@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.13

package/dist/{sync-CzHXiR9c.mjs → sync-B3xxXtJT.mjs}

@@ -1,8 +1,20 @@
-import { __require } from "./chunk-Duj1WY3L.mjs";
+import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { GetParameterCommand, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-
 //#region src/secrets/sync.ts
 /**
+* Secrets Sync via AWS SSM Parameter Store
+*
+* Stores and retrieves encrypted StageSecrets as SecureString parameters.
+* Reuses the SSM infrastructure from the state provider.
+*
+* Parameter naming: /gkm/{workspaceName}/{stage}/secrets
+*/
+var sync_exports = /* @__PURE__ */ __exportAll({
+	isSSMConfigured: () => isSSMConfigured,
+	pullSecrets: () => pullSecrets,
+	pushSecrets: () => pushSecrets
+});
+/**
 * Get the SSM parameter name for secrets.
 */
 function getSecretsParameterName(workspaceName, stage) {
@@ -30,7 +42,7 @@ async function pushSecrets(stage, workspace) {
 	if (!workspace.name) throw new Error("Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.");
 	const client = createSSMClient(config);
 	const parameterName = getSecretsParameterName(workspace.name, stage);
-	const { readStageSecrets } = await import("./storage-DGBzMLZa.mjs");
+	const { readStageSecrets } = await import("./storage-P_b3w7uj.mjs").then((n) => n.a);
 	const secrets = await readStageSecrets(stage, workspace.root);
 	if (!secrets) throw new Error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 	await client.send(new PutParameterCommand({
@@ -70,7 +82,7 @@ async function pullSecrets(stage, workspace) {
 function isSSMConfigured(workspace) {
 	return !!workspace.state && workspace.state.provider === "ssm";
 }
-
 //#endregion
-export { isSSMConfigured, pullSecrets, pushSecrets };
-//# sourceMappingURL=sync-CzHXiR9c.mjs.map
+export { sync_exports as i, pullSecrets as n, pushSecrets as r, isSSMConfigured as t };
+
+//# sourceMappingURL=sync-B3xxXtJT.mjs.map

package/dist/sync-B3xxXtJT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-B3xxXtJT.mjs","names":[],"sources":["../src/secrets/sync.ts"],"sourcesContent":["/**\n * Secrets Sync via AWS SSM Parameter Store\n *\n * Stores and retrieves encrypted StageSecrets as SecureString parameters.\n * Reuses the SSM infrastructure from the state provider.\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/secrets\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SSMStateConfig } from '../deploy/StateProvider.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\n/**\n * Get the SSM parameter name for secrets.\n */\nfunction getSecretsParameterName(workspaceName: string, stage: string): string {\n\treturn `/gkm/${workspaceName}/${stage}/secrets`;\n}\n\n/**\n * Create an SSM client from workspace state config.\n */\nfunction createSSMClient(config: SSMStateConfig): SSMClient {\n\tconst clientConfig: SSMClientConfig = {\n\t\tregion: config.region,\n\t};\n\n\tif (config.profile) {\n\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\tclientConfig.credentials = fromIni({ profile: config.profile });\n\t}\n\n\treturn new SSMClient(clientConfig);\n}\n\n/**\n * Push secrets to SSM Parameter Store.\n *\n * Stores the full StageSecrets object as a SecureString parameter.\n */\nexport async function pushSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<void> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\tthrow new Error(\n\t\t\t'SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.',\n\t\t);\n\t}\n\n\tif (!workspace.name) {\n\t\tthrow new Error(\n\t\t\t'Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.',\n\t\t);\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\tconst { readStageSecrets } = await import('./storage.js');\n\tconst secrets = await readStageSecrets(stage, workspace.root);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`No secrets found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tawait client.send(\n\t\tnew PutParameterCommand({\n\t\t\tName: parameterName,\n\t\t\tValue: JSON.stringify(secrets),\n\t\t\tType: 'SecureString',\n\t\t\tOverwrite: true,\n\t\t\tDescription: `GKM secrets for ${workspace.name}/${stage}`,\n\t\t}),\n\t);\n}\n\n/**\n * Pull secrets from SSM Parameter Store.