@geekmidas/cli 10.0.0-alpha.10 → 10.0.0-alpha.101

package/dist/s3-CrPoA89T.cjs

@@ -0,0 +1,215 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_workspace = require("./workspace-BwqQnool.cjs");
+const require_projectBucket = require("./projectBucket-BBbQ1lHF.cjs");
+const require_awsStore = require("./awsStore-u3ehhMoY.cjs");
+let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
+let _aws_sdk_client_sts = require("@aws-sdk/client-sts");
+//#region src/secrets/s3.ts
+/**
+* A stage's secrets in S3: one object per stage,
+* `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the
+* deploy state (`providers/projectBucket.ts`) — or in a bucket the config
+* names, which must exist.
+*
+* Encrypted at rest with SSE-S3, asked for on every write although the
+* project bucket defaults to it, so no KMS key is another place to keep. The
+* bucket's versioning keeps every past document. Unlike an SSM parameter
+* there is no size to outgrow.
+*
+* The project bucket is created by the first write, never by a read: a stage
+* whose bucket or object does not exist yet has no secrets. Every write is
+* conditional — `If-Match` on the ETag this store last read for the stage,
+* `If-None-Match: *` when it read none — so two `secrets:set` runs at once
+* cannot each overwrite the other's key: the second is refused with
+* {@link StageSecretsChanged}.
+*/
+/**
+* Another run wrote the stage's secrets after this one read them. Nothing was
+* written: the change is to be made again, on top of theirs.
+*/
+var StageSecretsChanged = class extends require_errors.GkmError {
+	stage;
+	location;
+	constructor(stage, location) {
+		super(`The secrets for stage "${stage}" at ${location} changed after this command read them — another secrets command or deploy wrote them first. Nothing was written; run the command again to make the change on top of theirs.`);
+		this.stage = stage;
+		this.location = location;
+		this.name = "StageSecretsChanged";
+	}
+};
+/** A conditional write that lost: the object is not what the write assumed. */
+function lostRace(error) {
+	const { name, $metadata } = error;
+	return name === "PreconditionFailed" || name === "ConditionalRequestConflict" || $metadata?.httpStatusCode === 412 || $metadata?.httpStatusCode === 409;
+}
+function notFound(error) {
+	const { name, $metadata } = error;
+	return name === "NoSuchKey" || name === "NotFound" || $metadata?.httpStatusCode === 404;
+}
+var S3SecretsStore = class {
+	options;
+	name = "s3";
+	clients;
+	/** The bucket's name, once known. */
+	bucketName;
+	/** Whether the bucket is known to exist. */
+	exists = false;
+	/** The ETag each stage was last read at — null: read, and not there. */
+	etags = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.options = options;
+		if (options.bucket) {
+			this.bucketName = options.bucket;
+			this.exists = true;
+		}
+	}
+	/** The bucket's name; the project bucket's is known after the first call. */
+	get bucket() {
+		return this.bucketName ?? require_projectBucket.projectBucketName(this.options.identity.scope, "<account id>");
+	}
+	/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */
+	location(stage) {
+		return `s3://${this.bucket}/${this.key(stage)}`;
+	}
+	key(stage) {
+		return require_workspace.s3SecretsKey(this.options.prefix, this.options.project, stage);
+	}
+	async client() {
+		if (this.clients) return this.clients;
+		const base = await require_awsStore.awsClientConfig(this.options);
+		const endpoint = base.endpoint ?? process.env.AWS_ENDPOINT_URL_S3 ?? process.env.AWS_ENDPOINT_URL;
+		const credentials = this.options.credentials ?? base.credentials;
+		this.clients = {
+			s3: new _aws_sdk_client_s3.S3Client({
+				region: base.region,
+				...endpoint ? {
+					endpoint,
+					forcePathStyle: true
