK,EAAE,OAAO,OAAO,WAAW;AAChE,QAAM,MAAM,QAAQ,WAAW,EAAE,EAAE,WAAW,KAAM,EAAC;AACrD,QAAM,UAAU,YAAY,KAAK;AAEjC,SAAO,KAAK,+BAA+B,WAAW,EAAE;AACxD,SAAO,KAAK,YAAY,WAAW,OAAO,QAAQ;CAClD,SAAQ,OAAO;AACf,QAAM,IAAI,OACR,iCAAkC,MAAgB,QAAQ;CAE5D;AACD;AAYD,SAAS,kBAAkBA,MAAoC;CAC9D,MAAMC,aAA8B,CAAE;AAEtC,QAAO,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,QAAQ,KAAK;AACvD,SAAO,QAAQ,QAAQ,CAAC,QAAQ,CAAC,CAAC,QAAQ,UAAU,KAAK;AACxD,OAAI,UAAU,YACb,YAAW,KAAK;IACf,aAAa,UAAU;IACvB;IACA,QAAQ,OAAO,aAAa;IAC5B,WAAW,EAAE,OAAO,aAAa,CAAC,GAAG,KAAK;IAC1C,YAAY,UAAU;IACtB,eAAe,UAAU;IACzB,cAAc,oBAAoB,UAAU;GAC5C,EAAC;EAEH,EAAC;CACF,EAAC;AAEF,QAAO;AACP;AAED,SAAS,oBAAoBC,WAAwB;CACpD,MAAM,YAAY,UAAU;AAC5B,MAAK,UAAW,QAAO;CAEvB,MAAM,kBAAkB,UAAU,UAAU,UAAU;AACtD,MAAK,iBAAiB,UAAU,qBAAqB,OACpD,QAAO;CAIR,MAAM,SAAS,gBAAgB,QAAQ,oBAAoB;AAC3D,QAAO,mBAAmB,OAAO;AACjC;AAED,SAAS,mBAAmBC,QAAqB;AAChD,MAAK,OAAQ,QAAO;AAEpB,SAAQ,OAAO,MAAf;EACC,KAAK,SACJ,QAAO;EACR,KAAK;EACL,KAAK,UACJ,QAAO;EACR,KAAK,UACJ,QAAO;EACR,KAAK,QACJ,SAAQ,QAAQ,mBAAmB,OAAO,MAAM,CAAC;EAClD,KAAK;AACJ,OAAI,OAAO,YAAY;IACtB,MAAM,QAAQ,OAAO,QAAQ,OAAO,WAAW,CAC7C,IACA,CAAC,CAAC,KAAK,MAAqB,MAC1B,EAAE,IAAI,IAAI,mBAAmB,MAAM,CAAC,EACtC,CACA,KAAK,KAAK;AACZ,YAAQ,IAAI,MAAM;GAClB;AACD,UAAO;EACR,QACC,QAAO;CACR;AACD;AAED,SAAS,uBACRC,OACAH,YACAI,SACS;CACT,MAAM,WAAW;;;;eAIH,QAAQ,aAAa,CAAC;;;;;;CAOpC,MAAM,aAAa,WACjB,OAAO,CAAC,OAAO,GAAG,WAAW,MAAM,CACnC,IAAI,CAAC,OAAO,kBAAkB,IAAI,QAAQ,CAAC,CAC3C,KAAK,OAAO;CAEd,MAAM,gBAAgB,WACpB,OAAO,CAAC,OAAO,GAAG,WAAW,MAAM,CACnC,IAAI,CAAC,OAAO,qBAAqB,IAAI,QAAQ,CAAC,CAC9C,KAAK,OAAO;CAEd,MAAM,cAAc,oBAAoB,WAAW;AAEnD,SAAQ,EAAE,QAAQ;;EAEjB,WAAW;;;EAGX,cAAc;;;EAGd,YAAY;;;WAGH,QAAQ,aAAa,CAAC;;AAEhC;AAED,SAAS,kBAAkBC,IAAmBD,SAAyB;CACtE,MAAM,YAAY,KAAK,WAAW,GAAG,YAAY,CAAC;CAClD,MAAM,WAAW,GAAG;CACpB,MAAM,YAAY,GAAG,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO;CAC7D,MAAM,WAAW,GAAG,YAAY,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ;CAG7D,IAAI,SAAS;CACb,IAAI,OAAO;AAEX,KAAI,aAAa,UAAU;EAC1B,MAAME,aAAuB,CAAE;AAC/B,MAAI,WAAW;GACd,MAAM,aACL,GAAG,YAAY,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAE;AACvE,cAAW,MACT,YAAY,WAAW,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,KAAK,KAAK,CAAC,IAC9D;EACD;AACD,MAAI,SACH,YAAW,MAAM,6BAA6B;AAE/C,YAAU,YAAY,WAAW,KAAK,KAAK,CAAC;AAC5C,SAAO;CACP;AAED,SAAQ,eAAe,SAAS;IAC7B,OAAO,8BAA8B,QAAQ,aAAa,CAAC;;WAEpD,QAAQ,aAAa,CAAC,aAAa,SAAS,UAAU,KAAK;;AAErE;AAED,SAAS,qBAAqBD,IAAmBD,SAAyB;CACzE,MAAM,YAAY,KAAK,WAAW,GAAG,YAAY,CAAC;CAClD,MAAM,WAAW,GAAG;AAEpB,SAAQ,eAAe,SAAS;gCACD,QAAQ,aAAa,CAAC;;WAE3C,QAAQ,aAAa,CAAC,gBAAgB,SAAS;;AAEzD;AAED,SAAS,oBAAoBJ,YAAqC;CACjE,MAAM,UAAU,WAAW,IAAI,CAAC,OAAO;EACtC,MAAM,WAAW,WAAW,GAAG,YAAY;EAC3C,MAAM,UAAU,GAAG,WAAW;AAE9B,MAAI,QACH,SAAQ,cAAc,SAAS,qDAAqD,SAAS;MAE7F,SAAQ,cAAc,SAAS,qDAAqD,SAAS;CAE9F,EAAC;AAEF,QAAO,QAAQ,KAAK,KAAK;AACzB;AAED,SAAS,WAAWO,KAAqB;AACxC,QAAO,IAAI,OAAO,EAAE,CAAC,aAAa,GAAG,IAAI,MAAM,EAAE;AACjD"}

package/dist/openapi-react-query.mjs

@@ -1,4 +1,4 @@
 #!/usr/bin/env -S npx tsx
-import { generateReactQueryCommand } from "./openapi-react-query-DGEkD39r.mjs";
+import { generateReactQueryCommand } from "./openapi-react-query-DaTMSPD5.mjs";
 
 export { generateReactQueryCommand };

package/dist/openapi.cjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env -S npx tsx
-require('./workspace-BMJE18LV.cjs');
-require('./config-Bayob8pB.cjs');
-const require_openapi = require('./openapi-ZhO7wwya.cjs');
+require('./workspace-CeFgIDC-.cjs');
+require('./config-C1dM7aZb.cjs');
+const require_openapi = require('./openapi-Dcja4e1C.cjs');
 
 exports.OPENAPI_OUTPUT_PATH = require_openapi.OPENAPI_OUTPUT_PATH;
 exports.generateOpenApi = require_openapi.generateOpenApi;

package/dist/openapi.d.mts

@@ -1,5 +1,5 @@
 #!/usr/bin/env -S npx tsx
-import { GkmConfig, OpenApiConfig } from "./types-BldpmqQX.mjs";
+import { GkmConfig, OpenApiConfig } from "./types-B9UZ7fOG.mjs";
 
