@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.121

package/dist/github-BThvbf2W.cjs

@@ -1,197 +0,0 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-require('./discover-DmW9Bscc.cjs');
-const require_config = require('./config-RYR9j6EF.cjs');
-const require_workspace = require('./workspace-DPV7FtAv.cjs');
-const require_keystore = require('./keystore-C9rint2E.cjs');
-const node_fs = require_chunk.__toESM(require("node:fs"));
-const node_child_process = require_chunk.__toESM(require("node:child_process"));
-const __aws_sdk_client_iam = require_chunk.__toESM(require("@aws-sdk/client-iam"));
-
-//#region src/deploy/github.ts
-const logger = console;
-const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
-const AUDIENCE = "sts.amazonaws.com";
-/**
-* What SST needs to create a stack is most of AWS, so this is the default —
-* said out loud in the output, and replaceable with `--policy-arn`.
-*/
-const DEFAULT_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";
-const defaultGh = (args, input) => (0, node_child_process.execFileSync)("gh", args, {
-	encoding: "utf-8",
-	...input === void 0 ? {} : {
-		input,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	}
-}).trim();
-/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */
-function roleName(project, stage) {
-	return `${project}-github-${stage}`.toLowerCase().replace(/[^a-z0-9+=,.@_-]/g, "-").slice(0, 64);
-}
-/**
-* Who may assume the role: a workflow job running in this repository's
-* `<stage>` environment, and nothing else — not another branch's job, not
-* another environment's. That is what keeps a staging deploy from using the
-* production role.
-*/
-function trustPolicy(providerArn, repo, stage) {
-	return JSON.stringify({
-		Version: "2012-10-17",
-		Statement: [{
-			Effect: "Allow",
-			Principal: { Federated: providerArn },
-			Action: "sts:AssumeRoleWithWebIdentity",
-			Condition: { StringEquals: {
-				[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,
-				[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`
-			} }
-		}]
-	});
-}
-/** GitHub's OIDC provider in this account, created if it is not there. */
-async function ensureOidcProvider(iam) {
-	const { OpenIDConnectProviderList = [] } = await iam.send(new __aws_sdk_client_iam.ListOpenIDConnectProvidersCommand({}));
-	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
-	if (existing) return existing;
-	const created = await iam.send(new __aws_sdk_client_iam.CreateOpenIDConnectProviderCommand({
-		Url: `https://${GITHUB_OIDC_HOST}`,
-		ClientIDList: [AUDIENCE]
-	}));
-	return created.OpenIDConnectProviderArn;
-}
-/** The deploy role, created or brought back to this trust and policy. */
-async function ensureRole(iam, name, trust, policyArn) {
-	let arn;
-	try {
-		const { Role } = await iam.send(new __aws_sdk_client_iam.GetRoleCommand({ RoleName: name }));
-		await iam.send(new __aws_sdk_client_iam.UpdateAssumeRolePolicyCommand({
-			RoleName: name,
-			PolicyDocument: trust
-		}));
-		arn = Role.Arn;
-	} catch (error) {
-		if (error.name !== "NoSuchEntityException") throw error;
-		const { Role } = await iam.send(new __aws_sdk_client_iam.CreateRoleCommand({
-			RoleName: name,
-			AssumeRolePolicyDocument: trust,
-			Description: "Deploys from GitHub Actions (gkm deploy:github)",
-			MaxSessionDuration: 3600 * 2
-		}));
-		arn = Role.Arn;
-	}
-	await iam.send(new __aws_sdk_client_iam.AttachRolePolicyCommand({
-		RoleName: name,
-		PolicyArn: policyArn
-	}));
-	return arn;
-}
-/**
-* An IAM client for the stage's account.
-*
-* `fromIni` for a named profile, deliberately: it resolves exactly that
-* profile — keys, assume-role, `credential_process` or SSO, whichever
-* ~/.aws/config says — and never falls back to AWS_* in the environment. The
-* provider chain checks the environment first, so exported staging keys would
-* quietly win over `--profile prod` and the production role would land in the
-* staging account.