+				} : {},
+				...credentials ? { credentials } : {}
+			}),
+			sts: new _aws_sdk_client_sts.STSClient({
+				region: base.region,
+				...base.endpoint ? { endpoint: base.endpoint } : {},
+				...credentials ? { credentials } : {}
+			})
+		};
+		return this.clients;
+	}
+	/** One AWS call, a missing or expired credential refused by name. */
+	call(stage, access, run) {
+		return require_awsStore.withStageCredentials({
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		}, run);
+	}
+	/**
+	* The bucket, or null for a project bucket that does not exist yet and is
+	* not to be created (a read).
+	*/
+	async use(stage, create) {
+		const { s3, sts } = await this.client();
+		if (this.exists) return {
+			s3,
+			bucket: this.bucketName
+		};
+		const access = create ? "write" : "read";
+		this.bucketName ??= require_projectBucket.projectBucketName(this.options.identity.scope, await this.call(stage, access, () => require_projectBucket.callerAccountId(sts)));
+		const bucket = this.bucketName;
+		if (create) await this.call(stage, access, () => require_projectBucket.ensureProjectBucket(s3, {
+			bucket,
+			region: this.options.region,
+			identity: this.options.identity
+		}));
+		else if (await this.call(stage, access, () => require_projectBucket.findProjectBucket(s3, bucket)) === "none") return {
+			s3,
+			bucket: null
+		};
+		this.exists = true;
+		return {
+			s3,
+			bucket
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
+	async read(stage) {
+		const { s3, bucket } = await this.use(stage, false);
+		if (!bucket) {
+			this.etags.set(stage, null);
+			return null;
+		}
+		try {
+			const response = await this.call(stage, "read", () => s3.send(new _aws_sdk_client_s3.GetObjectCommand({
+				Bucket: bucket,
+				Key: this.key(stage)
+			})));
+			const body = await response.Body.transformToString("utf-8");
+			this.remember(stage, response.ETag);
+			return JSON.parse(body);
+		} catch (error) {
+			if (!notFound(error)) throw error;
+			this.etags.set(stage, null);
+			return null;
+		}
+	}
+	/**
+	* Replace the stage's secrets — on the condition that they are still what
+	* this store last read. A stage never read here is replaced as it is now.
+	*
+	* @throws {StageSecretsChanged} when another run wrote them in between
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
+	async write(stage, secrets) {
+		const { s3, bucket } = await this.use(stage, true);
+		const Bucket = bucket;
+		const Key = this.key(stage);
+		const expected = this.etags.has(stage) ? this.etags.get(stage) ?? null : await this.currentEtag(s3, stage, Bucket, Key);
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new _aws_sdk_client_s3.PutObjectCommand({
+				Bucket,
+				Key,
+				Body: JSON.stringify(secrets),
+				ContentType: "application/json",
+				ServerSideEncryption: "AES256",
+				...expected === null ? { IfNoneMatch: "*" } : { IfMatch: expected }
+			})));
+			this.remember(stage, ETag);
+		} catch (error) {
+			if (lostRace(error)) {
+				this.etags.delete(stage);
+				throw new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);
+			}
+			throw error;
+		}
+	}
+	/**
+	* The ETag the stage is now at. Some S3-compatible servers answer without
+	* one: then nothing is remembered, and the next write asks for it first.
+	*/
+	remember(stage, etag) {
+		if (etag) this.etags.set(stage, etag);
+		else this.etags.delete(stage);
+	}
+	async currentEtag(s3, stage, Bucket, Key) {
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new _aws_sdk_client_s3.HeadObjectCommand({
+				Bucket,
+				Key
+			})));
+			return ETag ?? null;
+		} catch (error) {
+			if (notFound(error)) return null;
+			throw error;
+		}
+	}
+};
+//#endregion
+exports.S3SecretsStore = S3SecretsStore;
+
+//# sourceMappingURL=s3-CrPoA89T.cjs.map