\n *\n * @returns StageSecrets or null if no secrets are stored remotely\n */\nexport async function pullSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<StageSecrets | null> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\treturn null;\n\t}\n\n\tif (!workspace.name) {\n\t\treturn null;\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\ttry {\n\t\tconst response = await client.send(\n\t\t\tnew GetParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tWithDecryption: true,\n\t\t\t}),\n\t\t);\n\n\t\tif (!response.Parameter?.Value) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn JSON.parse(response.Parameter.Value) as StageSecrets;\n\t} catch (error) {\n\t\tif (error instanceof ParameterNotFound) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if SSM is configured for the workspace.\n */\nexport function isSSMConfigured(workspace: NormalizedWorkspace): boolean {\n\treturn !!workspace.state && workspace.state.provider === 'ssm';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuBA,SAAS,wBAAwB,eAAuB,OAAuB;CAC9E,OAAO,QAAQ,cAAc,GAAG,MAAM;AACvC;;;;AAKA,SAAS,gBAAgB,QAAmC;CAC3D,MAAM,eAAgC,EACrC,QAAQ,OAAO,OAChB;CAEA,IAAI,OAAO,SAAS;EACnB,MAAM,EAAE,YAAA,UAAoB,+BAA+B;EAC3D,aAAa,cAAc,QAAQ,EAAE,SAAS,OAAO,QAAQ,CAAC;CAC/D;CAEA,OAAO,IAAI,UAAU,YAAY;AAClC;;;;;;AAOA,eAAsB,YACrB,OACA,WACgB;CAChB,MAAM,SAAS,UAAU;CACzB,IAAI,CAAC,UAAU,OAAO,aAAa,OAClC,MAAM,IAAI,MACT,wGACD;CAGD,IAAI,CAAC,UAAU,MACd,MAAM,IAAI,MACT,iFACD;CAGD,MAAM,SAAS,gBAAgB,MAAwB;CACvD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,KAAK;CAEnE,MAAM,EAAE,qBAAqB,MAAM,OAAO,yBAAe,CAAA,MAAA,MAAA,EAAA,CAAA;CACzD,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,IAAI;CAE5D,IAAI,CAAC,SACJ,MAAM,IAAI,MACT,+BAA+B,MAAM,mCAAmC,MAAM,SAC/E;CAGD,MAAM,OAAO,KACZ,IAAI,oBAAoB;EACvB,MAAM;EACN,OAAO,KAAK,UAAU,OAAO;EAC7B,MAAM;EACN,WAAW;EACX,aAAa,mBAAmB,UAAU,KAAK,GAAG;CACnD,CAAC,CACF;AACD;;;;;;AAOA,eAAsB,YACrB,OACA,WAC+B;CAC/B,MAAM,SAAS,UAAU;CACzB,IAAI,CAAC,UAAU,OAAO,aAAa,OAClC,OAAO;CAGR,IAAI,CAAC,UAAU,MACd,OAAO;CAGR,MAAM,SAAS,gBAAgB,MAAwB;CACvD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,KAAK;CAEnE,IAAI;EACH,MAAM,WAAW,MAAM,OAAO,KAC7B,IAAI,oBAAoB;GACvB,MAAM;GACN,gBAAgB;EACjB,CAAC,CACF;EAEA,IAAI,CAAC,SAAS,WAAW,OACxB,OAAO;EAGR,OAAO,KAAK,MAAM,SAAS,UAAU,KAAK;CAC3C,SAAS,OAAO;EACf,IAAI,iBAAiB,mBACpB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,SAAgB,gBAAgB,WAAyC;CACxE,OAAO,CAAC,CAAC,UAAU,SAAS,UAAU,MAAM,aAAa;AAC1D"}

package/dist/{sync-0ILCb-1S.cjs → sync-D7uTIIEi.cjs}

@@ -1,8 +1,20 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_client_ssm = require_chunk.__toESM(require("@aws-sdk/client-ssm"));
-
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+let _aws_sdk_client_ssm = require("@aws-sdk/client-ssm");
 //#region src/secrets/sync.ts
 /**
+* Secrets Sync via AWS SSM Parameter Store
+*
+* Stores and retrieves encrypted StageSecrets as SecureString parameters.
+* Reuses the SSM infrastructure from the state provider.
+*
+* Parameter naming: /gkm/{workspaceName}/{stage}/secrets
+*/
+var sync_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	isSSMConfigured: () => isSSMConfigured,
+	pullSecrets: () => pullSecrets,
+	pushSecrets: () => pushSecrets
+});
+/**
 * Get the SSM parameter name for secrets.
 */
 function getSecretsParameterName(workspaceName, stage) {
@@ -17,7 +29,7 @@ function createSSMClient(config) {
 		const { fromIni } = require("@aws-sdk/credential-providers");
 		clientConfig.credentials = fromIni({ profile: config.profile });
 	}
-	return new __aws_sdk_client_ssm.SSMClient(clientConfig);
+	return new _aws_sdk_client_ssm.SSMClient(clientConfig);
 }
 /**
 * Push secrets to SSM Parameter Store.
