@geekmidas/cli 10.0.0-alpha.118 → 10.0.0-alpha.119

package/dist/config.cjs

@@ -3,7 +3,7 @@ const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_workspace = require("./workspace-BwqQnool.cjs");
 const require_schemas = require("./schemas-BQ_v0lEX.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_discover = require("./discover-Bsr7HjqJ.cjs");
+const require_discover = require("./discover-DozUKs8f.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");

package/dist/config.mjs

@@ -2,7 +2,7 @@ import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { a as allConstructGlobs, b as isWorkspaceConfig, d as getAppGkmConfig, l as defineWorkspace, m as processConfig } from "./workspace-D1QbNd55.mjs";
 import { a as discriminatedUnion, c as literal, d as object, f as record, g as unknown, n as array, p as string } from "./schemas-BCwKKA42.mjs";
 import { n as derivedApps } from "./derive-B4vDpzgP.mjs";
-import { f as output, i as discover, l as runWorker } from "./discover-Ca8U75dl.mjs";
+import { f as output, i as discover, l as runWorker } from "./discover-C5roJuc9.mjs";
 import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { dirname, join, parse, resolve, sep } from "node:path";
 import { existsSync, realpathSync } from "node:fs";

package/dist/{credentialSchemas-D_VUCDUh.cjs → credentialSchemas-B67WJOOm.cjs}

@@ -1,6 +1,6 @@
 const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_schemas = require("./schemas-BQ_v0lEX.cjs");
-const require_discover = require("./discover-Bsr7HjqJ.cjs");
+const require_discover = require("./discover-DozUKs8f.cjs");
 const require_sandbox = require("./sandbox-CHv3OYXg.cjs");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let _geekmidas_constructs_credential = require("@geekmidas/constructs/credential");
@@ -269,4 +269,4 @@ Object.defineProperty(exports, "loadCredentialSchemas", {
 	}
 });
 
-//# sourceMappingURL=credentialSchemas-D_VUCDUh.cjs.map
+//# sourceMappingURL=credentialSchemas-B67WJOOm.cjs.map

package/dist/{credentialSchemas-D_VUCDUh.cjs.map → credentialSchemas-B67WJOOm.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"credentialSchemas-D_VUCDUh.cjs","names":["provideKey","decodeCredentials","activeSandbox","runWorker","ConstructDiscoveryFailed","discover","GkmError"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,MAAA,GAAKA,oBAAAA,WAAAA,CAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAA,gBAAA,aAAsB,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,UAAA,GAASC,iCAAAA,kBAAAA,CAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAA,gBAAA,OAAiB;CAAE,MAAA,gBAAA,OAAe;CAAG,SAAA,gBAAA,OAAkB;AAAE,CAAC;;AAGhE,MAAM,oBAAA,gBAAA,mBAAyC,UAAU,CAAA,gBAAA,OAC/C;CACR,QAAA,gBAAA,QAAkB,WAAW;CAC7B,SAAA,gBAAA,MAAA,gBAAA,OACU;EACR,KAAA,gBAAA,OAAc;EACd,IAAA,gBAAA,OAAa;EACb,MAAA,gBAAA,MAAa,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAA,gBAAA,OAAA,gBAAA,OAA8B,GAAA,gBAAA,QAAa,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAA,gBAAA,OAAA,gBAAA,OACU,GAAA,gBAAA,OACA;EAAE,IAAA,gBAAA,QAAc;EAAG,QAAA,gBAAA,MAAgB,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GAAA,gBAAA,OACQ;CACR,QAAA,gBAAA,QAAkB,QAAQ;CAC1B,OAAA,gBAAA,OAAgB;EAAE,MAAA,gBAAA,OAAe;EAAG,SAAA,gBAAA,OAAkB;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAUC,gBAAAA,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAMC,iBAAAA,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAIC,iBAAAA,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALNC,iBAAAA,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAOH,gBAAAA,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwCI,eAAAA,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}
+{"version":3,"file":"credentialSchemas-B67WJOOm.cjs","names":["provideKey","decodeCredentials","activeSandbox","runWorker","ConstructDiscoveryFailed","discover","GkmError"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,MAAA,GAAKA,oBAAAA,WAAAA,CAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAA,gBAAA,aAAsB,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,UAAA,GAASC,iCAAAA,kBAAAA,CAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAA,gBAAA,OAAiB;CAAE,MAAA,gBAAA,OAAe;CAAG,SAAA,gBAAA,OAAkB;AAAE,CAAC;;AAGhE,MAAM,oBAAA,gBAAA,mBAAyC,UAAU,CAAA,gBAAA,OAC/C;CACR,QAAA,gBAAA,QAAkB,WAAW;CAC7B,SAAA,gBAAA,MAAA,gBAAA,OACU;EACR,KAAA,gBAAA,OAAc;EACd,IAAA,gBAAA,OAAa;EACb,MAAA,gBAAA,MAAa,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAA,gBAAA,OAAA,gBAAA,OAA8B,GAAA,gBAAA,QAAa,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAA,gBAAA,OAAA,gBAAA,OACU,GAAA,gBAAA,OACA;EAAE,IAAA,gBAAA,QAAc;EAAG,QAAA,gBAAA,MAAgB,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GAAA,gBAAA,OACQ;CACR,QAAA,gBAAA,QAAkB,QAAQ;CAC1B,OAAA,gBAAA,OAAgB;EAAE,MAAA,gBAAA,OAAe;EAAG,SAAA,gBAAA,OAAkB;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAUC,gBAAAA,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAMC,iBAAAA,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAIC,iBAAAA,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALNC,iBAAAA,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAOH,gBAAAA,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwCI,eAAAA,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}

package/dist/{credentialSchemas-Cf5Pf8VE.mjs → credentialSchemas-DDOLRCLF.mjs}

@@ -1,6 +1,6 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { a as discriminatedUnion, c as literal, d as object, f as record, g as unknown, n as array, p as string, r as boolean, t as _enum, v as toJSONSchema } from "./schemas-BCwKKA42.mjs";
-import { i as discover, l as runWorker, t as ConstructDiscoveryFailed } from "./discover-Ca8U75dl.mjs";
+import { i as discover, l as runWorker, t as ConstructDiscoveryFailed } from "./discover-C5roJuc9.mjs";
 import { i as activeSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { provideKey } from "@geekmidas/manifest";
 import { decodeCredentials } from "@geekmidas/constructs/credential";
@@ -234,4 +234,4 @@ async function assertStageCredentials(options) {
 //#endregion
 export { liveCredentials as a, issueLine as i, assertStageCredentials as n, loadCredentialSchemas as o, inspectLive as r, CredentialsInvalid as t };
 
-//# sourceMappingURL=credentialSchemas-Cf5Pf8VE.mjs.map
+//# sourceMappingURL=credentialSchemas-DDOLRCLF.mjs.map