-*/
-async function iamFor(profile, endpoint) {
-	const config = { region: "us-east-1" };
-	if (profile) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		config.credentials = fromIni({ profile });
-	}
-	if (endpoint) {
-		config.endpoint = endpoint;
-		config.credentials = {
-			accessKeyId: "test",
-			secretAccessKey: "test"
-		};
-	}
-	return new __aws_sdk_client_iam.IAMClient(config);
-}
-async function deployGithubCommand(options, deps = {}) {
-	const gh = deps.gh ?? defaultGh;
-	const { workspace } = await require_config.loadWorkspaceConfig(deps.cwd);
-	require_workspace.assertDeployedStage(workspace.stages, options.stage);
-	const repo = options.repo ?? gh([
-		"repo",
-		"view",
-		"--json",
-		"nameWithOwner",
-		"-q",
-		".nameWithOwner"
-	]);
-	const role = roleName(workspace.name, options.stage);
-	const policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;
-	const keyPath = require_keystore.getKeyPath(options.stage, workspace.name);
-	const hasKey = (0, node_fs.existsSync)(keyPath);
-	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
-	logger.log(`  Repository:   ${repo}`);
-	logger.log(`  AWS profile:  ${options.profile ?? "(default credentials)"}`);
-	logger.log(`  Role:         ${role}`);
-	logger.log(`  Policy:       ${policyArn}${options.policyArn ? "" : "  (default; --policy-arn to narrow)"}`);
-	logger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);
-	logger.log(`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`);
-	if (options.dryRun) {
-		logger.log("\n  --dry-run: nothing changed.\n");
-		return { repo };
-	}
-	const iam = deps.iam ?? await iamFor(options.profile);
-	const providerArn = await ensureOidcProvider(iam).catch((error) => {
-		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
-		throw error;
-	});
-	const roleArn = await ensureRole(iam, role, trustPolicy(providerArn, repo, options.stage), policyArn);
-	logger.log(`\n  ✓ AWS: ${roleArn}`);
-	gh([
-		"api",
-		"--method",
-		"PUT",
-		`repos/${repo}/environments/${options.stage}`
-	]);
-	gh([
-		"variable",
-		"set",
-		"AWS_ROLE_ARN",
-		"--env",
-		options.stage,
-		"--repo",
-		repo,
-		"--body",
-		roleArn
-	]);
-	logger.log(`  ✓ GitHub: environment "${options.stage}", AWS_ROLE_ARN`);
-	if (hasKey) {
-		gh([
-			"secret",
-			"set",
-			"GKM_SECRETS_KEY",
-			"--env",
-			options.stage,
-			"--repo",
-			repo
-		], (0, node_fs.readFileSync)(keyPath, "utf-8").trim());
-		logger.log("  ✓ GitHub: GKM_SECRETS_KEY");
-	} else logger.log(`  ⚠ No secrets key for "${options.stage}"; run gkm secrets:init --stage ${options.stage}, then this again.`);
-	logger.log(`\n  Protect it: add required reviewers to the "${options.stage}" environment in the repository settings.\n`);
-	return {
-		roleArn,
-		repo
-	};
-}
-/** The profile's SSO login has lapsed; the fix is one command away. */
-var SsoSessionExpired = class extends Error {
-	constructor(profile) {
-		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
-		this.profile = profile;
-		this.name = "SsoSessionExpired";
-	}
-};
-
-//#endregion
-exports.deployGithubCommand = deployGithubCommand;
-//# sourceMappingURL=github-BThvbf2W.cjs.map

package/dist/github-BThvbf2W.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-BThvbf2W.cjs","names":["defaultGh: Gh","project: string","stage: string","providerArn: string","repo: string","iam: IAMClient","ListOpenIDConnectProvidersCommand","CreateOpenIDConnectProviderCommand","name: string","trust: string","policyArn: string","arn: string","GetRoleCommand","UpdateAssumeRolePolicyCommand","CreateRoleCommand","AttachRolePolicyCommand","profile?: string","endpoint?: string","config: IAMClientConfig","IAMClient","options: DeployGithubOptions","deps: { iam?: IAMClient; gh?: Gh; cwd?: string }","profile: string"],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as\n * `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath } from '../secrets/keystore.