package/dist/s3-CrPoA89T.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-CrPoA89T.cjs","names":["GkmError","projectBucketName","s3SecretsKey","awsClientConfig","S3Client","STSClient","withStageCredentials","callerAccountId","ensureProjectBucket","findProjectBucket","GetObjectCommand","PutObjectCommand","HeadObjectCommand"],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyCA,eAAAA,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACLC,sBAAAA,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAOC,kBAAAA,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAIC,mBAAAA,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAIC,oBAAAA,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAOC,iBAAAA,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAeL,sBAAAA,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAcM,sBAAAA,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtBC,sBAAAA,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAcC,sBAAAA,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAIC,mBAAAA,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAIC,mBAAAA,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}

package/dist/s3-DQXZdmCM.mjs

@@ -0,0 +1,215 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { lt as s3SecretsKey } from "./workspace-D1QbNd55.mjs";
+import { a as findProjectBucket, i as ensureProjectBucket, o as projectBucketName, r as callerAccountId } from "./projectBucket-C_DN4WzF.mjs";
+import { r as withStageCredentials, t as awsClientConfig } from "./awsStore-Bx5nCFnS.mjs";
+import { GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { STSClient } from "@aws-sdk/client-sts";
+//#region src/secrets/s3.ts
+/**
+* A stage's secrets in S3: one object per stage,
+* `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the
+* deploy state (`providers/projectBucket.ts`) — or in a bucket the config
+* names, which must exist.
+*
+* Encrypted at rest with SSE-S3, asked for on every write although the
+* project bucket defaults to it, so no KMS key is another place to keep. The
+* bucket's versioning keeps every past document. Unlike an SSM parameter
+* there is no size to outgrow.
+*
+* The project bucket is created by the first write, never by a read: a stage
+* whose bucket or object does not exist yet has no secrets. Every write is
+* conditional — `If-Match` on the ETag this store last read for the stage,
+* `If-None-Match: *` when it read none — so two `secrets:set` runs at once
+* cannot each overwrite the other's key: the second is refused with
+* {@link StageSecretsChanged}.
+*/
+/**
+* Another run wrote the stage's secrets after this one read them. Nothing was
+* written: the change is to be made again, on top of theirs.
+*/
+var StageSecretsChanged = class extends GkmError {
+	stage;
+	location;
+	constructor(stage, location) {
+		super(`The secrets for stage "${stage}" at ${location} changed after this command read them — another secrets command or deploy wrote them first. Nothing was written; run the command again to make the change on top of theirs.`);
+		this.stage = stage;
+		this.location = location;
+		this.name = "StageSecretsChanged";
+	}
+};
+/** A conditional write that lost: the object is not what the write assumed. */
+function lostRace(error) {
+	const { name, $metadata } = error;
+	return name === "PreconditionFailed" || name === "ConditionalRequestConflict" || $metadata?.httpStatusCode === 412 || $metadata?.httpStatusCode === 409;
+}
+function notFound(error) {
+	const { name, $metadata } = error;
+	return name === "NoSuchKey" || name === "NotFound" || $metadata?.httpStatusCode === 404;
+}
+var S3SecretsStore = class {
+	options;
+	name = "s3";
+	clients;
+	/** The bucket's name, once known. */
+	bucketName;
+	/** Whether the bucket is known to exist. */
+	exists = false;
+	/** The ETag each stage was last read at — null: read, and not there. */
+	etags = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.options = options;
+		if (options.bucket) {
+			this.bucketName = options.bucket;
+			this.exists = true;
+		}
+	}
+	/** The bucket's name; the project bucket's is known after the first call. */
+	get bucket() {
+		return this.bucketName ?? projectBucketName(this.options.identity.scope, "<account id>");
