@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.110

package/dist/credentialSchemas-Cf5Pf8VE.mjs

@@ -0,0 +1,237 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { a as discriminatedUnion, c as literal, d as object, f as record, g as unknown, n as array, p as string, r as boolean, t as _enum, v as toJSONSchema } from "./schemas-BCwKKA42.mjs";
+import { i as discover, l as runWorker, t as ConstructDiscoveryFailed } from "./discover-Ca8U75dl.mjs";
+import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
+import { provideKey } from "@geekmidas/manifest";
+import { decodeCredentials } from "@geekmidas/constructs/credential";
+//#region src/secrets/credentialSchemas.ts
+/**
+* A third party's credentials, checked against the schema of the construct
+* that reads them — before they are stored, and before a deploy builds
+* anything with them.
+*
+* The schema lives on the construct (`ExternalApi.credentialsSchema`,
+* `Credential.credentialsSchema`), which is the project's code. So the
+* constructs are loaded where a deploy loads them: in the run's sandbox when
+* there is one, here otherwise. What comes back is data only — each schema as
+* JSON Schema where it can say so, and `{ ok, issues }` for each value asked
+* about — because a live schema cannot cross an isolating sandbox. A value
+* asked about goes in as a secret file, never an argument, and no issue
+* carries it back: an issue is a path and a message.
+*/
+/** The credentials keys a manifest declares, by the construct that reads each. */
+function credentialKeys(manifest) {
+	return Object.entries(manifest).flatMap(([id, declaration]) => declaration.kind === "external-api" || declaration.kind === "credential" ? [{
+		key: provideKey(id, "credentials"),
+		id,
+		kind: declaration.kind
+	}] : []);
+}
+/** The constructs that read a third party's credentials, with their schemas. */
+function liveCredentials(manifest, sources) {
+	return credentialKeys(manifest).flatMap(({ key, id, kind }) => {
+		const schema = (sources[id]?.construct)?.credentialsSchema;
+		return isStandardSchema(schema) ? [{
+			key,
+			id,
+			kind,
+			schema
+		}] : [];
+	});
+}
+function isStandardSchema(value) {
+	return typeof value === "object" && value !== null && typeof value["~standard"]?.validate === "function";
+}
+/**
+* A schema as JSON Schema: through the Standard JSON Schema extension where
+* the schema has it, as zod 4's does, else zod's own converter — or nothing,
+* for a schema neither can describe.
+*/
+function jsonSchemaOf(schema) {
+	const standard = schema["~standard"];
+	try {
+		const described = standard.jsonSchema?.input?.({ target: "draft-2020-12" });
+		if (described) return described;
+	} catch {}
+	if (typeof schema === "object" && schema !== null && "_zod" in schema) try {
+		return toJSONSchema(schema, { io: "input" });
+	} catch {
+		return;
+	}
+}
+/** A stored value against its schema, read the way the construct reads it. */
+async function checkCredential(schema, raw) {
+	const result = await schema["~standard"].validate(decodeCredentials(raw));
+	if (!result.issues) return {
+		ok: true,
+		issues: []
+	};
+	return {
+		ok: false,
+		issues: result.issues.map((issue) => ({
+			path: (issue.path ?? []).map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join("."),
+			message: issue.message
+		}))
+	};
+}
+/** What a set of live credentials says about some values: data only. */
+async function inspectLive(live, values) {
+	const checks = {};
+	for (const credential of live) {
+		const value = values[credential.key];
+		if (value === void 0) continue;
+		checks[credential.key] = await checkCredential(credential.schema, value);
+	}
+	return {
+		schemas: live.map(({ key, id, kind, schema }) => {
+			const jsonSchema = jsonSchemaOf(schema);
+			return {
+				key,
+				id,
+				kind,
+				...jsonSchema ? { jsonSchema } : {}
+			};
+		}),
+		checks
+	};
+}
+const Issue = object({
+	path: string(),
+	message: string()
+});
+/** What the credentials worker answers. Checked: the worker ran project code. */
+const CredentialsAnswer = discriminatedUnion("reason", [object({
+	reason: literal("inspected"),
+	schemas: array(object({
+		key: string(),
+		id: string(),
+		kind: _enum(["external-api", "credential"]),
+		jsonSchema: record(string(), unknown()).optional()
+	})),
+	checks: record(string(), object({
+		ok: boolean(),
+		issues: array(Issue)
+	}))
+}), object({
+	reason: literal("failed"),
+	error: object({
+		name: string(),
+		message: string()
+	}).loose()
+})]);
+/** How long loading the constructs to check credentials may take. */
+const INSPECT_TIMEOUT_MS = 6e4;
+/**
+* The workspace's credential schemas, and what each of `values` comes to —
+* loaded in the run's sandbox when there is one, here otherwise.
