@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/storage-B020InPW.mjs

@@ -1,222 +0,0 @@
-import { getOrCreateKey, readKey } from "./keystore-TxeYM7an.mjs";
-import { existsSync } from "node:fs";
-import { basename, join } from "node:path";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-
-//#region src/secrets/storage.ts
-/** Default secrets directory relative to project root */
-const SECRETS_DIR = ".gkm/secrets";
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
-const AUTH_TAG_LENGTH = 16;
-/**
-* Get the secrets directory path.
-*/
-function getSecretsDir(cwd = process.cwd()) {
-	return join(cwd, SECRETS_DIR);
-}
-/**
-* Get the secrets file path for a stage.
-*/
-function getSecretsPath(stage, cwd = process.cwd()) {
-	return join(getSecretsDir(cwd), `${stage}.json`);
-}
-/**
-* Check if secrets exist for a stage.
-*/
-function secretsExist(stage, cwd = process.cwd()) {
-	return existsSync(getSecretsPath(stage, cwd));
-}
-/**
-* Initialize an empty StageSecrets object for a stage.
-*/
-function initStageSecrets(stage) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	return {
-		stage,
-		createdAt: now,
-		updatedAt: now,
-		services: {},
-		urls: {},
-		custom: {}
-	};
-}
-/**
-* Encrypt secrets using a key.
-*/
-function encryptSecretsData(secrets, keyHex) {
-	const key = Buffer.from(keyHex, "hex");
-	const iv = randomBytes(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = createCipheriv(ALGORITHM, key, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	const combined = Buffer.concat([ciphertext, authTag]);
-	return {
-		version: 1,
-		encrypted: combined.toString("base64"),
-		iv: iv.toString("hex")
-	};
-}
-/**
-* Decrypt secrets using a key.
-*/
-function decryptSecretsData(data, keyHex) {
-	const key = Buffer.from(keyHex, "hex");
-	const ivBuffer = Buffer.from(data.iv, "hex");
-	const combined = Buffer.from(data.encrypted, "base64");
-	const ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);
-	const authTag = combined.subarray(-AUTH_TAG_LENGTH);
-	const decipher = createDecipheriv(ALGORITHM, key, ivBuffer);
-	decipher.setAuthTag(authTag);
-	const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-	return JSON.parse(plaintext.toString("utf-8"));
-}
-/**
-* Read secrets for a stage (encrypted).
-* Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key
-*
-* @returns StageSecrets or null if not found
-*/
-async function readStageSecrets(stage, cwd = process.cwd()) {
-	const path = getSecretsPath(stage, cwd);
-	if (!existsSync(path)) return null;
-	const content = await readFile(path, "utf-8");
-	const data = JSON.parse(content);
-	if (data.version === 1 && data.encrypted && data.iv) {
-		const projectName = basename(cwd);
-		const key = await readKey(stage, projectName);
-		if (!key) throw new Error(`Decryption key not found for stage "${stage}". Expected key at: ~/.gkm/${projectName}/${stage}.key`);
-		return decryptSecretsData(data, key);
-	}
-	return data;
-}
-/**
-* Write secrets for a stage (encrypted).
-* Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key
-*/
-async function writeStageSecrets(secrets, cwd = process.cwd()) {
-	const dir = getSecretsDir(cwd);
-	const path = getSecretsPath(secrets.stage, cwd);
-	const projectName = basename(cwd);
-	await mkdir(dir, { recursive: true });
-	const key = await getOrCreateKey(secrets.stage, projectName);
-	const encrypted = encryptSecretsData(secrets, key);
-	await writeFile(path, JSON.stringify(encrypted, null, 2), "utf-8");
-}
-/**
-* Convert StageSecrets to embeddable format (flat key-value pairs).
-* This is what gets encrypted and embedded in the bundle.
-*/
-function toEmbeddableSecrets(secrets) {
-	return {
-		...secrets.urls,
-		...secrets.custom,
-		...secrets.services.postgres && {
-			POSTGRES_USER: secrets.services.postgres.username,
-			POSTGRES_PASSWORD: secrets.services.postgres.password,
-			POSTGRES_DB: secrets.services.postgres.database ?? "app",
-			POSTGRES_HOST: secrets.services.postgres.host,
-			POSTGRES_PORT: String(secrets.services.postgres.port)
-		},
-		...secrets.services.redis && {
-			REDIS_PASSWORD: secrets.services.redis.password,
-			REDIS_HOST: secrets.services.redis.host,
-			REDIS_PORT: String(secrets.services.redis.port)
-		},
-		...secrets.services.rabbitmq && {
-			RABBITMQ_USER: secrets.services.rabbitmq.username,
-			RABBITMQ_PASSWORD: secrets.services.rabbitmq.password,
-			RABBITMQ_HOST: secrets.services.rabbitmq.host,
-			RABBITMQ_PORT: String(secrets.services.rabbitmq.port),
-			RABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? "/"
-		},
-		...secrets.services.minio && {
-			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
-			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
-			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
-			STORAGE_REGION: "eu-west-1",
-			STORAGE_FORCE_PATH_STYLE: "true"
-		},
-		...secrets.services.mailpit && {
-			SMTP_HOST: secrets.services.mailpit.host,
-			SMTP_PORT: String(secrets.services.mailpit.port),
-			SMTP_USER: secrets.services.mailpit.username,
-			SMTP_PASS: secrets.services.mailpit.password,
-			SMTP_SECURE: "false",
-			MAIL_FROM: "noreply@localhost"
-		},
-		...secrets.services.localstack && {
-			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
-			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
-			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
-			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
-		},
-		...secrets.services.pgboss && {
-			PGBOSS_DB_USER: secrets.services.pgboss.username,
-			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
-		}
-	};
-}
-/**
-* Update a custom secret in the secrets file.
-*/
-async function setCustomSecret(stage, key, value, cwd = process.cwd()) {
-	const secrets = await readStageSecrets(stage, cwd);
-	if (!secrets) throw new Error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
-	const updated = {
-		...secrets,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		custom: {
-			...secrets.custom,
-			[key]: value
-		}
-	};
-	await writeStageSecrets(updated, cwd);
-	return updated;
-}
-/**
-* Mask a password for display (show first 4 and last 2 chars).
-*/
-function maskPassword(password) {
-	if (password.length <= 8) return "********";
-	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
-}
-/**
-* Validate that all required environment variables are present in secrets.