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\tconst keyPath = getKeyPath(options.stage, workspace.name);\n\tconst hasKey = existsSync(keyPath);\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tlogger.log(\n\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t);\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\treadFileSync(keyPath, 'utf-8').trim(),\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;;AAgCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;;;;;AAMjB,MAAa,qBAAqB;AAgBlC,MAAMA,YAAgB,CAAC,MAAM,UAC5B,qCAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,mBACD,CAAE,IACF;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAO;CAAW;AACtD,EAAC,CAAC,MAAM;;AAGV,SAAgB,SAASC,SAAiBC,OAAuB;AAChE,QAAO,CAAC,EAAE,QAAQ,UAAU,MAAM,EAChC,aAAa,CACb,QAAQ,qBAAqB,IAAI,CACjC,MAAM,GAAG,GAAG;AACd;;;;;;;AAQD,SAAgB,YACfC,aACAC,MACAF,OACS;AACT,QAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAa;GACrC,QAAQ;GACR,WAAW,EACV,cAAc;MACX,EAAE,iBAAiB,QAAQ;MAC3B,EAAE,iBAAiB,SAAS,OAAO,KAAK,eAAe,MAAM;GAC/D,EACD;EACD,CACD;CACD,EAAC;AACF;;AAGD,eAAsB,mBAAmBG,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAE,GAAE,GAAG,MAAM,IAAI,KACpD,IAAIC,uDAAkC,CAAE,GACxC;CACD,MAAM,WAAW,0BAA0B,KAAK,CAAC,MAChD,EAAE,KAAK,UAAU,gBAAgB,iBAAiB,EAAE,CACpD,EAAE;AACH,KAAI,SAAU,QAAO;CAErB,MAAM,UAAU,MAAM,IAAI,KACzB,IAAIC,wDAAmC;EACtC,MAAM,UAAU,iBAAiB;EACjC,cAAc,CAAC,QAAS;CACxB,GACD;AACD,QAAO,QAAQ;AACf;;AAGD,eAAsB,WACrBF,KACAG,MACAC,OACAC,WACkB;CAClB,IAAIC;AACJ,KAAI;EACH,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAAK,IAAIC,oCAAe,EAAE,UAAU,KAAM,GAAE;AACvE,QAAM,IAAI,KACT,IAAIC,mDAA8B;GACjC,UAAU;GACV,gBAAgB;EAChB,GACD;AACD,QAAM,KAAM;CACZ,SAAQ,OAAO;AACf,MAAK,MAA4B,SAAS,wBACzC,OAAM;EAEP,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAC1B,IAAIC,uCAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB,OAAO;EAC3B,GACD;AACD,QAAM,KAAM;CACZ;AAGD,OAAM,IAAI,KACT,IAAIC,6CAAwB;EAAE,UAAU;EAAM,WAAW;CAAW,GACpE;AACD,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,OACrBC,SACAC,UACqB;CACrB,MAAMC,SAA0B,EAAE,QAAQ,YAAa;AACvD,KAAI,SAAS;EACZ,MAAM,EAAE,SAAS,GAAG,MAAM,OAAO;AACjC,SAAO,cAAc,QAAQ,EAAE,QAAS,EAAC;CACzC;AACD,KAAI,UAAU;AACb,SAAO,WAAW;AAClB,SAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAQ;CACrE;AACD,QAAO,IAAIC,+BAAU;AACrB;AAED,eAAsB,oBACrBC,SACAC,OAAmD,CAAE,GACP;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,WAAW,GAAG,MAAM,mCAAoB,KAAK,IAAI;AACzD,uCAAoB,UAAU,QAAQ,QAAQ,MAAM;CAEpD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAiB,EAAC;CACxE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,MAAM;CACpD,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,4BAAW,QAAQ,OAAO,UAAU,KAAK;CACzD,MAAM,SAAS,wBAAW,QAAQ;AAElC,QAAO,KAAK,+BAA+B,QAAQ,MAAM,KAAK;AAC9D,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KAAK,kBAAkB,QAAQ,WAAW,wBAAwB,EAAE;AAC3E,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KACL,kBAAkB,UAAU,EAAE,QAAQ,YAAY,KAAK,sCAAsC,EAC9F;AACD,QAAO,KAAK,uBAAuB,KAAK,eAAe,QAAQ,MAAM,OAAO;AAC5E,QAAO,KACL,kBAAkB,SAAS,WAAW,UAAU,QAAQ,kCAAkC,QAAQ,MAAM,QAAQ,EACjH;AAED,KAAI,QAAQ,QAAQ;AACnB,SAAO,IAAI,oCAAoC;AAC/C,SAAO,EAAE,KAAM;CACf;CAED,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,QAAQ;CACtD,MAAM,cAAc,MAAM,mBAAmB,IAAI,CAAC,MAAM,CAAC,UAAU;AAGlE,MAAI,eAAe,KAAK,OAAO,OAAO,QAAQ,CAAC,IAAI,QAAQ,QAC1D,OAAM,IAAI,kBAAkB,QAAQ;AAErC,QAAM;CACN,EAAC;CACF,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,aAAa,MAAM,QAAQ,MAAM,EAC7C,UACA;AACD,QAAO,KAAK,aAAa,QAAQ,EAAE;AAGnC,IAAG;EAAC;EAAO;EAAY;GAAQ,QAAQ,KAAK,gBAAgB,QAAQ,MAAM;CAAE,EAAC;AAC7E,IAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACA,EAAC;AACF,QAAO,KAAK,2BAA2B,QAAQ,MAAM,iBAAiB;AAEtE,KAAI,QAAQ;AAEX,KACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACA,GACD,0BAAa,SAAS,QAAQ,CAAC,MAAM,CACrC;AACD,SAAO,IAAI,8BAA8B;CACzC,MACA,QAAO,KACL,0BAA0B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,oBACzF;AAGF,QAAO,KACL,iDAAiD,QAAQ,MAAM,6CAChE;AACD,QAAO;EAAE;EAAS;CAAM;AACxB;;AAGD,IAAa,oBAAb,cAAuC,MAAM;CAC5C,YAAqBC,SAAiB;AACrC,SACE,+BAA+B,QAAQ,4DAA4D,QAAQ,EAC5G;EAHmB;AAIpB,OAAK,OAAO;CACZ;AACD"}

package/dist/github-DpMZurEK.mjs

@@ -1,196 +0,0 @@
-import "./discover-BYHQwQqu.mjs";
-import { loadWorkspaceConfig } from "./config-DTsVjKZD.mjs";
-import { assertDeployedStage } from "./workspace-CtnZnWsa.mjs";
-import { getKeyPath } from "./keystore-TxeYM7an.mjs";
-import { existsSync, readFileSync } from "node:fs";
-import { execFileSync } from "node:child_process";
-import { AttachRolePolicyCommand, CreateOpenIDConnectProviderCommand, CreateRoleCommand, GetRoleCommand, IAMClient, ListOpenIDConnectProvidersCommand, UpdateAssumeRolePolicyCommand } from "@aws-sdk/client-iam";
-
-//#region src/deploy/github.ts
-const logger = console;
-const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
-const AUDIENCE = "sts.amazonaws.com";
-/**
-* What SST needs to create a stack is most of AWS, so this is the default —
-* said out loud in the output, and replaceable with `--policy-arn`.