+	}
+	/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */
+	location(stage) {
+		return `s3://${this.bucket}/${this.key(stage)}`;
+	}
+	key(stage) {
+		return s3SecretsKey(this.options.prefix, this.options.project, stage);
+	}
+	async client() {
+		if (this.clients) return this.clients;
+		const base = await awsClientConfig(this.options);
+		const endpoint = base.endpoint ?? process.env.AWS_ENDPOINT_URL_S3 ?? process.env.AWS_ENDPOINT_URL;
+		const credentials = this.options.credentials ?? base.credentials;
+		this.clients = {
+			s3: new S3Client({
+				region: base.region,
+				...endpoint ? {
+					endpoint,
+					forcePathStyle: true
+				} : {},
+				...credentials ? { credentials } : {}
+			}),
+			sts: new STSClient({
+				region: base.region,
+				...base.endpoint ? { endpoint: base.endpoint } : {},
+				...credentials ? { credentials } : {}
+			})
+		};
+		return this.clients;
+	}
+	/** One AWS call, a missing or expired credential refused by name. */
+	call(stage, access, run) {
+		return withStageCredentials({
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		}, run);
+	}
+	/**
+	* The bucket, or null for a project bucket that does not exist yet and is
+	* not to be created (a read).
+	*/
+	async use(stage, create) {
+		const { s3, sts } = await this.client();
+		if (this.exists) return {
+			s3,
+			bucket: this.bucketName
+		};
+		const access = create ? "write" : "read";
+		this.bucketName ??= projectBucketName(this.options.identity.scope, await this.call(stage, access, () => callerAccountId(sts)));
+		const bucket = this.bucketName;
+		if (create) await this.call(stage, access, () => ensureProjectBucket(s3, {
+			bucket,
+			region: this.options.region,
+			identity: this.options.identity
+		}));
+		else if (await this.call(stage, access, () => findProjectBucket(s3, bucket)) === "none") return {
+			s3,
+			bucket: null
+		};
+		this.exists = true;
+		return {
+			s3,
+			bucket
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
+	async read(stage) {
+		const { s3, bucket } = await this.use(stage, false);
+		if (!bucket) {
+			this.etags.set(stage, null);
+			return null;
+		}
+		try {
+			const response = await this.call(stage, "read", () => s3.send(new GetObjectCommand({
+				Bucket: bucket,
+				Key: this.key(stage)
+			})));
+			const body = await response.Body.transformToString("utf-8");
+			this.remember(stage, response.ETag);
+			return JSON.parse(body);
+		} catch (error) {
+			if (!notFound(error)) throw error;
+			this.etags.set(stage, null);
+			return null;
+		}
+	}
+	/**
+	* Replace the stage's secrets — on the condition that they are still what
+	* this store last read. A stage never read here is replaced as it is now.
+	*
+	* @throws {StageSecretsChanged} when another run wrote them in between
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
+	async write(stage, secrets) {
+		const { s3, bucket } = await this.use(stage, true);
+		const Bucket = bucket;
+		const Key = this.key(stage);
+		const expected = this.etags.has(stage) ? this.etags.get(stage) ?? null : await this.currentEtag(s3, stage, Bucket, Key);
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new PutObjectCommand({
+				Bucket,
+				Key,
+				Body: JSON.stringify(secrets),
+				ContentType: "application/json",
+				ServerSideEncryption: "AES256",
+				...expected === null ? { IfNoneMatch: "*" } : { IfMatch: expected }
+			})));
+			this.remember(stage, ETag);
+		} catch (error) {
+			if (lostRace(error)) {
+				this.etags.delete(stage);
+				throw new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);
+			}
+			throw error;
+		}
+	}
+	/**
+	* The ETag the stage is now at. Some S3-compatible servers answer without
+	* one: then nothing is remembered, and the next write asks for it first.
+	*/
+	remember(stage, etag) {
+		if (etag) this.etags.set(stage, etag);
+		else this.etags.delete(stage);
+	}
+	async currentEtag(s3, stage, Bucket, Key) {
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new HeadObjectCommand({
+				Bucket,
+				Key
+			})));
+			return ETag ?? null;
+		} catch (error) {
+			if (notFound(error)) return null;
+			throw error;
+		}
+	}
+};
+//#endregion
+export { S3SecretsStore };
+
+//# sourceMappingURL=s3-DQXZdmCM.mjs.map

