@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.120

package/dist/github-BAeaC1Pl.cjs

@@ -0,0 +1,833 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_workspace = require("./workspace-BwqQnool.cjs");
+const require_dns = require("./dns-BIYf20p7.cjs");
+const require_seeds = require("./seeds-C2w4UqVP.cjs");
+const require_identity = require("./identity-CbLfgQNT.cjs");
+const require_discover = require("./discover-DozUKs8f.cjs");
+const require_config = require("./config.cjs");
+const require_deploy = require("./deploy-BMM2hx-K.cjs");
+const require_projectBucket = require("./projectBucket-BBbQ1lHF.cjs");
+const require_aws = require("./aws-DY9NqQIT.cjs");
+const require_secretsManager = require("./secretsManager-RAGcEDX1.cjs");
+let node_child_process = require("node:child_process");
+let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
+//#region src/deploy/githubOidc.ts
+/**
+* The `sub` GitHub puts in a deploy job's OIDC token — what the deploy role's
+* trust policy has to match exactly.
+*
+* It is not always `repo:<owner>/<name>:environment:<stage>`. A repository
+* (or its organisation) decides the format, and says which through
+* `GET /repos/{owner}/{repo}/actions/oidc/customization/sub`:
+*
+* - the default: `repo:<owner>/<name>:environment:<stage>`;
+* - the immutable subject — the default for repositories created after
+*   15 July 2026, opt-in before — puts the owner's and the repository's ids in
+*   the `repo` segment: `repo:<owner>@<ownerId>/<name>@<repoId>:environment:<stage>`.
+*   The API hands that segment back as `sub_claim_prefix`;
+* - a custom template (`use_default: false`) builds the `sub` from
+*   `include_claim_keys`, in order, each as `<key>:<value>` joined by `:`,
+*   where `context` is `environment:<stage>` in an environment job.
+*
+* A `:` inside a value is sent as `%3A`.
+*
+* See https://docs.github.com/en/actions/reference/security/oidc.
+*/
+/**
+* Template keys whose values are known for a repository's environment job
+* before the job runs. Anything else — `job_workflow_ref`, `ref`, `sha`,
+* `run_id`, `workflow`, `actor`, a custom property — depends on the run.
+*/
+const SUPPORTED_CLAIM_KEYS = [
+	"repo",
+	"context",
+	"environment",
+	"repository",
+	"repository_owner",
+	"repository_owner_id",
+	"repository_id",
+	"repository_visibility"
+];
+const NEEDS_FACTS = /* @__PURE__ */ new Set([
+	"repository_owner_id",
+	"repository_id",
+	"repository_visibility"
+]);
+/** A `:` inside a claim value is sent as `%3A`. */
+function claim(value) {
+	return value.replaceAll(":", "%3A");
+}
+/** Whether {@link oidcSubject} needs the repository's ids or visibility. */
+function needsRepoFacts(customization) {
+	const immutableWithoutPrefix = customization.use_immutable_subject === true && !customization.sub_claim_prefix;
+	if (customization.use_default) return immutableWithoutPrefix;
+	return (customization.include_claim_keys ?? []).some((key) => NEEDS_FACTS.has(key) || key === "repo" && immutableWithoutPrefix);
+}
+/**
+* The exact `sub` of a job in `repo`'s `stage` environment.
+*
+* @throws OidcSubjectNotSupported when a custom template includes a claim
+*   whose value depends on the run, so no one subject can be trusted.
+*/
+function oidcSubject(repo, stage, customization, facts) {
+	const [owner = "", name = ""] = repo.split("/");
+	const environment = `environment:${claim(stage)}`;
+	const repoSegment = () => {
+		if (customization.sub_claim_prefix) return customization.sub_claim_prefix;
+		if (customization.use_immutable_subject) {
+			if (!facts) throw new RepoFactsRequired(repo);
+			return `repo:${owner}@${facts.ownerId}/${name}@${facts.repoId}`;
+		}
+		return `repo:${repo}`;
+	};
+	const immutable = customization.use_immutable_subject === true || customization.sub_claim_prefix !== void 0;
+	if (customization.use_default) return {
+		subject: `${repoSegment()}:${environment}`,
+		kind: immutable ? "immutable" : "default"
+	};
+	const keys = customization.include_claim_keys ?? [];
+	const unsupported = keys.filter((key) => !SUPPORTED_CLAIM_KEYS.includes(key));
+	if (keys.length === 0 || unsupported.length > 0) throw new OidcSubjectNotSupported(repo, keys, unsupported);
+	if (keys.some((key) => NEEDS_FACTS.has(key)) && !facts) throw new RepoFactsRequired(repo);
+	return {
+		subject: keys.map((key) => {
+			switch (key) {
+				case "repo": return repoSegment();
+				case "context":
+				case "environment": return environment;
+				case "repository": return `repository:${claim(repo)}`;
+				case "repository_owner": return `repository_owner:${claim(owner)}`;
+				case "repository_owner_id": return `repository_owner_id:${facts.ownerId}`;
+				case "repository_id": return `repository_id:${facts.repoId}`;
+				default: return `repository_visibility:${claim(facts.visibility)}`;
+			}
+		}).join(":"),
+		kind: "custom"
+	};
+}
+/** The endpoint a repository's subject format is read from. */
+function customizationEndpoint(repo) {
+	return `repos/${repo}/actions/oidc/customization/sub`;
+}
+/**
+* The `sub` GitHub will send for `repo`'s `stage` environment, read from the
+* repository's OIDC settings through `gh`.