package/dist/{credentialSchemas-Cf5Pf8VE.mjs.map → credentialSchemas-DDOLRCLF.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"credentialSchemas-Cf5Pf8VE.mjs","names":["z.toJSONSchema","z.object","z.string","z.discriminatedUnion","z.literal","z.array","z.enum","z.record","z.unknown","z.boolean"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,KAAK,WAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAOA,aAAe,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,SAAS,kBAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAQC,OAAS;CAAE,MAAMC,OAAS;CAAG,SAASA,OAAS;AAAE,CAAC;;AAGhE,MAAM,oBAAoBC,mBAAqB,UAAU,CACxDF,OAAS;CACR,QAAQG,QAAU,WAAW;CAC7B,SAASC,MACRJ,OAAS;EACR,KAAKC,OAAS;EACd,IAAIA,OAAS;EACb,MAAMI,MAAO,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAYC,OAASL,OAAS,GAAGM,QAAU,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAQD,OACPL,OAAS,GACTD,OAAS;EAAE,IAAIQ,QAAU;EAAG,QAAQJ,MAAQ,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GACDJ,OAAS;CACR,QAAQG,QAAU,QAAQ;CAC1B,OAAOH,OAAS;EAAE,MAAMC,OAAS;EAAG,SAASA,OAAS;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAU,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALN,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAO,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwC,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}
+{"version":3,"file":"credentialSchemas-DDOLRCLF.mjs","names":["z.toJSONSchema","z.object","z.string","z.discriminatedUnion","z.literal","z.array","z.enum","z.record","z.unknown","z.boolean"],"sources":["../src/secrets/credentialSchemas.ts"],"sourcesContent":["/**\n * A third party's credentials, checked against the schema of the construct\n * that reads them — before they are stored, and before a deploy builds\n * anything with them.\n *\n * The schema lives on the construct (`ExternalApi.credentialsSchema`,\n * `Credential.credentialsSchema`), which is the project's code. So the\n * constructs are loaded where a deploy loads them: in the run's sandbox when\n * there is one, here otherwise. What comes back is data only — each schema as\n * JSON Schema where it can say so, and `{ ok, issues }` for each value asked\n * about — because a live schema cannot cross an isolating sandbox. A value\n * asked about goes in as a secret file, never an argument, and no issue\n * carries it back: an issue is a path and a message.\n */\n\nimport { decodeCredentials } from '@geekmidas/constructs/credential';\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport type { StandardSchemaV1 } from '@standard-schema/spec';\nimport { z } from 'zod';\nimport { GkmError } from '../errors';\nimport {\n\tConstructDiscoveryFailed,\n\ttype ConstructSource,\n\tdiscover,\n} from '../reconcile/discover';\nimport { activeSandbox } from '../sandbox/sandbox';\nimport { runWorker } from '../sandbox/worker';\n\n/** One thing a schema refused: where in the value, and why. */\nexport interface CredentialIssue {\n\t/** Dotted, from the value's root — `apiKey`, `keys.0`; empty for the root. */\n\tpath: string;\n\tmessage: string;\n}\n\n/** What a candidate value came to. */\nexport interface CredentialCheck {\n\tok: boolean;\n\tissues: CredentialIssue[];\n}\n\n/** A construct's credentials key, and its schema as data. */\nexport interface CredentialSchemaInfo {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\t/**\n\t * The schema as JSON Schema, where the schema can say — zod's, or any\n\t * Standard JSON Schema. Absent otherwise: the value is asked for as JSON.\n\t */\n\tjsonSchema?: Record<string, unknown>;\n}\n\n/** What loading the constructs answers. */\nexport interface CredentialInspection {\n\tschemas: CredentialSchemaInfo[];\n\t/** Each value asked about, by key. */\n\tchecks: Record<string, CredentialCheck>;\n}\n\n/** A construct whose credentials have a schema. */\ninterface LiveCredential {\n\tkey: string;\n\tid: string;\n\tkind: 'external-api' | 'credential';\n\tschema: StandardSchemaV1;\n}\n\n/** The credentials keys a manifest declares, by the construct that reads each. */\nexport function credentialKeys(\n\tmanifest: ConstructManifest,\n): { key: string; id: string; kind: 'external-api' | 'credential' }[] {\n\treturn Object.entries(manifest).flatMap(([id, declaration]) =>\n\t\tdeclaration.kind === 'external-api' || declaration.kind === 'credential'\n\t\t\t? [{ key: provideKey(id, 'credentials'), id, kind: declaration.kind }]\n\t\t\t: [],\n\t);\n}\n\n/** The constructs that read a third party's credentials, with their schemas. */\nexport function liveCredentials(\n\tmanifest: ConstructManifest,\n\tsources: Readonly<Record<string, ConstructSource>>,\n): LiveCredential[] {\n\treturn credentialKeys(manifest).flatMap(({ key, id, kind }) => {\n\t\tconst schema = (sources[id]?.construct as { credentialsSchema?: unknown })\n\t\t\t?.credentialsSchema;\n\t\treturn isStandardSchema(schema) ? [{ key, id, kind, schema }] : [];\n\t});\n}\n\nfunction isStandardSchema(value: unknown): value is StandardSchemaV1 {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\ttypeof (value as StandardSchemaV1)['~standard']?.validate === 'function'\n\t);\n}\n\n/**\n * A schema as JSON Schema: through the Standard JSON Schema extension where\n * the schema has it, as zod 4's does, else zod's own converter — or nothing,\n * for a schema neither can describe.\n */\nexport function jsonSchemaOf(\n\tschema: StandardSchemaV1,\n): Record<string, unknown> | undefined {\n\tconst standard = schema['~standard'] as StandardSchemaV1['~standard'] & {\n\t\tjsonSchema?: {\n\t\t\tinput?: (options: { target: string }) => Record<string, unknown>;\n\t\t};\n\t};\n\ttry {\n\t\tconst described = standard.jsonSchema?.input?.({\n\t\t\ttarget: 'draft-2020-12',\n\t\t});\n\t\tif (described) return described;\n\t} catch {\n\t\t// A type JSON Schema cannot express: try zod's converter, then nothing.\n\t}\n\tif (typeof schema === 'object' && schema !== null && '_zod' in schema) {\n\t\ttry {\n\t\t\treturn z.toJSONSchema(schema as unknown as z.ZodType, {\n\t\t\t\tio: 'input',\n\t\t\t}) as Record<string, unknown>;\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** A stored value against its schema, read the way the construct reads it. */\nexport async function checkCredential(\n\tschema: StandardSchemaV1,\n\traw: string,\n): Promise<CredentialCheck> {\n\tconst result = await schema['~standard'].validate(decodeCredentials(raw));\n\tif (!result.issues) return { ok: true, issues: [] };\n\treturn {\n\t\tok: false,\n\t\tissues: result.issues.map((issue) => ({\n\t\t\tpath: (issue.path ?? [])\n\t\t\t\t.map((segment) =>\n\t\t\t\t\ttypeof segment === 'object' ? String(segment.key) : String(segment),\n\t\t\t\t)\n\t\t\t\t.join('.'),\n\t\t\tmessage: issue.message,\n\t\t})),\n\t};\n}\n\n/** What a set of live credentials says about some values: data only. */\nexport async function inspectLive(\n\tlive: readonly LiveCredential[],\n\tvalues: Readonly<Record<string, string>>,\n): Promise<CredentialInspection> {\n\tconst checks: Record<string, CredentialCheck> = {};\n\tfor (const credential of live) {\n\t\tconst value = values[credential.key];\n\t\tif (value === undefined) continue;\n\t\tchecks[credential.key] = await checkCredential(credential.schema, value);\n\t}\n\treturn {\n\t\tschemas: live.map(({ key, id, kind, schema }) => {\n\t\t\tconst jsonSchema = jsonSchemaOf(schema);\n\t\t\treturn { key, id, kind, ...(jsonSchema ? { jsonSchema } : {}) };\n\t\t}),\n\t\tchecks,\n\t};\n}\n\nexport interface InspectOptions {\n\t/** The workspace root. */\n\troot: string;\n\t/** Its construct globs. */\n\tpatterns: readonly string[];\n\t/** The values to check, by key. Only credentials keys are looked at. */\n\tvalues?: Readonly<Record<string, string>>;\n}\n\nconst Issue = z.object({ path: z.string(), message: z.string() });\n\n/** What the credentials worker answers. Checked: the worker ran project code. */\nconst CredentialsAnswer = z.discriminatedUnion('reason', [\n\tz.object({\n\t\treason: z.literal('inspected'),\n\t\tschemas: z.array(\n\t\t\tz.object({\n\t\t\t\tkey: z.string(),\n\t\t\t\tid: z.string(),\n\t\t\t\tkind: z.enum(['external-api', 'credential']),\n\t\t\t\tjsonSchema: z.record(z.string(), z.unknown()).optional(),\n\t\t\t}),\n\t\t),\n\t\tchecks: z.record(\n\t\t\tz.string(),\n\t\t\tz.object({ ok: z.boolean(), issues: z.array(Issue) }),\n\t\t),\n\t}),\n\tz.object({\n\t\treason: z.literal('failed'),\n\t\terror: z.object({ name: z.string(), message: z.string() }).loose(),\n\t}),\n]);\n\n/** How long loading the constructs to check credentials may take. */\nconst INSPECT_TIMEOUT_MS = 60_000;\n\n/**\n * The workspace's credential schemas, and what each of `values` comes to —\n * loaded in the run's sandbox when there is one, here otherwise.\n */\nexport async function inspectCredentials(\n\toptions: InspectOptions,\n): Promise<CredentialInspection> {\n\tconst sandbox = activeSandbox();\n\tif (!sandbox) {\n\t\treturn (await loadCredentialSchemasHere(options)).inspect(\n\t\t\toptions.values ?? {},\n\t\t);\n\t}\n\n\tconst secrets = Object.fromEntries(\n\t\tObject.entries(options.values ?? {}).filter(([key]) =>\n\t\t\tkey.endsWith('_CREDENTIALS'),\n\t\t),\n\t);\n\tconst { value } = await runWorker(sandbox, 'credentials check', {\n\t\tname: 'credentials-worker',\n\t\targs: [JSON.stringify({ patterns: options.patterns, cwd: options.root })],\n\t\tcwd: options.root,\n\t\ttimeoutMs: INSPECT_TIMEOUT_MS,\n\t\tschema: CredentialsAnswer,\n\t\t...(Object.keys(secrets).length > 0 ? { secrets } : {}),\n\t});\n\tif (value.reason === 'failed') {\n\t\tthrow new ConstructDiscoveryFailed(value.error.name, value.error.message);\n\t}\n\tconst { schemas, checks } = value;\n\treturn {\n\t\tschemas: schemas.map(({ jsonSchema, ...rest }) => ({\n\t\t\t...rest,\n\t\t\t...