+*/
+async function inspectCredentials(options) {
+	const sandbox = activeSandbox();
+	if (!sandbox) return (await loadCredentialSchemasHere(options)).inspect(options.values ?? {});
+	const secrets = Object.fromEntries(Object.entries(options.values ?? {}).filter(([key]) => key.endsWith("_CREDENTIALS")));
+	const { value } = await runWorker(sandbox, "credentials check", {
+		name: "credentials-worker",
+		args: [JSON.stringify({
+			patterns: options.patterns,
+			cwd: options.root
+		})],
+		cwd: options.root,
+		timeoutMs: INSPECT_TIMEOUT_MS,
+		schema: CredentialsAnswer,
+		...Object.keys(secrets).length > 0 ? { secrets } : {}
+	});
+	if (value.reason === "failed") throw new ConstructDiscoveryFailed(value.error.name, value.error.message);
+	const { schemas, checks } = value;
+	return {
+		schemas: schemas.map(({ jsonSchema, ...rest }) => ({
+			...rest,
+			...jsonSchema ? { jsonSchema } : {}
+		})),
+		checks
+	};
+}
+/** The constructs loaded once, here, and asked about as often as needed. */
+async function loadCredentialSchemasHere(options) {
+	const sources = {};
+	const live = liveCredentials(await discover({
+		patterns: [...options.patterns],
+		cwd: options.root,
+		sources
+	}), sources);
+	return { inspect: (values) => inspectLive(live, values) };
+}
+/**
+* The workspace's credential schemas, for a command that checks values one
+* at a time as they are typed. In-process the constructs are loaded once;
+* in a sandbox each check is a run of the worker.
+*/
+async function loadCredentialSchemas(options) {
+	const here = activeSandbox() ? void 0 : await loadCredentialSchemasHere(options);
+	const inspect = (values) => here ? here.inspect(values) : inspectCredentials({
+		...options,
+		values
+	});
+	const { schemas } = await inspect({});
+	return {
+		schemas,
+		async check(key, raw) {
+			if (!schemas.some((s) => s.key === key)) return {
+				ok: true,
+				issues: []
+			};
+			const { checks } = await inspect({ [key]: raw });
+			return checks[key] ?? {
+				ok: true,
+				issues: []
+			};
+		}
+	};
+}
+/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */
+function issueLine(key, issue) {
+	return `${key}${issue.path ? `.${issue.path}` : ""}: ${issue.message}`;
+}
+/**
+* Credentials their construct's schema refuses — on their way into the
+* stage's secrets, or already there when a deploy reads them. The values are
+* never in the message: only where each is wrong, and why.