-*
-* @param requiredVars - Array of environment variable names required by the application
-* @param secrets - Stage secrets to validate against
-* @returns Validation result with missing and provided variables
-*
-* @example
-* ```typescript
-* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
-* const secrets = await readStageSecrets('production');
-* const result = validateEnvironmentVariables(required, secrets);
-*
-* if (!result.valid) {
-*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
-* }
-* ```
-*/
-function validateEnvironmentVariables(requiredVars, secrets) {
-	const embeddable = toEmbeddableSecrets(secrets);
-	const availableVars = new Set(Object.keys(embeddable));
-	const missing = [];
-	const provided = [];
-	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
-	else missing.push(varName);
-	return {
-		valid: missing.length === 0,
-		missing: missing.sort(),
-		provided: provided.sort(),
-		required: [...requiredVars].sort()
-	};
-}
-
-//#endregion
-export { getSecretsDir, getSecretsPath, initStageSecrets, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, validateEnvironmentVariables, writeStageSecrets };
-//# sourceMappingURL=storage-B020InPW.mjs.map

package/dist/storage-B020InPW.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage-B020InPW.mjs","names":["stage: string","secrets: StageSecrets","keyHex: string","data: EncryptedSecretsFile","key: string","value: string","updated: StageSecrets","password: string","requiredVars: string[]","missing: string[]","provided: string[]"],"sources":["../src/secrets/storage.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { basename, join } from 'node:path';\nimport { getOrCreateKey, readKey } from './keystore';\nimport type { EmbeddableSecrets, StageSecrets } from './types';\n\n/** Default secrets directory relative to project root */\nconst SECRETS_DIR = '.gkm/secrets';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/** Encrypted secrets file structure */\ninterface EncryptedSecretsFile {\n\t/** Version for future format changes */\n\tversion: 1;\n\t/** Base64 encoded encrypted data (ciphertext + auth tag) */\n\tencrypted: string;\n\t/** Hex encoded IV */\n\tiv: string;\n}\n\n/**\n * Get the secrets directory path.\n */\nexport function getSecretsDir(cwd = process.cwd()): string {\n\treturn join(cwd, SECRETS_DIR);\n}\n\n/**\n * Get the secrets file path for a stage.\n */\nexport function getSecretsPath(stage: string, cwd = process.cwd()): string {\n\treturn join(getSecretsDir(cwd), `${stage}.json`);\n}\n\n/**\n * Check if secrets exist for a stage.\n */\nexport function secretsExist(stage: string, cwd = process.cwd()): boolean {\n\treturn existsSync(getSecretsPath(stage, cwd));\n}\n\n/**\n * Initialize an empty StageSecrets object for a stage.\n */\nexport function initStageSecrets(stage: string): StageSecrets {\n\tconst now = new Date().toISOString();\n\treturn {\n\t\tstage,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tservices: {},\n\t\turls: {},\n\t\tcustom: {},\n\t};\n}\n\n/**\n * Encrypt secrets using a key.\n */\nfunction encryptSecretsData(\n\tsecrets: StageSecrets,\n\tkeyHex: string,\n): EncryptedSecretsFile {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tversion: 1,\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets using a key.\n */\nfunction decryptSecretsData(\n\tdata: EncryptedSecretsFile,\n\tkeyHex: string,\n): StageSecrets {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst ivBuffer = Buffer.from(data.iv, 'hex');\n\tconst combined = Buffer.from(data.encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as StageSecrets;\n}\n\n/**\n * Read secrets for a stage (encrypted).\n * Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key\n *\n * @returns StageSecrets or null if not found\n */\nexport async function readStageSecrets(\n\tstage: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets | null> {\n\tconst path = getSecretsPath(stage, cwd);\n\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\tconst content = await readFile(path, 'utf-8');\n\tconst data = JSON.parse(content);\n\n\t// Check if this is an encrypted file (has version field)\n\tif (data.version === 1 && data.encrypted && data.iv) {\n\t\tconst projectName = basename(cwd);\n\t\tconst key = await readKey(stage, projectName);\n\n\t\tif (!key) {\n\t\t\tthrow new Error(\n\t\t\t\t`Decryption key not found for stage \"${stage}\". ` +\n\t\t\t\t\t`Expected key at: ~/.gkm/${projectName}/${stage}.key`,\n\t\t\t);\n\t\t}\n\n\t\treturn decryptSecretsData(data as EncryptedSecretsFile, key);\n\t}\n\n\t// Legacy: unencrypted format (for backwards compatibility)\n\treturn data as StageSecrets;\n}\n\n/**\n * Write secrets for a stage (encrypted).\n * Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key\n */\nexport async function writeStageSecrets(\n\tsecrets: StageSecrets,\n\tcwd = process.cwd(),\n): Promise<void> {\n\tconst dir = getSecretsDir(cwd);\n\tconst path = getSecretsPath(secrets.stage, cwd);\n\tconst projectName = basename(cwd);\n\n\t// Ensure directory exists\n\tawait mkdir(dir, { recursive: true });\n\n\t// Get or create encryption key\n\tconst key = await getOrCreateKey(secrets.stage, projectName);\n\n\t// Encrypt and write\n\tconst encrypted = encryptSecretsData(secrets, key);\n\tawait writeFile(path, JSON.stringify(encrypted, null, 2), 'utf-8');\n}\n\n/**\n * Convert StageSecrets to embeddable format (flat key-value pairs).\n * This is what gets encrypted and embedded in the bundle.\n */\nexport function toEmbeddableSecrets(secrets: StageSecrets): EmbeddableSecrets {\n\treturn {\n\t\t...secrets.urls,\n\t\t...secrets.custom,\n\t\t// Also include individual service credentials if needed\n\t\t...(secrets.services.postgres && {\n\t\t\tPOSTGRES_USER: secrets.services.postgres.username,\n\t\t\tPOSTGRES_PASSWORD: secrets.services.postgres.password,\n\t\t\tPOSTGRES_DB: secrets.services.postgres.database ?? 