@geekmidas/cli 10.0.0-alpha.104 → 10.0.0-alpha.106

package/dist/{seeds-CjBwLvWY.cjs → seeds-RTQPjA4K.cjs}

@@ -8,7 +8,7 @@ const require_identity = require("./identity-CbLfgQNT.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-BwbYTMtB.cjs");
 const require_discover = require("./discover-Bsr7HjqJ.cjs");
 const require_config = require("./config.cjs");
-const require_resolve = require("./resolve-By_cw893.cjs");
+const require_resolve = require("./resolve-ClAnYHo-.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -1033,6 +1033,10 @@ function planFor(manifest, stage, order, options = {}) {
 			} } : {},
 			...declaration.kind === "external-api" && !fake ? { url: declaration.url } : {},
 			...declaration.kind === "credential" && options.credentialFakes?.[id] !== void 0 ? { fakeCredentials: options.credentialFakes[id] } : {},
+			...declaration.kind === "secret" && (declaration.length !== void 0 || declaration.symbols !== void 0) ? { format: {
+				...declaration.length !== void 0 ? { length: declaration.length } : {},
+				...declaration.symbols !== void 0 ? { symbols: declaration.symbols } : {}
+			} } : {},
 			..."of" in declaration && !detached ? { of: declaration.of } : {},
 			..."schema" in declaration && declaration.schema ? { schema: declaration.schema } : {},
 			..."version" in declaration && declaration.version ? { version: declaration.version } : {},
@@ -1552,10 +1556,36 @@ function localKeyring(project, plan, resource) {
 * A hash of what identifies it, so it is stable, distinct per project, stage
 * and construct, and never written to disk as a literal. Deployed this is the
 * one kind whose value does *not* come from here — a secret manager generates
-* it once and the target reads it back.
+* it once and the target reads it back. Drawn in the format the deploy draws
+* it in, so a value that passes a third party's rules here passes them there.
 */
 function localSecret(project, plan, resource) {
-	return (0, node_crypto.createHash)("sha256").update(`${project}:${plan.stage}:${resource.id}`).digest("base64url").slice(0, 43);
+	return (0, _geekmidas_manifest.drawSecret)(hashStream(`${project}:${plan.stage}:${resource.id}`), resource.format);
+}
+/**
+* Integers in `[0, n)` drawn from a hash of `seed`, the same every time —
+* what a local secret is drawn with instead of `crypto`, so `gkm dev` and
+* `gkm test` need nothing stored. Rejection-sampled, so no character is
+* likelier than another.
+*/
+function hashStream(seed) {
+	let block = 0;
+	let bytes = Buffer.alloc(0);
+	let offset = 0;
+	const next = () => {
+		if (offset === bytes.length) {
+			bytes = (0, node_crypto.createHash)("sha256").update(`${seed}:${block++}`).digest();
+			offset = 0;
+		}
+		return bytes[offset++];
+	};
+	return (n) => {
+		const limit = 256 - 256 % n;
+		for (;;) {
+			const byte = next();
+			if (byte < limit) return byte % n;
+		}
+	};
 }
 //#endregion
 //#region src/compose/redis.ts
@@ -1713,8 +1743,8 @@ function redisService(redis) {
 *   master and roles, a bucket's root user. Derived from repo facts alone
 *   (project, stage, construct id), those passwords were computable by anyone
 *   who could read the repo.
-* - **Each `secret` construct's value** — an auth server's signing secret —
-*   random, rather than derived.
+* - **Each `secret` construct's value** — an auth server's signing secret, a
+*   `RandomPassword` — random, rather than derived, in its declared format.
 * - **Each `encryption` construct's keyring** — one random key and an index
 *   key. Later keys are added by `gkm encryption:rotate`, never by a deploy.
 *
@@ -1735,7 +1765,7 @@ function withGeneratedSecrets(secrets, manifest) {
 		if (declaration?.kind !== "secret" && declaration?.kind !== "encryption") continue;
 		const key = declaration.provides?.[0];
 		if (!key || custom[key]) continue;
-		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : random();
+		custom[key] = declaration.kind === "encryption" ? (0, _geekmidas_constructs_encryption.generateKeyring)() : (0, _geekmidas_manifest.drawSecret)(node_crypto.randomInt, declaration);
 		generated.push(key);
 	}
 	const seed = secrets.seed ?? generateSeed();
@@ -3977,17 +4007,17 @@ async function prepareEntryCredentials(options) {
 		secretsRoot = workspace?.root ?? findSecretsRoot(cwd);
 	}
 	if (appName && workspace && options.explicitPort === void 0) {
-		const { assignAppPorts, describeHolder, holderOf, withAppPorts } = await Promise.resolve().then(() => require("./appPorts-Cu79hJF6.cjs")).then((n) => n.appPorts_exports);
+		const { assignAppPorts, describeMove, holderOf, withAppPorts } = await Promise.resolve().then(() => require("./appPorts-IW-OZmRi.cjs")).then((n) => n.appPorts_exports);
 		const assigned = await assignAppPorts(workspace, [appName], {
 			free: isPortAvailable,
 			holder: holderOf
 		});
-		for (const { app, from, to, holder } of assigned.moved) logger$2.log(`↪️  ${app}: ${from} is held by ${describeHolder(holder)}, which is not this workspace's — using ${to}`);
+		for (const move of assigned.moved) logger$2.log(describeMove(move));
 		workspace = withAppPorts(workspace, assigned.ports);
 		workspaceAppPort = assigned.ports[appName] ?? workspaceAppPort;
 	}
 	if (appName) {
-		const { APP_TAG_ENV, appTag } = await Promise.resolve().then(() => require("./appPorts-Cu79hJF6.cjs")).then((n) => n.appPorts_exports);
+		const { APP_TAG_ENV, appTag } = await Promise.resolve().then(() => require("./appPorts-IW-OZmRi.cjs")).then((n) => n.appPorts_exports);
 		process.env[APP_TAG_ENV] = appTag(secretsRoot, appName);
 	}
 	const resolvedPort = options.explicitPort ?? workspaceAppPort ?? 3e3;
@@ -7282,7 +7312,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-dezqtUth.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-BesL1P15.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -9104,4 +9134,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-CjBwLvWY.cjs.map
+//# sourceMappingURL=seeds-RTQPjA4K.cjs.map