 //#region src/openapi.d.ts
 interface OpenAPIOptions {

package/dist/openapi.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env -S npx tsx
-import "./workspace-CASoZOjs.mjs";
-import "./config-BQ4a36Rq.mjs";
-import { OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-NthphEWK.mjs";
+import "./workspace-Cb_I7oCJ.mjs";
+import "./config-C1bidhvG.mjs";
+import { OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi-9k6a6VA4.mjs";
 
 export { OPENAPI_OUTPUT_PATH, generateOpenApi, openapiCommand, resolveOpenApiConfig };

package/dist/{storage-BMW6yLu3.mjs → storage-DmCbr6DI.mjs}

@@ -269,4 +269,4 @@ function validateEnvironmentVariables(requiredVars, secrets) {
 
 //#endregion
 export { getKeyPath, getSecretsDir, getSecretsPath, initStageSecrets, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, validateEnvironmentVariables, writeStageSecrets };
-//# sourceMappingURL=storage-BMW6yLu3.mjs.map
+//# sourceMappingURL=storage-DmCbr6DI.mjs.map

package/dist/{storage-BMW6yLu3.mjs.map → storage-DmCbr6DI.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"storage-BMW6yLu3.mjs","names":["projectName?: string","stage: string","stage: string","secrets: StageSecrets","keyHex: string","data: EncryptedSecretsFile","key: string","value: string","updated: StageSecrets","password: string","requiredVars: string[]","missing: string[]","provided: string[]"],"sources":["../src/secrets/keystore.ts","../src/secrets/storage.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { basename, join } from 'node:path';\n\n/** Key length for AES-256 encryption */\nconst KEY_LENGTH = 32; // 256 bits\n\n/**\n * Get the keystore directory for a project.\n * Keys are stored at ~/.gkm/{project-name}/\n *\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the keystore directory\n */\nexport function getKeystoreDir(projectName?: string): string {\n\tconst name = projectName ?? basename(process.cwd());\n\treturn join(homedir(), '.gkm', name);\n}\n\n/**\n * Get the path to a stage's encryption key.\n *\n * @param stage - Stage name (e.g., 'development', 'production')\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the key file\n */\nexport function getKeyPath(stage: string, projectName?: string): string {\n\treturn join(getKeystoreDir(projectName), `${stage}.key`);\n}\n\n/**\n * Check if a key exists for a stage.\n */\nexport function keyExists(stage: string, projectName?: string): boolean {\n\treturn existsSync(getKeyPath(stage, projectName));\n}\n\n/**\n * Generate a new encryption key for a stage.\n * The key is stored at ~/.gkm/{project-name}/{stage}.key with restricted permissions.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The generated key as a hex string\n */\nexport async function generateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst keyDir = getKeystoreDir(projectName);\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\t// Ensure keystore directory exists with restricted permissions\n\tawait mkdir(keyDir, { recursive: true, mode: 0o700 });\n\n\t// Generate random key\n\tconst key = randomBytes(KEY_LENGTH).toString('hex');\n\n\t// Write key with restricted permissions (owner read/write only)\n\tawait writeFile(keyPath, key, { mode: 0o600, encoding: 'utf-8' });\n\n\t// Ensure permissions are set correctly (in case file existed)\n\tawait chmod(keyPath, 0o600);\n\n\treturn key;\n}\n\n/**\n * Read an encryption key for a stage.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string, or null if not found\n */\nexport async function readKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string | null> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (!existsSync(keyPath)) {\n\t\treturn null;\n\t}\n\n\tconst key = await readFile(keyPath, 'utf-8');\n\treturn key.trim();\n}\n\n/**\n * Read an encryption key for a stage, throwing if not found.\n */\nexport async function requireKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst key = await readKey(stage, projectName);\n\n\tif (!key) {\n\t\tconst name = projectName ?? basename(process.cwd());\n\t\tthrow new Error(\n\t\t\t`Encryption key not found for stage \"${stage}\" in project \"${name}\". ` +\n\t\t\t\t`Expected key at: ${getKeyPath(stage, projectName)}`,\n\t\t);\n\t}\n\n\treturn key;\n}\n\n/**\n * Delete a key for a stage.\n */\nexport async function deleteKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<void> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (existsSync(keyPath)) {\n\t\tawait rm(keyPath);\n\t}\n}\n\n/**\n * Get or create a key for a stage.\n * If the key already exists, it is returned. Otherwise, a new key is generated.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string\n */\nexport async function getOrCreateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst existingKey = await readKey(stage, projectName);\n\n\tif (existingKey) {\n\t\treturn existingKey;\n\t}\n\n\treturn generateKey(stage, projectName);\n}\n","import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { basename, join } from 'node:path';\nimport { getOrCreateKey, readKey } from './keystore';\nimport type { EmbeddableSecrets, StageSecrets } from './types';\n\n/** Default secrets directory relative to project root */\nconst SECRETS_DIR = '.gkm/secrets';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/** Encrypted secrets file structure */\ninterface EncryptedSecretsFile {\n\t/** Version for future format changes */\n\tversion: 1;\n\t/** Base64 encoded encrypted data (ciphertext + auth tag) */\n\tencrypted: string;\n\t/** Hex encoded IV */\n\tiv: string;\n}\n\n/**\n * Get the secrets directory path.