-*/
-const DEFAULT_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";
-const defaultGh = (args, input) => execFileSync("gh", args, {
-	encoding: "utf-8",
-	...input === void 0 ? {} : {
-		input,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	}
-}).trim();
-/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */
-function roleName(project, stage) {
-	return `${project}-github-${stage}`.toLowerCase().replace(/[^a-z0-9+=,.@_-]/g, "-").slice(0, 64);
-}
-/**
-* Who may assume the role: a workflow job running in this repository's
-* `<stage>` environment, and nothing else — not another branch's job, not
-* another environment's. That is what keeps a staging deploy from using the
-* production role.
-*/
-function trustPolicy(providerArn, repo, stage) {
-	return JSON.stringify({
-		Version: "2012-10-17",
-		Statement: [{
-			Effect: "Allow",
-			Principal: { Federated: providerArn },
-			Action: "sts:AssumeRoleWithWebIdentity",
-			Condition: { StringEquals: {
-				[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,
-				[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`
-			} }
-		}]
-	});
-}
-/** GitHub's OIDC provider in this account, created if it is not there. */
-async function ensureOidcProvider(iam) {
-	const { OpenIDConnectProviderList = [] } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
-	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
-	if (existing) return existing;
-	const created = await iam.send(new CreateOpenIDConnectProviderCommand({
-		Url: `https://${GITHUB_OIDC_HOST}`,
-		ClientIDList: [AUDIENCE]
-	}));
-	return created.OpenIDConnectProviderArn;
-}
-/** The deploy role, created or brought back to this trust and policy. */
-async function ensureRole(iam, name, trust, policyArn) {
-	let arn;
-	try {
-		const { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));
-		await iam.send(new UpdateAssumeRolePolicyCommand({
-			RoleName: name,
-			PolicyDocument: trust
-		}));
-		arn = Role.Arn;
-	} catch (error) {
-		if (error.name !== "NoSuchEntityException") throw error;
-		const { Role } = await iam.send(new CreateRoleCommand({
-			RoleName: name,
-			AssumeRolePolicyDocument: trust,
-			Description: "Deploys from GitHub Actions (gkm deploy:github)",
-			MaxSessionDuration: 3600 * 2
-		}));
-		arn = Role.Arn;
-	}
-	await iam.send(new AttachRolePolicyCommand({
-		RoleName: name,
-		PolicyArn: policyArn
-	}));
-	return arn;
-}
-/**
-* An IAM client for the stage's account.
-*
-* `fromIni` for a named profile, deliberately: it resolves exactly that
-* profile — keys, assume-role, `credential_process` or SSO, whichever
-* ~/.aws/config says — and never falls back to AWS_* in the environment. The
-* provider chain checks the environment first, so exported staging keys would
-* quietly win over `--profile prod` and the production role would land in the
-* staging account.
-*/
-async function iamFor(profile, endpoint) {
-	const config = { region: "us-east-1" };
-	if (profile) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		config.credentials = fromIni({ profile });
-	}
-	if (endpoint) {
-		config.endpoint = endpoint;
-		config.credentials = {
-			accessKeyId: "test",
-			secretAccessKey: "test"
-		};
-	}
-	return new IAMClient(config);
-}
-async function deployGithubCommand(options, deps = {}) {
-	const gh = deps.gh ?? defaultGh;
-	const { workspace } = await loadWorkspaceConfig(deps.cwd);
-	assertDeployedStage(workspace.stages, options.stage);
-	const repo = options.repo ?? gh([
-		"repo",
-		"view",
-		"--json",
-		"nameWithOwner",
-		"-q",
-		".nameWithOwner"
-	]);
-	const role = roleName(workspace.name, options.stage);
-	const policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;
-	const keyPath = getKeyPath(options.stage, workspace.name);
-	const hasKey = existsSync(keyPath);
-	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
-	logger.log(`  Repository:   ${repo}`);
-	logger.log(`  AWS profile:  ${options.profile ?? "(default credentials)"}`);
-	logger.log(`  Role:         ${role}`);
-	logger.log(`  Policy:       ${policyArn}${options.policyArn ? "" : "  (default; --policy-arn to narrow)"}`);
-	logger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);
-	logger.log(`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`);