+*
+* A repository on a custom template that names no keys of its own uses its
+* organisation's, read from `orgs/{owner}/actions/oidc/customization/sub`.
+* When the settings cannot be read at all — no permission, or a GitHub
+* Enterprise Server without the endpoint — the default format is assumed, with
+* a warning saying where to check it.
+*/
+function resolveOidcSubject(gh, repo, stage) {
+	const endpoint = customizationEndpoint(repo);
+	let customization;
+	try {
+		customization = JSON.parse(gh(["api", endpoint]));
+	} catch {
+		return {
+			subject: `repo:${repo}:environment:${claim(stage)}`,
+			kind: "assumed",
+			warning: `Could not read ${endpoint}, so the default subject format is assumed. Check it with: gh api ${endpoint} — a repository on the immutable subject or a custom template sends a different sub, and the role would not be assumable.`
+		};
+	}
+	if (!customization.use_default && (customization.include_claim_keys ?? []).length === 0) {
+		const [owner = ""] = repo.split("/");
+		const orgEndpoint = `orgs/${owner}/actions/oidc/customization/sub`;
+		let org;
+		try {
+			org = JSON.parse(gh(["api", orgEndpoint]));
+		} catch {
+			throw new OrgOidcTemplateUnreadable(repo, orgEndpoint);
+		}
+		customization = {
+			...customization,
+			include_claim_keys: org.include_claim_keys ?? [],
+			use_immutable_subject: customization.use_immutable_subject ?? org.use_immutable_subject
+		};
+	}
+	const facts = needsRepoFacts(customization) ? readRepoFacts(gh, repo) : void 0;
+	return oidcSubject(repo, stage, customization, facts);
+}
+function readRepoFacts(gh, repo) {
+	const raw = JSON.parse(gh(["api", `repos/${repo}`]));
+	return {
+		ownerId: raw.owner.id,
+		repoId: raw.id,
+		visibility: raw.visibility
+	};
+}
+/**
+* The repository's custom subject template includes a claim whose value
+* depends on the run — or names none — so no one subject can be trusted.
+*/
+var OidcSubjectNotSupported = class extends require_errors.GkmError {
+	repo;
+	includeClaimKeys;
+	unsupportedKeys;
+	constructor(repo, includeClaimKeys, unsupportedKeys) {
+		super(`${repo} builds its OIDC subject from a custom template, ${JSON.stringify(includeClaimKeys)}, and ${unsupportedKeys.length > 0 ? `${unsupportedKeys.join(", ")} depend${unsupportedKeys.length === 1 ? "s" : ""} on the run` : "it names no claims"}, so the deploy role cannot trust one exact subject. Set the repository back to the default subject — gh api --method PUT ${customizationEndpoint(repo)} -F use_default=true — (or keep the immutable one by also passing -F use_immutable_subject=true), or use a template built only from ${SUPPORTED_CLAIM_KEYS.join(", ")}; then run this again.`);
+		this.repo = repo;
+		this.includeClaimKeys = includeClaimKeys;
+		this.unsupportedKeys = unsupportedKeys;
+		this.name = "OidcSubjectNotSupported";
+	}
+};
+/** The subject needs the repository's ids, and none were read. */
+var RepoFactsRequired = class extends require_errors.GkmError {
+	repo;
+	constructor(repo) {
+		super(`The OIDC subject of ${repo} includes its owner and repository ids; read them with gh api repos/${repo} and pass them in.`);
+		this.repo = repo;
+		this.name = "RepoFactsRequired";
+	}
+};
+/**
+* The repository uses its organisation's subject template, and that template
+* could not be read — so what GitHub sends is unknown, and is not guessed.