\n */\nexport function getSecretsDir(cwd = process.cwd()): string {\n\treturn join(cwd, SECRETS_DIR);\n}\n\n/**\n * Get the secrets file path for a stage.\n */\nexport function getSecretsPath(stage: string, cwd = process.cwd()): string {\n\treturn join(getSecretsDir(cwd), `${stage}.json`);\n}\n\n/**\n * Check if secrets exist for a stage.\n */\nexport function secretsExist(stage: string, cwd = process.cwd()): boolean {\n\treturn existsSync(getSecretsPath(stage, cwd));\n}\n\n/**\n * Initialize an empty StageSecrets object for a stage.\n */\nexport function initStageSecrets(stage: string): StageSecrets {\n\tconst now = new Date().toISOString();\n\treturn {\n\t\tstage,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tservices: {},\n\t\turls: {},\n\t\tcustom: {},\n\t};\n}\n\n/**\n * Encrypt secrets using a key.\n */\nfunction encryptSecretsData(\n\tsecrets: StageSecrets,\n\tkeyHex: string,\n): EncryptedSecretsFile {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tversion: 1,\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets using a key.\n */\nfunction decryptSecretsData(\n\tdata: EncryptedSecretsFile,\n\tkeyHex: string,\n): StageSecrets {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst ivBuffer = Buffer.from(data.iv, 'hex');\n\tconst combined = Buffer.from(data.encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as StageSecrets;\n}\n\n/**\n * Read secrets for a stage (encrypted).\n * Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key\n *\n * @returns StageSecrets or null if not found\n */\nexport async function readStageSecrets(\n\tstage: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets | null> {\n\tconst path = getSecretsPath(stage, cwd);\n\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\tconst content = await readFile(path, 'utf-8');\n\tconst data = JSON.parse(content);\n\n\t// Check if this is an encrypted file (has version field)\n\tif (data.version === 1 && data.encrypted && data.iv) {\n\t\tconst projectName = basename(cwd);\n\t\tconst key = await readKey(stage, projectName);\n\n\t\tif (!key) {\n\t\t\tthrow new Error(\n\t\t\t\t`Decryption key not found for stage \"${stage}\". ` +\n\t\t\t\t\t`Expected key at: ~/.gkm/${projectName}/${stage}.key`,\n\t\t\t);\n\t\t}\n\n\t\treturn decryptSecretsData(data as EncryptedSecretsFile, key);\n\t}\n\n\t// Legacy: unencrypted format (for backwards compatibility)\n\treturn data as StageSecrets;\n}\n\n/**\n * Write secrets for a stage (encrypted).\n * Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key\n */\nexport async function writeStageSecrets(\n\tsecrets: StageSecrets,\n\tcwd = process.cwd(),\n): Promise<void> {\n\tconst dir = getSecretsDir(cwd);\n\tconst path = getSecretsPath(secrets.stage, cwd);\n\tconst projectName = basename(cwd);\n\n\t// Ensure directory exists\n\tawait mkdir(dir, { recursive: true });\n\n\t// Get or create encryption key\n\tconst key = await getOrCreateKey(secrets.stage, projectName);\n\n\t// Encrypt and write\n\tconst encrypted = encryptSecretsData(secrets, key);\n\tawait writeFile(path, JSON.stringify(encrypted, null, 2), 'utf-8');\n}\n\n/**\n * Convert StageSecrets to embeddable format (flat key-value pairs).\n * This is what gets encrypted and embedded in the bundle.\n */\nexport function toEmbeddableSecrets(secrets: StageSecrets): EmbeddableSecrets {\n\treturn {\n\t\t...secrets.urls,\n\t\t...secrets.custom,\n\t\t// Also include individual service credentials if needed\n\t\t...(secrets.services.postgres && {\n\t\t\tPOSTGRES_USER: secrets.services.postgres.username,\n\t\t\tPOSTGRES_PASSWORD: secrets.services.postgres.password,\n\t\t\tPOSTGRES_DB: secrets.services.postgres.database ?? 'app',\n\t\t\tPOSTGRES_HOST: secrets.services.postgres.host,\n\t\t\tPOSTGRES_PORT: String(secrets.services.postgres.port),\n\t\t}),\n\t\t...(secrets.services.redis && {\n\t\t\tREDIS_PASSWORD: secrets.services.redis.password,\n\t\t\tREDIS_HOST: secrets.services.redis.host,\n\t\t\tREDIS_PORT: String(secrets.services.redis.port),\n\t\t}),\n\t\t...(secrets.services.rabbitmq && {\n\t\t\tRABBITMQ_USER: secrets.services.rabbitmq.username,\n\t\t\tRABBITMQ_PASSWORD: secrets.services.rabbitmq.password,\n\t\t\tRABBITMQ_HOST: secrets.services.rabbitmq.host,\n\t\t\tRABBITMQ_PORT: String(secrets.services.rabbitmq.port),\n\t\t\tRABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? '/',\n\t\t}),\n\t};\n}\n\n/**\n * Update a custom secret in the secrets file.\n */\nexport async function setCustomSecret(\n\tstage: string,\n\tkey: string,\n\tvalue: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets> {\n\tconst secrets = await readStageSecrets(stage, cwd);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`Secrets not found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tconst updated: StageSecrets = {\n\t\t...secrets,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tcustom: {\n\t\t\t...secrets.custom,\n\t\t\t[key]: value,\n\t\t},\n\t};\n\n\tawait writeStageSecrets(updated, cwd);\n\treturn updated;\n}\n\n/**\n * Mask a password for display (show first 4 and last 2 chars).\n */\nexport function maskPassword(password: string): string {\n\tif (password.length <= 8) {\n\t\treturn '********';\n\t}\n\treturn `${password.slice(0, 4)}${'*'.repeat(password.length - 6)}${password.slice(-2)}`;\n}\n\n/**\n * Result of environment variable validation.