+*/
+var CredentialsInvalid = class extends GkmError {
+	stage;
+	invalid;
+	during;
+	constructor(stage, invalid, during) {
+		const lines = invalid.flatMap(({ key, issues }) => issues.map((issue) => `  ${issueLine(key, issue)}`));
+		const keys = invalid.map((i) => i.key);
+		super(during === "set" ? `${keys.join(", ")} is not what its construct's schema describes, so nothing was saved:\n\n${lines.join("\n")}\n\nSet a value that matches, or let gkm ask for each field: gkm secrets:add --stage ${stage}` : `The stage '${stage}' holds ${keys.length === 1 ? "a credential" : "credentials"} ${keys.length === 1 ? "its construct's schema refuses" : "their constructs' schemas refuse"}, and every app reading ${keys.length === 1 ? "it" : "them"} would fail as it starts:\n\n${lines.join("\n")}\n\nSet ${keys.length === 1 ? "it" : "them"} again, field by field: gkm secrets:add --stage ${stage}`);
+		this.stage = stage;
+		this.invalid = invalid;
+		this.during = during;
+		this.name = "CredentialsInvalid";
+	}
+};
+/**
+* Every credential the stage holds for a construct, against its schema —
+* before a deploy builds anything with one the app would refuse as it
+* starts. Loads nothing when the stage holds none.
+*
+* @throws {CredentialsInvalid} naming each key and every issue
+*/
+async function assertStageCredentials(options) {
+	const values = Object.fromEntries(credentialKeys(options.manifest).map(({ key }) => [key, options.supplied[key]]).filter((entry) => entry[1] !== void 0));
+	if (Object.keys(values).length === 0) return;
+	const { checks } = await inspectCredentials({
+		root: options.root,
+		patterns: options.patterns,
+		values
+	});
+	const invalid = Object.entries(checks).filter(([, check]) => !check.ok).map(([key, check]) => ({
+		key,
+		issues: check.issues
+	})).sort((a, b) => a.key.localeCompare(b.key));
+	if (invalid.length > 0) throw new CredentialsInvalid(options.stage, invalid, "deploy");
+}
+//#endregion
+export { liveCredentials as a, issueLine as i, assertStageCredentials as n, loadCredentialSchemas as o, inspectLive as r, CredentialsInvalid as t };
+
+//# sourceMappingURL=credentialSchemas-Cf5Pf8VE.mjs.map

package/dist/credentialSchemas-Cf5Pf8VE.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialSchemas-Cf5Pf8VE.mjs","names":["z.toJSONSchema","z.object","z.string","z.discriminatedUnion","z.literal","z.array","z.enum","z.record","z.unknown","z.boolean"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,KAAK,WAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAOA,aAAe,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,SAAS,kBAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAQC,OAAS;CAAE,MAAMC,OAAS;CAAG,SAASA,OAAS;AAAE,CAAC;;AAGhE,MAAM,oBAAoBC,mBAAqB,UAAU,CACxDF,OAAS;CACR,QAAQG,QAAU,WAAW;CAC7B,SAASC,MACRJ,OAAS;EACR,KAAKC,OAAS;EACd,IAAIA,OAAS;EACb,MAAMI,MAAO,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAYC,OAASL,OAAS,GAAGM,QAAU,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAQD,OACPL,OAAS,GACTD,OAAS;EAAE,IAAIQ,QAAU;EAAG,QAAQJ,MAAQ,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GACDJ,OAAS;CACR,QAAQG,QAAU,QAAQ;CAC1B,OAAOH,OAAS;EAAE,MAAMC,OAAS;EAAG,SAASA,OAAS;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAU,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALN,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAO,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwC,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}

package/dist/credentialSchemas-D_VUCDUh.cjs

@@ -0,0 +1,272 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_schemas = require("./schemas-BQ_v0lEX.cjs");
+const require_discover = require("./discover-Bsr7HjqJ.cjs");
+const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let _geekmidas_constructs_credential = require("@geekmidas/constructs/credential");
+//#region src/secrets/credentialSchemas.ts
+/**
+* A third party's credentials, checked against the schema of the construct
+* that reads them — before they are stored, and before a deploy builds
+* anything with them.