'app',\n\t\t\tPOSTGRES_HOST: secrets.services.postgres.host,\n\t\t\tPOSTGRES_PORT: String(secrets.services.postgres.port),\n\t\t}),\n\t\t...(secrets.services.redis && {\n\t\t\tREDIS_PASSWORD: secrets.services.redis.password,\n\t\t\tREDIS_HOST: secrets.services.redis.host,\n\t\t\tREDIS_PORT: String(secrets.services.redis.port),\n\t\t}),\n\t\t...(secrets.services.rabbitmq && {\n\t\t\tRABBITMQ_USER: secrets.services.rabbitmq.username,\n\t\t\tRABBITMQ_PASSWORD: secrets.services.rabbitmq.password,\n\t\t\tRABBITMQ_HOST: secrets.services.rabbitmq.host,\n\t\t\tRABBITMQ_PORT: String(secrets.services.rabbitmq.port),\n\t\t\tRABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? '/',\n\t\t}),\n\t\t...(secrets.services.minio && {\n\t\t\tSTORAGE_ACCESS_KEY_ID: secrets.services.minio.username,\n\t\t\tSTORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,\n\t\t\tSTORAGE_BUCKET: secrets.services.minio.bucket ?? 'app',\n\t\t\tSTORAGE_REGION: 'eu-west-1',\n\t\t\tSTORAGE_FORCE_PATH_STYLE: 'true',\n\t\t}),\n\t\t...(secrets.services.mailpit && {\n\t\t\tSMTP_HOST: secrets.services.mailpit.host,\n\t\t\tSMTP_PORT: String(secrets.services.mailpit.port),\n\t\t\tSMTP_USER: secrets.services.mailpit.username,\n\t\t\tSMTP_PASS: secrets.services.mailpit.password,\n\t\t\tSMTP_SECURE: 'false',\n\t\t\tMAIL_FROM: 'noreply@localhost',\n\t\t}),\n\t\t...(secrets.services.localstack && {\n\t\t\tAWS_ACCESS_KEY_ID:\n\t\t\t\tsecrets.services.localstack.accessKeyId ??\n\t\t\t\tsecrets.services.localstack.username,\n\t\t\tAWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,\n\t\t\tAWS_REGION: secrets.services.localstack.region ?? 'us-east-1',\n\t\t\tAWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`,\n\t\t}),\n\t\t...(secrets.services.pgboss && {\n\t\t\tPGBOSS_DB_USER: secrets.services.pgboss.username,\n\t\t\tPGBOSS_DB_PASSWORD: secrets.services.pgboss.password,\n\t\t}),\n\t};\n}\n\n/**\n * Update a custom secret in the secrets file.\n */\nexport async function setCustomSecret(\n\tstage: string,\n\tkey: string,\n\tvalue: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets> {\n\tconst secrets = await readStageSecrets(stage, cwd);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`Secrets not found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tconst updated: StageSecrets = {\n\t\t...secrets,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tcustom: {\n\t\t\t...secrets.custom,\n\t\t\t[key]: value,\n\t\t},\n\t};\n\n\tawait writeStageSecrets(updated, cwd);\n\treturn updated;\n}\n\n/**\n * Mask a password for display (show first 4 and last 2 chars).\n */\nexport function maskPassword(password: string): string {\n\tif (password.length <= 8) {\n\t\treturn '********';\n\t}\n\treturn `${password.slice(0, 4)}${'*'.repeat(password.length - 6)}${password.slice(-2)}`;\n}\n\n/**\n * Result of environment variable validation.\n */\nexport interface EnvValidationResult {\n\t/** Whether all required environment variables are present */\n\tvalid: boolean;\n\t/** List of missing environment variable names */\n\tmissing: string[];\n\t/** List of environment variables that are provided */\n\tprovided: string[];\n\t/** List of environment variables that were required */\n\trequired: string[];\n}\n\n/**\n * Validate that all required environment variables are present in secrets.\n *\n * @param requiredVars - Array of environment variable names required by the application\n * @param secrets - Stage secrets to validate against\n * @returns Validation result with missing and provided variables\n *\n * @example\n * ```typescript\n * const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];\n * const secrets = await readStageSecrets('production');\n * const result = validateEnvironmentVariables(required, secrets);\n *\n * if (!result.valid) {\n *   console.error(`Missing environment variables: ${result.missing.join(', ')}`);\n * }\n * ```\n */\nexport function validateEnvironmentVariables(\n\trequiredVars: string[],\n\tsecrets: StageSecrets,\n): EnvValidationResult {\n\tconst embeddable = toEmbeddableSecrets(secrets);\n\tconst availableVars = new Set(Object.keys(embeddable));\n\n\tconst missing: string[] = [];\n\tconst provided: string[] = [];\n\n\tfor (const varName of requiredVars) {\n\t\tif (availableVars.has(varName)) {\n\t\t\tprovided.push(varName);\n\t\t} else {\n\t\t\tmissing.push(varName);\n\t\t}\n\t}\n\n\treturn {\n\t\tvalid: missing.length === 0,\n\t\tmissing: missing.sort(),\n\t\tprovided: provided.sort(),\n\t\trequired: [...requiredVars].sort(),\n\t};\n}\n"],"mappings":";;;;;;;;AAQA,MAAM,cAAc;;AAGpB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,kBAAkB;;;;AAexB,SAAgB,cAAc,MAAM,QAAQ,KAAK,EAAU;AAC1D,QAAO,KAAK,KAAK,YAAY;AAC7B;;;;AAKD,SAAgB,eAAeA,OAAe,MAAM,QAAQ,KAAK,EAAU;AAC1E,QAAO,KAAK,cAAc,IAAI,GAAG,EAAE,MAAM,OAAO;AAChD;;;;AAKD,SAAgB,aAAaA,OAAe,MAAM,QAAQ,KAAK,EAAW;AACzE,QAAO,WAAW,eAAe,OAAO,IAAI,CAAC;AAC7C;;;;AAKD,SAAgB,iBAAiBA,OAA6B;CAC7D,MAAM,MAAM,qBAAI,QAAO,aAAa;AACpC,QAAO;EACN;EACA,WAAW;EACX,WAAW;EACX,UAAU,CAAE;EACZ,MAAM,CAAE;EACR,QAAQ,CAAE;CACV;AACD;;;;AAKD,SAAS,mBACRC,SACAC,QACuB;CACvB,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,KAAK,YAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,eAAe,WAAW,KAAK,GAAG;CACjD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,SAAS;EACT,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;CACtB;AACD;;;;AAKD,SAAS,mBACRC,MACAD,QACe;CACf,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,WAAW,OAAO,KAAK,KAAK,IAAI,MAAM;CAC5C,MAAM,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS;CAGtD,MAAM,aAAa,SAAS,SAAS,IAAI,gBAAgB;CACzD,MAAM,UAAU,SAAS,UAAU,gBAAgB;CAGnD,MAAM,WAAW,iBAAiB,WAAW,KAAK,SAAS;AAC3D,UAAS,WAAW,QAAQ;CAE5B,MAAM,YAAY,OAAO,OAAO,CAC/B,SAAS,OAAO,WAAW,EAC3B,SAAS,OAAO,AAChB,EAAC;AAEF,QAAO,KAAK,MAAM,UAAU,SAAS,QAAQ,CAAC;AAC9C;;;;;;;AAQD,eAAsB,iBACrBF,OACA,MAAM,QAAQ,KAAK,EACY;CAC/B,MAAM,OAAO,eAAe,OAAO,IAAI;AAEvC,MAAK,WAAW,KAAK,