(jsonSchema ? { jsonSchema } : {}),\n\t\t})),\n\t\tchecks,\n\t};\n}\n\n/** The constructs loaded once, here, and asked about as often as needed. */\nasync function loadCredentialSchemasHere(options: InspectOptions): Promise<{\n\tinspect(\n\t\tvalues: Readonly<Record<string, string>>,\n\t): Promise<CredentialInspection>;\n}> {\n\tconst sources: Record<string, ConstructSource> = {};\n\tconst manifest = await discover({\n\t\tpatterns: [...options.patterns],\n\t\tcwd: options.root,\n\t\tsources,\n\t});\n\tconst live = liveCredentials(manifest, sources);\n\treturn { inspect: (values) => inspectLive(live, values) };\n}\n\n/** The schemas, and a check of one candidate value at a time. */\nexport interface CredentialSchemas {\n\tschemas: CredentialSchemaInfo[];\n\t/** `raw` against `key`'s schema; ok for a key no schema describes. */\n\tcheck(key: string, raw: string): Promise<CredentialCheck>;\n}\n\n/**\n * The workspace's credential schemas, for a command that checks values one\n * at a time as they are typed. In-process the constructs are loaded once;\n * in a sandbox each check is a run of the worker.\n */\nexport async function loadCredentialSchemas(\n\toptions: Omit<InspectOptions, 'values'>,\n): Promise<CredentialSchemas> {\n\tconst here = activeSandbox()\n\t\t? undefined\n\t\t: await loadCredentialSchemasHere(options);\n\tconst inspect = (values: Readonly<Record<string, string>>) =>\n\t\there ? here.inspect(values) : inspectCredentials({ ...options, values });\n\n\tconst { schemas } = await inspect({});\n\treturn {\n\t\tschemas,\n\t\tasync check(key, raw) {\n\t\t\tif (!schemas.some((s) => s.key === key)) return { ok: true, issues: [] };\n\t\t\tconst { checks } = await inspect({ [key]: raw });\n\t\t\treturn checks[key] ?? { ok: true, issues: [] };\n\t\t},\n\t};\n}\n\n/** One stored credential its schema refuses. */\nexport interface InvalidCredential {\n\tkey: string;\n\tissues: CredentialIssue[];\n}\n\n/** An issue as the line that names it: `SHIPPING_CREDENTIALS.apiKey: …`. */\nexport function issueLine(key: string, issue: CredentialIssue): string {\n\treturn `${key}${issue.path ? `.${issue.path}` : ''}: ${issue.message}`;\n}\n\n/**\n * Credentials their construct's schema refuses — on their way into the\n * stage's secrets, or already there when a deploy reads them. The values are\n * never in the message: only where each is wrong, and why.\n */\nexport class CredentialsInvalid extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly invalid: readonly InvalidCredential[],\n\t\t/** Whether a value was being set (and was not saved), or deployed. */\n\t\treadonly during: 'set' | 'deploy',\n\t) {\n\t\tconst lines = invalid.flatMap(({ key, issues }) =>\n\t\t\tissues.map((issue) => `  ${issueLine(key, issue)}`),\n\t\t);\n\t\tconst keys = invalid.map((i) => i.key);\n\t\tsuper(\n\t\t\tduring === 'set'\n\t\t\t\t? `${keys.join(', ')} is not what its construct's schema describes, ` +\n\t\t\t\t\t\t`so nothing was saved:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set a value that matches, or let gkm ask for each field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`\n\t\t\t\t: `The stage '${stage}' holds ${keys.length === 1 ? 'a credential' : 'credentials'} ` +\n\t\t\t\t\t\t`${keys.length === 1 ? \"its construct's schema refuses\" : \"their constructs' schemas refuse\"}, ` +\n\t\t\t\t\t\t`and every app reading ${keys.length === 1 ? 'it' : 'them'} would fail ` +\n\t\t\t\t\t\t`as it starts:\\n\\n${lines.join('\\n')}\\n\\n` +\n\t\t\t\t\t\t`Set ${keys.length === 1 ? 'it' : 'them'} again, field by field: ` +\n\t\t\t\t\t\t`gkm secrets:add --stage ${stage}`,\n\t\t);\n\t\tthis.name = 'CredentialsInvalid';\n\t}\n}\n\n/**\n * Every credential the stage holds for a construct, against its schema —\n * before a deploy builds anything with one the app would refuse as it\n * starts. Loads nothing when the stage holds none.\n *\n * @throws {CredentialsInvalid} naming each key and every issue\n */\nexport async function assertStageCredentials(options: {\n\troot: string;\n\tpatterns: readonly string[];\n\tmanifest: ConstructManifest;\n\tstage: string;\n\tsupplied: Readonly<Record<string, string>>;\n}): Promise<void> {\n\tconst values = Object.fromEntries(\n\t\tcredentialKeys(options.manifest)\n\t\t\t.map(({ key }) => [key, options.supplied[key]] as const)\n\t\t\t.filter((entry): entry is [string, string] => entry[1] !== undefined),\n\t);\n\tif (Object.keys(values).length === 0) return;\n\n\tconst { checks } = await inspectCredentials({\n\t\troot: options.root,\n\t\tpatterns: options.patterns,\n\t\tvalues,\n\t});\n\tconst invalid = Object.entries(checks)\n\t\t.filter(([, check]) => !check.ok)\n\t\t.map(([key, check]) => ({ key, issues: check.issues }))\n\t\t.sort((a, b) => a.key.localeCompare(b.key));\n\tif (invalid.length > 0) {\n\t\tthrow new CredentialsInvalid(options.stage, invalid, 'deploy');\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqEA,SAAgB,eACf,UACqE;CACrE,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC,SAAS,CAAC,IAAI,iBAC7C,YAAY,SAAS,kBAAkB,YAAY,SAAS,eACzD,CAAC;EAAE,KAAK,WAAW,IAAI,aAAa;EAAG;EAAI,MAAM,YAAY;CAAK,CAAC,IACnE,CAAC,CACL;AACD;;AAGA,SAAgB,gBACf,UACA,SACmB;CACnB,OAAO,eAAe,QAAQ,CAAC,CAAC,SAAS,EAAE,KAAK,IAAI,WAAW;EAC9D,MAAM,UAAU,QAAQ,GAAG,EAAE,UAAA,EAC1B;EACH,OAAO,iBAAiB,MAAM,IAAI,CAAC;GAAE;GAAK;GAAI;GAAM;EAAO,CAAC,IAAI,CAAC;CAClE,CAAC;AACF;AAEA,SAAS,iBAAiB,OAA2C;CACpE,OACC,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA2B,YAAY,EAAE,aAAa;AAEhE;;;;;;AAOA,SAAgB,aACf,QACsC;CACtC,MAAM,WAAW,OAAO;CAKxB,IAAI;EACH,MAAM,YAAY,SAAS,YAAY,QAAQ,EAC9C,QAAQ,gBACT,CAAC;EACD,IAAI,WAAW,OAAO;CACvB,QAAQ,CAER;CACA,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,QAC9D,IAAI;EACH,OAAOA,aAAe,QAAgC,EACrD,IAAI,QACL,CAAC;CACF,QAAQ;EACP;CACD;AAGF;;AAGA,eAAsB,gBACrB,QACA,KAC2B;CAC3B,MAAM,SAAS,MAAM,OAAO,YAAY,CAAC,SAAS,kBAAkB,GAAG,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ,CAAC;CAAE;CAClD,OAAO;EACN,IAAI;EACJ,QAAQ,OAAO,OAAO,KAAK,WAAW;GACrC,OAAO,MAAM,QAAQ,CAAC,EAAA,CACpB,KAAK,YACL,OAAO,YAAY,WAAW,OAAO,QAAQ,GAAG,IAAI,OAAO,OAAO,CACnE,CAAC,CACA,KAAK,GAAG;GACV,SAAS,MAAM;EAChB,EAAE;CACH;AACD;;AAGA,eAAsB,YACrB,MACA,QACgC;CAChC,MAAM,SAA0C,CAAC;CACjD,KAAK,MAAM,cAAc,MAAM;EAC9B,MAAM,QAAQ,OAAO,WAAW;EAChC,IAAI,UAAU,KAAA,GAAW;EACzB,OAAO,WAAW,OAAO,MAAM,gBAAgB,WAAW,QAAQ,KAAK;CACxE;CACA,OAAO;EACN,SAAS,KAAK,KAAK,EAAE,KAAK,IAAI,MAAM,aAAa;GAChD,MAAM,aAAa,aAAa,MAAM;GACtC,OAAO;IAAE;IAAK;IAAI;IAAM,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;GAAG;EAC/D,CAAC;EACD;CACD;AACD;AAWA,MAAM,QAAQC,OAAS;CAAE,MAAMC,OAAS;CAAG,SAASA,OAAS;AAAE,CAAC;;AAGhE,MAAM,oBAAoBC,mBAAqB,UAAU,CACxDF,OAAS;CACR,QAAQG,QAAU,WAAW;CAC7B,SAASC,MACRJ,OAAS;EACR,KAAKC,OAAS;EACd,IAAIA,OAAS;EACb,MAAMI,MAAO,CAAC,gBAAgB,YAAY,CAAC;EAC3C,YAAYC,OAASL,OAAS,GAAGM,QAAU,CAAC,CAAC,CAAC,SAAS;CACxD,CAAC,CACF;CACA,QAAQD,OACPL,OAAS,GACTD,OAAS;EAAE,IAAIQ,QAAU;EAAG,QAAQJ,MAAQ,KAAK;CAAE,CAAC,CACrD;AACD,CAAC,GACDJ,OAAS;CACR,QAAQG,QAAU,QAAQ;CAC1B,OAAOH,OAAS;EAAE,MAAMC,OAAS;EAAG,SAASA,OAAS;CAAE,CAAC,CAAC,CAAC,MAAM;AAClE,CAAC,CACF,CAAC;;AAGD,MAAM,qBAAqB;;;;;AAM3B,eAAsB,mBACrB,SACgC;CAChC,MAAM,UAAU,cAAc;CAC9B,IAAI,CAAC,SACJ,QAAQ,MAAM,0BAA0B,OAAO,EAAA,CAAG,QACjD,QAAQ,UAAU,CAAC,CACpB;CAGD,MAAM,UAAU,OAAO,YACtB,OAAO,QAAQ,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAC7C,IAAI,SAAS,cAAc,CAC5B,CACD;CACA,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,qBAAqB;EAC/D,MAAM;EACN,MAAM,CAAC,KAAK,UAAU;GAAE,UAAU,QAAQ;GAAU,KAAK,QAAQ;EAAK,CAAC,CAAC;EACxE,KAAK,QAAQ;EACb,WAAW;EACX,QAAQ;EACR,GAAI,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;CACtD,CAAC;CACD,IAAI,MAAM,WAAW,UACpB,MAAM,IAAI,yBAAyB,MAAM,MAAM,MAAM,MAAM,MAAM,OAAO;CAEzE,MAAM,EAAE,SAAS,WAAW;CAC5B,OAAO;EACN,SAAS,QAAQ,KAAK,EAAE,YAAY,GAAG,YAAY;GAClD,GAAG;GACH,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACpC,EAAE;EACF;CACD;AACD;;AAGA,eAAe,0BAA0B,SAItC;CACF,MAAM,UAA2C,CAAC;CAMlD,MAAM,OAAO,gBAAgB,MALN,SAAS;EAC/B,UAAU,CAAC,GAAG,QAAQ,QAAQ;EAC9B,KAAK,QAAQ;EACb;CACD,CAAC,GACsC,OAAO;CAC9C,OAAO,EAAE,UAAU,WAAW,YAAY,MAAM,MAAM,EAAE;AACzD;;;;;;AAcA,eAAsB,sBACrB,SAC6B;CAC7B,MAAM,OAAO,cAAc,IACxB,KAAA,IACA,MAAM,0BAA0B,OAAO;CAC1C,MAAM,WAAW,WAChB,OAAO,KAAK,QAAQ,MAAM,IAAI,mBAAmB;EAAE,GAAG;EAAS;CAAO,CAAC;CAExE,MAAM,EAAE,YAAY,MAAM,QAAQ,CAAC,CAAC;CACpC,OAAO;EACN;EACA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,CAAC,QAAQ,MAAM,MAAM,EAAE,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;GACvE,MAAM,EAAE,WAAW,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC;GAC/C,OAAO,OAAO,QAAQ;IAAE,IAAI;IAAM,QAAQ,CAAC;GAAE;EAC9C;CACD;AACD;;AASA,SAAgB,UAAU,KAAa,OAAgC;CACtE,OAAO,GAAG,MAAM,MAAM,OAAO,IAAI,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9D;;;;;;AAOA,IAAa,qBAAb,cAAwC,SAAS;CAEtC;CACA;CAEA;CAJV,YACC,OACA,SAEA,QACC;EACD,MAAM,QAAQ,QAAQ,SAAS,EAAE,KAAK,aACrC,OAAO,KAAK,UAAU,KAAK,UAAU,KAAK,KAAK,GAAG,CACnD;EACA,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE,GAAG;EACrC,MACC,WAAW,QACR,GAAG,KAAK,KAAK,IAAI,EAAE,0EACS,MAAM,KAAK,IAAI,EAAE,uFAElB,UAC3B,cAAc,MAAM,UAAU,KAAK,WAAW,IAAI,iBAAiB,cAAc,GAC9E,KAAK,WAAW,IAAI,mCAAmC,mCAAmC,0BACpE,KAAK,WAAW,IAAI,OAAO,OAAO,+BACvC,MAAM,KAAK,IAAI,EAAE,UAC9B,KAAK,WAAW,IAAI,OAAO,OAAO,kDACd,OAC/B;EArBS,KAAA,QAAA;EACA,KAAA,UAAA;EAEA,KAAA,SAAA;EAmBT,KAAK,OAAO;CACb;AACD;;;;;;;;AASA,eAAsB,uBAAuB,SAM3B;CACjB,MAAM,SAAS,OAAO,YACrB,eAAe,QAAQ,QAAQ,CAAC,CAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,QAAQ,SAAS,IAAI,CAAU,CAAC,CACvD,QAAQ,UAAqC,MAAM,OAAO,KAAA,CAAS,CACtE;CACA,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;CAEtC,MAAM,EAAE,WAAW,MAAM,mBAAmB;EAC3C,MAAM,QAAQ;EACd,UAAU,QAAQ;EAClB;CACD,CAAC;CACD,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC,CACpC,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAChC,KAAK,CAAC,KAAK,YAAY;EAAE;EAAK,QAAQ,MAAM;CAAO,EAAE,CAAC,CACtD,MAAM,GAAG,MAAM,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;CAC3C,IAAI,QAAQ,SAAS,GACpB,MAAM,IAAI,mBAAmB,QAAQ,OAAO,SAAS,QAAQ;AAE/D"}