+*
+* The schema lives on the construct (`ExternalApi.credentialsSchema`,
+* `Credential.credentialsSchema`), which is the project's code. So the
+* constructs are loaded where a deploy loads them: in the run's sandbox when
+* there is one, here otherwise. What comes back is data only — each schema as
+* JSON Schema where it can say so, and `{ ok, issues }` for each value asked
+* about — because a live schema cannot cross an isolating sandbox. A value
+* asked about goes in as a secret file, never an argument, and no issue
+* carries it back: an issue is a path and a message.
+*/
+/** The credentials keys a manifest declares, by the construct that reads each. */
+function credentialKeys(manifest) {
+	return Object.entries(manifest).flatMap(([id, declaration]) => declaration.kind === "external-api" || declaration.kind === "credential" ? [{
+		key: (0, _geekmidas_manifest.provideKey)(id, "credentials"),
+		id,
+		kind: declaration.kind
+	}] : []);
+}
+/** The constructs that read a third party's credentials, with their schemas. */
+function liveCredentials(manifest, sources) {
+	return credentialKeys(manifest).flatMap(({ key, id, kind }) => {
+		const schema = (sources[id]?.construct)?.credentialsSchema;
+		return isStandardSchema(schema) ? [{
+			key,
+			id,
+			kind,
+			schema
+		}] : [];
+	});
+}
+function isStandardSchema(value) {
+	return typeof value === "object" && value !== null && typeof value["~standard"]?.validate === "function";
+}
+/**
+* A schema as JSON Schema: through the Standard JSON Schema extension where
+* the schema has it, as zod 4's does, else zod's own converter — or nothing,
+* for a schema neither can describe.
+*/
+function jsonSchemaOf(schema) {
+	const standard = schema["~standard"];
+	try {
+		const described = standard.jsonSchema?.input?.({ target: "draft-2020-12" });
+		if (described) return described;
+	} catch {}
+	if (typeof schema === "object" && schema !== null && "_zod" in schema) try {
+		return require_schemas.toJSONSchema(schema, { io: "input" });
+	} catch {
+		return;
+	}
+}
+/** A stored value against its schema, read the way the construct reads it. */
+async function checkCredential(schema, raw) {
+	const result = await schema["~standard"].validate((0, _geekmidas_constructs_credential.decodeCredentials)(raw));
+	if (!result.issues) return {
+		ok: true,
+		issues: []
+	};
+	return {
+		ok: false,
+		issues: result.issues.map((issue) => ({
+			path: (issue.path ?? []).map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join("."),
+			message: issue.message
+		}))
+	};
+}
+/** What a set of live credentials says about some values: data only. */
+async function inspectLive(live, values) {
+	const checks = {};
+	for (const credential of live) {
+		const value = values[credential.key];
+		if (value === void 0) continue;
+		checks[credential.key] = await checkCredential(credential.schema, value);
+	}
+	return {
+		schemas: live.map(({ key, id, kind, schema }) => {
+			const jsonSchema = jsonSchemaOf(schema);
+			return {
+				key,
+				id,
+				kind,
+				...jsonSchema ? { jsonSchema } : {}
+			};
+		}),
+		checks
+	};
+}
+const Issue = require_schemas.object({
+	path: require_schemas.string(),
+	message: require_schemas.string()
+});
+/** What the credentials worker answers. Checked: the worker ran project code. */
+const CredentialsAnswer = require_schemas.discriminatedUnion("reason", [require_schemas.object({
+	reason: require_schemas.literal("inspected"),
+	schemas: require_schemas.array(require_schemas.object({
+		key: require_schemas.string(),
+		id: require_schemas.string(),
+		kind: require_schemas._enum(["external-api", "credential"]),
+		jsonSchema: require_schemas.record(require_schemas.string(), require_schemas.unknown()).optional()
+	})),
+	checks: require_schemas.record(require_schemas.string(), require_schemas.object({
+		ok: require_schemas.boolean(),
+		issues: require_schemas.array(Issue)
+	}))
+}), require_schemas.object({
+	reason: require_schemas.literal("failed"),
+	error: require_schemas.object({
+		name: require_schemas.string(),
+		message: require_schemas.string()
+	}).loose()
+})]);
+/** How long loading the constructs to check credentials may take. */
+const INSPECT_TIMEOUT_MS = 6e4;
+/**
+* The workspace's credential schemas, and what each of `values` comes to —
+* loaded in the run's sandbox when there is one, here otherwise.