-	if (options.dryRun) {
-		logger.log("\n  --dry-run: nothing changed.\n");
-		return { repo };
-	}
-	const iam = deps.iam ?? await iamFor(options.profile);
-	const providerArn = await ensureOidcProvider(iam).catch((error) => {
-		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
-		throw error;
-	});
-	const roleArn = await ensureRole(iam, role, trustPolicy(providerArn, repo, options.stage), policyArn);
-	logger.log(`\n  ✓ AWS: ${roleArn}`);
-	gh([
-		"api",
-		"--method",
-		"PUT",
-		`repos/${repo}/environments/${options.stage}`
-	]);
-	gh([
-		"variable",
-		"set",
-		"AWS_ROLE_ARN",
-		"--env",
-		options.stage,
-		"--repo",
-		repo,
-		"--body",
-		roleArn
-	]);
-	logger.log(`  ✓ GitHub: environment "${options.stage}", AWS_ROLE_ARN`);
-	if (hasKey) {
-		gh([
-			"secret",
-			"set",
-			"GKM_SECRETS_KEY",
-			"--env",
-			options.stage,
-			"--repo",
-			repo
-		], readFileSync(keyPath, "utf-8").trim());
-		logger.log("  ✓ GitHub: GKM_SECRETS_KEY");
-	} else logger.log(`  ⚠ No secrets key for "${options.stage}"; run gkm secrets:init --stage ${options.stage}, then this again.`);
-	logger.log(`\n  Protect it: add required reviewers to the "${options.stage}" environment in the repository settings.\n`);
-	return {
-		roleArn,
-		repo
-	};
-}
-/** The profile's SSO login has lapsed; the fix is one command away. */
-var SsoSessionExpired = class extends Error {
-	constructor(profile) {
-		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
-		this.profile = profile;
-		this.name = "SsoSessionExpired";
-	}
-};
-
-//#endregion
-export { deployGithubCommand };
-//# sourceMappingURL=github-DpMZurEK.mjs.map

package/dist/github-DpMZurEK.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-DpMZurEK.mjs","names":["defaultGh: Gh","project: string","stage: string","providerArn: string","repo: string","iam: IAMClient","name: string","trust: string","policyArn: string","arn: string","profile?: string","endpoint?: string","config: IAMClientConfig","options: DeployGithubOptions","deps: { iam?: IAMClient; gh?: Gh; cwd?: string }","profile: string"],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as\n * `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath } from '../secrets/keystore.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\tconst keyPath = getKeyPath(options.stage, workspace.name);\n\tconst hasKey = existsSync(keyPath);\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tlogger.log(\n\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t);\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\treadFileSync(keyPath, 'utf-8').trim(),\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;AAgCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;;;;;AAMjB,MAAa,qBAAqB;AAgBlC,MAAMA,YAAgB,CAAC,MAAM,UAC5B,aAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,mBACD,CAAE,IACF;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAO;CAAW;AACtD,EAAC,CAAC,MAAM;;AAGV,SAAgB,SAASC,SAAiBC,OAAuB;AAChE,QAAO,CAAC,EAAE,QAAQ,UAAU,MAAM,EAChC,aAAa,CACb,QAAQ,qBAAqB,IAAI,CACjC,MAAM,GAAG,GAAG;AACd;;;;;;;AAQD,SAAgB,YACfC,aACAC,MACAF,OACS;AACT,QAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAa;GACrC,QAAQ;GACR,WAAW,EACV,cAAc;MACX,EAAE,iBAAiB,QAAQ;MAC3B,EAAE,iBAAiB,SAAS,OAAO,KAAK,eAAe,MAAM;GAC/D,EACD;EACD,CACD;CACD,EAAC;AACF;;AAGD,eAAsB,mBAAmBG,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAE,GAAE,GAAG,MAAM,IAAI,KACpD,IAAI,kCAAkC,CAAE,GACxC;CACD,MAAM,WAAW,0BAA0B,KAAK,CAAC,MAChD,EAAE,KAAK,UAAU,gBAAgB,iBAAiB,EAAE,CACpD,EAAE;AACH,KAAI,SAAU,QAAO;CAErB,MAAM,UAAU,MAAM,IAAI,KACzB,IAAI,mCAAmC;EACtC,MAAM,UAAU,iBAAiB;EACjC,cAAc,CAAC,QAAS;CACxB,GACD;AACD,QAAO,QAAQ;AACf;;AAGD,eAAsB,WACrBA,KACAC,MACAC,OACAC,WACkB;CAClB,IAAIC;AACJ,KAAI;EACH,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,KAAM,GAAE;AACvE,QAAM,IAAI,KACT,IAAI,8BAA8B;GACjC,UAAU;GACV,gBAAgB;EAChB,GACD;AACD,QAAM,KAAM;CACZ,SAAQ,OAAO;AACf,MAAK,MAA4B,SAAS,wBACzC,OAAM;EAEP,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAC1B,IAAI,kBAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB,OAAO;EAC3B,GACD;AACD,QAAM,KAAM;CACZ;AAGD,OAAM,IAAI,KACT,IAAI,wBAAwB;EAAE,UAAU;EAAM,WAAW;CAAW,GACpE;AACD,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,OACrBC,SACAC,UACqB;CACrB,MAAMC,SAA0B,EAAE,QAAQ,YAAa;AACvD,KAAI,SAAS;EACZ,MAAM,EAAE,SAAS,GAAG,MAAM,OAAO;AACjC,SAAO,cAAc,QAAQ,EAAE,QAAS,EAAC;CACzC;AACD,KAAI,UAAU;AACb,SAAO,WAAW;AAClB,SAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAQ;CACrE;AACD,QAAO,IAAI,UAAU;AACrB;AAED,eAAsB,oBACrBC,SACAC,OAAmD,CAAE,GACP;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,WAAW,GAAG,MAAM,oBAAoB,KAAK,IAAI;AACzD,qBAAoB,UAAU,QAAQ,QAAQ,MAAM;CAEpD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAiB,EAAC;CACxE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,MAAM;CACpD,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,WAAW,QAAQ,OAAO,UAAU,KAAK;CACzD,MAAM,SAAS,WAAW,QAAQ;AAElC,QAAO,KAAK,+BAA+B,QAAQ,MAAM,KAAK;AAC9D,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KAAK,kBAAkB,QAAQ,WAAW,wBAAwB,EAAE;AAC3E,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KACL,kBAAkB,UAAU,EAAE,QAAQ,YAAY,KAAK,sCAAsC,EAC9F;AACD,QAAO,KAAK,uBAAuB,KAAK,eAAe,QAAQ,MAAM,OAAO;AAC5E,QAAO,KACL,kBAAkB,SAAS,WAAW,UAAU,QAAQ,kCAAkC,QAAQ,MAAM,QAAQ,EACjH;AAED,KAAI,QAAQ,QAAQ;AACnB,SAAO,IAAI,oCAAoC;AAC/C,SAAO,EAAE,KAAM;CACf;CAED,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,QAAQ;CACtD,MAAM,cAAc,MAAM,mBAAmB,IAAI,CAAC,MAAM,CAAC,UAAU;AAGlE,MAAI,eAAe,KAAK,OAAO,OAAO,QAAQ,CAAC,IAAI,QAAQ,QAC1D,OAAM,IAAI,kBAAkB,QAAQ;AAErC,QAAM;CACN,EAAC;CACF,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,aAAa,MAAM,QAAQ,MAAM,EAC7C,UACA;AACD,QAAO,KAAK,aAAa,QAAQ,EAAE;AAGnC,IAAG;EAAC;EAAO;EAAY;GAAQ,QAAQ,KAAK,gBAAgB,QAAQ,MAAM;CAAE,EAAC;AAC7E,IAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACA,EAAC;AACF,QAAO,KAAK,2BAA2B,QAAQ,MAAM,iBAAiB;AAEtE,KAAI,QAAQ;AAEX,KACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACA,GACD,aAAa,SAAS,QAAQ,CAAC,MAAM,CACrC;AACD,SAAO,IAAI,8BAA8B;CACzC,MACA,QAAO,KACL,0BAA0B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,oBACzF;AAGF,QAAO,KACL,iDAAiD,QAAQ,MAAM,6CAChE;AACD,QAAO;EAAE;EAAS;CAAM;AACxB;;AAGD,IAAa,oBAAb,cAAuC,MAAM;CAC5C,YAAqBC,SAAiB;AACrC,SACE,+BAA+B,QAAQ,4DAA4D,QAAQ,EAC5G;EAHmB;AAIpB,OAAK,OAAO;CACZ;AACD"}

package/dist/index-BzJ7QJ9c.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-BzJ7QJ9c.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;ACoHb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA8CtB;AAAwC,iBDjLxB,kBAAA,CCiLwB,SAAA,CAAA,EDjLO,SCiLP,CAAA,EAAA,MAAA;;;AAGlB;AA0DtB;AAA6B,iBD1Nb,iBAAA,CC0Na,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA9I7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA8CtB;;;;AAGsB;AA0DtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAkCZ;AAmCA;AAAoC,iBA/TpB,eA+ToB,CAAA,oBA/TgB,UA+ThB,CAAA,CAAA,MAAA,EA9T3B,cA8T2B,CA9TZ,KA8TY,CAAA,CAAA,EA7TjC,uBA6TiC,CA7TT,KA6TS,CAAA;;;AAI3B;AAgDO,iBAnVA,kBAAA,CAqV2B,MAAA,EApVlC,eAoVkC,EAAA,GAAA,EAAA,MAAA,CAAA,EAlVxC,mBAkVwC;;;;;iBApS3B,wBAAA,SACP,yBAEN;;;;;iBA0Da,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAkCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}

package/dist/index-CfMjtdVC.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-CfMjtdVC.d.cts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;ACoHb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA8CtB;AAAwC,iBDjLxB,kBAAA,CCiLwB,SAAA,CAAA,EDjLO,SCiLP,CAAA,EAAA,MAAA;;;AAGlB;AA0DtB;AAA6B,iBD1Nb,iBAAA,CC0Na,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA9I7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA8CtB;;;;AAGsB;AA0DtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAkCZ;AAmCA;AAAoC,iBA/TpB,eA+ToB,CAAA,oBA/TgB,UA+ThB,CAAA,CAAA,MAAA,EA9T3B,cA8T2B,CA9TZ,KA8TY,CAAA,CAAA,EA7TjC,uBA6TiC,CA7TT,KA6TS,CAAA;;;AAI3B;AAgDO,iBAnVA,kBAAA,CAqV2B,MAAA,EApVlC,eAoVkC,EAAA,GAAA,EAAA,MAAA,CAAA,EAlVxC,mBAkVwC;;;;;iBApS3B,wBAAA,SACP,yBAEN;;;;;iBA0Da,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAkCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}

package/dist/keystore-C9rint2E.cjs

@@ -1,101 +0,0 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const node_fs = require_chunk.__toESM(require("node:fs"));
-const node_path = require_chunk.__toESM(require("node:path"));
-const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
-const node_os = require_chunk.__toESM(require("node:os"));
-const node_crypto = require_chunk.__toESM(require("node:crypto"));
-
-//#region src/secrets/keystore.ts
-/** Key length for AES-256 encryption */
-const KEY_LENGTH = 32;
-/**
-* Get the keystore directory for a project.