package/dist/s3-DQXZdmCM.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-DQXZdmCM.mjs","names":[],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyC,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACL,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAO,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAI,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAI,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAO,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAe,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAc,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtB,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAc,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAI,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAI,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}

package/dist/sandbox/config-worker.cjs

@@ -0,0 +1,43 @@
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+let node_fs_promises = require("node:fs/promises");
+let node_url = require("node:url");
+//#region src/sandbox/config-worker.ts
+/**
+* Loads `gkm.config.ts` in a sandbox and answers with it as data.
+*
+* Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):
+*   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts
+*
+* Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the
+* config holds something JSON cannot carry, or `{ reason: 'failed', error }`
+* when it could not be loaded at all.
+*/
+async function load(configPath) {
+	if (configPath.endsWith(".json")) return JSON.parse(await (0, node_fs_promises.readFile)(configPath, "utf8"));
+	return (await import((0, node_url.pathToFileURL)(configPath).href)).default;
+}
+async function main() {
+	const configPath = process.argv[2];
+	try {
+		if (!configPath) throw new TypeError("No config path was given.");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const config = await load(configPath);
+		const paths = require_workerRuntime.liveValuePaths(config);
+		require_workerRuntime.answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "loaded",
+			config
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=config-worker.cjs.map

package/dist/sandbox/config-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-worker.cjs","names":["readFile","pathToFileURL","registerAdjacentTsconfig","liveValuePaths","errorData"],"sources":["../../src/sandbox/config-worker.ts"],"sourcesContent":["/**\n * Loads `gkm.config.ts` in a sandbox and answers with it as data.\n *\n * Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):\n *   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts\n *\n * Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the\n * config holds something JSON cannot carry, or `{ reason: 'failed', error }`\n * when it could not be loaded at all.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { pathToFileURL } from 'node:url';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function load(configPath: string): Promise<unknown> {\n\tif (configPath.endsWith('.json')) {\n\t\treturn JSON.parse(await readFile(configPath, 'utf8'));\n\t}\n\tconst module = await import(pathToFileURL(configPath).href);\n\treturn module.default;\n}\n\nasync function main(): Promise<void> {\n\tconst configPath = process.argv[2];\n\ttry {\n\t\tif (!configPath) throw new TypeError('No config path was given.');\n\t\tawait registerAdjacentTsconfig();\n\t\tconst config = await load(configPath);\n\t\tconst paths = liveValuePaths(config);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: { reason: 'loaded', config },\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,KAAK,YAAsC;CACzD,IAAI,WAAW,SAAS,OAAO,GAC9B,OAAO,KAAK,MAAM,OAAA,GAAMA,iBAAAA,SAAAA,CAAS,YAAY,MAAM,CAAC;CAGrD,QAAO,MADc,QAAA,GAAOC,SAAAA,cAAAA,CAAc,UAAU,CAAC,CAAC,MAAA,CACxC;AACf;AAEA,eAAe,OAAsB;CACpC,MAAM,aAAa,QAAQ,KAAK;CAChC,IAAI;EACH,IAAI,CAAC,YAAY,MAAM,IAAI,UAAU,2BAA2B;EAChE,MAAMC,sBAAAA,yBAAyB;EAC/B,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,MAAM,QAAQC,sBAAAA,eAAe,MAAM;EACnC,sBAAA,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GAAE,QAAQ;GAAU;EAAO,CAC/B;CACD,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/config-worker.d.cts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/config-worker.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/sandbox/config-worker.mjs

@@ -0,0 +1,44 @@
+import { a as registerAdjacentTsconfig, i as liveValuePaths, n as answer, r as errorData } from "../workerRuntime-CsOyBRx2.mjs";
+import { readFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+//#region src/sandbox/config-worker.ts
+/**
+* Loads `gkm.config.ts` in a sandbox and answers with it as data.
+*
+* Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):
+*   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts
+*
+* Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the
+* config holds something JSON cannot carry, or `{ reason: 'failed', error }`
+* when it could not be loaded at all.
+*/
+async function load(configPath) {
+	if (configPath.endsWith(".json")) return JSON.parse(await readFile(configPath, "utf8"));
+	return (await import(pathToFileURL(configPath).href)).default;
+}
+async function main() {
+	const configPath = process.argv[2];
+	try {
+		if (!configPath) throw new TypeError("No config path was given.");
+		await registerAdjacentTsconfig();
+		const config = await load(configPath);
+		const paths = liveValuePaths(config);
+		answer(paths.length > 0 ? {
+			reason: "live",
+			paths
+		} : {
+			reason: "loaded",
+			config
+		});
+	} catch (error) {
+		answer({
+			reason: "failed",
+			error: errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+export {};
+
+//# sourceMappingURL=config-worker.mjs.map