+*/
+var OrgOidcTemplateUnreadable = class extends require_errors.GkmError {
+	repo;
+	endpoint;
+	constructor(repo, endpoint) {
+		super(`${repo} uses its organisation's OIDC subject template, and ${endpoint} could not be read. Run this as an organisation owner (gh auth refresh -s admin:org), or set the repository back to the default subject with gh api --method PUT ${customizationEndpoint(repo)} -F use_default=true; then run this again.`);
+		this.repo = repo;
+		this.endpoint = endpoint;
+		this.name = "OrgOidcTemplateUnreadable";
+	}
+};
+//#endregion
+//#region src/deploy/githubPolicy.ts
+/**
+* What SST needs to create a stack is most of AWS, so this is the default
+* outside compose — said out loud in the output, and replaceable with
+* `--policy-arn`.
+*/
+const DEFAULT_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";
+/** The name of the inline policy a compose stage's role is given. */
+const SCOPED_POLICY_NAME = "gkm-deploy";
+/** Every target the stage's apps deploy through. */
+function deployTargets(workspace) {
+	const targets = /* @__PURE__ */ new Set([workspace.deploy?.default ?? "dokploy"]);
+	for (const app of Object.values(workspace.apps)) targets.add(app.resolvedDeployTarget);
+	return [...targets].sort();
+}
+/**
+* The access the stage's deploy role is given: `--policy-arn` when passed,
+* the scoped policy for a stage only the compose target deploys, and
+* `AdministratorAccess` otherwise.
+*/
+function deployAccess(workspace, stage, policyArn, manifest = {}) {
+	const buckets = Object.entries(manifest).filter(([, d]) => d.kind === "objects").map(([id]) => id);
+	if (policyArn) return {
+		kind: "managed",
+		policyArn,
+		reason: "--policy-arn"
+	};
+	const targets = deployTargets(workspace);
+	if (targets.length !== 1 || targets[0] !== "compose") return {
+		kind: "managed",
+		policyArn: DEFAULT_POLICY_ARN,
+		reason: `the ${targets.join(", ")} target${targets.length === 1 ? "" : "s"} deploy${targets.length === 1 ? "s" : ""} infrastructure; --policy-arn to narrow`
+	};
+	const project = workspace.name;
+	const store = workspace.secrets.store ?? "file";
+	const state = workspace.state;
+	if (typeof store === "object" && typeof store.provider === "object" || state !== void 0 && typeof state.provider === "object") return {
+		kind: "managed",
+		policyArn: DEFAULT_POLICY_ARN,
+		reason: `a custom ${typeof store === "object" && typeof store.provider === "object" ? "secrets store" : "state provider"} cannot be scoped; --policy-arn to narrow`
+	};
+	const describe = [];
+	const build = [];
+	const projectBucketIn = (account) => require_projectBucket.projectBucketName(require_identity.deployIdentity(workspace, stage).scope, account);
+	const projectBucketStatement = (account) => ({
+		Sid: "ProjectBucket",
+		Effect: "Allow",
+		Action: [...require_projectBucket.PROJECT_BUCKET_CREATE_ACTIONS],
+		Resource: `arn:aws:s3:::${projectBucketIn(account)}`
+	});
+	const stateInSecretsBucket = typeof store === "object" && store.provider === "s3" && state?.provider === "s3" && state.bucket === store.bucket;
+	if (typeof store === "object" && store.provider === "s3") {
+		const location = require_workspace.s3SecretsLocation(store, state);
+		const key = require_workspace.s3SecretsKey(location.prefix, project, stage);
+		const named = location.bucket;
+		const bucketIn = (account) => named ?? projectBucketIn(account);
+		describe.push(named ? `read and update s3://${named}/${key}` : `read and update ${key} in the project bucket ${projectBucketIn("<account>")}${stateInSecretsBucket ? "" : ", creating it"}`);
+		build.push((account) => [{
+			Sid: "StageSecrets",
+			Effect: "Allow",
+			Action: ["s3:GetObject", "s3:PutObject"],
+			Resource: `arn:aws:s3:::${bucketIn(account)}/${key}`
+		}, ...stateInSecretsBucket ? [] : [{
+			Sid: "StageSecretsBucket",
+			Effect: "Allow",
+			Action: ["s3:ListBucket"],
+			Resource: `arn:aws:s3:::${bucketIn(account)}`
+		}, ...named ? [] : [projectBucketStatement(account)]]]);
+	} else if (typeof store === "object" && store.provider === "ssm") {
+		const { region } = store;
+		const name = require_aws.secretsParameterName(project, stage);
+		describe.push(`read and update ${name} (SSM, ${region})`);