\n */\nexport interface EnvValidationResult {\n\t/** Whether all required environment variables are present */\n\tvalid: boolean;\n\t/** List of missing environment variable names */\n\tmissing: string[];\n\t/** List of environment variables that are provided */\n\tprovided: string[];\n\t/** List of environment variables that were required */\n\trequired: string[];\n}\n\n/**\n * Validate that all required environment variables are present in secrets.\n *\n * @param requiredVars - Array of environment variable names required by the application\n * @param secrets - Stage secrets to validate against\n * @returns Validation result with missing and provided variables\n *\n * @example\n * ```typescript\n * const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];\n * const secrets = await readStageSecrets('production');\n * const result = validateEnvironmentVariables(required, secrets);\n *\n * if (!result.valid) {\n *   console.error(`Missing environment variables: ${result.missing.join(', ')}`);\n * }\n * ```\n */\nexport function validateEnvironmentVariables(\n\trequiredVars: string[],\n\tsecrets: StageSecrets,\n): EnvValidationResult {\n\tconst embeddable = toEmbeddableSecrets(secrets);\n\tconst availableVars = new Set(Object.keys(embeddable));\n\n\tconst missing: string[] = [];\n\tconst provided: string[] = [];\n\n\tfor (const varName of requiredVars) {\n\t\tif (availableVars.has(varName)) {\n\t\t\tprovided.push(varName);\n\t\t} else {\n\t\t\tmissing.push(varName);\n\t\t}\n\t}\n\n\treturn {\n\t\tvalid: missing.length === 0,\n\t\tmissing: missing.sort(),\n\t\tprovided: provided.sort(),\n\t\trequired: [...requiredVars].sort(),\n\t};\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,aAAa;;;;;;;;AASnB,SAAgB,eAAeA,aAA8B;CAC5D,MAAM,OAAO,eAAe,SAAS,QAAQ,KAAK,CAAC;AACnD,QAAO,KAAK,SAAS,EAAE,QAAQ,KAAK;AACpC;;;;;;;;AASD,SAAgB,WAAWC,OAAeD,aAA8B;AACvE,QAAO,KAAK,eAAe,YAAY,GAAG,EAAE,MAAM,MAAM;AACxD;;;;;;;;;AAiBD,eAAsB,YACrBC,OACAD,aACkB;CAClB,MAAM,SAAS,eAAe,YAAY;CAC1C,MAAM,UAAU,WAAW,OAAO,YAAY;AAG9C,OAAM,MAAM,QAAQ;EAAE,WAAW;EAAM,MAAM;CAAO,EAAC;CAGrD,MAAM,MAAM,YAAY,WAAW,CAAC,SAAS,MAAM;AAGnD,OAAM,UAAU,SAAS,KAAK;EAAE,MAAM;EAAO,UAAU;CAAS,EAAC;AAGjE,OAAM,MAAM,SAAS,IAAM;AAE3B,QAAO;AACP;;;;;;;;AASD,eAAsB,QACrBC,OACAD,aACyB;CACzB,MAAM,UAAU,WAAW,OAAO,YAAY;AAE9C,MAAK,WAAW,QAAQ,CACvB,QAAO;CAGR,MAAM,MAAM,MAAM,SAAS,SAAS,QAAQ;AAC5C,QAAO,IAAI,MAAM;AACjB;;;;;;;;;AA4CD,eAAsB,eACrBC,OACAD,aACkB;CAClB,MAAM,cAAc,MAAM,QAAQ,OAAO,YAAY;AAErD,KAAI,YACH,QAAO;AAGR,QAAO,YAAY,OAAO,YAAY;AACtC;;;;;ACvID,MAAM,cAAc;;AAGpB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,kBAAkB;;;;AAexB,SAAgB,cAAc,MAAM,QAAQ,KAAK,EAAU;AAC1D,QAAO,KAAK,KAAK,YAAY;AAC7B;;;;AAKD,SAAgB,eAAeE,OAAe,MAAM,QAAQ,KAAK,EAAU;AAC1E,QAAO,KAAK,cAAc,IAAI,GAAG,EAAE,MAAM,OAAO;AAChD;;;;AAKD,SAAgB,aAAaA,OAAe,MAAM,QAAQ,KAAK,EAAW;AACzE,QAAO,WAAW,eAAe,OAAO,IAAI,CAAC;AAC7C;;;;AAKD,SAAgB,iBAAiBA,OAA6B;CAC7D,MAAM,MAAM,qBAAI,QAAO,aAAa;AACpC,QAAO;EACN;EACA,WAAW;EACX,WAAW;EACX,UAAU,CAAE;EACZ,MAAM,CAAE;EACR,QAAQ,CAAE;CACV;AACD;;;;AAKD,SAAS,mBACRC,SACAC,QACuB;CACvB,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,KAAK,YAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,eAAe,WAAW,KAAK,GAAG;CACjD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,SAAS;EACT,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;CACtB;AACD;;;;AAKD,SAAS,mBACRC,MACAD,QACe;CACf,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,WAAW,OAAO,KAAK,KAAK,IAAI,MAAM;CAC5C,MAAM,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS;CAGtD,MAAM,aAAa,SAAS,SAAS,IAAI,gBAAgB;CACzD,MAAM,UAAU,SAAS,UAAU,gBAAgB;CAGnD,MAAM,WAAW,iBAAiB,WAAW,KAAK,SAAS;AAC3D,UAAS,WAAW,QAAQ;CAE5B,MAAM,YAAY,OAAO,OAAO,CAC/B,SAAS,OAAO,WAAW,EAC3B,SAAS,OAAO,AAChB,EAAC;AAEF,QAAO,KAAK,MAAM,UAAU,SAAS,QAAQ,CAAC;AAC9C;;;;;;;AAQD,eAAsB,iBACrBF,OACA,MAAM,QAAQ,KAAK,EACY;CAC/B,MAAM,OAAO,eAAe,OAAO,IAAI;AAEvC,MAAK,WAAW,KAAK,CACpB,QAAO;CAGR,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;CAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAGhC,KAAI,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,IAAI;EACpD,MAAM,cAAc,SAAS,IAAI;EACjC,MAAM,MAAM,MAAM,QAAQ,OAAO,YAAY;AAE7C,OAAK,IACJ,OAAM,IAAI,OACR,sCAAsC,MAAM,6BACjB,YAAY,GAAG,MAAM;AAInD,SAAO,mBAAmB,MAA8B,IAAI;CAC5D;AAGD,QAAO;AACP;;;;;AAMD,eAAsB,kBACrBC,SACA,MAAM,QAAQ,KAAK,EACH;CAChB,MAAM,MAAM,cAAc,IAAI;CAC9B,MAAM,OAAO,eAAe,QAAQ,OAAO,IAAI;CAC/C,MAAM,cAAc,SAAS,IAAI;AAGjC,OAAM,MAAM,KAAK,EAAE,WAAW,KAAM,EAAC;CAGrC,MAAM,MAAM,MAAM,eAAe,QAAQ,OAAO,YAAY;CAG5D,MAAM,YAAY,mBAAmB,SAAS,IAAI;AAClD,OAAM,UAAU,MAAM,KAAK,UAAU,WAAW,MAAM,EAAE,EAAE,QAAQ;AAClE;;;;;AAMD,SAAgB,oBAAoBA,SAA0C;AAC7E,QAAO;EACN,GAAG,QAAQ;EACX,GAAG,QAAQ;EAEX,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,aAAa,QAAQ,SAAS,SAAS,YAAY;GACnD,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;EACrD;EACD,GAAI,QAAQ,SAAS,SAAS;GAC7B,gBAAgB,QAAQ,SAAS,MAAM;GACvC,YAAY,QAAQ,SAAS,MAAM;GACnC,YAAY,OAAO,QAAQ,SAAS,MAAM,KAAK;EAC/C;EACD,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;GACrD,gBAAgB,QAAQ,SAAS,SAAS,SAAS;EACnD;CACD;AACD;;;;AAKD,eAAsB,gBACrBD,OACAI,KACAC,OACA,MAAM,QAAQ,KAAK,EACK;CACxB,MAAM,UAAU,MAAM,iBAAiB,OAAO,IAAI;AAElD,MAAK,QACJ,OAAM,IAAI,OACR,+BAA+B,MAAM,mCAAmC,MAAM;CAIjF,MAAMC,UAAwB;EAC7B,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;EACnC,QAAQ;GACP,GAAG,QAAQ;IACV,MAAM;EACP;CACD;AAED,OAAM,kBAAkB,SAAS,IAAI;AACrC,QAAO;AACP;;;;AAKD,SAAgB,aAAaC,UAA0B;AACtD,KAAI,SAAS,UAAU,EACtB,QAAO;AAER,SAAQ,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,EAAE,IAAI,OAAO,SAAS,SAAS,EAAE,CAAC,EAAE,SAAS,MAAM,GAAG,CAAC;AACtF;;;;;;;;;;;;;;;;;;;AAkCD,SAAgB,6BACfC,cACAP,SACsB;CACtB,MAAM,aAAa,oBAAoB,QAAQ;CAC/C,MAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,WAAW;CAErD,MAAMQ,UAAoB,CAAE;CAC5B,MAAMC,WAAqB,CAAE;AAE7B,MAAK,MAAM,WAAW,aACrB,KAAI,cAAc,IAAI,QAAQ,CAC7B,UAAS,KAAK,QAAQ;KAEtB,SAAQ,KAAK,QAAQ;AAIvB,QAAO;EACN,OAAO,QAAQ,WAAW;EAC1B,SAAS,QAAQ,MAAM;EACvB,UAAU,SAAS,MAAM;EACzB,UAAU,CAAC,GAAG,YAAa,EAAC,MAAM;CAClC;AACD"}