@@ -30,10 +42,10 @@ async function pushSecrets(stage, workspace) {
 	if (!workspace.name) throw new Error("Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.");
 	const client = createSSMClient(config);
 	const parameterName = getSecretsParameterName(workspace.name, stage);
-	const { readStageSecrets } = await Promise.resolve().then(() => require("./storage-DlVol_oj.cjs"));
+	const { readStageSecrets } = await Promise.resolve().then(() => require("./storage-C-30BD1e.cjs")).then((n) => n.storage_exports);
 	const secrets = await readStageSecrets(stage, workspace.root);
 	if (!secrets) throw new Error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
-	await client.send(new __aws_sdk_client_ssm.PutParameterCommand({
+	await client.send(new _aws_sdk_client_ssm.PutParameterCommand({
 		Name: parameterName,
 		Value: JSON.stringify(secrets),
 		Type: "SecureString",
@@ -53,14 +65,14 @@ async function pullSecrets(stage, workspace) {
 	const client = createSSMClient(config);
 	const parameterName = getSecretsParameterName(workspace.name, stage);
 	try {
-		const response = await client.send(new __aws_sdk_client_ssm.GetParameterCommand({
+		const response = await client.send(new _aws_sdk_client_ssm.GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: true
 		}));
 		if (!response.Parameter?.Value) return null;
 		return JSON.parse(response.Parameter.Value);
 	} catch (error) {
-		if (error instanceof __aws_sdk_client_ssm.ParameterNotFound) return null;
+		if (error instanceof _aws_sdk_client_ssm.ParameterNotFound) return null;
 		throw error;
 	}
 }
@@ -70,24 +82,30 @@ async function pullSecrets(stage, workspace) {
 function isSSMConfigured(workspace) {
 	return !!workspace.state && workspace.state.provider === "ssm";
 }
-
 //#endregion
-Object.defineProperty(exports, 'isSSMConfigured', {
-  enumerable: true,
-  get: function () {
-    return isSSMConfigured;
-  }
+Object.defineProperty(exports, "isSSMConfigured", {
+	enumerable: true,
+	get: function() {
+		return isSSMConfigured;
+	}
+});
+Object.defineProperty(exports, "pullSecrets", {
+	enumerable: true,
+	get: function() {
+		return pullSecrets;
+	}
 });
-Object.defineProperty(exports, 'pullSecrets', {
-  enumerable: true,
-  get: function () {
-    return pullSecrets;
-  }
+Object.defineProperty(exports, "pushSecrets", {
+	enumerable: true,
+	get: function() {
+		return pushSecrets;
+	}
 });
-Object.defineProperty(exports, 'pushSecrets', {
-  enumerable: true,
-  get: function () {
-    return pushSecrets;
-  }
+Object.defineProperty(exports, "sync_exports", {
+	enumerable: true,
+	get: function() {
+		return sync_exports;
+	}
 });
-//# sourceMappingURL=sync-0ILCb-1S.cjs.map
+
+//# sourceMappingURL=sync-D7uTIIEi.cjs.map

package/dist/sync-D7uTIIEi.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-D7uTIIEi.cjs","names":["SSMClient","PutParameterCommand","GetParameterCommand","ParameterNotFound"],"sources":["../src/secrets/sync.ts"],"sourcesContent":["/**\n * Secrets Sync via AWS SSM Parameter Store\n *\n * Stores and retrieves encrypted StageSecrets as SecureString parameters.\n * Reuses the SSM infrastructure from the state provider.\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/secrets\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SSMStateConfig } from '../deploy/StateProvider.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\n/**\n * Get the SSM parameter name for secrets.\n */\nfunction getSecretsParameterName(workspaceName: string, stage: string): string {\n\treturn `/gkm/${workspaceName}/${stage}/secrets`;\n}\n\n/**\n * Create an SSM client from workspace state config.