package/dist/deploy/public.cjs

@@ -4,17 +4,17 @@ const require_run = require("../run-fVZ-rLnc.cjs");
 const require_credentials = require("../credentials-Zqr3QQYB.cjs");
 const require_workspace = require("../workspace-BwqQnool.cjs");
 const require_define = require("../define-crmMcXFS.cjs");
-const require_seeds = require("../seeds-CF9Nx6_g.cjs");
+const require_seeds = require("../seeds-CPFoexOv.cjs");
 const require_identity = require("../identity-CbLfgQNT.cjs");
-const require_discover = require("../discover-Bsr7HjqJ.cjs");
+const require_discover = require("../discover-DozUKs8f.cjs");
 const require_sandbox = require("../sandbox-CHv3OYXg.cjs");
 const require_config = require("../config.cjs");
-const require_resolve = require("../resolve-isFTuJp4.cjs");
-const require_deploy = require("../deploy-D-liNXfx.cjs");
+const require_resolve = require("../resolve-Dtrp53jt.cjs");
+const require_deploy = require("../deploy-rwfdH_Uw.cjs");
 const require_local = require("../local-DNhnkugT.cjs");
-const require_sniffer = require("../sniffer-Dz3Va1Jo.cjs");
-const require_engine = require("../engine-CKfdvEVt.cjs");
-const require_rollback = require("../rollback-Lj9bQvHq.cjs");
+const require_sniffer = require("../sniffer-DIVpELrO.cjs");
+const require_engine = require("../engine-C9qO5k6r.cjs");
+const require_rollback = require("../rollback-DAKtcSCy.cjs");
 const require_provider = require("../provider-BqpjG9QM.cjs");
 const require_sst = require("../sst-B-Uz4cvm.cjs");
 let node_path = require("node:path");