+{"version":3,"file":"storage-DmCbr6DI.mjs","names":["projectName?: string","stage: string","stage: string","secrets: StageSecrets","keyHex: string","data: EncryptedSecretsFile","key: string","value: string","updated: StageSecrets","password: string","requiredVars: string[]","missing: string[]","provided: string[]"],"sources":["../src/secrets/keystore.ts","../src/secrets/storage.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { basename, join } from 'node:path';\n\n/** Key length for AES-256 encryption */\nconst KEY_LENGTH = 32; // 256 bits\n\n/**\n * Get the keystore directory for a project.\n * Keys are stored at ~/.gkm/{project-name}/\n *\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the keystore directory\n */\nexport function getKeystoreDir(projectName?: string): string {\n\tconst name = projectName ?? basename(process.cwd());\n\treturn join(homedir(), '.gkm', name);\n}\n\n/**\n * Get the path to a stage's encryption key.\n *\n * @param stage - Stage name (e.g., 'development', 'production')\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the key file\n */\nexport function getKeyPath(stage: string, projectName?: string): string {\n\treturn join(getKeystoreDir(projectName), `${stage}.key`);\n}\n\n/**\n * Check if a key exists for a stage.\n */\nexport function keyExists(stage: string, projectName?: string): boolean {\n\treturn existsSync(getKeyPath(stage, projectName));\n}\n\n/**\n * Generate a new encryption key for a stage.\n * The key is stored at ~/.gkm/{project-name}/{stage}.key with restricted permissions.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The generated key as a hex string\n */\nexport async function generateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst keyDir = getKeystoreDir(projectName);\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\t// Ensure keystore directory exists with restricted permissions\n\tawait mkdir(keyDir, { recursive: true, mode: 0o700 });\n\n\t// Generate random key\n\tconst key = randomBytes(KEY_LENGTH).toString('hex');\n\n\t// Write key with restricted permissions (owner read/write only)\n\tawait writeFile(keyPath, key, { mode: 0o600, encoding: 'utf-8' });\n\n\t// Ensure permissions are set correctly (in case file existed)\n\tawait chmod(keyPath, 0o600);\n\n\treturn key;\n}\n\n/**\n * Read an encryption key for a stage.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string, or null if not found\n */\nexport async function readKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string | null> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (!existsSync(keyPath)) {\n\t\treturn null;\n\t}\n\n\tconst key = await readFile(keyPath, 'utf-8');\n\treturn key.trim();\n}\n\n/**\n * Read an encryption key for a stage, throwing if not found.\n */\nexport async function requireKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst key = await readKey(stage, projectName);\n\n\tif (!key) {\n\t\tconst name = projectName ?? basename(process.cwd());\n\t\tthrow new Error(\n\t\t\t`Encryption key not found for stage \"${stage}\" in project \"${name}\". ` +\n\t\t\t\t`Expected key at: ${getKeyPath(stage, projectName)}`,\n\t\t);\n\t}\n\n\treturn key;\n}\n\n/**\n * Delete a key for a stage.\n */\nexport async function deleteKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<void> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (existsSync(keyPath)) {\n\t\tawait rm(keyPath);\n\t}\n}\n\n/**\n * Get or create a key for a stage.\n * If the key already exists, it is returned. Otherwise, a new key is generated.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string\n */\nexport async function getOrCreateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst existingKey = await readKey(stage, projectName);\n\n\tif (existingKey) {\n\t\treturn existingKey;\n\t}\n\n\treturn generateKey(stage, projectName);\n}\n","import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { basename, join } from 'node:path';\nimport { getOrCreateKey, readKey } from './keystore';\nimport type { EmbeddableSecrets, StageSecrets } from './types';\n\n/** Default secrets directory relative to project root */\nconst SECRETS_DIR = '.gkm/secrets';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/** Encrypted secrets file structure */\ninterface EncryptedSecretsFile {\n\t/** Version for future format changes */\n\tversion: 1;\n\t/** Base64 encoded encrypted data (ciphertext + auth tag) */\n\tencrypted: string;\n\t/** Hex encoded IV */\n\tiv: string;\n}\n\n/**\n * Get the secrets directory path.\n */\nexport function getSecretsDir(cwd = process.cwd()): string {\n\treturn join(cwd, SECRETS_DIR);\n}\n\n/**\n * Get the secrets file path for a stage.\n */\nexport function getSecretsPath(stage: string, cwd = process.cwd()): string {\n\treturn join(getSecretsDir(cwd), `${stage}.json`);\n}\n\n/**\n * Check if secrets exist for a stage.