CACpB,QAAO;CAGR,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;CAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAGhC,KAAI,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,IAAI;EACpD,MAAM,cAAc,SAAS,IAAI;EACjC,MAAM,MAAM,MAAM,QAAQ,OAAO,YAAY;AAE7C,OAAK,IACJ,OAAM,IAAI,OACR,sCAAsC,MAAM,6BACjB,YAAY,GAAG,MAAM;AAInD,SAAO,mBAAmB,MAA8B,IAAI;CAC5D;AAGD,QAAO;AACP;;;;;AAMD,eAAsB,kBACrBC,SACA,MAAM,QAAQ,KAAK,EACH;CAChB,MAAM,MAAM,cAAc,IAAI;CAC9B,MAAM,OAAO,eAAe,QAAQ,OAAO,IAAI;CAC/C,MAAM,cAAc,SAAS,IAAI;AAGjC,OAAM,MAAM,KAAK,EAAE,WAAW,KAAM,EAAC;CAGrC,MAAM,MAAM,MAAM,eAAe,QAAQ,OAAO,YAAY;CAG5D,MAAM,YAAY,mBAAmB,SAAS,IAAI;AAClD,OAAM,UAAU,MAAM,KAAK,UAAU,WAAW,MAAM,EAAE,EAAE,QAAQ;AAClE;;;;;AAMD,SAAgB,oBAAoBA,SAA0C;AAC7E,QAAO;EACN,GAAG,QAAQ;EACX,GAAG,QAAQ;EAEX,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,aAAa,QAAQ,SAAS,SAAS,YAAY;GACnD,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;EACrD;EACD,GAAI,QAAQ,SAAS,SAAS;GAC7B,gBAAgB,QAAQ,SAAS,MAAM;GACvC,YAAY,QAAQ,SAAS,MAAM;GACnC,YAAY,OAAO,QAAQ,SAAS,MAAM,KAAK;EAC/C;EACD,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;GACrD,gBAAgB,QAAQ,SAAS,SAAS,SAAS;EACnD;EACD,GAAI,QAAQ,SAAS,SAAS;GAC7B,uBAAuB,QAAQ,SAAS,MAAM;GAC9C,2BAA2B,QAAQ,SAAS,MAAM;GAClD,gBAAgB,QAAQ,SAAS,MAAM,UAAU;GACjD,gBAAgB;GAChB,0BAA0B;EAC1B;EACD,GAAI,QAAQ,SAAS,WAAW;GAC/B,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,OAAO,QAAQ,SAAS,QAAQ,KAAK;GAChD,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,QAAQ,SAAS,QAAQ;GACpC,aAAa;GACb,WAAW;EACX;EACD,GAAI,QAAQ,SAAS,cAAc;GAClC,mBACC,QAAQ,SAAS,WAAW,eAC5B,QAAQ,SAAS,WAAW;GAC7B,uBAAuB,QAAQ,SAAS,WAAW;GACnD,YAAY,QAAQ,SAAS,WAAW,UAAU;GAClD,mBAAmB,SAAS,QAAQ,SAAS,WAAW,KAAK,GAAG,QAAQ,SAAS,WAAW,KAAK;EACjG;EACD,GAAI,QAAQ,SAAS,UAAU;GAC9B,gBAAgB,QAAQ,SAAS,OAAO;GACxC,oBAAoB,QAAQ,SAAS,OAAO;EAC5C;CACD;AACD;;;;AAKD,eAAsB,gBACrBD,OACAI,KACAC,OACA,MAAM,QAAQ,KAAK,EACK;CACxB,MAAM,UAAU,MAAM,iBAAiB,OAAO,IAAI;AAElD,MAAK,QACJ,OAAM,IAAI,OACR,+BAA+B,MAAM,mCAAmC,MAAM;CAIjF,MAAMC,UAAwB;EAC7B,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;EACnC,QAAQ;GACP,GAAG,QAAQ;IACV,MAAM;EACP;CACD;AAED,OAAM,kBAAkB,SAAS,IAAI;AACrC,QAAO;AACP;;;;AAKD,SAAgB,aAAaC,UAA0B;AACtD,KAAI,SAAS,UAAU,EACtB,QAAO;AAER,SAAQ,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,EAAE,IAAI,OAAO,SAAS,SAAS,EAAE,CAAC,EAAE,SAAS,MAAM,GAAG,CAAC;AACtF;;;;;;;;;;;;;;;;;;;AAkCD,SAAgB,6BACfC,cACAP,SACsB;CACtB,MAAM,aAAa,oBAAoB,QAAQ;CAC/C,MAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,WAAW;CAErD,MAAMQ,UAAoB,CAAE;CAC5B,MAAMC,WAAqB,CAAE;AAE7B,MAAK,MAAM,WAAW,aACrB,KAAI,cAAc,IAAI,QAAQ,CAC7B,UAAS,KAAK,QAAQ;KAEtB,SAAQ,KAAK,QAAQ;AAIvB,QAAO;EACN,OAAO,QAAQ,WAAW;EAC1B,SAAS,QAAQ,MAAM;EACvB,UAAU,SAAS,MAAM;EACzB,UAAU,CAAC,GAAG,YAAa,EAAC,MAAM;CAClC;AACD"}

package/dist/storage-CSNplaJn.cjs

@@ -1,282 +0,0 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const require_keystore = require('./keystore-C9rint2E.cjs');
-const node_fs = require_chunk.__toESM(require("node:fs"));
-const node_path = require_chunk.__toESM(require("node:path"));
-const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
-const node_crypto = require_chunk.__toESM(require("node:crypto"));
-
-//#region src/secrets/storage.ts
-/** Default secrets directory relative to project root */
-const SECRETS_DIR = ".gkm/secrets";
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
-const AUTH_TAG_LENGTH = 16;
-/**
-* Get the secrets directory path.
-*/
-function getSecretsDir(cwd = process.cwd()) {
-	return (0, node_path.join)(cwd, SECRETS_DIR);
-}
-/**
-* Get the secrets file path for a stage.
-*/
-function getSecretsPath(stage, cwd = process.cwd()) {
-	return (0, node_path.join)(getSecretsDir(cwd), `${stage}.json`);
-}
-/**
-* Check if secrets exist for a stage.
-*/
-function secretsExist(stage, cwd = process.cwd()) {
-	return (0, node_fs.existsSync)(getSecretsPath(stage, cwd));
-}
-/**
-* Initialize an empty StageSecrets object for a stage.
-*/
-function initStageSecrets(stage) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	return {
-		stage,
-		createdAt: now,
-		updatedAt: now,
-		services: {},
-		urls: {},
-		custom: {}
-	};
-}
-/**
-* Encrypt secrets using a key.
-*/
-function encryptSecretsData(secrets, keyHex) {
-	const key = Buffer.from(keyHex, "hex");
-	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, key, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	const combined = Buffer.concat([ciphertext, authTag]);
-	return {
-		version: 1,
-		encrypted: combined.toString("base64"),
-		iv: iv.toString("hex")
-	};
-}
-/**
-* Decrypt secrets using a key.
-*/
-function decryptSecretsData(data, keyHex) {
-	const key = Buffer.from(keyHex, "hex");
-	const ivBuffer = Buffer.from(data.iv, "hex");
-	const combined = Buffer.from(data.encrypted, "base64");
-	const ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);
-	const authTag = combined.subarray(-AUTH_TAG_LENGTH);
-	const decipher = (0, node_crypto.createDecipheriv)(ALGORITHM, key, ivBuffer);
-	decipher.setAuthTag(authTag);
-	const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-	return JSON.parse(plaintext.toString("utf-8"));
-}
-/**
-* Read secrets for a stage (encrypted).
-* Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key
-*
-* @returns StageSecrets or null if not found
-*/
-async function readStageSecrets(stage, cwd = process.cwd()) {
-	const path = getSecretsPath(stage, cwd);
-	if (!(0, node_fs.existsSync)(path)) return null;
-	const content = await (0, node_fs_promises.readFile)(path, "utf-8");
-	const data = JSON.parse(content);
-	if (data.version === 1 && data.encrypted && data.iv) {
-		const projectName = (0, node_path.basename)(cwd);
-		const key = await require_keystore.readKey(stage, projectName);
-		if (!key) throw new Error(`Decryption key not found for stage "${stage}". Expected key at: ~/.gkm/${projectName}/${stage}.key`);
-		return decryptSecretsData(data, key);
-	}
-	return data;
-}
-/**
-* Write secrets for a stage (encrypted).
-* Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key
-*/
-async function writeStageSecrets(secrets, cwd = process.cwd()) {
-	const dir = getSecretsDir(cwd);
-	const path = getSecretsPath(secrets.stage, cwd);
-	const projectName = (0, node_path.basename)(cwd);
-	await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-	const key = await require_keystore.getOrCreateKey(secrets.stage, projectName);
-	const encrypted = encryptSecretsData(secrets, key);
-	await (0, node_fs_promises.writeFile)(path, JSON.stringify(encrypted, null, 2), "utf-8");
-}
-/**
-* Convert StageSecrets to embeddable format (flat key-value pairs).
-* This is what gets encrypted and embedded in the bundle.
-*/
-function toEmbeddableSecrets(secrets) {
-	return {
-		...secrets.urls,
-		...secrets.custom,
-		...secrets.services.postgres && {
-			POSTGRES_USER: secrets.services.postgres.username,
-			POSTGRES_PASSWORD: secrets.services.postgres.password,
-			POSTGRES_DB: secrets.services.postgres.database ?? "app",
-			POSTGRES_HOST: secrets.services.postgres.host,
-			POSTGRES_PORT: String(secrets.services.postgres.port)
-		},
-		...secrets.services.redis && {
-			REDIS_PASSWORD: secrets.services.redis.password,
-			REDIS_HOST: secrets.services.redis.host,
-			REDIS_PORT: String(secrets.services.redis.port)
-		},
-		...secrets.services.rabbitmq && {
-			RABBITMQ_USER: secrets.services.rabbitmq.username,
-			RABBITMQ_PASSWORD: secrets.services.rabbitmq.password,
-			RABBITMQ_HOST: secrets.services.rabbitmq.host,
-			RABBITMQ_PORT: String(secrets.services.rabbitmq.port),
-			RABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? "/"
-		},
-		...secrets.services.minio && {
-			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
-			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
-			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
-			STORAGE_REGION: "eu-west-1",
-			STORAGE_FORCE_PATH_STYLE: "true"
-		},
-		...secrets.services.mailpit && {
-			SMTP_HOST: secrets.services.mailpit.host,
-			SMTP_PORT: String(secrets.services.mailpit.port),
-			SMTP_USER: secrets.services.mailpit.username,
-			SMTP_PASS: secrets.services.mailpit.password,
-			SMTP_SECURE: "false",
-			MAIL_FROM: "noreply@localhost"
-		},
-		...secrets.services.localstack && {
-			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
-			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
-			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
-			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
-		},
-		...secrets.services.pgboss && {
-			PGBOSS_DB_USER: secrets.services.pgboss.username,
-			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
-		}
-	};
-}
-/**
-* Update a custom secret in the secrets file.
-*/
-async function setCustomSecret(stage, key, value, cwd = process.cwd()) {
-	const secrets = await readStageSecrets(stage, cwd);
-	if (!secrets) throw new Error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
-	const updated = {
-		...secrets,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		custom: {
-			...secrets.custom,
-			[key]: value
-		}
-	};
-	await writeStageSecrets(updated, cwd);
-	return updated;
-}
-/**
-* Mask a password for display (show first 4 and last 2 chars).
-*/
-function maskPassword(password) {
-	if (password.length <= 8) return "********";
-	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
-}
-/**
-* Validate that all required environment variables are present in secrets.
-*
-* @param requiredVars - Array of environment variable names required by the application
-* @param secrets - Stage secrets to validate against
-* @returns Validation result with missing and provided variables
-*
-* @example
-* ```typescript
-* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
-* const secrets = await readStageSecrets('production');
-* const result = validateEnvironmentVariables(required, secrets);
-*
-* if (!result.valid) {
-*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
-* }
-* ```
-*/
-function validateEnvironmentVariables(requiredVars, secrets) {
-	const embeddable = toEmbeddableSecrets(secrets);
-	const availableVars = new Set(Object.keys(embeddable));
-	const missing = [];
-	const provided = [];
-	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
-	else missing.push(varName);
-	return {
-		valid: missing.length === 0,
-		missing: missing.sort(),
-		provided: provided.sort(),
-		required: [...requiredVars].sort()
-	};
-}
-
-//#endregion
-Object.defineProperty(exports, 'getSecretsDir', {
-  enumerable: true,
-  get: function () {
-    return getSecretsDir;
-  }
-});
-Object.defineProperty(exports, 'getSecretsPath', {
-  enumerable: true,
-  get: function () {
-    return getSecretsPath;
-  }
-});
-Object.defineProperty(exports, 'initStageSecrets', {
-  enumerable: true,
-  get: function () {
-    return initStageSecrets;
-  }
-});
-Object.defineProperty(exports, 'maskPassword', {
-  enumerable: true,
-  get: function () {
-    return maskPassword;
-  }
-});
-Object.defineProperty(exports, 'readStageSecrets', {
-  enumerable: true,
-  get: function () {
-    return readStageSecrets;
-  }
-});
-Object.defineProperty(exports, 'secretsExist', {
-  enumerable: true,
-  get: function () {
-    return secretsExist;
-  }
-});
-Object.defineProperty(exports, 'setCustomSecret', {
-  enumerable: true,
-  get: function () {
-    return setCustomSecret;
-  }
-});
-Object.defineProperty(exports, 'toEmbeddableSecrets', {
-  enumerable: true,
-  get: function () {
-    return toEmbeddableSecrets;
-  }
-});
-Object.defineProperty(exports, 'validateEnvironmentVariables', {
-  enumerable: true,
-  get: function () {
-    return validateEnvironmentVariables;
-  }
-});
-Object.defineProperty(exports, 'writeStageSecrets', {
-  enumerable: true,
-  get: function () {
-    return writeStageSecrets;