+*/
+async function inspectCredentials(options) {
+	const sandbox = require_sandbox.activeSandbox();
+	if (!sandbox) return (await loadCredentialSchemasHere(options)).inspect(options.values ?? {});
+	const secrets = Object.fromEntries(Object.entries(options.values ?? {}).filter(([key]) => key.endsWith("_CREDENTIALS")));
+	const { value } = await require_discover.runWorker(sandbox, "credentials check", {
+		name: "credentials-worker",
+		args: [JSON.stringify({
+			patterns: options.patterns,
+			cwd: options.root
+		})],
+		cwd: options.root,
+		timeoutMs: INSPECT_TIMEOUT_MS,
+		schema: CredentialsAnswer,
+		...Object.keys(secrets).length > 0 ? { secrets } : {}
+	});
+	if (value.reason === "failed") throw new require_discover.ConstructDiscoveryFailed(value.error.name, value.error.message);
+	const { schemas, checks } = value;
+	return {
+		schemas: schemas.map(({ jsonSchema, ...rest }) => ({
+			...rest,
+			...jsonSchema ? { jsonSchema } : {}
+		})),
+		checks
+	};
+}
+/** The constructs loaded once, here, and asked about as often as needed. */
+async function loadCredentialSchemasHere(options) {
+	const sources = {};
+	const live = liveCredentials(await require_discover.discover({
+		patterns: [...options.patterns],
+		cwd: options.root,
+		sources
+	}), sources);
+	return { inspect: (values) => inspectLive(live, values) };
+}
+/**
+* The workspace's credential schemas, for a command that checks values one
+* at a time as they are typed. In-process the constructs are loaded once;
+* in a sandbox each check is a run of the worker.
+*/
+async function loadCredentialSchemas(options) {
+	const here = require_sandbox.activeSandbox() ? void 0 : await loadCredentialSchemasHere(options);
+	const inspect = (values) => here ? here.inspect(values) : inspectCredentials({
+		...options,
+		values
+	});
+	const { schemas } = await inspect({});
+	return {
+		schemas,
+		async check(key, raw) {
+			if (!schemas.some((s) => s.key === key)) return {
+				ok: true,
+				issues: []
+			};
+			const { checks } = await inspect({ [key]: raw });
+			return checks[key] ?? {
+				ok: true,
+				issues: []
+			};
+		}
+	};
+}
+/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */
+function issueLine(key, issue) {
+	return `${key}${issue.path ? `.${issue.path}` : ""}: ${issue.message}`;
+}
+/**
+* Credentials their construct's schema refuses — on their way into the
+* stage's secrets, or already there when a deploy reads them. The values are
+* never in the message: only where each is wrong, and why.
+*/
+var CredentialsInvalid = class extends require_errors.GkmError {
+	stage;
+	invalid;
+	during;
+	constructor(stage, invalid, during) {
+		const lines = invalid.flatMap(({ key, issues }) => issues.map((issue) => `  ${issueLine(key, issue)}`));
+		const keys = invalid.map((i) => i.key);
+		super(during === "set" ? `${keys.join(", ")} is not what its construct's schema describes, so nothing was saved:\n\n${lines.join("\n")}\n\nSet a value that matches, or let gkm ask for each field: gkm secrets:add --stage ${stage}` : `The stage '${stage}' holds ${keys.length === 1 ? "a credential" : "credentials"} ${keys.length === 1 ? "its construct's schema refuses" : "their constructs' schemas refuse"}, and every app reading ${keys.length === 1 ? "it" : "them"} would fail as it starts:\n\n${lines.join("\n")}\n\nSet ${keys.length === 1 ? "it" : "them"} again, field by field: gkm secrets:add --stage ${stage}`);
+		this.stage = stage;
+		this.invalid = invalid;
+		this.during = during;
+		this.name = "CredentialsInvalid";
+	}
+};
+/**
+* Every credential the stage holds for a construct, against its schema —
+* before a deploy builds anything with one the app would refuse as it
+* starts. Loads nothing when the stage holds none.