+		build.push((account) => [{
+			Sid: "StageSecrets",
+			Effect: "Allow",
+			Action: ["ssm:GetParameter", "ssm:PutParameter"],
+			Resource: `arn:aws:ssm:${region}:${account}:parameter${name}`
+		}]);
+	} else if (typeof store === "object" && store.provider === "secrets-manager") {
+		const { region, kmsKeyId } = store;
+		const name = require_secretsManager.secretsManagerSecretName(project, stage);
+		describe.push(`read and update ${name} (Secrets Manager, ${region})`);
+		build.push((account) => {
+			const statements = [{
+				Sid: "StageSecrets",
+				Effect: "Allow",
+				Action: [
+					"secretsmanager:GetSecretValue",
+					"secretsmanager:PutSecretValue",
+					"secretsmanager:CreateSecret"
+				],
+				Resource: `arn:aws:secretsmanager:${region}:${account}:secret:${name}-??????`
+			}];
+			if (kmsKeyId) statements.push({
+				Sid: "StageSecretsKey",
+				Effect: "Allow",
+				Action: ["kms:Decrypt", "kms:GenerateDataKey"],
+				Resource: kmsKeyId.startsWith("arn:") ? kmsKeyId : "*",
+				Condition: { StringEquals: { "kms:ViaService": `secretsmanager.${region}.amazonaws.com` } }
+			});
+			return statements;
+		});
+	}
+	if (state?.provider === "ssm") {
+		const { region } = state;
+		const path = `/gkm/${project}/${stage}/`;
+		describe.push(`read and write the deploy state under ${path} (SSM, ${region})`);
+		build.push((account) => [{
+			Sid: "StageState",
+			Effect: "Allow",
+			Action: [
+				"ssm:GetParameter",
+				"ssm:PutParameter",
+				"ssm:DeleteParameter"
+			],
+			Resource: `arn:aws:ssm:${region}:${account}:parameter${path}*`
+		}]);
+	} else if (state?.provider === "s3") {
+		const prefix = (state.prefix ?? "gkm").replace(/\/+$/, "");
+		const path = `${prefix ? `${prefix}/` : ""}${project}/${stage}/`;
+		const named = state.bucket;
+		const bucketIn = (account) => named ?? projectBucketIn(account);
+		describe.push(named ? `read and write the deploy state under s3://${named}/${path}` : `create the project bucket ${projectBucketIn("<account>")}, and read and write the deploy state under ${path} in it`);
+		build.push((account) => [...stateBucketStatements(bucketIn(account), path), ...named ? [] : [projectBucketStatement(account)]]);
+	}
+	const objects = require_workspace.stageProvider(workspace, "objects", stage);
+	if (objects.mode === "provider" && objects.name === "s3" && buckets.length) {
+		const { scope } = require_identity.deployIdentity(workspace, stage);
+		const names = [...buckets].sort().map((id) => ({
+			bucket: require_deploy.bucketName({
+				scope,
+				stage,
+				id
+			}),
+			user: require_deploy.iamUserName({
+				scope,
+				stage,
+				id
+			})
+		}));
+		const suffix = "?".repeat(6);
+		describe.push(`create and configure the buckets ${names.map((n) => n.bucket).join(", ")} and their IAM users (S3, IAM)`);
+		build.push((account) => [{
+			Sid: "StageBuckets",
+			Effect: "Allow",
+			Action: [
+				"s3:CreateBucket",
+				"s3:ListBucket",
+				"s3:GetBucketTagging",
+				"s3:PutBucketTagging",
+				"s3:GetBucketPublicAccessBlock",
+				"s3:PutBucketPublicAccessBlock",
+				"s3:GetBucketPolicy",
+				"s3:PutBucketPolicy",
+				"s3:GetEncryptionConfiguration",
+				"s3:PutEncryptionConfiguration",
+				"s3:GetBucketVersioning",
+				"s3:PutBucketVersioning",
+				"s3:GetBucketCORS",
+				"s3:PutBucketCORS",
+				"s3:GetLifecycleConfiguration",
+				"s3:PutLifecycleConfiguration"
+			],
+			Resource: names.flatMap((n) => [`arn:aws:s3:::${n.bucket}`, `arn:aws:s3:::${n.bucket}-${suffix}`])
+		}, {
+			Sid: "StageBucketUsers",
+			Effect: "Allow",
+			Action: [
+				"iam:GetUser",
+				"iam:CreateUser",
+				"iam:TagUser",
+				"iam:ListUserTags",
+				"iam:GetUserPolicy",
+				"iam:PutUserPolicy",
+				"iam:ListAccessKeys",
+				"iam:CreateAccessKey",
+				"iam:DeleteAccessKey"
+			],
+			Resource: names.map((n) => `arn:aws:iam::${account}:user${require_deploy.IAM_USER_PATH}${n.user}`)
+		}]);
+	}
+	if (require_dns.stageBackups(workspace, manifest, stage).mode === "on") {
+		const { scope } = require_identity.deployIdentity(workspace, stage);
+		const user = require_deploy.backupsUserName(scope, stage);
+		const bucketIn = (account) => require_projectBucket.projectBucketName(scope, account);