\n */\nexport function secretsExist(stage: string, cwd = process.cwd()): boolean {\n\treturn existsSync(getSecretsPath(stage, cwd));\n}\n\n/**\n * Initialize an empty StageSecrets object for a stage.\n */\nexport function initStageSecrets(stage: string): StageSecrets {\n\tconst now = new Date().toISOString();\n\treturn {\n\t\tstage,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tservices: {},\n\t\turls: {},\n\t\tcustom: {},\n\t};\n}\n\n/**\n * Encrypt secrets using a key.\n */\nfunction encryptSecretsData(\n\tsecrets: StageSecrets,\n\tkeyHex: string,\n): EncryptedSecretsFile {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tversion: 1,\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets using a key.\n */\nfunction decryptSecretsData(\n\tdata: EncryptedSecretsFile,\n\tkeyHex: string,\n): StageSecrets {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst ivBuffer = Buffer.from(data.iv, 'hex');\n\tconst combined = Buffer.from(data.encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as StageSecrets;\n}\n\n/**\n * Read secrets for a stage (encrypted).\n * Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key\n *\n * @returns StageSecrets or null if not found\n */\nexport async function readStageSecrets(\n\tstage: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets | null> {\n\tconst path = getSecretsPath(stage, cwd);\n\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\tconst content = await readFile(path, 'utf-8');\n\tconst data = JSON.parse(content);\n\n\t// Check if this is an encrypted file (has version field)\n\tif (data.version === 1 && data.encrypted && data.iv) {\n\t\tconst projectName = basename(cwd);\n\t\tconst key = await readKey(stage, projectName);\n\n\t\tif (!key) {\n\t\t\tthrow new Error(\n\t\t\t\t`Decryption key not found for stage \"${stage}\". ` +\n\t\t\t\t\t`Expected key at: ~/.gkm/${projectName}/${stage}.key`,\n\t\t\t);\n\t\t}\n\n\t\treturn decryptSecretsData(data as EncryptedSecretsFile, key);\n\t}\n\n\t// Legacy: unencrypted format (for backwards compatibility)\n\treturn data as StageSecrets;\n}\n\n/**\n * Write secrets for a stage (encrypted).\n * Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key\n */\nexport async function writeStageSecrets(\n\tsecrets: StageSecrets,\n\tcwd = process.cwd(),\n): Promise<void> {\n\tconst dir = getSecretsDir(cwd);\n\tconst path = getSecretsPath(secrets.stage, cwd);\n\tconst projectName = basename(cwd);\n\n\t// Ensure directory exists\n\tawait mkdir(dir, { recursive: true });\n\n\t// Get or create encryption key\n\tconst key = await getOrCreateKey(secrets.stage, projectName);\n\n\t// Encrypt and write\n\tconst encrypted = encryptSecretsData(secrets, key);\n\tawait writeFile(path, JSON.stringify(encrypted, null, 2), 'utf-8');\n}\n\n/**\n * Convert StageSecrets to embeddable format (flat key-value pairs).\n * This is what gets encrypted and embedded in the bundle.\n */\nexport function toEmbeddableSecrets(secrets: StageSecrets): EmbeddableSecrets {\n\treturn {\n\t\t...secrets.urls,\n\t\t...secrets.custom,\n\t\t// Also include individual service credentials if needed\n\t\t...(secrets.services.postgres && {\n\t\t\tPOSTGRES_USER: secrets.services.postgres.username,\n\t\t\tPOSTGRES_PASSWORD: secrets.services.postgres.password,\n\t\t\tPOSTGRES_DB: secrets.services.postgres.database ?? 'app',\n\t\t\tPOSTGRES_HOST: secrets.services.postgres.host,\n\t\t\tPOSTGRES_PORT: String(secrets.services.postgres.port),\n\t\t}),\n\t\t...(secrets.services.redis && {\n\t\t\tREDIS_PASSWORD: secrets.services.redis.password,\n\t\t\tREDIS_HOST: secrets.services.redis.host,\n\t\t\tREDIS_PORT: String(secrets.services.redis.port),\n\t\t}),\n\t\t...(secrets.services.rabbitmq && {\n\t\t\tRABBITMQ_USER: secrets.services.rabbitmq.username,\n\t\t\tRABBITMQ_PASSWORD: secrets.services.rabbitmq.password,\n\t\t\tRABBITMQ_HOST: secrets.services.rabbitmq.host,\n\t\t\tRABBITMQ_PORT: String(secrets.services.rabbitmq.port),\n\t\t\tRABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? '/',\n\t\t}),\n\t};\n}\n\n/**\n * Update a custom secret in the secrets file.\n */\nexport async function setCustomSecret(\n\tstage: string,\n\tkey: string,\n\tvalue: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets> {\n\tconst secrets = await readStageSecrets(stage, cwd);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`Secrets not found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tconst updated: StageSecrets = {\n\t\t...secrets,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tcustom: {\n\t\t\t...secrets.custom,\n\t\t\t[key]: value,\n\t\t},\n\t};\n\n\tawait writeStageSecrets(updated, cwd);\n\treturn updated;\n}\n\n/**\n * Mask a password for display (show first 4 and last 2 chars).\n */\nexport function maskPassword(password: string): string {\n\tif (password.length <= 8) {\n\t\treturn '********';\n\t}\n\treturn `${password.slice(0, 4)}${'*'.repeat(password.length - 6)}${password.slice(-2)}`;\n}\n\n/**\n * Result of environment variable validation.\n */\nexport interface EnvValidationResult {\n\t/** Whether all required environment variables are present */\n\tvalid: boolean;\n\t/** List of missing environment variable names */\n\tmissing: string[];\n\t/** List of environment variables that are provided */\n\tprovided: string[];\n\t/** List of environment variables that were required */\n\trequired: string[];\n}\n\n/**\n * Validate that all required environment variables are present in secrets.