package/dist/deploy/public.d.cts

@@ -1,11 +1,12 @@
 import { At as deployIdentity, Ct as StateVersionConflict, Dt as LocalActor, Et as GithubActor, Tt as Actor, U as AnyDeployTarget, _t as StoredCredentialsOptions, at as DeployPhase, bt as LocalStateInCi, ct as AppDeployResult, dt as Credential, ft as CredentialKind, gt as MissingCredential, ht as CredentialRequest, it as DeployEventType, jt as GkmError, kt as DeployIdentity, lt as DeployResult, mt as CredentialProvider, nt as DeployEvent, ot as ResourceChange, pt as CredentialKinds, rt as DeployEventError, st as ResourceVia, ut as AwsCredential, vt as chainCredentials, wt as ReleasedImage, xt as StateLocked, yt as storedCredentials } from "../types-B6UXlEkf.cjs";
 import { a as SandboxOutput, c as confineCwd, i as SandboxExecOptions, n as Sandbox, o as SandboxResult, r as SandboxCwdEscape, s as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-CdKgQ3XU.cjs";
 import { i as ConfigLoadFailed, o as ConfigObjectNotSerializable } from "../config-DHDtsQrB.cjs";
-import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-CvTtV5ZD.cjs";
+import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-CSW_BMWa.cjs";
 import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-ACdfK59n.cjs";
 import { ConstructManifest, Declaration } from "@geekmidas/manifest";
 import "@geekmidas/envkit/sniffer";
 import "@geekmidas/db/pg/roles";
+import "@aws-sdk/client-s3";
 //#region src/home.d.ts
 /**
  * Where the CLI keeps what belongs to a person rather than a project: stage

package/dist/deploy/public.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/home.ts","../../src/providers/types.ts","../../src/providers/config.ts","../../src/deploy/devServices.ts","../../src/providers/notes.ts","../../src/providers/s3/errors.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/target/dokploy/dokploy-api.ts","../../src/target/dokploy/engine.ts","../../src/target/dokploy/health.ts","../../src/target/dokploy/migrations.ts","../../src/target/dokploy/rollback.ts","../../src/target/seeds.ts","../../src/target/sst/health.ts","../../src/target/sst/outputs.ts","../../src/target/sst/index.ts","../../src/deploy/deploy.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;cCYvB;KAED,uBAAuB;;;;qBC8BtB,6BAA6B;WAE/B,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;;;;;qBCpBE;KAED,qBAAqB;;qBAcpB,oCAAoC;WAC3B;EAArB,YAAqB;;;;;;;qBAeT,qCAAqC;WAC5B;EAArB,YAAqB;;;UAiCL;EAChB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;EAEV;;EAEA;;;;;;qBAOY,sCAAsC;WAExC;WACA,kBAAkB;EAF5B,YACU,eACA,kBAAkB;;;;;qBCjHhB,8BAA8B;WAEhC,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;qBCyHE,qCAAqC;WAEvC;WACA;WACA;WACA;EAJV,YACU,YACA,gBACA,eACA;;;;;qBCjHE,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KClFS;;;;qBCWC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCrMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;qBCuBE,yBAAyB;WAE3B;WACA,YAAY;EAFtB,YACU,uBACA,YAAY;;;qBAYV,2BAA2B;WAE7B;WACA;;WAEA,YAAY;EAJtB,YACU,uBACA,mBAEA;;EAAA,YAAY;;KA2vCX;;UAOK;EAChB;EACA,QAAQ;;EAER;EACA;EACA;;;;;qBC7oCY,4BAA4B;WAE9B;EADV,YACU,aACT;;;;;;;qBAeW,6BAA6B;WAE/B;EADV,YACU,yBACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBC3OE,4BAA4B;WAE9B;WACA;WACA;;WAEA;EALV,YACU,aACA,aACA,mBAEA;;EAAA;;;;;qBCJE,+BAA+B;WAEjC;;WAEA;EAHV,YACU,eAEA;;EAAA,gBACT;;;;UCDe;;EAEhB;EACA;;EAEA;;EAEA;;EAEA,cAAc;EACd,SAAS;;EAET,OAAO;;EAEP,UAAU;;;UAIM;EAChB;EACA,MAAM;EACN,IAAI;;;qBAIQ,yBAAyB;WAE3B;;WAEA;EAHV,YACU,eAEA;;EAAA;;;qBAWE,0BAA0B;WAE5B;WACA;EAFV,YACU,eACA;;;qBAWE,2BAA2B;WAClB;EAArB,YAAqB;;;;;;wBAaA,cACrB,OAAO,gBACL,QAAQ;;;;qBChGE,0BAA0B;WAE5B;;WAEA;;WAEA;WACS;EANnB,YACU,eAEA;;EAAA,mBAEA;;EAAA,cACS;;;;;qBCKP,0BAA0B;WAE5B;;WAEA;IACR;IACA;IACA;IACA;;EAPF,YACU,eAEA;;EAAA;IACR;IACA;IACA;IACA;;;;;;qBCZU,6BAA6B;WAE/B;WACA;EAFV,YACU,cACA;;;;;qBC2BE,0BAA0B;WACjB;EAArB,YAAqB;;;;;;;;UCtBL;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;;;;EAKA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA,cAAc;;;;;;;;;;EAUd;;;;;;EAMA;;EAEA;;EAEA;;EAEA,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBChH/B,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,4BAA4B;WACnB;EAArB,YAAqB;;;qBAST,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBCnHW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}
+{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/home.ts","../../src/providers/types.ts","../../src/providers/config.ts","../../src/deploy/devServices.ts","../../src/providers/notes.ts","../../src/providers/s3/errors.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/target/dokploy/dokploy-api.ts","../../src/target/dokploy/engine.ts","../../src/target/dokploy/health.ts","../../src/target/dokploy/migrations.ts","../../src/target/dokploy/rollback.ts","../../src/target/seeds.ts","../../src/target/sst/health.ts","../../src/target/sst/outputs.ts","../../src/target/sst/index.ts","../../src/deploy/deploy.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;cCYvB;KAED,uBAAuB;;;;qBC8BtB,6BAA6B;WAE/B,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;;;;;qBCpBE;KAED,qBAAqB;;qBAcpB,oCAAoC;WAC3B;EAArB,YAAqB;;;;;;;qBAeT,qCAAqC;WAC5B;EAArB,YAAqB;;;UAiCL;EAChB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;EAEV;;EAEA;;;;;;qBAOY,sCAAsC;WAExC;WACA,kBAAkB;EAF5B,YACU,eACA,kBAAkB;;;;;qBCjHhB,8BAA8B;WAEhC,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;qBCyHE,qCAAqC;WAEvC;WACA;WACA;WACA;EAJV,YACU,YACA,gBACA,eACA;;;;;qBCjHE,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KClFS;;;;qBCWC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCrMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;qBCuBE,yBAAyB;WAE3B;WACA,YAAY;EAFtB,YACU,uBACA,YAAY;;;qBAYV,2BAA2B;WAE7B;WACA;;WAEA,YAAY;EAJtB,YACU,uBACA,mBAEA;;EAAA,YAAY;;KA2vCX;;UAOK;EAChB;EACA,QAAQ;;EAER;EACA;EACA;;;;;qBC7oCY,4BAA4B;WAE9B;EADV,YACU,aACT;;;;;;;qBAeW,6BAA6B;WAE/B;EADV,YACU,yBACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBC3OE,4BAA4B;WAE9B;WACA;WACA;;WAEA;EALV,YACU,aACA,aACA,mBAEA;;EAAA;;;;;qBCJE,+BAA+B;WAEjC;;WAEA;EAHV,YACU,eAEA;;EAAA,gBACT;;;;UCDe;;EAEhB;EACA;;EAEA;;EAEA;;EAEA,cAAc;EACd,SAAS;;EAET,OAAO;;EAEP,UAAU;;;UAIM;EAChB;EACA,MAAM;EACN,IAAI;;;qBAIQ,yBAAyB;WAE3B;;WAEA;EAHV,YACU,eAEA;;EAAA;;;qBAWE,0BAA0B;WAE5B;WACA;EAFV,YACU,eACA;;;qBAWE,2BAA2B;WAClB;EAArB,YAAqB;;;;;;wBAaA,cACrB,OAAO,gBACL,QAAQ;;;;qBChGE,0BAA0B;WAE5B;;WAEA;;WAEA;WACS;EANnB,YACU,eAEA;;EAAA,mBAEA;;EAAA,cACS;;;;;qBCKP,0BAA0B;WAE5B;;WAEA;IACR;IACA;IACA;IACA;;EAPF,YACU,eAEA;;EAAA;IACR;IACA;IACA;IACA;;;;;;qBCZU,6BAA6B;WAE/B;WACA;EAFV,YACU,cACA;;;;;qBC2BE,0BAA0B;WACjB;EAArB,YAAqB;;;;;;;;UCtBL;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;;;;EAKA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA,cAAc;;;;;;;;;;EAUd;;;;;;EAMA;;EAEA;;EAEA;;EAEA,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBChH/B,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,4BAA4B;WACnB;EAArB,YAAqB;;;qBAST,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBCnHW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}