+		describe.push(`create the project bucket ${bucketIn("<account>")} and keep its lifecycle, and create the backups user ${user} and its key (S3, IAM)`);
+		build.push((account) => [{
+			Sid: "StageBackupsBucket",
+			Effect: "Allow",
+			Action: ["s3:ListBucket", .../* @__PURE__ */ new Set([...require_projectBucket.PROJECT_BUCKET_CREATE_ACTIONS, ...require_projectBucket.PROJECT_BUCKET_LIFECYCLE_ACTIONS])],
+			Resource: `arn:aws:s3:::${bucketIn(account)}`
+		}, {
+			Sid: "StageBackupsUser",
+			Effect: "Allow",
+			Action: [
+				"iam:GetUser",
+				"iam:CreateUser",
+				"iam:TagUser",
+				"iam:ListUserTags",
+				"iam:GetUserPolicy",
+				"iam:PutUserPolicy",
+				"iam:ListAccessKeys",
+				"iam:CreateAccessKey",
+				"iam:DeleteAccessKey"
+			],
+			Resource: `arn:aws:iam::${account}:user${require_deploy.IAM_USER_PATH}${user}`
+		}]);
+	}
+	for (const { domain, config } of require_dns.stageDnsDomains(stage, workspace.domains, workspace.dns)) {
+		if (config.provider !== "route53") continue;
+		const zoneId = config.hostedZoneId?.replace(/^\/?hostedzone\//, "");
+		describe.push(`write the A, AAAA and CNAME records of ${domain} (Route53${zoneId ? `, ${zoneId}` : ""})`);
+		build.push(() => [
+			{
+				Sid: "StageDnsRecords",
+				Effect: "Allow",
+				Action: ["route53:ChangeResourceRecordSets", "route53:ListResourceRecordSets"],
+				Resource: `arn:aws:route53:::hostedzone/${zoneId ?? "*"}`
+			},
+			{
+				Sid: "StageDnsChanges",
+				Effect: "Allow",
+				Action: ["route53:GetChange"],
+				Resource: "arn:aws:route53:::change/*"
+			},
+			...zoneId ? [] : [{
+				Sid: "StageDnsZones",
+				Effect: "Allow",
+				Action: ["route53:ListHostedZonesByName"],
+				Resource: "*"
+			}]
+		]);
+	}
+	return {
+		kind: "scoped",
+		statements: (account) => build.flatMap((statements) => statements(account)),
+		describe
+	};
+}
+/**
+* Reading and writing one stage's deploy state in `bucket`, as the deploy
+* role is given it.
+*/
+function stateBucketStatements(bucket, path) {
+	return [{
+		Sid: "StageState",
+		Effect: "Allow",
+		Action: [
+			"s3:GetObject",
+			"s3:PutObject",
+			"s3:DeleteObject"
+		],
+		Resource: `arn:aws:s3:::${bucket}/${path}*`
+	}, {
+		Sid: "StageStateBucket",
+		Effect: "Allow",
+		Action: ["s3:ListBucket"],
+		Resource: `arn:aws:s3:::${bucket}`
+	}];
+}
+/** The scoped access as a policy document, or null when it allows nothing. */
+function scopedPolicyDocument(statements) {
+	if (statements.length === 0) return null;
+	return JSON.stringify({
+		Version: "2012-10-17",
+		Statement: statements
+	});
+}
+/** The account an IAM ARN is in: `arn:aws:iam::<account>:…`. */
+function accountOf(arn) {
+	return arn.split(":")[4] ?? "";
+}
+//#endregion
+//#region src/deploy/github.ts
+/**
+* `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.
+*
+* A stage usually lives in its own AWS account — staging in one, production in
+* another — so this runs once per stage, with that account's profile:
+*
+*   gkm deploy:github --stage staging --profile acme-dev
+*   gkm deploy:github --stage prod    --profile acme-prod
+*
+* In the stage's account it makes sure GitHub's OIDC provider exists, and a
+* role that only this repository's `<stage>` environment can assume. On
+* GitHub it creates that environment and gives it what the generated deploy
+* workflow reads: `AWS_ROLE_ARN`, and — when the stage's secrets are kept in
+* the local file — its key as `GKM_SECRETS_KEY`. With `secrets.store` set to
+* S3, SSM or Secrets Manager the deploy job reads them with the role instead, so
+* no key is handed to GitHub, and this checks the stage's store in the same
+* account, with the same profile. Re-running it converges rather than duplicating.
+*
+* The role trusts the exact `sub` GitHub sends for the environment, read from
+* the repository's OIDC subject settings (`githubOidc.ts`) — the default, the
+* immutable subject with the owner's and repository's ids, or a custom
+* template. A re-run rewrites an existing role's trust to it, so running this
+* again repairs a role that trusted the wrong format. What the role may do is
+* `githubPolicy.ts`: `AdministratorAccess` for SST, and for a compose stage
+* only its own secrets (and deploy state, when that is in AWS).