\n */\nfunction createSSMClient(config: SSMStateConfig): SSMClient {\n\tconst clientConfig: SSMClientConfig = {\n\t\tregion: config.region,\n\t};\n\n\tif (config.profile) {\n\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\tclientConfig.credentials = fromIni({ profile: config.profile });\n\t}\n\n\treturn new SSMClient(clientConfig);\n}\n\n/**\n * Push secrets to SSM Parameter Store.\n *\n * Stores the full StageSecrets object as a SecureString parameter.\n */\nexport async function pushSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<void> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\tthrow new Error(\n\t\t\t'SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.',\n\t\t);\n\t}\n\n\tif (!workspace.name) {\n\t\tthrow new Error(\n\t\t\t'Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.',\n\t\t);\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\tconst { readStageSecrets } = await import('./storage.js');\n\tconst secrets = await readStageSecrets(stage, workspace.root);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`No secrets found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tawait client.send(\n\t\tnew PutParameterCommand({\n\t\t\tName: parameterName,\n\t\t\tValue: JSON.stringify(secrets),\n\t\t\tType: 'SecureString',\n\t\t\tOverwrite: true,\n\t\t\tDescription: `GKM secrets for ${workspace.name}/${stage}`,\n\t\t}),\n\t);\n}\n\n/**\n * Pull secrets from SSM Parameter Store.\n *\n * @returns StageSecrets or null if no secrets are stored remotely\n */\nexport async function pullSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n): Promise<StageSecrets | null> {\n\tconst config = workspace.state;\n\tif (!config || config.provider !== 'ssm') {\n\t\treturn null;\n\t}\n\n\tif (!workspace.name) {\n\t\treturn null;\n\t}\n\n\tconst client = createSSMClient(config as SSMStateConfig);\n\tconst parameterName = getSecretsParameterName(workspace.name, stage);\n\n\ttry {\n\t\tconst response = await client.send(\n\t\t\tnew GetParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tWithDecryption: true,\n\t\t\t}),\n\t\t);\n\n\t\tif (!response.Parameter?.Value) {\n\t\t\treturn null;\n\t\t}\n\n\t\treturn JSON.parse(response.Parameter.Value) as StageSecrets;\n\t} catch (error) {\n\t\tif (error instanceof ParameterNotFound) {\n\t\t\treturn null;\n\t\t}\n\t\tthrow error;\n\t}\n}\n\n/**\n * Check if SSM is configured for the workspace.\n */\nexport function isSSMConfigured(workspace: NormalizedWorkspace): boolean {\n\treturn !!workspace.state && workspace.state.provider === 'ssm';\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuBA,SAAS,wBAAwB,eAAuB,OAAuB;CAC9E,OAAO,QAAQ,cAAc,GAAG,MAAM;AACvC;;;;AAKA,SAAS,gBAAgB,QAAmC;CAC3D,MAAM,eAAgC,EACrC,QAAQ,OAAO,OAChB;CAEA,IAAI,OAAO,SAAS;EACnB,MAAM,EAAE,YAAY,QAAQ,+BAA+B;EAC3D,aAAa,cAAc,QAAQ,EAAE,SAAS,OAAO,QAAQ,CAAC;CAC/D;CAEA,OAAO,IAAIA,oBAAAA,UAAU,YAAY;AAClC;;;;;;AAOA,eAAsB,YACrB,OACA,WACgB;CAChB,MAAM,SAAS,UAAU;CACzB,IAAI,CAAC,UAAU,OAAO,aAAa,OAClC,MAAM,IAAI,MACT,wGACD;CAGD,IAAI,CAAC,UAAU,MACd,MAAM,IAAI,MACT,iFACD;CAGD,MAAM,SAAS,gBAAgB,MAAwB;CACvD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,KAAK;CAEnE,MAAM,EAAE,qBAAqB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,eAAA;CACnC,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,IAAI;CAE5D,IAAI,CAAC,SACJ,MAAM,IAAI,MACT,+BAA+B,MAAM,mCAAmC,MAAM,SAC/E;CAGD,MAAM,OAAO,KACZ,IAAIC,oBAAAA,oBAAoB;EACvB,MAAM;EACN,OAAO,KAAK,UAAU,OAAO;EAC7B,MAAM;EACN,WAAW;EACX,aAAa,mBAAmB,UAAU,KAAK,GAAG;CACnD,CAAC,CACF;AACD;;;;;;AAOA,eAAsB,YACrB,OACA,WAC+B;CAC/B,MAAM,SAAS,UAAU;CACzB,IAAI,CAAC,UAAU,OAAO,aAAa,OAClC,OAAO;CAGR,IAAI,CAAC,UAAU,MACd,OAAO;CAGR,MAAM,SAAS,gBAAgB,MAAwB;CACvD,MAAM,gBAAgB,wBAAwB,UAAU,MAAM,KAAK;CAEnE,IAAI;EACH,MAAM,WAAW,MAAM,OAAO,KAC7B,IAAIC,oBAAAA,oBAAoB;GACvB,MAAM;GACN,gBAAgB;EACjB,CAAC,CACF;EAEA,IAAI,CAAC,SAAS,WAAW,OACxB,OAAO;EAGR,OAAO,KAAK,MAAM,SAAS,UAAU,KAAK;CAC3C,SAAS,OAAO;EACf,IAAI,iBAAiBC,oBAAAA,mBACpB,OAAO;EAER,MAAM;CACP;AACD;;;;AAKA,SAAgB,gBAAgB,WAAyC;CACxE,OAAO,CAAC,CAAC,UAAU,SAAS,UAAU,MAAM,aAAa;AAC1D"}