package/dist/sandbox/config-worker.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-worker.mjs","names":[],"sources":["../../src/sandbox/config-worker.ts"],"sourcesContent":["/**\n * Loads `gkm.config.ts` in a sandbox and answers with it as data.\n *\n * Usage (by `loadWorkspaceConfig` with a sandbox, never by hand):\n *   node --import=<tsx> config-worker.ts /path/to/gkm.config.ts\n *\n * Answers `{ reason: 'loaded', config }`, `{ reason: 'live', paths }` when the\n * config holds something JSON cannot carry, or `{ reason: 'failed', error }`\n * when it could not be loaded at all.\n */\n\nimport { readFile } from 'node:fs/promises';\nimport { pathToFileURL } from 'node:url';\nimport {\n\tanswer,\n\terrorData,\n\tliveValuePaths,\n\tregisterAdjacentTsconfig,\n} from './workerRuntime';\n\nasync function load(configPath: string): Promise<unknown> {\n\tif (configPath.endsWith('.json')) {\n\t\treturn JSON.parse(await readFile(configPath, 'utf8'));\n\t}\n\tconst module = await import(pathToFileURL(configPath).href);\n\treturn module.default;\n}\n\nasync function main(): Promise<void> {\n\tconst configPath = process.argv[2];\n\ttry {\n\t\tif (!configPath) throw new TypeError('No config path was given.');\n\t\tawait registerAdjacentTsconfig();\n\t\tconst config = await load(configPath);\n\t\tconst paths = liveValuePaths(config);\n\t\tanswer(\n\t\t\tpaths.length > 0\n\t\t\t\t? { reason: 'live', paths }\n\t\t\t\t: { reason: 'loaded', config },\n\t\t);\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAe,KAAK,YAAsC;CACzD,IAAI,WAAW,SAAS,OAAO,GAC9B,OAAO,KAAK,MAAM,MAAM,SAAS,YAAY,MAAM,CAAC;CAGrD,QAAO,MADc,OAAO,cAAc,UAAU,CAAC,CAAC,MAAA,CACxC;AACf;AAEA,eAAe,OAAsB;CACpC,MAAM,aAAa,QAAQ,KAAK;CAChC,IAAI;EACH,IAAI,CAAC,YAAY,MAAM,IAAI,UAAU,2BAA2B;EAChE,MAAM,yBAAyB;EAC/B,MAAM,SAAS,MAAM,KAAK,UAAU;EACpC,MAAM,QAAQ,eAAe,MAAM;EACnC,OACC,MAAM,SAAS,IACZ;GAAE,QAAQ;GAAQ;EAAM,IACxB;GAAE,QAAQ;GAAU;EAAO,CAC/B;CACD,SAAS,OAAO;EACf,OAAO;GAAE,QAAQ;GAAU,OAAO,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}

package/dist/sandbox/credentials-worker.cjs

@@ -0,0 +1,54 @@
+const require_discover = require("../discover-BfhVW_kT.cjs");
+const require_sandbox = require("../sandbox-CHv3OYXg.cjs");
+const require_workerRuntime = require("../workerRuntime-BXfhbe13.cjs");
+const require_credentialSchemas = require("../credentialSchemas-DDda4Mmm.cjs");
+let node_path = require("node:path");
+let node_fs_promises = require("node:fs/promises");
+//#region src/sandbox/credentials-worker.ts
+/**
+* Loads a project's constructs in a sandbox and answers with what their
+* credentials schemas say, as data: each schema as JSON Schema, and whether
+* each value it was handed passes.
+*
+* Usage (by `inspectCredentials` under a sandbox, never by hand):
+*   node --import=<tsx> credentials-worker.ts '{"patterns":[…],"cwd":"…"}'
+*
+* The schemas are the project's code, which is why they run here. Each value
+* arrives as a file in `GKM_SECRETS_DIR` named by its key, is read into this
+* process's memory only, and never comes back: an answer carries issue paths
+* and messages, not values.
+*/
+/** Every secret file the sandbox mounted, by name. */
+async function mountedSecrets() {
+	const dir = process.env[require_sandbox.SECRETS_DIR_ENV];
+	if (!dir) return {};
+	const secrets = {};
+	for (const name of await (0, node_fs_promises.readdir)(dir)) secrets[name] = (await (0, node_fs_promises.readFile)((0, node_path.join)(dir, name), "utf8")).trim();
+	return secrets;
+}
+async function main() {
+	try {
+		const request = JSON.parse(process.argv[2] ?? "{}");
+		await require_workerRuntime.registerAdjacentTsconfig();
+		const sources = {};
+		const manifest = await require_discover.discover({
+			patterns: request.patterns,
+			cwd: request.cwd,
+			sources
+		});
+		const inspection = await require_credentialSchemas.inspectLive(require_credentialSchemas.liveCredentials(manifest, sources), await mountedSecrets());
+		require_workerRuntime.answer({
+			reason: "inspected",
+			...inspection
+		});
+	} catch (error) {
+		require_workerRuntime.answer({
+			reason: "failed",
+			error: require_workerRuntime.errorData(error)
+		});
+	}
+}
+main();
+//#endregion
+
+//# sourceMappingURL=credentials-worker.cjs.map