+*/
+const logger = console;
+const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
+const AUDIENCE = "sts.amazonaws.com";
+/**
+* The tag recording which managed policy gkm attached to the role — so a
+* re-run detaches only what gkm put there, never a policy someone else did.
+*/
+const POLICY_TAG = "gkm:policy-arn";
+/** The system's `gh`. */
+const ghCli = (args, input) => (0, node_child_process.execFileSync)("gh", args, {
+	encoding: "utf-8",
+	stdio: [
+		"pipe",
+		"pipe",
+		"pipe"
+	],
+	...input === void 0 ? {} : { input }
+}).trim();
+/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */
+function roleName(project, stage) {
+	return `${project}-github-${stage}`.toLowerCase().replace(/[^a-z0-9+=,.@_-]/g, "-").slice(0, 64);
+}
+/**
+* Who may assume the role: a workflow job whose OIDC token carries exactly
+* `subject` — the repository's `<stage>` environment, in the format the
+* repository sends (see `githubOidc.ts`), and nothing else. Not another
+* branch's job, not another environment's: that is what keeps a staging
+* deploy from using the production role.
+*/
+function trustPolicy(providerArn, subject) {
+	return JSON.stringify({
+		Version: "2012-10-17",
+		Statement: [{
+			Effect: "Allow",
+			Principal: { Federated: providerArn },
+			Action: "sts:AssumeRoleWithWebIdentity",
+			Condition: { StringEquals: {
+				[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,
+				[`${GITHUB_OIDC_HOST}:sub`]: subject
+			} }
+		}]
+	});
+}
+/**
+* The subject a trust policy trusts, or undefined when it names none. IAM
+* hands documents back URL-encoded.
+*/
+function trustedSubject(document) {
+	if (!document) return void 0;
+	let parsed;
+	try {
+		parsed = JSON.parse(safeDecode(document));
+	} catch {
+		return;
+	}
+	for (const statement of parsed.Statement ?? []) for (const operator of Object.values(statement.Condition ?? {})) {
+		const value = operator[`${GITHUB_OIDC_HOST}:sub`];
+		if (typeof value === "string") return value;
+		if (Array.isArray(value)) return value.join(", ");
+	}
+}
+function safeDecode(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+/** GitHub's OIDC provider in this account, created if it is not there. */
+async function ensureOidcProvider(iam) {
+	const { OpenIDConnectProviderList = [] } = await iam.send(new _aws_sdk_client_iam.ListOpenIDConnectProvidersCommand({}));
+	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
+	if (existing) return existing;
+	return (await iam.send(new _aws_sdk_client_iam.CreateOpenIDConnectProviderCommand({
+		Url: `https://${GITHUB_OIDC_HOST}`,
+		ClientIDList: [AUDIENCE]
+	}))).OpenIDConnectProviderArn;
+}
+function isNoSuchEntity(error) {
+	return error.name === "NoSuchEntityException";
+}
+/**
+* The deploy role, created or brought back to this trust and access.
+*
+* Converges: re-running rewrites the trust, and moves the role from one access
+* to another — detaching a managed policy only when the role's
+* {@link POLICY_TAG} says gkm attached it.
+*/
+async function ensureRole(iam, name, trust, access) {
+	let arn;
+	let created = false;
+	let previousSubject;
+	let recorded;
+	try {
+		const { Role } = await iam.send(new _aws_sdk_client_iam.GetRoleCommand({ RoleName: name }));
+		previousSubject = trustedSubject(Role.AssumeRolePolicyDocument);
+		await iam.send(new _aws_sdk_client_iam.UpdateAssumeRolePolicyCommand({
+			RoleName: name,
+			PolicyDocument: trust
+		}));
+		arn = Role.Arn;
+		const { Tags = [] } = await iam.send(new _aws_sdk_client_iam.ListRoleTagsCommand({ RoleName: name }));
+		recorded = Tags.find((tag) => tag.Key === POLICY_TAG)?.Value;
+	} catch (error) {
+		if (!isNoSuchEntity(error)) throw error;
+		const { Role } = await iam.send(new _aws_sdk_client_iam.CreateRoleCommand({
+			RoleName: name,
+			AssumeRolePolicyDocument: trust,
+			Description: "Deploys from GitHub Actions (gkm deploy:github)",
+			MaxSessionDuration: 7200
+		}));
+		arn = Role.Arn;
+		created = true;
+	}
+	const detached = [];
+	const leftAttached = [];
+	const detach = async (policyArn) => {
+		try {
+			await iam.send(new _aws_sdk_client_iam.DetachRolePolicyCommand({
+				RoleName: name,