-  }
-});
-//# sourceMappingURL=storage-CSNplaJn.cjs.map

package/dist/storage-CSNplaJn.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"storage-CSNplaJn.cjs","names":["stage: string","secrets: StageSecrets","keyHex: string","data: EncryptedSecretsFile","key: string","value: string","updated: StageSecrets","password: string","requiredVars: string[]","missing: string[]","provided: string[]"],"sources":["../src/secrets/storage.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { basename, join } from 'node:path';\nimport { getOrCreateKey, readKey } from './keystore';\nimport type { EmbeddableSecrets, StageSecrets } from './types';\n\n/** Default secrets directory relative to project root */\nconst SECRETS_DIR = '.gkm/secrets';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/** Encrypted secrets file structure */\ninterface EncryptedSecretsFile {\n\t/** Version for future format changes */\n\tversion: 1;\n\t/** Base64 encoded encrypted data (ciphertext + auth tag) */\n\tencrypted: string;\n\t/** Hex encoded IV */\n\tiv: string;\n}\n\n/**\n * Get the secrets directory path.\n */\nexport function getSecretsDir(cwd = process.cwd()): string {\n\treturn join(cwd, SECRETS_DIR);\n}\n\n/**\n * Get the secrets file path for a stage.\n */\nexport function getSecretsPath(stage: string, cwd = process.cwd()): string {\n\treturn join(getSecretsDir(cwd), `${stage}.json`);\n}\n\n/**\n * Check if secrets exist for a stage.\n */\nexport function secretsExist(stage: string, cwd = process.cwd()): boolean {\n\treturn existsSync(getSecretsPath(stage, cwd));\n}\n\n/**\n * Initialize an empty StageSecrets object for a stage.\n */\nexport function initStageSecrets(stage: string): StageSecrets {\n\tconst now = new Date().toISOString();\n\treturn {\n\t\tstage,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tservices: {},\n\t\turls: {},\n\t\tcustom: {},\n\t};\n}\n\n/**\n * Encrypt secrets using a key.\n */\nfunction encryptSecretsData(\n\tsecrets: StageSecrets,\n\tkeyHex: string,\n): EncryptedSecretsFile {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tversion: 1,\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets using a key.\n */\nfunction decryptSecretsData(\n\tdata: EncryptedSecretsFile,\n\tkeyHex: string,\n): StageSecrets {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst ivBuffer = Buffer.from(data.iv, 'hex');\n\tconst combined = Buffer.from(data.encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as StageSecrets;\n}\n\n/**\n * Read secrets for a stage (encrypted).\n * Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key\n *\n * @returns StageSecrets or null if not found\n */\nexport async function readStageSecrets(\n\tstage: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets | null> {\n\tconst path = getSecretsPath(stage, cwd);\n\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\tconst content = await readFile(path, 'utf-8');\n\tconst data = JSON.parse(content);\n\n\t// Check if this is an encrypted file (has version field)\n\tif (data.version === 1 && data.encrypted && data.iv) {\n\t\tconst projectName = basename(cwd);\n\t\tconst key = await readKey(stage, projectName);\n\n\t\tif (!key) {\n\t\t\tthrow new Error(\n\t\t\t\t`Decryption key not found for stage \"${stage}\". ` +\n\t\t\t\t\t`Expected key at: ~/.gkm/${projectName}/${stage}.key`,\n\t\t\t);\n\t\t}\n\n\t\treturn decryptSecretsData(data as EncryptedSecretsFile, key);\n\t}\n\n\t// Legacy: unencrypted format (for backwards compatibility)\n\treturn data as StageSecrets;\n}\n\n/**\n * Write secrets for a stage (encrypted).\n * Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key\n */\nexport async function writeStageSecrets(\n\tsecrets: StageSecrets,\n\tcwd = process.cwd(),\n): Promise<void> {\n\tconst dir = getSecretsDir(cwd);\n\tconst path = getSecretsPath(secrets.stage, cwd);\n\tconst projectName = basename(cwd);\n\n\t// Ensure directory exists\n\tawait mkdir(dir, { recursive: true });\n\n\t// Get or create encryption key\n\tconst key = await getOrCreateKey(secrets.stage, projectName);\n\n\t// Encrypt and write\n\tconst encrypted = encryptSecretsData(secrets, key);\n\tawait writeFile(path, JSON.stringify(encrypted, null, 2), 'utf-8');\n}\n\n/**\n * Convert StageSecrets to embeddable format (flat key-value pairs).\n * This is what gets encrypted and embedded in the bundle.\n */\nexport function toEmbeddableSecrets(secrets: StageSecrets): EmbeddableSecrets {\n\treturn {\n\t\t...secrets.urls,\n\t\t...secrets.custom,\n\t\t// Also include individual service credentials if needed\n\t\t...(secrets.services.postgres && {\n\t\t\tPOSTGRES_USER: secrets.services.postgres.username,\n\t\t\tPOSTGRES_PASSWORD: secrets.services.postgres.password,\n\t\t\tPOSTGRES_DB: secrets.services.postgres.database ?? 'app',\n\t\t\tPOSTGRES_HOST: secrets.services.postgres.host,\n\t\t\tPOSTGRES_PORT: String(secrets.services.postgres.port),\n\t\t}),\n\t\t...(secrets.services.redis && {\n\t\t\tREDIS_PASSWORD: secrets.services.redis.password,\n\t\t\tREDIS_HOST: secrets.services.redis.host,\n\t\t\tREDIS_PORT: String(secrets.services.redis.port),\n\t\t}),\n\t\t...(secrets.services.rabbitmq && {\n\t\t\tRABBITMQ_USER: secrets.services.rabbitmq.username,\n\t\t\tRABBITMQ_PASSWORD: secrets.services.rabbitmq.password,\n\t\t\tRABBITMQ_HOST: secrets.services.rabbitmq.host,\n\t\t\tRABBITMQ_PORT: String(secrets.services.rabbitmq.port),\n\t\t\tRABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? '/',\n\t\t}),\n\t\t...(secrets.services.minio && {\n\t\t\tSTORAGE_ACCESS_KEY_ID: secrets.services.minio.username,\n\t\t\tSTORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,\n\t\t\tSTORAGE_BUCKET: secrets.services.minio.bucket ?? 'app',\n\t\t\tSTORAGE_REGION: 'eu-west-1',\n\t\t\tSTORAGE_FORCE_PATH_STYLE: 'true',\n\t\t}),\n\t\t...