\n *\n * @param requiredVars - Array of environment variable names required by the application\n * @param secrets - Stage secrets to validate against\n * @returns Validation result with missing and provided variables\n *\n * @example\n * ```typescript\n * const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];\n * const secrets = await readStageSecrets('production');\n * const result = validateEnvironmentVariables(required, secrets);\n *\n * if (!result.valid) {\n *   console.error(`Missing environment variables: ${result.missing.join(', ')}`);\n * }\n * ```\n */\nexport function validateEnvironmentVariables(\n\trequiredVars: string[],\n\tsecrets: StageSecrets,\n): EnvValidationResult {\n\tconst embeddable = toEmbeddableSecrets(secrets);\n\tconst availableVars = new Set(Object.keys(embeddable));\n\n\tconst missing: string[] = [];\n\tconst provided: string[] = [];\n\n\tfor (const varName of requiredVars) {\n\t\tif (availableVars.has(varName)) {\n\t\t\tprovided.push(varName);\n\t\t} else {\n\t\t\tmissing.push(varName);\n\t\t}\n\t}\n\n\treturn {\n\t\tvalid: missing.length === 0,\n\t\tmissing: missing.sort(),\n\t\tprovided: provided.sort(),\n\t\trequired: [...requiredVars].sort(),\n\t};\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,aAAa;;;;;;;;AASnB,SAAgB,eAAeA,aAA8B;CAC5D,MAAM,OAAO,eAAe,SAAS,QAAQ,KAAK,CAAC;AACnD,QAAO,KAAK,SAAS,EAAE,QAAQ,KAAK;AACpC;;;;;;;;AASD,SAAgB,WAAWC,OAAeD,aAA8B;AACvE,QAAO,KAAK,eAAe,YAAY,GAAG,EAAE,MAAM,MAAM;AACxD;;;;;;;;;AAiBD,eAAsB,YACrBC,OACAD,aACkB;CAClB,MAAM,SAAS,eAAe,YAAY;CAC1C,MAAM,UAAU,WAAW,OAAO,YAAY;AAG9C,OAAM,MAAM,QAAQ;EAAE,WAAW;EAAM,MAAM;CAAO,EAAC;CAGrD,MAAM,MAAM,YAAY,WAAW,CAAC,SAAS,MAAM;AAGnD,OAAM,UAAU,SAAS,KAAK;EAAE,MAAM;EAAO,UAAU;CAAS,EAAC;AAGjE,OAAM,MAAM,SAAS,IAAM;AAE3B,QAAO;AACP;;;;;;;;AASD,eAAsB,QACrBC,OACAD,aACyB;CACzB,MAAM,UAAU,WAAW,OAAO,YAAY;AAE9C,MAAK,WAAW,QAAQ,CACvB,QAAO;CAGR,MAAM,MAAM,MAAM,SAAS,SAAS,QAAQ;AAC5C,QAAO,IAAI,MAAM;AACjB;;;;;;;;;AA4CD,eAAsB,eACrBC,OACAD,aACkB;CAClB,MAAM,cAAc,MAAM,QAAQ,OAAO,YAAY;AAErD,KAAI,YACH,QAAO;AAGR,QAAO,YAAY,OAAO,YAAY;AACtC;;;;;ACvID,MAAM,cAAc;;AAGpB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,kBAAkB;;;;AAexB,SAAgB,cAAc,MAAM,QAAQ,KAAK,EAAU;AAC1D,QAAO,KAAK,KAAK,YAAY;AAC7B;;;;AAKD,SAAgB,eAAeE,OAAe,MAAM,QAAQ,KAAK,EAAU;AAC1E,QAAO,KAAK,cAAc,IAAI,GAAG,EAAE,MAAM,OAAO;AAChD;;;;AAKD,SAAgB,aAAaA,OAAe,MAAM,QAAQ,KAAK,EAAW;AACzE,QAAO,WAAW,eAAe,OAAO,IAAI,CAAC;AAC7C;;;;AAKD,SAAgB,iBAAiBA,OAA6B;CAC7D,MAAM,MAAM,qBAAI,QAAO,aAAa;AACpC,QAAO;EACN;EACA,WAAW;EACX,WAAW;EACX,UAAU,CAAE;EACZ,MAAM,CAAE;EACR,QAAQ,CAAE;CACV;AACD;;;;AAKD,SAAS,mBACRC,SACAC,QACuB;CACvB,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,KAAK,YAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,eAAe,WAAW,KAAK,GAAG;CACjD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,SAAS;EACT,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;CACtB;AACD;;;;AAKD,SAAS,mBACRC,MACAD,QACe;CACf,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,WAAW,OAAO,KAAK,KAAK,IAAI,MAAM;CAC5C,MAAM,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS;CAGtD,MAAM,aAAa,SAAS,SAAS,IAAI,gBAAgB;CACzD,MAAM,UAAU,SAAS,UAAU,gBAAgB;CAGnD,MAAM,WAAW,iBAAiB,WAAW,KAAK,SAAS;AAC3D,UAAS,WAAW,QAAQ;CAE5B,MAAM,YAAY,OAAO,OAAO,CAC/B,SAAS,OAAO,WAAW,EAC3B,SAAS,OAAO,AAChB,EAAC;AAEF,QAAO,KAAK,MAAM,UAAU,SAAS,QAAQ,CAAC;AAC9C;;;;;;;AAQD,eAAsB,iBACrBF,OACA,MAAM,QAAQ,KAAK,EACY;CAC/B,MAAM,OAAO,eAAe,OAAO,IAAI;AAEvC,MAAK,WAAW,KAAK,CACpB,QAAO;CAGR,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;CAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAGhC,KAAI,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,IAAI;EACpD,MAAM,cAAc,SAAS,IAAI;EACjC,MAAM,MAAM,MAAM,QAAQ,OAAO,YAAY;AAE7C,OAAK,IACJ,OAAM,IAAI,OACR,sCAAsC,MAAM,6BACjB,YAAY,GAAG,MAAM;AAInD,SAAO,mBAAmB,MAA8B,IAAI;CAC5D;AAGD,QAAO;AACP;;;;;AAMD,eAAsB,kBACrBC,SACA,MAAM,QAAQ,KAAK,EACH;CAChB,MAAM,MAAM,cAAc,IAAI;CAC9B,MAAM,OAAO,eAAe,QAAQ,OAAO,IAAI;CAC/C,MAAM,cAAc,SAAS,IAAI;AAGjC,OAAM,MAAM,KAAK,EAAE,WAAW,KAAM,EAAC;CAGrC,MAAM,MAAM,MAAM,eAAe,QAAQ,OAAO,YAAY;CAG5D,MAAM,YAAY,mBAAmB,SAAS,IAAI;AAClD,OAAM,UAAU,MAAM,KAAK,UAAU,WAAW,MAAM,EAAE,EAAE,QAAQ;AAClE;;;;;AAMD,SAAgB,oBAAoBA,SAA0C;AAC7E,QAAO;EACN,GAAG,QAAQ;EACX,GAAG,QAAQ;EAEX,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,aAAa,QAAQ,SAAS,SAAS,YAAY;GACnD,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;EACrD;EACD,GAAI,QAAQ,SAAS,SAAS;GAC7B,gBAAgB,QAAQ,SAAS,MAAM;GACvC,YAAY,QAAQ,SAAS,MAAM;GACnC,YAAY,OAAO,QAAQ,SAAS,MAAM,KAAK;EAC/C;EACD,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;GACrD,gBAAgB,QAAQ,SAAS,SAAS,SAAS;EACnD;CACD;AACD;;;;AAKD,eAAsB,gBACrBD,OACAI,KACAC,OACA,MAAM,QAAQ,KAAK,EACK;CACxB,MAAM,UAAU,MAAM,iBAAiB,OAAO,IAAI;AAElD,MAAK,QACJ,OAAM,IAAI,OACR,+BAA+B,MAAM,mCAAmC,MAAM;CAIjF,MAAMC,UAAwB;EAC7B,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;EACnC,QAAQ;GACP,GAAG,QAAQ;IACV,MAAM;EACP;CACD;AAED,OAAM,kBAAkB,SAAS,IAAI;AACrC,QAAO;AACP;;;;AAKD,SAAgB,aAAaC,UAA0B;AACtD,KAAI,SAAS,UAAU,EACtB,QAAO;AAER,SAAQ,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,EAAE,IAAI,OAAO,SAAS,SAAS,EAAE,CAAC,EAAE,SAAS,MAAM,GAAG,CAAC;AACtF;;;;;;;;;;;;;;;;;;;AAkCD,SAAgB,6BACfC,cACAP,SACsB;CACtB,MAAM,aAAa,oBAAoB,QAAQ;CAC/C,MAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,WAAW;CAErD,MAAMQ,UAAoB,CAAE;CAC5B,MAAMC,WAAqB,CAAE;AAE7B,MAAK,MAAM,WAAW,aACrB,KAAI,cAAc,IAAI,QAAQ,CAC7B,UAAS,KAAK,QAAQ;KAEtB,SAAQ,KAAK,QAAQ;AAIvB,QAAO;EACN,OAAO,QAAQ,WAAW;EAC1B,SAAS,QAAQ,MAAM;EACvB,UAAU,SAAS,MAAM;EACzB,UAAU,CAAC,GAAG,YAAa,EAAC,MAAM;CAClC;AACD"}