+				PolicyArn: policyArn
+			}));
+			detached.push(policyArn);
+		} catch (error) {
+			if (!isNoSuchEntity(error)) throw error;
+		}
+	};
+	const deleteInline = async () => {
+		try {
+			await iam.send(new _aws_sdk_client_iam.DeleteRolePolicyCommand({
+				RoleName: name,
+				PolicyName: SCOPED_POLICY_NAME
+			}));
+		} catch (error) {
+			if (!isNoSuchEntity(error)) throw error;
+		}
+	};
+	if ("managed" in access) {
+		await iam.send(new _aws_sdk_client_iam.AttachRolePolicyCommand({
+			RoleName: name,
+			PolicyArn: access.managed
+		}));
+		if (recorded && recorded !== access.managed) await detach(recorded);
+		if (recorded !== access.managed) await iam.send(new _aws_sdk_client_iam.TagRoleCommand({
+			RoleName: name,
+			Tags: [{
+				Key: POLICY_TAG,
+				Value: access.managed
+			}]
+		}));
+		if (!created) await deleteInline();
+		return {
+			arn,
+			created,
+			previousSubject,
+			detached,
+			leftAttached
+		};
+	}
+	if (access.inline) await iam.send(new _aws_sdk_client_iam.PutRolePolicyCommand({
+		RoleName: name,
+		PolicyName: SCOPED_POLICY_NAME,
+		PolicyDocument: access.inline
+	}));
+	else if (!created) await deleteInline();
+	if (created) return {
+		arn,
+		created,
+		previousSubject,
+		detached,
+		leftAttached
+	};
+	if (recorded) {
+		await detach(recorded);
+		await iam.send(new _aws_sdk_client_iam.UntagRoleCommand({
+			RoleName: name,
+			TagKeys: [POLICY_TAG]
+		}));
+	}
+	const { AttachedPolicies = [] } = await iam.send(new _aws_sdk_client_iam.ListAttachedRolePoliciesCommand({ RoleName: name }));
+	for (const policy of AttachedPolicies) if (policy.PolicyArn && !detached.includes(policy.PolicyArn)) leftAttached.push(policy.PolicyArn);
+	return {
+		arn,
+		created,
+		previousSubject,
+		detached,
+		leftAttached
+	};
+}
+/**
+* An IAM client for the stage's account.
+*
+* `fromIni` for a named profile, deliberately: it resolves exactly that
+* profile — keys, assume-role, `credential_process` or SSO, whichever
+* ~/.aws/config says — and never falls back to AWS_* in the environment. The
+* provider chain checks the environment first, so exported staging keys would
+* quietly win over `--profile prod` and the production role would land in the
+* staging account.
+*/
+async function iamFor(profile, endpoint) {
+	const config = { region: "us-east-1" };
+	if (profile) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		config.credentials = fromIni({ profile });
+	}
+	if (endpoint) {
+		config.endpoint = endpoint;
+		config.credentials = {
+			accessKeyId: "test",
+			secretAccessKey: "test"
+		};
+	}
+	return new _aws_sdk_client_iam.IAMClient(config);
+}
+async function deployGithubCommand(options, deps = {}) {
+	const gh = deps.gh ?? ghCli;
+	const { workspace } = await require_config.loadWorkspaceConfig(deps.cwd);
+	require_workspace.assertDeployedStage(workspace.stages, options.stage);
+	const repo = options.repo ?? gh([
+		"repo",
+		"view",
+		"--json",
+		"nameWithOwner",
+		"-q",
+		".nameWithOwner"
+	]);
+	const role = roleName(workspace.name, options.stage);
+	const oidc = resolveOidcSubject(gh, repo, options.stage);
+	const manifest = await require_discover.discover({
+		patterns: require_seeds.constructGlobs(workspace),
+		cwd: workspace.root
+	});
+	const access = deployAccess(workspace, options.stage, options.policyArn, manifest);
+	const key = await require_seeds.readKey(options.stage, require_seeds.keystoreProject(workspace));
+	const keyPath = require_seeds.getKeyPath(options.stage, require_seeds.keystoreProject(workspace));
+	const hasKey = key !== null;
+	const remote = require_seeds.isRemoteStore(workspace, options.stage);
+	const store = await require_seeds.secretsStoreFor(workspace, options.stage, { ...options.profile ? { profile: options.profile } : {} });
+	const hasSecrets = remote && await store.read(options.stage) !== null;
+	const via = options.profile ? `profile "${options.profile}"` : "the default credentials";
+	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
+	logger.log(`  Repository:   ${repo}`);
+	logger.log(`  AWS profile:  ${options.profile ?? "(default credentials)"}`);
+	logger.log(`  Role:         ${role}`);