package/dist/deploy/public.d.mts

@@ -1,10 +1,11 @@
 import { At as deployIdentity, Ct as StateVersionConflict, Dt as LocalActor, Et as GithubActor, Tt as Actor, U as AnyDeployTarget, _t as StoredCredentialsOptions, at as DeployPhase, bt as LocalStateInCi, ct as AppDeployResult, dt as Credential, ft as CredentialKind, gt as MissingCredential, ht as CredentialRequest, it as DeployEventType, jt as GkmError, kt as DeployIdentity, lt as DeployResult, mt as CredentialProvider, nt as DeployEvent, ot as ResourceChange, pt as CredentialKinds, rt as DeployEventError, st as ResourceVia, ut as AwsCredential, vt as chainCredentials, wt as ReleasedImage, xt as StateLocked, yt as storedCredentials } from "../types-HqVPddRK.mjs";
 import { a as SandboxOutput, c as confineCwd, i as SandboxExecOptions, n as Sandbox, o as SandboxResult, r as SandboxCwdEscape, s as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-C4g1eG31.mjs";
 import { i as ConfigLoadFailed, o as ConfigObjectNotSerializable } from "../config-D48erO2j.mjs";
-import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-W2kab9Lc.mjs";
+import { n as ConstructsNotSerializable, t as ConstructDiscoveryFailed } from "../discover-xtT7fgWg.mjs";
 import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-YyQuekxi.mjs";
 import { ConstructManifest, Declaration } from "@geekmidas/manifest";
 import "@geekmidas/db/pg/roles";
+import "@aws-sdk/client-s3";
 import "@geekmidas/envkit/sniffer";
 //#region src/home.d.ts
 /**

package/dist/deploy/public.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/home.ts","../../src/providers/types.ts","../../src/providers/config.ts","../../src/deploy/devServices.ts","../../src/providers/notes.ts","../../src/providers/s3/errors.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/target/dokploy/dokploy-api.ts","../../src/target/dokploy/engine.ts","../../src/target/dokploy/health.ts","../../src/target/dokploy/migrations.ts","../../src/target/dokploy/rollback.ts","../../src/target/seeds.ts","../../src/target/sst/health.ts","../../src/target/sst/outputs.ts","../../src/target/sst/index.ts","../../src/deploy/deploy.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;cCYvB;KAED,uBAAuB;;;;qBC8BtB,6BAA6B;WAE/B,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;;;;;qBCpBE;KAED,qBAAqB;;qBAcpB,oCAAoC;WAC3B;EAArB,YAAqB;;;;;;;qBAeT,qCAAqC;WAC5B;EAArB,YAAqB;;;UAiCL;EAChB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;EAEV;;EAEA;;;;;;qBAOY,sCAAsC;WAExC;WACA,kBAAkB;EAF5B,YACU,eACA,kBAAkB;;;;;qBCjHhB,8BAA8B;WAEhC,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;qBCyHE,qCAAqC;WAEvC;WACA;WACA;WACA;EAJV,YACU,YACA,gBACA,eACA;;;;;qBCjHE,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KClFS;;;;qBCWC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCrMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;qBCuBE,yBAAyB;WAE3B;WACA,YAAY;EAFtB,YACU,uBACA,YAAY;;;qBAYV,2BAA2B;WAE7B;WACA;;WAEA,YAAY;EAJtB,YACU,uBACA,mBAEA;;EAAA,YAAY;;KA2vCX;;UAOK;EAChB;EACA,QAAQ;;EAER;EACA;EACA;;;;;qBC7oCY,4BAA4B;WAE9B;EADV,YACU,aACT;;;;;;;qBAeW,6BAA6B;WAE/B;EADV,YACU,yBACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBC3OE,4BAA4B;WAE9B;WACA;WACA;;WAEA;EALV,YACU,aACA,aACA,mBAEA;;EAAA;;;;;qBCJE,+BAA+B;WAEjC;;WAEA;EAHV,YACU,eAEA;;EAAA,gBACT;;;;UCDe;;EAEhB;EACA;;EAEA;;EAEA;;EAEA,cAAc;EACd,SAAS;;EAET,OAAO;;EAEP,UAAU;;;UAIM;EAChB;EACA,MAAM;EACN,IAAI;;;qBAIQ,yBAAyB;WAE3B;;WAEA;EAHV,YACU,eAEA;;EAAA;;;qBAWE,0BAA0B;WAE5B;WACA;EAFV,YACU,eACA;;;qBAWE,2BAA2B;WAClB;EAArB,YAAqB;;;;;;wBAaA,cACrB,OAAO,gBACL,QAAQ;;;;qBChGE,0BAA0B;WAE5B;;WAEA;;WAEA;WACS;EANnB,YACU,eAEA;;EAAA,mBAEA;;EAAA,cACS;;;;;qBCKP,0BAA0B;WAE5B;;WAEA;IACR;IACA;IACA;IACA;;EAPF,YACU,eAEA;;EAAA;IACR;IACA;IACA;IACA;;;;;;qBCZU,6BAA6B;WAE/B;WACA;EAFV,YACU,cACA;;;;;qBC2BE,0BAA0B;WACjB;EAArB,YAAqB;;;;;;;;UCtBL;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;;;;EAKA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA,cAAc;;;;;;;;;;EAUd;;;;;;EAMA;;EAEA;;EAEA;;EAEA,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBChH/B,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,4BAA4B;WACnB;EAArB,YAAqB;;;qBAST,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBCnHW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}
+{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/home.ts","../../src/providers/types.ts","../../src/providers/config.ts","../../src/deploy/devServices.ts","../../src/providers/notes.ts","../../src/providers/s3/errors.ts","../../src/run.ts","../../src/sandbox/env.ts","../../src/docker/templates.ts","../../src/sandbox/install.ts","../../src/sandbox/local.ts","../../src/sandbox/worker.ts","../../src/target/dokploy/dokploy-api.ts","../../src/target/dokploy/engine.ts","../../src/target/dokploy/health.ts","../../src/target/dokploy/migrations.ts","../../src/target/dokploy/rollback.ts","../../src/target/seeds.ts","../../src/target/sst/health.ts","../../src/target/sst/outputs.ts","../../src/target/sst/index.ts","../../src/deploy/deploy.ts","../../src/deploy/orchestrate.ts","../../src/deploy/ownership.ts","../../src/deploy/registry.ts"],"mappings":";;;;;;;;;;;;;;;;;;;qBAaa;;wBAGG,QAAQ,MAAK,OAAO;;;;cCYvB;KAED,uBAAuB;;;;qBC8BtB,6BAA6B;WAE/B,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;;;;;qBCpBE;KAED,qBAAqB;;qBAcpB,oCAAoC;WAC3B;EAArB,YAAqB;;;;;;;qBAeT,qCAAqC;WAC5B;EAArB,YAAqB;;;UAiCL;EAChB;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAU;;EAEV;;EAEA;;;;;;qBAOY,sCAAsC;WAExC;WACA,kBAAkB;EAF5B,YACU,eACA,kBAAkB;;;;;qBCjHhB,8BAA8B;WAEhC,MAAM;WACN;WACA;EAHV,YACU,MAAM,cACN,eACA;;;;;qBCyHE,qCAAqC;WAEvC;WACA;WACA;WACA;EAJV,YACU,YACA,gBACA,eACA;;;;;qBCjHE,sBAAsB;WAExB;WACA;WACA;WACA,QAAQ,OAAO;EAJzB,YACU,iBACA,yBACA,yBACA,QAAQ,OAAO;;;qBAUb,wBAAwB;WAE1B;WACA;WACA;EAHV,YACU,iBACA,yBACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBC3BE,0CAA0C;;;;;wBAyDvC,eACf,SAAQ,OAAO,YACf,4BACE;;;KClFS;;;;qBCWC;UAEI;;EAEhB;;EAEA,iBAAiB;;;;;;;EAOjB;;;;;EAKA;;EAEA,MAAM,SAAS;;EAEf;;EAEA,SAAS;EACT,SAAS;;;qBAIG,oCAAoC;WAC3B;EAArB,YAAqB;;;qBAWT,2CAA2C;WAE7C;WACA;EAFV,YACU,wBACA;;;;;;;;;;;;;;;;;;;;wBAqJW,oBACrB,SAAS,SACT,UAAS,iBACP,QAAQ;;;UCrMM;;EAEhB;;;;;;;;;EASA;;;;;EAKA;;EAEA,UAAU,OAAO;;;;;;;;;;;;;;;;;qBA0BL,wBAAwB;WAC3B;WACA;WACA,KAAK,SAAS;EAEvB,YAAY,SAAS;EAUf,KACL,iBACA,yBACA,SAAS,qBACP,QAAQ;;;;;qBCpBC,4BAA4B;WAE9B;WACA;WACA;EAHV,YACU,cACA,yBACA;;;;;qBCuBE,yBAAyB;WAE3B;WACA,YAAY;EAFtB,YACU,uBACA,YAAY;;;qBAYV,2BAA2B;WAE7B;WACA;;WAEA,YAAY;EAJtB,YACU,uBACA,mBAEA;;EAAA,YAAY;;KA2vCX;;UAOK;EAChB;EACA,QAAQ;;EAER;EACA;EACA;;;;;qBC7oCY,4BAA4B;WAE9B;EADV,YACU,aACT;;;;;;;qBAeW,6BAA6B;WAE/B;EADV,YACU,yBACT;;;qBAWW,uBAAuB;WAEzB;WACA;WACA;EAHV,YACU,aACA,4BACA;;;;;qBC3OE,4BAA4B;WAE9B;WACA;WACA;;WAEA;EALV,YACU,aACA,aACA,mBAEA;;EAAA;;;;;qBCJE,+BAA+B;WAEjC;;WAEA;EAHV,YACU,eAEA;;EAAA,gBACT;;;;UCDe;;EAEhB;EACA;;EAEA;;EAEA;;EAEA,cAAc;EACd,SAAS;;EAET,OAAO;;EAEP,UAAU;;;UAIM;EAChB;EACA,MAAM;EACN,IAAI;;;qBAIQ,yBAAyB;WAE3B;;WAEA;EAHV,YACU,eAEA;;EAAA;;;qBAWE,0BAA0B;WAE5B;WACA;EAFV,YACU,eACA;;;qBAWE,2BAA2B;WAClB;EAArB,YAAqB;;;;;;wBAaA,cACrB,OAAO,gBACL,QAAQ;;;;qBChGE,0BAA0B;WAE5B;;WAEA;;WAEA;WACS;EANnB,YACU,eAEA;;EAAA,mBAEA;;EAAA,cACS;;;;;qBCKP,0BAA0B;WAE5B;;WAEA;IACR;IACA;IACA;IACA;;EAPF,YACU,eAEA;;EAAA;IACR;IACA;IACA;IACA;;;;;;qBCZU,6BAA6B;WAE/B;WACA;EAFV,YACU,cACA;;;;;qBC2BE,0BAA0B;WACjB;EAArB,YAAqB;;;;;;;;UCtBL;EAChB,KAAK;EACL,KAAK;EACL,OAAO;;UAGS;;;;;EAKhB;;;;;EAKA;;;;;EAKA;;;;;;EAMA,UAAU,eAAe;;EAEzB;;EAEA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA;;;;;;EAMA,cAAc;;;;;;;;;;EAUd;;;;;;EAMA;;EAEA;;EAEA;;EAEA,SAAS;;;;;;EAMT,SAAS;;;;;EAKT;;;;;EAKA;;;;;;;;;;;;EAYA,UAAU;;;UAIM,kBAAkB,cAAc;;;;;;WAMvC,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;wBAqEV,OAAO,OAAO,cAAc;;;;qBChH/B,0BAA0B;WAE5B;WACA;EAFV,YACU,yBACA;;;qBAWE,yBAAyB;WAE3B;WACA;EAFV,YACU,eACA;;;qBAUE,4BAA4B;WACnB;EAArB,YAAqB;;;qBAST,uBAAuB;WAEzB;;WAEA;EAHV,YACU,gBAEA;;EAAA,kBACT;;;;;;;;qBCnHW,wBAAwB;WAE1B;WACA;WACA;;WAEA;EALV,YACU,qBACA,mBACA,kBAEA;;EAAA;;;;;qBChBE,8BAA8B;WACrB;EAArB,YAAqB;;;qBAUT,yBAAyB;WAChB;EAArB,YAAqB;;;qBAUT,0BAA0B;WAE5B;WACA;EAFV,YACU,kBACA"}