-* Keys are stored at ~/.gkm/{project-name}/
-*
-* @param projectName - Name of the project (defaults to current directory name)
-* @returns Path to the keystore directory
-*/
-function getKeystoreDir(projectName) {
-	const name = projectName ?? (0, node_path.basename)(process.cwd());
-	return (0, node_path.join)((0, node_os.homedir)(), ".gkm", name);
-}
-/**
-* Get the path to a stage's encryption key.
-*
-* @param stage - Stage name (e.g., 'development', 'production')
-* @param projectName - Name of the project (defaults to current directory name)
-* @returns Path to the key file
-*/
-function getKeyPath(stage, projectName) {
-	return (0, node_path.join)(getKeystoreDir(projectName), `${stage}.key`);
-}
-/**
-* Generate a new encryption key for a stage.
-* The key is stored at ~/.gkm/{project-name}/{stage}.key with restricted permissions.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The generated key as a hex string
-*/
-async function generateKey(stage, projectName) {
-	const keyDir = getKeystoreDir(projectName);
-	const keyPath = getKeyPath(stage, projectName);
-	await (0, node_fs_promises.mkdir)(keyDir, {
-		recursive: true,
-		mode: 448
-	});
-	const key = (0, node_crypto.randomBytes)(KEY_LENGTH).toString("hex");
-	await (0, node_fs_promises.writeFile)(keyPath, key, {
-		mode: 384,
-		encoding: "utf-8"
-	});
-	await (0, node_fs_promises.chmod)(keyPath, 384);
-	return key;
-}
-/**
-* Read an encryption key for a stage.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The key as a hex string, or null if not found
-*/
-async function readKey(stage, projectName) {
-	const keyPath = getKeyPath(stage, projectName);
-	if (!(0, node_fs.existsSync)(keyPath)) return null;
-	const key = await (0, node_fs_promises.readFile)(keyPath, "utf-8");
-	return key.trim();
-}
-/**
-* Get or create a key for a stage.
-* If the key already exists, it is returned. Otherwise, a new key is generated.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The key as a hex string
-*/
-async function getOrCreateKey(stage, projectName) {
-	const existingKey = await readKey(stage, projectName);
-	if (existingKey) return existingKey;
-	return generateKey(stage, projectName);
-}
-
-//#endregion
-Object.defineProperty(exports, 'getKeyPath', {
-  enumerable: true,
-  get: function () {
-    return getKeyPath;
-  }
-});
-Object.defineProperty(exports, 'getOrCreateKey', {
-  enumerable: true,
-  get: function () {
-    return getOrCreateKey;
-  }
-});
-Object.defineProperty(exports, 'readKey', {
-  enumerable: true,
-  get: function () {
-    return readKey;
-  }
-});
-//# sourceMappingURL=keystore-C9rint2E.cjs.map

package/dist/keystore-C9rint2E.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"keystore-C9rint2E.cjs","names":["projectName?: string","stage: string"],"sources":["../src/secrets/keystore.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { basename, join } from 'node:path';\n\n/** Key length for AES-256 encryption */\nconst KEY_LENGTH = 32; // 256 bits\n\n/**\n * Get the keystore directory for a project.\n * Keys are stored at ~/.gkm/{project-name}/\n *\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the keystore directory\n */\nexport function getKeystoreDir(projectName?: string): string {\n\tconst name = projectName ?? basename(process.cwd());\n\treturn join(homedir(), '.gkm', name);\n}\n\n/**\n * Get the path to a stage's encryption key.\n *\n * @param stage - Stage name (e.g., 'development', 'production')\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the key file\n */\nexport function getKeyPath(stage: string, projectName?: string): string {\n\treturn join(getKeystoreDir(projectName), `${stage}.key`);\n}\n\n/**\n * Check if a key exists for a stage.\n */\nexport function keyExists(stage: string, projectName?: string): boolean {\n\treturn existsSync(getKeyPath(stage, projectName));\n}\n\n/**\n * Generate a new encryption key for a stage.\n * The key is stored at ~/.gkm/{project-name}/{stage}.key with restricted permissions.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The generated key as a hex string\n */\nexport async function generateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst keyDir = getKeystoreDir(projectName);\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\t// Ensure keystore directory exists with restricted permissions\n\tawait mkdir(keyDir, { recursive: true, mode: 0o700 });\n\n\t// Generate random key\n\tconst key = randomBytes(KEY_LENGTH).toString('hex');\n\n\t// Write key with restricted permissions (owner read/write only)\n\tawait writeFile(keyPath, key, { mode: 0o600, encoding: 'utf-8' });\n\n\t// Ensure permissions are set correctly (in case file existed)\n\tawait chmod(keyPath, 0o600);\n\n\treturn key;\n}\n\n/**\n * Read an encryption key for a stage.