(secrets.services.mailpit && {\n\t\t\tSMTP_HOST: secrets.services.mailpit.host,\n\t\t\tSMTP_PORT: String(secrets.services.mailpit.port),\n\t\t\tSMTP_USER: secrets.services.mailpit.username,\n\t\t\tSMTP_PASS: secrets.services.mailpit.password,\n\t\t\tSMTP_SECURE: 'false',\n\t\t\tMAIL_FROM: 'noreply@localhost',\n\t\t}),\n\t\t...(secrets.services.localstack && {\n\t\t\tAWS_ACCESS_KEY_ID:\n\t\t\t\tsecrets.services.localstack.accessKeyId ??\n\t\t\t\tsecrets.services.localstack.username,\n\t\t\tAWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,\n\t\t\tAWS_REGION: secrets.services.localstack.region ?? 'us-east-1',\n\t\t\tAWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`,\n\t\t}),\n\t\t...(secrets.services.pgboss && {\n\t\t\tPGBOSS_DB_USER: secrets.services.pgboss.username,\n\t\t\tPGBOSS_DB_PASSWORD: secrets.services.pgboss.password,\n\t\t}),\n\t};\n}\n\n/**\n * Update a custom secret in the secrets file.\n */\nexport async function setCustomSecret(\n\tstage: string,\n\tkey: string,\n\tvalue: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets> {\n\tconst secrets = await readStageSecrets(stage, cwd);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`Secrets not found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tconst updated: StageSecrets = {\n\t\t...secrets,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tcustom: {\n\t\t\t...secrets.custom,\n\t\t\t[key]: value,\n\t\t},\n\t};\n\n\tawait writeStageSecrets(updated, cwd);\n\treturn updated;\n}\n\n/**\n * Mask a password for display (show first 4 and last 2 chars).\n */\nexport function maskPassword(password: string): string {\n\tif (password.length <= 8) {\n\t\treturn '********';\n\t}\n\treturn `${password.slice(0, 4)}${'*'.repeat(password.length - 6)}${password.slice(-2)}`;\n}\n\n/**\n * Result of environment variable validation.\n */\nexport interface EnvValidationResult {\n\t/** Whether all required environment variables are present */\n\tvalid: boolean;\n\t/** List of missing environment variable names */\n\tmissing: string[];\n\t/** List of environment variables that are provided */\n\tprovided: string[];\n\t/** List of environment variables that were required */\n\trequired: string[];\n}\n\n/**\n * Validate that all required environment variables are present in secrets.\n *\n * @param requiredVars - Array of environment variable names required by the application\n * @param secrets - Stage secrets to validate against\n * @returns Validation result with missing and provided variables\n *\n * @example\n * ```typescript\n * const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];\n * const secrets = await readStageSecrets('production');\n * const result = validateEnvironmentVariables(required, secrets);\n *\n * if (!result.valid) {\n *   console.error(`Missing environment variables: ${result.missing.join(', ')}`);\n * }\n * ```\n */\nexport function validateEnvironmentVariables(\n\trequiredVars: string[],\n\tsecrets: StageSecrets,\n): EnvValidationResult {\n\tconst embeddable = toEmbeddableSecrets(secrets);\n\tconst availableVars = new Set(Object.keys(embeddable));\n\n\tconst missing: string[] = [];\n\tconst provided: string[] = [];\n\n\tfor (const varName of requiredVars) {\n\t\tif (availableVars.has(varName)) {\n\t\t\tprovided.push(varName);\n\t\t} else {\n\t\t\tmissing.push(varName);\n\t\t}\n\t}\n\n\treturn {\n\t\tvalid: missing.length === 0,\n\t\tmissing: missing.sort(),\n\t\tprovided: provided.sort(),\n\t\trequired: [...requiredVars].sort(),\n\t};\n}\n"],"mappings":";;;;;;;;;AAQA,MAAM,cAAc;;AAGpB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,kBAAkB;;;;AAexB,SAAgB,cAAc,MAAM,QAAQ,KAAK,EAAU;AAC1D,QAAO,oBAAK,KAAK,YAAY;AAC7B;;;;AAKD,SAAgB,eAAeA,OAAe,MAAM,QAAQ,KAAK,EAAU;AAC1E,QAAO,oBAAK,cAAc,IAAI,GAAG,EAAE,MAAM,OAAO;AAChD;;;;AAKD,SAAgB,aAAaA,OAAe,MAAM,QAAQ,KAAK,EAAW;AACzE,QAAO,wBAAW,eAAe,OAAO,IAAI,CAAC;AAC7C;;;;AAKD,SAAgB,iBAAiBA,OAA6B;CAC7D,MAAM,MAAM,qBAAI,QAAO,aAAa;AACpC,QAAO;EACN;EACA,WAAW;EACX,WAAW;EACX,UAAU,CAAE;EACZ,MAAM,CAAE;EACR,QAAQ,CAAE;CACV;AACD;;;;AAKD,SAAS,mBACRC,SACAC,QACuB;CACvB,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,KAAK,6BAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,gCAAe,WAAW,KAAK,GAAG;CACjD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,SAAS;EACT,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;CACtB;AACD;;;;AAKD,SAAS,mBACRC,MACAD,QACe;CACf,MAAM,MAAM,OAAO,KAAK,QAAQ,MAAM;CACtC,MAAM,WAAW,OAAO,KAAK,KAAK,IAAI,MAAM;CAC5C,MAAM,WAAW,OAAO,KAAK,KAAK,WAAW,SAAS;CAGtD,MAAM,aAAa,SAAS,SAAS,IAAI,gBAAgB;CACzD,MAAM,UAAU,SAAS,UAAU,gBAAgB;CAGnD,MAAM,WAAW,kCAAiB,WAAW,KAAK,SAAS;AAC3D,UAAS,WAAW,QAAQ;CAE5B,MAAM,YAAY,OAAO,OAAO,CAC/B,SAAS,OAAO,WAAW,EAC3B,SAAS,OAAO,AAChB,EAAC;AAEF,QAAO,KAAK,MAAM,UAAU,SAAS,QAAQ,CAAC;AAC9C;;;;;;;AAQD,eAAsB,iBACrBF,OACA,MAAM,QAAQ,KAAK,EACY;CAC/B,MAAM,OAAO,eAAe,OAAO,IAAI;AAEvC,MAAK,wBAAW,KAAK,CACpB,QAAO;CAGR,MAAM,UAAU,MAAM,+BAAS,MAAM,QAAQ;CAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAGhC,KAAI,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,IAAI;EACpD,MAAM,cAAc,wBAAS,IAAI;EACjC,MAAM,MAAM,MAAM,yBAAQ,OAAO,YAAY;AAE7C,OAAK,IACJ,OAAM,IAAI,OACR,sCAAsC,MAAM,6BACjB,YAAY,GAAG,MAAM;AAInD,SAAO,mBAAmB,MAA8B,IAAI;CAC5D;AAGD,QAAO;AACP;;;;;AAMD,eAAsB,kBACrBC,SACA,MAAM,QAAQ,KAAK,EACH;CAChB,MAAM,MAAM,cAAc,IAAI;CAC9B,MAAM,OAAO,eAAe,QAAQ,OAAO,IAAI;CAC/C,MAAM,cAAc,wBAAS,IAAI;AAGjC,OAAM,4BAAM,KAAK,EAAE,WAAW,KAAM,EAAC;CAGrC,MAAM,MAAM,MAAM,gCAAe,QAAQ,OAAO,YAAY;CAG5D,MAAM,YAAY,mBAAmB,SAAS,IAAI;AAClD,OAAM,gCAAU,MAAM,KAAK,UAAU,WAAW,MAAM,EAAE,EAAE,QAAQ;AAClE;;;;;AAMD,SAAgB,oBAAoBA,SAA0C;AAC7E,QAAO;EACN,GAAG,QAAQ;EACX,GAAG,QAAQ;EAEX,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,aAAa,QAAQ,SAAS,SAAS,YAAY;GACnD,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;EACrD;EACD,GAAI,QAAQ,SAAS,SAAS;GAC7B,gBAAgB,QAAQ,SAAS,MAAM;GACvC,YAAY,QAAQ,SAAS,MAAM;GACnC,YAAY,OAAO,QAAQ,SAAS,MAAM,KAAK;EAC/C;EACD,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,KAAK;GACrD,gBAAgB,QAAQ,SAAS,SAAS,SAAS;EACnD;EACD,GAAI,QAAQ,SAAS,SAAS;GAC7B,uBAAuB,QAAQ,SAAS,MAAM;GAC9C,2BAA2B,QAAQ,SAAS,MAAM;GAClD,gBAAgB,QAAQ,SAAS,MAAM,UAAU;GACjD,gBAAgB;GAChB,0BAA0B;EAC1B;EACD,GAAI,QAAQ,SAAS,WAAW;GAC/B,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,OAAO,QAAQ,SAAS,QAAQ,KAAK;GAChD,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,QAAQ,SAAS,QAAQ;GACpC,aAAa;GACb,WAAW;EACX;EACD,GAAI,QAAQ,SAAS,cAAc;GAClC,mBACC,QAAQ,SAAS,WAAW,eAC5B,QAAQ,SAAS,WAAW;GAC7B,uBAAuB,QAAQ,SAAS,WAAW;GACnD,YAAY,QAAQ,SAAS,WAAW,UAAU;GAClD,mBAAmB,SAAS,QAAQ,SAAS,WAAW,KAAK,GAAG,QAAQ,SAAS,WAAW,KAAK;EACjG;EACD,GAAI,QAAQ,SAAS,UAAU;GAC9B,gBAAgB,QAAQ,SAAS,OAAO;GACxC,oBAAoB,QAAQ,SAAS,OAAO;EAC5C;CACD;AACD;;;;AAKD,eAAsB,gBACrBD,OACAI,KACAC,OACA,MAAM,QAAQ,KAAK,EACK;CACxB,MAAM,UAAU,MAAM,iBAAiB,OAAO,IAAI;AAElD,MAAK,QACJ,OAAM,IAAI,OACR,+BAA+B,MAAM,mCAAmC,MAAM;CAIjF,MAAMC,UAAwB;EAC7B,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;EACnC,QAAQ;GACP,GAAG,QAAQ;IACV,MAAM;EACP;CACD;AAED,OAAM,kBAAkB,SAAS,IAAI;AACrC,QAAO;AACP;;;;AAKD,SAAgB,aAAaC,UAA0B;AACtD,KAAI,SAAS,UAAU,EACtB,QAAO;AAER,SAAQ,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,EAAE,IAAI,OAAO,SAAS,SAAS,EAAE,CAAC,EAAE,SAAS,MAAM,GAAG,CAAC;AACtF;;;;;;;;;;;;;;;;;;;AAkCD,SAAgB,6BACfC,cACAP,SACsB;CACtB,MAAM,aAAa,oBAAoB,QAAQ;CAC/C,MAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,WAAW;CAErD,MAAMQ,UAAoB,CAAE;CAC5B,MAAMC,WAAqB,CAAE;AAE7B,MAAK,MAAM,WAAW,aACrB,KAAI,cAAc,IAAI,QAAQ,CAC7B,UAAS,KAAK,QAAQ;KAEtB,SAAQ,KAAK,QAAQ;AAIvB,QAAO;EACN,OAAO,QAAQ,WAAW;EAC1B,SAAS,QAAQ,MAAM;EACvB,UAAU,SAAS,MAAM;EACzB,UAAU,CAAC,GAAG,YAAa,EAAC,MAAM;CAClC;AACD"}

package/dist/storage-DGBzMLZa.mjs

@@ -1,4 +0,0 @@
-import "./keystore-TxeYM7an.mjs";
-import { getSecretsDir, getSecretsPath, initStageSecrets, maskPassword, readStageSecrets, secretsExist, setCustomSecret, toEmbeddableSecrets, validateEnvironmentVariables, writeStageSecrets } from "./storage-B020InPW.mjs";
-
-export { initStageSecrets, readStageSecrets, toEmbeddableSecrets, validateEnvironmentVariables, writeStageSecrets };

package/dist/storage-DlVol_oj.cjs

@@ -1,8 +0,0 @@
-require('./keystore-C9rint2E.cjs');
-const require_storage = require('./storage-CSNplaJn.cjs');
-
-exports.initStageSecrets = require_storage.initStageSecrets;
-exports.readStageSecrets = require_storage.readStageSecrets;
-exports.toEmbeddableSecrets = require_storage.toEmbeddableSecrets;
-exports.validateEnvironmentVariables = require_storage.validateEnvironmentVariables;
-exports.writeStageSecrets = require_storage.writeStageSecrets;

package/dist/sync-0ILCb-1S.cjs

@@ -1,93 +0,0 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const __aws_sdk_client_ssm = require_chunk.__toESM(require("@aws-sdk/client-ssm"));
-
-//#region src/secrets/sync.ts
-/**
-* Get the SSM parameter name for secrets.
-*/
-function getSecretsParameterName(workspaceName, stage) {
-	return `/gkm/${workspaceName}/${stage}/secrets`;
-}
-/**
-* Create an SSM client from workspace state config.
-*/
-function createSSMClient(config) {
-	const clientConfig = { region: config.region };
-	if (config.profile) {
-		const { fromIni } = require("@aws-sdk/credential-providers");
-		clientConfig.credentials = fromIni({ profile: config.profile });
-	}
-	return new __aws_sdk_client_ssm.SSMClient(clientConfig);
-}
-/**
-* Push secrets to SSM Parameter Store.
-*
-* Stores the full StageSecrets object as a SecureString parameter.
-*/
-async function pushSecrets(stage, workspace) {
-	const config = workspace.state;
-	if (!config || config.provider !== "ssm") throw new Error("SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.");
-	if (!workspace.name) throw new Error("Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.");
-	const client = createSSMClient(config);
-	const parameterName = getSecretsParameterName(workspace.name, stage);
-	const { readStageSecrets } = await Promise.resolve().then(() => require("./storage-DlVol_oj.cjs"));
-	const secrets = await readStageSecrets(stage, workspace.root);
-	if (!secrets) throw new Error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
-	await client.send(new __aws_sdk_client_ssm.PutParameterCommand({
-		Name: parameterName,
-		Value: JSON.stringify(secrets),
-		Type: "SecureString",
-		Overwrite: true,
-		Description: `GKM secrets for ${workspace.name}/${stage}`
-	}));
-}
-/**
-* Pull secrets from SSM Parameter Store.
-*
-* @returns StageSecrets or null if no secrets are stored remotely
-*/
-async function pullSecrets(stage, workspace) {
-	const config = workspace.state;
-	if (!config || config.provider !== "ssm") return null;
-	if (!workspace.name) return null;
-	const client = createSSMClient(config);
-	const parameterName = getSecretsParameterName(workspace.name, stage);
-	try {
-		const response = await client.send(new __aws_sdk_client_ssm.GetParameterCommand({
-			Name: parameterName,
-			WithDecryption: true
-		}));
-		if (!response.Parameter?.Value) return null;
-		return JSON.parse(response.Parameter.Value);
-	} catch (error) {
-		if (error instanceof __aws_sdk_client_ssm.ParameterNotFound) return null;
-		throw error;
-	}
-}
-/**
-* Check if SSM is configured for the workspace.
-*/
-function isSSMConfigured(workspace) {
-	return !!workspace.state && workspace.state.provider === "ssm";
-}
-
-//#endregion
-Object.defineProperty(exports, 'isSSMConfigured', {
-  enumerable: true,
-  get: function () {
-    return isSSMConfigured;
-  }
-});
-Object.defineProperty(exports, 'pullSecrets', {
-  enumerable: true,
-  get: function () {
-    return pullSecrets;
-  }
-});
-Object.defineProperty(exports, 'pushSecrets', {
-  enumerable: true,
-  get: function () {
-    return pushSecrets;
-  }
-});
-//# sourceMappingURL=sync-0ILCb-1S.cjs.map