package/dist/deploy/public.mjs

@@ -3,17 +3,17 @@ import { n as CommandTimedOut, o as GKM_HOME_ENV, s as gkmHome, t as CommandFail
 import { n as chainCredentials, r as storedCredentials, t as MissingCredential } from "../credentials-B5N5yKk6.mjs";
 import { V as UnknownStageProvider, et as ProvisionedBucketUnreachable } from "../workspace-D1QbNd55.mjs";
 import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported } from "../define-6poNqm5O.mjs";
-import { J as DEV_SERVICES, Jt as detectPackageManager, X as ExternalServicesNotConfigured, Y as DevServicesNeedServerTarget, k as StageProviderDisabled, q as AllowDevServicesTakesNoValue, t as DeploySeedsFailed } from "../seeds-CYzoBDg2.mjs";
+import { J as DEV_SERVICES, Jt as detectPackageManager, X as ExternalServicesNotConfigured, Y as DevServicesNeedServerTarget, k as StageProviderDisabled, q as AllowDevServicesTakesNoValue, t as DeploySeedsFailed } from "../seeds-BBnvSEgG.mjs";
 import { n as deployIdentity } from "../identity-CBXr4wNi.mjs";
-import { n as ConstructsNotSerializable, s as SandboxWorkerFailed, t as ConstructDiscoveryFailed } from "../discover-Ca8U75dl.mjs";
+import { n as ConstructsNotSerializable, s as SandboxWorkerFailed, t as ConstructDiscoveryFailed } from "../discover-C5roJuc9.mjs";
 import { n as SandboxCwdEscape, o as confineCwd, r as SecretNameInvalid, t as SECRETS_DIR_ENV } from "../sandbox-CbVB7uOD.mjs";
 import { ConfigLoadFailed, ConfigObjectNotSerializable } from "../config.mjs";
-import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-CC6ndodR.mjs";
-import { a as UnknownDeployApps, i as TargetBuildsNothing, n as NoDeployableApps, r as RollbackFailed, t as deploy } from "../deploy-_g-2dX38.mjs";
+import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-CJwadE_F.mjs";
+import { a as UnknownDeployApps, i as TargetBuildsNothing, n as NoDeployableApps, r as RollbackFailed, t as deploy } from "../deploy-CyQ36GSx.mjs";
 import { n as SANDBOX_ENV_ALLOWLIST, r as allowlistedEnv, t as LocalSandbox } from "../local-BwC2v2Y8.mjs";
-import { a as DeploymentTimedOut, f as StateLocked, g as StateVersionConflict, i as DeploymentFailed, u as LocalStateInCi } from "../sniffer-CRJHtBaK.mjs";
-import { _ as RegistryNotConfigured, g as RegistryAmbiguous, h as HealthCheckTimedOut, m as DeployMigrationsFailed, n as FrontendDeployFailed, r as MissingEnvVars, t as BackendDeployFailed, v as RegistryNotFound, y as ProjectNotOwned } from "../engine-BBnTj8OD.mjs";
-import { i as rollbackStage, n as RollbackNeedsApp, r as StageNeverDeployed, t as NothingToRollBack } from "../rollback-DaEmEC2Y.mjs";
+import { a as DeploymentTimedOut, f as StateLocked, g as StateVersionConflict, i as DeploymentFailed, u as LocalStateInCi } from "../sniffer-DDUAlVqp.mjs";
+import { _ as RegistryNotConfigured, g as RegistryAmbiguous, h as HealthCheckTimedOut, m as DeployMigrationsFailed, n as FrontendDeployFailed, r as MissingEnvVars, t as BackendDeployFailed, v as RegistryNotFound, y as ProjectNotOwned } from "../engine-tmvpAPHz.mjs";
+import { i as rollbackStage, n as RollbackNeedsApp, r as StageNeverDeployed, t as NothingToRollBack } from "../rollback-Cx89OK9S.mjs";
 import { t as ProviderRemoved } from "../provider-CEOKk8NS.mjs";
 import { i as SurfacesUnhealthy, r as SstOutputsUnreadable, t as SstConfigNotFound } from "../sst-C1pxbFEd.mjs";
 import { join, resolve } from "node:path";