package/dist/{storage-D8XzjVaO.mjs → storage-Dx_jZbq6.mjs}

@@ -1,3 +1,3 @@
-import { getSecretsDir, getSecretsPath, initStageSecrets, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, validateEnvironmentVariables, writeStageSecrets } from "./storage-BMW6yLu3.mjs";
+import { getSecretsDir, getSecretsPath, initStageSecrets, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, validateEnvironmentVariables, writeStageSecrets } from "./storage-DmCbr6DI.mjs";
 
 export { initStageSecrets, readStageSecrets, toEmbeddableSecrets, validateEnvironmentVariables, writeStageSecrets };

package/dist/{types-BldpmqQX.d.mts → types-B9UZ7fOG.d.mts}

@@ -261,4 +261,4 @@ interface GkmConfig {
 }
 //#endregion
 export { GkmConfig, HooksConfig, OpenApiConfig, ProvidersConfig, Routes, Runtime, StudioConfig, TelescopeConfig };
-//# sourceMappingURL=types-BldpmqQX.d.mts.map
+//# sourceMappingURL=types-B9UZ7fOG.d.mts.map

package/dist/{types-BldpmqQX.d.mts.map → types-B9UZ7fOG.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-BldpmqQX.d.mts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;AASiB,KAFL,MAAA,GAEmB,MAAA,GAAA,MAAA,EAAA;AAKd,UALA,cAAA,CAKoB;EAIpB,OAAA,CAAA,EAAA,OAAA;EAIA,SAAA,CAAA,EAAA,MAAA;AA4BjB;AAcY,UAlDK,mBAAA,SAA4B,cAkDf,CAAA,CAG9B;AAAiC,UAjDhB,eAAA,SAAwB,cAiDR,CAAA;AACM,UA9CtB,gBAAA,CA8CsB;EAAa;EAGnC,OAAA,CAAA,EAAA,OAAY;EAAA;EAAA,MAwBhB,CAAA,EAAA,OAAA;EAAqB;EAAqB,MAAA,CAAA,EAAA,OAAA;EAItC;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAIA,gBAJQ,CAAA,EAAA,OAAA;EAAc;EAOxC,QAAA,CAAA,EAAO,MAAA,EAAA;EAEF;EAiBA,WAAA,CAAA,EAAA,SAAY,GAAA,SAAA;EASZ;EAWA,OAAA,CAAA,EAAA,OAAW;EA6BX;AAajB;;;;;;EAQoC,iBAGhB,CAAA,EAAA,OAAA;;AAEsB;AAGzB,UAzJA,aAAA,CAyJS;EAAA;;;;EAGX,KACA,CAAA,EAAA,MAAA;EAAM;;;;EA+BoB,OAmBpB,CAAA,EAAA,MAAA;;;AA8BC,KA/NV,kBAAA,GA+NU,UAAA,GAAA,OAAA,GAAA,UAAA;;KA5NV,qBAAA,WACL,gCAAgC;UAGtB,YAAA;;;;;;;;;;;;;;;;;;;;;;;;eAwBJ,wBAAwB;;;UAIpB,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;UACR;cACI;UACJ;gBACM;;;cAGF;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD"}
+{"version":3,"file":"types-B9UZ7fOG.d.mts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;AASiB,KAFL,MAAA,GAEmB,MAAA,GAAA,MAAA,EAAA;AAKd,UALA,cAAA,CAKoB;EAIpB,OAAA,CAAA,EAAA,OAAA;EAIA,SAAA,CAAA,EAAA,MAAA;AA4BjB;AAcY,UAlDK,mBAAA,SAA4B,cAkDf,CAAA,CAG9B;AAAiC,UAjDhB,eAAA,SAAwB,cAiDR,CAAA;AACM,UA9CtB,gBAAA,CA8CsB;EAAa;EAGnC,OAAA,CAAA,EAAA,OAAY;EAAA;EAAA,MAwBhB,CAAA,EAAA,OAAA;EAAqB;EAAqB,MAAA,CAAA,EAAA,OAAA;EAItC;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAIA,gBAJQ,CAAA,EAAA,OAAA;EAAc;EAOxC,QAAA,CAAA,EAAO,MAAA,EAAA;EAEF;EAiBA,WAAA,CAAA,EAAA,SAAY,GAAA,SAAA;EASZ;EAWA,OAAA,CAAA,EAAA,OAAW;EA6BX;AAajB;;;;;;EAQoC,iBAGhB,CAAA,EAAA,OAAA;;AAEsB;AAGzB,UAzJA,aAAA,CAyJS;EAAA;;;;EAGX,KACA,CAAA,EAAA,MAAA;EAAM;;;;EA+BoB,OAmBpB,CAAA,EAAA,MAAA;;;AA8BC,KA/NV,kBAAA,GA+NU,UAAA,GAAA,OAAA,GAAA,UAAA;;KA5NV,qBAAA,WACL,gCAAgC;UAGtB,YAAA;;;;;;;;;;;;;;;;;;;;;;;;eAwBJ,wBAAwB;;;UAIpB,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;UACR;cACI;UACJ;gBACM;;;cAGF;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD"}

package/dist/workspace/index.cjs

@@ -1,4 +1,4 @@
-const require_workspace = require('../workspace-BMJE18LV.cjs');
+const require_workspace = require('../workspace-CeFgIDC-.cjs');
 
 exports.PHASE_2_DEPLOY_TARGETS = require_workspace.PHASE_2_DEPLOY_TARGETS;
 exports.SUPPORTED_DEPLOY_TARGETS = require_workspace.SUPPORTED_DEPLOY_TARGETS;

package/dist/workspace/index.d.cts

@@ -1,3 +1,3 @@
 import "../types-l53qUmGt.cjs";
-import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-CufAAnge.cjs";
+import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-DzmZ6SUW.cjs";
 export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };

package/dist/workspace/index.d.mts

@@ -1,3 +1,3 @@
-import "../types-BldpmqQX.mjs";
-import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-Bi9vGQJy.mjs";
+import "../types-B9UZ7fOG.mjs";
+import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../index-DvpWzLD7.mjs";
 export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ClientConfig, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };

package/dist/workspace/index.mjs

@@ -1,3 +1,3 @@
-import { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../workspace-CASoZOjs.mjs";
+import { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace } from "../workspace-Cb_I7oCJ.mjs";
 
 export { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };

package/dist/{workspace-CASoZOjs.mjs → workspace-Cb_I7oCJ.mjs}

@@ -1,10 +1,6 @@
-import { createRequire } from "node:module";
+import { __require } from "./chunk-Duj1WY3L.mjs";
 import { basename } from "node:path";
 
-//#region rolldown:runtime
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-
-//#endregion
 //#region ../../node_modules/.pnpm/zod@4.1.13/node_modules/zod/v4/core/core.js
 /** A special constant with type `never` */
 const NEVER = Object.freeze({ status: "aborted" });
@@ -3695,7 +3691,8 @@ const LocalStateConfigSchema = object({ provider: literal("local") });
 */
 const SSMStateConfigSchema = object({
 	provider: literal("ssm"),
-	region: AwsRegionSchema
+	region: AwsRegionSchema,
+	profile: string().optional()
 });
 /**
 * Custom state provider config (user-provided implementation).
@@ -4150,5 +4147,5 @@ function getEndpointForStage(dokployConfig, stage) {
 }
 
 //#endregion
-export { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, __require, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };
-//# sourceMappingURL=workspace-CASoZOjs.mjs.map
+export { PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, WorkspaceConfigSchema, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig, wrapSingleAppAsWorkspace };
+//# sourceMappingURL=workspace-Cb_I7oCJ.mjs.map