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string, or null if not found\n */\nexport async function readKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string | null> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (!existsSync(keyPath)) {\n\t\treturn null;\n\t}\n\n\tconst key = await readFile(keyPath, 'utf-8');\n\treturn key.trim();\n}\n\n/**\n * Read an encryption key for a stage, throwing if not found.\n */\nexport async function requireKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst key = await readKey(stage, projectName);\n\n\tif (!key) {\n\t\tconst name = projectName ?? basename(process.cwd());\n\t\tthrow new Error(\n\t\t\t`Encryption key not found for stage \"${stage}\" in project \"${name}\". ` +\n\t\t\t\t`Expected key at: ${getKeyPath(stage, projectName)}`,\n\t\t);\n\t}\n\n\treturn key;\n}\n\n/**\n * Delete a key for a stage.\n */\nexport async function deleteKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<void> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (existsSync(keyPath)) {\n\t\tawait rm(keyPath);\n\t}\n}\n\n/**\n * Get or create a key for a stage.\n * If the key already exists, it is returned. Otherwise, a new key is generated.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string\n */\nexport async function getOrCreateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst existingKey = await readKey(stage, projectName);\n\n\tif (existingKey) {\n\t\treturn existingKey;\n\t}\n\n\treturn generateKey(stage, projectName);\n}\n"],"mappings":";;;;;;;;;AAOA,MAAM,aAAa;;;;;;;;AASnB,SAAgB,eAAeA,aAA8B;CAC5D,MAAM,OAAO,eAAe,wBAAS,QAAQ,KAAK,CAAC;AACnD,QAAO,oBAAK,sBAAS,EAAE,QAAQ,KAAK;AACpC;;;;;;;;AASD,SAAgB,WAAWC,OAAeD,aAA8B;AACvE,QAAO,oBAAK,eAAe,YAAY,GAAG,EAAE,MAAM,MAAM;AACxD;;;;;;;;;AAiBD,eAAsB,YACrBC,OACAD,aACkB;CAClB,MAAM,SAAS,eAAe,YAAY;CAC1C,MAAM,UAAU,WAAW,OAAO,YAAY;AAG9C,OAAM,4BAAM,QAAQ;EAAE,WAAW;EAAM,MAAM;CAAO,EAAC;CAGrD,MAAM,MAAM,6BAAY,WAAW,CAAC,SAAS,MAAM;AAGnD,OAAM,gCAAU,SAAS,KAAK;EAAE,MAAM;EAAO,UAAU;CAAS,EAAC;AAGjE,OAAM,4BAAM,SAAS,IAAM;AAE3B,QAAO;AACP;;;;;;;;AASD,eAAsB,QACrBC,OACAD,aACyB;CACzB,MAAM,UAAU,WAAW,OAAO,YAAY;AAE9C,MAAK,wBAAW,QAAQ,CACvB,QAAO;CAGR,MAAM,MAAM,MAAM,+BAAS,SAAS,QAAQ;AAC5C,QAAO,IAAI,MAAM;AACjB;;;;;;;;;AA4CD,eAAsB,eACrBC,OACAD,aACkB;CAClB,MAAM,cAAc,MAAM,QAAQ,OAAO,YAAY;AAErD,KAAI,YACH,QAAO;AAGR,QAAO,YAAY,OAAO,YAAY;AACtC"}

package/dist/keystore-TxeYM7an.mjs

@@ -1,83 +0,0 @@
-import { existsSync } from "node:fs";
-import { basename, join } from "node:path";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { randomBytes } from "node:crypto";
-
-//#region src/secrets/keystore.ts
-/** Key length for AES-256 encryption */
-const KEY_LENGTH = 32;
-/**
-* Get the keystore directory for a project.
-* Keys are stored at ~/.gkm/{project-name}/
-*
-* @param projectName - Name of the project (defaults to current directory name)
-* @returns Path to the keystore directory
-*/
-function getKeystoreDir(projectName) {
-	const name = projectName ?? basename(process.cwd());
-	return join(homedir(), ".gkm", name);
-}
-/**
-* Get the path to a stage's encryption key.
-*
-* @param stage - Stage name (e.g., 'development', 'production')
-* @param projectName - Name of the project (defaults to current directory name)
-* @returns Path to the key file
-*/
-function getKeyPath(stage, projectName) {
-	return join(getKeystoreDir(projectName), `${stage}.key`);
-}
-/**
-* Generate a new encryption key for a stage.
-* The key is stored at ~/.gkm/{project-name}/{stage}.key with restricted permissions.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The generated key as a hex string
-*/
-async function generateKey(stage, projectName) {
-	const keyDir = getKeystoreDir(projectName);
-	const keyPath = getKeyPath(stage, projectName);
-	await mkdir(keyDir, {
-		recursive: true,
-		mode: 448
-	});
-	const key = randomBytes(KEY_LENGTH).toString("hex");
-	await writeFile(keyPath, key, {
-		mode: 384,
-		encoding: "utf-8"
-	});
-	await chmod(keyPath, 384);
-	return key;
-}
-/**
-* Read an encryption key for a stage.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The key as a hex string, or null if not found
-*/
-async function readKey(stage, projectName) {
-	const keyPath = getKeyPath(stage, projectName);
-	if (!existsSync(keyPath)) return null;
-	const key = await readFile(keyPath, "utf-8");
-	return key.trim();
-}
-/**
-* Get or create a key for a stage.
-* If the key already exists, it is returned. Otherwise, a new key is generated.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The key as a hex string
-*/
-async function getOrCreateKey(stage, projectName) {
-	const existingKey = await readKey(stage, projectName);
-	if (existingKey) return existingKey;
-	return generateKey(stage, projectName);
-}
-
-//#endregion
-export { getKeyPath, getOrCreateKey, readKey };
-//# sourceMappingURL=keystore-TxeYM7an.mjs.map