package/dist/{deploy-_g-2dX38.mjs → deploy-CyQ36GSx.mjs}

@@ -2,19 +2,19 @@ import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
 import { s as gkmHome } from "./run-BJLIerMM.mjs";
 import { r as storedCredentials } from "./credentials-B5N5yKk6.mjs";
 import { $ as IamUserNotOwned, G as checkS3Config, J as BucketNameUnavailable, K as AccessKeyLimit, L as resolveStageTelemetry, N as assertDeployedStage, Q as BucketRegionUnknown, U as stageProvider, W as S3_PROVISIONING, X as BucketProbeFailed, Y as BucketOwnedByAnotherProject, Z as BucketRegionMismatch, et as ProvisionedBucketUnreachable, ht as isReservedStageKey, nt as RotationInProgress, q as BucketKeySetElsewhere, rt as S3RegionRequired, tt as RecordedBucketUnreachable, u as getAppBuildOrder } from "./workspace-D1QbNd55.mjs";
-import { S as deploysWithCompose, _ as backupExpiries, c as stageDnsDomains, d as BACKUPS_URL_KEY, n as dnsCredentials, u as BACKUPS_SERVICE, x as stageBackups, y as backupsPrefix } from "./dns-DGq4xkJT.mjs";
+import { S as deploysWithCompose, _ as backupExpiries, c as stageDnsDomains, d as BACKUPS_URL_KEY, n as dnsCredentials, u as BACKUPS_SERVICE, x as stageBackups, y as backupsPrefix } from "./dns-BHveRzd8.mjs";
 import { o as builtinTarget } from "./define-6poNqm5O.mjs";
-import { $ as devServicesUsed, $n as resolveHost, A as assertStageProvidersEnabled, Fn as usesTelemetry, It as secretsStoreFor, M as stageProviderNotes, N as PROVIDER_KINDS, Qn as isMainFrontendApp, X as ExternalServicesNotConfigured, Y as DevServicesNeedServerTarget, Zn as NoDomainForStage, _ as createComposeState, at as appEnvKeys, dt as constructGlobs, et as externalServices, rt as stageServiceDeclarations, tt as reportDevServices, u as DeployJournal, v as createEmptyState, zt as initStageSecrets } from "./seeds-CYzoBDg2.mjs";
+import { $ as devServicesUsed, A as assertStageProvidersEnabled, It as secretsStoreFor, M as stageProviderNotes, N as PROVIDER_KINDS, Rn as usesTelemetry, X as ExternalServicesNotConfigured, Y as DevServicesNeedServerTarget, _ as createComposeState, at as appEnvKeys, dt as constructGlobs, er as NoDomainForStage, et as externalServices, nr as resolveHost, rt as stageServiceDeclarations, tr as isMainFrontendApp, tt as reportDevServices, u as DeployJournal, un as mergeLifecycle, v as createEmptyState, zt as initStageSecrets } from "./seeds-BBnvSEgG.mjs";
 import { n as derivedApps, t as appKey } from "./derive-B4vDpzgP.mjs";
 import { n as deployIdentity, t as applicationName } from "./identity-CBXr4wNi.mjs";
-import { i as discover, p as withOutput } from "./discover-Ca8U75dl.mjs";
+import { i as discover, p as withOutput } from "./discover-C5roJuc9.mjs";
 import { c as withSandbox } from "./sandbox-CbVB7uOD.mjs";
 import { findWorkspaceRoot, loadWorkspaceConfig } from "./config.mjs";
-import { a as parseTargetOptions, o as resolveTarget } from "./resolve-CC6ndodR.mjs";
+import { a as parseTargetOptions, o as resolveTarget } from "./resolve-CJwadE_F.mjs";
 import { t as LocalSandbox } from "./local-BwC2v2Y8.mjs";
-import { E as eventError, S as createStateStore, v as assertStateOutlivesRun, y as assertStateRoom } from "./sniffer-CRJHtBaK.mjs";
+import { E as eventError, S as createStateStore, v as assertStateOutlivesRun, y as assertStateRoom } from "./sniffer-DDUAlVqp.mjs";
 import { a as findProjectBucket, i as ensureProjectBucket, o as projectBucketName, r as callerAccountId, s as reconcileProjectBucketLifecycle } from "./projectBucket-C_DN4WzF.mjs";
-import { n as assertStageCredentials } from "./credentialSchemas-Cf5Pf8VE.mjs";
+import { n as assertStageCredentials } from "./credentialSchemas-DDOLRCLF.mjs";
 import { resolve } from "node:path";
 import { randomInt } from "node:crypto";
 import { dependentsOf, kebabCase, provideKey, providedKeyFor } from "@geekmidas/manifest";
@@ -917,6 +917,7 @@ function bucketConstructs(manifest) {
 	return Object.entries(manifest).filter(([, d]) => d.kind === "objects").map(([id, d]) => ({
 		id,
 		versioned: d.versioned === true,
+		...d.expire ? { expire: d.expire } : {},
 		servers: Object.entries(manifest).filter(([, s]) => s.kind === "file-server" && s.of === id).map(([sid, s]) => ({
 			id: sid,
 			open: s.open ?? []
@@ -1074,7 +1075,8 @@ async function ensureBucket(ctx, stageClients, construct) {
 		bucket,
 		exists,
 		versioning,
-		open
+		open,
+		...construct.expire ? { expire: construct.expire } : {}
 	});
 	const user = await ensureIamUser(ctx, clients, {
 		id,
@@ -1223,7 +1225,10 @@ async function ensureBucketName(ctx, clients, id, good) {
 	}
 	throw new BucketNameUnavailable(id, tried.filter((n) => n !== pending));
 }
-/** Tags, Block Public Access, encryption, policy, versioning and CORS. */
+/**
+* Tags, Block Public Access, encryption, policy, versioning, lifecycle and
+* CORS.
+*/
 async function ensureBucketSettings(ctx, clients, input) {
 	const { S3, s3 } = clients;
 	const { id, bucket } = input;
@@ -1282,6 +1287,12 @@ async function ensureBucketSettings(ctx, clients, input) {
 		Bucket,
 		VersioningConfiguration: { Status: "Suspended" }
 	})));
+	const lifecycle = await read(() => s3.send(new S3.GetBucketLifecycleConfigurationCommand({ Bucket })), ["NoSuchLifecycleConfiguration"]);
+	const merge = mergeLifecycle(lifecycle?.Rules, input.expire);
+	if (merge.changed) await set(merge.describe, () => merge.rules.length > 0 ? s3.send(new S3.PutBucketLifecycleConfigurationCommand({
+		Bucket,
+		LifecycleConfiguration: { Rules: merge.rules }
+	})) : s3.send(new S3.DeleteBucketLifecycleCommand({ Bucket })));
 	const { origins, unresolved } = bucketOrigins({
 		workspace: ctx.workspace,
 		manifest: ctx.manifest,
@@ -2314,4 +2325,4 @@ async function load(input, sandbox) {
 //#endregion
 export { UnknownDeployApps as a, bucketName as c, awsEndpoint as d, awsProvisioningCredentials as f, TargetBuildsNothing as i, iamUserName as l, NoDeployableApps as n, backupsUserName as o, RollbackFailed as r, IAM_USER_PATH as s, deploy as t, awsClientConfig as u };
 
-//# sourceMappingURL=deploy-_g-2dX38.mjs.map
+//# sourceMappingURL=deploy-CyQ36GSx.mjs.map