+*
+* @throws {CredentialsInvalid} naming each key and every issue
+*/
+async function assertStageCredentials(options) {
+	const values = Object.fromEntries(credentialKeys(options.manifest).map(({ key }) => [key, options.supplied[key]]).filter((entry) => entry[1] !== void 0));
+	if (Object.keys(values).length === 0) return;
+	const { checks } = await inspectCredentials({
+		root: options.root,
+		patterns: options.patterns,
+		values
+	});
+	const invalid = Object.entries(checks).filter(([, check]) => !check.ok).map(([key, check]) => ({
+		key,
+		issues: check.issues
+	})).sort((a, b) => a.key.localeCompare(b.key));
+	if (invalid.length > 0) throw new CredentialsInvalid(options.stage, invalid, "deploy");
+}
+//#endregion
+Object.defineProperty(exports, "CredentialsInvalid", {
+	enumerable: true,
+	get: function() {
+		return CredentialsInvalid;
+	}
+});
+Object.defineProperty(exports, "assertStageCredentials", {
+	enumerable: true,
+	get: function() {
+		return assertStageCredentials;
+	}
+});
+Object.defineProperty(exports, "inspectLive", {
+	enumerable: true,
+	get: function() {
+		return inspectLive;
+	}
+});
+Object.defineProperty(exports, "issueLine", {
+	enumerable: true,
+	get: function() {
+		return issueLine;
+	}
+});
+Object.defineProperty(exports, "liveCredentials", {
+	enumerable: true,
+	get: function() {
+		return liveCredentials;
+	}
+});
+Object.defineProperty(exports, "loadCredentialSchemas", {
+	enumerable: true,
+	get: function() {
+		return loadCredentialSchemas;
+	}
+});
+
+//# sourceMappingURL=credentialSchemas-D_VUCDUh.cjs.map

package/dist/credentialSchemas-D_VUCDUh.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentialSchemas-D_VUCDUh.cjs","names":["provideKey","decodeCredentials","activeSandbox","runWorker","ConstructDiscoveryFailed","discover","GkmError"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,MAAA,GAAKA,oBAAAA,WAAAA,CAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAA,gBAAA,aAAsB,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,UAAA,GAASC,iCAAAA,kBAAAA,CAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAA,gBAAA,OAAiB;CAAE,MAAA,gBAAA,OAAe;CAAG,SAAA,gBAAA,OAAkB;AAAE,CAAC;;AAGhE,MAAM,oBAAA,gBAAA,mBAAyC,UAAU,CAAA,gBAAA,OAC/C;CACR,QAAA,gBAAA,QAAkB,WAAW;CAC7B,SAAA,gBAAA,MAAA,gBAAA,OACU;EACR,KAAA,gBAAA,OAAc;EACd,IAAA,gBAAA,OAAa;EACb,MAAA,gBAAA,MAAa,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAA,gBAAA,OAAA,gBAAA,OAA8B,GAAA,gBAAA,QAAa,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAA,gBAAA,OAAA,gBAAA,OACU,GAAA,gBAAA,OACA;EAAE,IAAA,gBAAA,QAAc;EAAG,QAAA,gBAAA,MAAgB,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GAAA,gBAAA,OACQ;CACR,QAAA,gBAAA,QAAkB,QAAQ;CAC1B,OAAA,gBAAA,OAAgB;EAAE,MAAA,gBAAA,OAAe;EAAG,SAAA,gBAAA,OAAkB;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAUC,gBAAAA,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAMC,iBAAAA,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAIC,iBAAAA,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALNC,iBAAAA,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAOH,gBAAAA,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwCI,eAAAA,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}