package/dist/sandbox/credentials-worker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-worker.cjs","names":["SECRETS_DIR_ENV","readdir","readFile","join","registerAdjacentTsconfig","discover","inspectLive","liveCredentials","errorData"],"sources":["../../src/sandbox/credentials-worker.ts"],"sourcesContent":["/**\n * Loads a project's constructs in a sandbox and answers with what their\n * credentials schemas say, as data: each schema as JSON Schema, and whether\n * each value it was handed passes.\n *\n * Usage (by `inspectCredentials` under a sandbox, never by hand):\n *   node --import=<tsx> credentials-worker.ts '{\"patterns\":[…],\"cwd\":\"…\"}'\n *\n * The schemas are the project's code, which is why they run here. Each value\n * arrives as a file in `GKM_SECRETS_DIR` named by its key, is read into this\n * process's memory only, and never comes back: an answer carries issue paths\n * and messages, not values.\n */\n\nimport { readdir, readFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { type ConstructSource, discover } from '../reconcile/discover';\nimport { inspectLive, liveCredentials } from '../secrets/credentialSchemas';\nimport { SECRETS_DIR_ENV } from './sandbox';\nimport { answer, errorData, registerAdjacentTsconfig } from './workerRuntime';\n\n/** Every secret file the sandbox mounted, by name. */\nasync function mountedSecrets(): Promise<Record<string, string>> {\n\tconst dir = process.env[SECRETS_DIR_ENV];\n\tif (!dir) return {};\n\n\tconst secrets: Record<string, string> = {};\n\tfor (const name of await readdir(dir)) {\n\t\tsecrets[name] = (await readFile(join(dir, name), 'utf8')).trim();\n\t}\n\treturn secrets;\n}\n\nasync function main(): Promise<void> {\n\ttry {\n\t\tconst request = JSON.parse(process.argv[2] ?? '{}') as {\n\t\t\tpatterns: string[];\n\t\t\tcwd: string;\n\t\t};\n\t\tawait registerAdjacentTsconfig();\n\n\t\tconst sources: Record<string, ConstructSource> = {};\n\t\tconst manifest = await discover({\n\t\t\tpatterns: request.patterns,\n\t\t\tcwd: request.cwd,\n\t\t\tsources,\n\t\t});\n\n\t\tconst inspection = await inspectLive(\n\t\t\tliveCredentials(manifest, sources),\n\t\t\tawait mountedSecrets(),\n\t\t);\n\t\tanswer({ reason: 'inspected', ...inspection });\n\t} catch (error) {\n\t\tanswer({ reason: 'failed', error: errorData(error) });\n\t}\n}\n\nvoid main();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,iBAAkD;CAChE,MAAM,MAAM,QAAQ,IAAIA,gBAAAA;CACxB,IAAI,CAAC,KAAK,OAAO,CAAC;CAElB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,QAAAA,CAAQ,GAAG,GACnC,QAAQ,SAAS,OAAA,GAAMC,iBAAAA,SAAAA,EAAAA,GAASC,UAAAA,KAAAA,CAAK,KAAK,IAAI,GAAG,MAAM,EAAA,CAAG,KAAK;CAEhE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,IAAI;EACH,MAAM,UAAU,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI;EAIlD,MAAMC,sBAAAA,yBAAyB;EAE/B,MAAM,UAA2C,CAAC;EAClD,MAAM,WAAW,MAAMC,iBAAAA,SAAS;GAC/B,UAAU,QAAQ;GAClB,KAAK,QAAQ;GACb;EACD,CAAC;EAED,MAAM,aAAa,MAAMC,0BAAAA,YACxBC,0BAAAA,gBAAgB,UAAU,OAAO,GACjC,MAAM,eAAe,CACtB;EACA,sBAAA,OAAO;GAAE,QAAQ;GAAa,GAAG;EAAW,CAAC;CAC9C,SAAS,OAAO;EACf,sBAAA,OAAO;GAAE,QAAQ;GAAU,OAAOC,sBAAAA,UAAU,KAAK;EAAE,CAAC;CACrD;AACD;AAEK,KAAK"}