+	if (access.kind === "managed") logger.log(`  Policy:       ${access.policyArn}  (${access.reason})`);
+	else if (access.describe.length > 0) {
+		logger.log(`  Policy:       inline "${SCOPED_POLICY_NAME}", scoped to the compose deploy — only:`);
+		for (const line of access.describe) logger.log(`                  ${line}`);
+	} else logger.log("  Policy:       none — a compose deploy with file secrets and local state reads nothing from AWS");
+	logger.log(`  Trusted by:   ${oidc.subject} only  (${SUBJECT_KINDS[oidc.kind]})`);
+	if (oidc.warning) logger.log(`  ⚠ ${oidc.warning}`);
+	if (remote) logger.log(`  Secrets:      ${hasSecrets ? `in the store (${store.name}), read with ${via}` : `none in the store yet — gkm secrets:set <KEY> '…' --stage ${options.stage}`}`);
+	else logger.log(`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`);
+	if (options.dryRun) {
+		if (access.kind === "scoped") {
+			const document = scopedPolicyDocument(access.statements("<account>"));
+			if (document) logger.log(`\n  Inline policy:\n${JSON.stringify(JSON.parse(document), null, 2).replace(/^/gm, "    ")}`);
+		}
+		logger.log("\n  --dry-run: nothing changed.\n");
+		return {
+			repo,
+			subject: oidc.subject
+		};
+	}
+	const iam = deps.iam ?? await iamFor(options.profile);
+	const providerArn = await ensureOidcProvider(iam).catch((error) => {
+		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
+		throw error;
+	});
+	const outcome = await ensureRole(iam, role, trustPolicy(providerArn, oidc.subject), access.kind === "managed" ? { managed: access.policyArn } : { inline: scopedPolicyDocument(access.statements(accountOf(providerArn))) });
+	const roleArn = outcome.arn;
+	logger.log(`\n  ✓ AWS: ${roleArn}${outcome.created ? " (created)" : ""}`);
+	if (!outcome.created) logger.log(outcome.previousSubject === oidc.subject ? `  ✓ Trust: unchanged, ${oidc.subject}` : `  ✓ Trust: ${outcome.previousSubject ?? "(no subject)"} → ${oidc.subject}`);
+	for (const detached of outcome.detached) logger.log(`  ✓ Detached ${detached} (attached by gkm, no longer needed)`);
+	if (access.kind === "scoped") for (const attached of outcome.leftAttached) logger.log(`  ⚠ ${attached} is still attached to ${role}. gkm has no record of attaching it, so it is left; the compose deploy does not need it. Detach it with: aws iam detach-role-policy --role-name ${role} --policy-arn ${attached}${options.profile ? ` --profile ${options.profile}` : ""}`);
+	gh([
+		"api",
+		"--method",
+		"PUT",
+		`repos/${repo}/environments/${options.stage}`
+	]);
+	gh([
+		"variable",
+		"set",
+		"AWS_ROLE_ARN",
+		"--env",
+		options.stage,
+		"--repo",
+		repo,
+		"--body",
+		roleArn
+	]);
+	logger.log(`  ✓ GitHub: environment "${options.stage}", AWS_ROLE_ARN`);
+	if (remote) {
+		if (!hasSecrets) logger.log(`  ⚠ The "${options.stage}" store holds no secrets yet; set them with gkm secrets:set <KEY> '…' --stage ${options.stage}${options.profile ? ` (AWS_PROFILE=${options.profile})` : ""}.`);
+	} else if (hasKey) {
+		gh([
+			"secret",
+			"set",
+			"GKM_SECRETS_KEY",
+			"--env",
+			options.stage,
+			"--repo",
+			repo
+		], key);
+		logger.log("  ✓ GitHub: GKM_SECRETS_KEY");
+	} else logger.log(`  ⚠ No secrets key for "${options.stage}"; run gkm secrets:init --stage ${options.stage}, then this again.`);
+	logger.log(`\n  Protect it: add required reviewers to the "${options.stage}" environment in the repository settings.\n`);
+	return {
+		roleArn,
+		repo,
+		subject: oidc.subject
+	};
+}
+const SUBJECT_KINDS = {
+	default: "the repository's default subject",
+	immutable: "the repository's immutable subject",
+	custom: "the repository's custom subject template",
+	assumed: "assumed: the default format"
+};
+/** The profile's SSO login has lapsed; the fix is one command away. */
+var SsoSessionExpired = class extends require_errors.GkmError {
+	profile;
+	constructor(profile) {
+		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
+		this.profile = profile;
+		this.name = "SsoSessionExpired";
+	}
+};
+//#endregion
+exports.deployGithubCommand = deployGithubCommand;
+exports.ghCli = ghCli;
+
+//# sourceMappingURL=github-BAeaC1Pl.cjs.map