@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.13

package/dist/{github-BThvbf2W.cjs → github-BfflNPVe.cjs}

@@ -1,21 +1,28 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-require('./discover-DmW9Bscc.cjs');
-const require_config = require('./config-RYR9j6EF.cjs');
-const require_workspace = require('./workspace-DPV7FtAv.cjs');
-const require_keystore = require('./keystore-C9rint2E.cjs');
-const node_fs = require_chunk.__toESM(require("node:fs"));
-const node_child_process = require_chunk.__toESM(require("node:child_process"));
-const __aws_sdk_client_iam = require_chunk.__toESM(require("@aws-sdk/client-iam"));
-
+const require_config = require("./config-Q1rvKHvw.cjs");
+const require_workspace = require("./workspace-mFpI_ky_.cjs");
+const require_keystore = require("./keystore-DgGRj2Yy.cjs");
+let node_fs = require("node:fs");
+let node_child_process = require("node:child_process");
+let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
 //#region src/deploy/github.ts
+/**
+* `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.
+*
+* A stage usually lives in its own AWS account — staging in one, production in
+* another — so this runs once per stage, with that account's profile:
+*
+*   gkm deploy:github --stage staging --profile acme-dev
+*   gkm deploy:github --stage prod    --profile acme-prod
+*
+* In the stage's account it makes sure GitHub's OIDC provider exists, and a
+* role that only this repository's `<stage>` environment can assume. On
+* GitHub it creates that environment and gives it what the generated deploy
+* workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as
+* `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.
+*/
 const logger = console;
 const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
 const AUDIENCE = "sts.amazonaws.com";
-/**
-* What SST needs to create a stack is most of AWS, so this is the default —
-* said out loud in the output, and replaceable with `--policy-arn`.
-*/
-const DEFAULT_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";
 const defaultGh = (args, input) => (0, node_child_process.execFileSync)("gh", args, {
 	encoding: "utf-8",
 	...input === void 0 ? {} : {
@@ -53,36 +60,35 @@ function trustPolicy(providerArn, repo, stage) {
 }
 /** GitHub's OIDC provider in this account, created if it is not there. */
 async function ensureOidcProvider(iam) {
-	const { OpenIDConnectProviderList = [] } = await iam.send(new __aws_sdk_client_iam.ListOpenIDConnectProvidersCommand({}));
+	const { OpenIDConnectProviderList = [] } = await iam.send(new _aws_sdk_client_iam.ListOpenIDConnectProvidersCommand({}));
 	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
 	if (existing) return existing;
-	const created = await iam.send(new __aws_sdk_client_iam.CreateOpenIDConnectProviderCommand({
+	return (await iam.send(new _aws_sdk_client_iam.CreateOpenIDConnectProviderCommand({
 		Url: `https://${GITHUB_OIDC_HOST}`,
 		ClientIDList: [AUDIENCE]
-	}));
-	return created.OpenIDConnectProviderArn;
+	}))).OpenIDConnectProviderArn;
 }
 /** The deploy role, created or brought back to this trust and policy. */
 async function ensureRole(iam, name, trust, policyArn) {
 	let arn;
 	try {
-		const { Role } = await iam.send(new __aws_sdk_client_iam.GetRoleCommand({ RoleName: name }));
-		await iam.send(new __aws_sdk_client_iam.UpdateAssumeRolePolicyCommand({
+		const { Role } = await iam.send(new _aws_sdk_client_iam.GetRoleCommand({ RoleName: name }));
+		await iam.send(new _aws_sdk_client_iam.UpdateAssumeRolePolicyCommand({
 			RoleName: name,
 			PolicyDocument: trust
 		}));
 		arn = Role.Arn;
 	} catch (error) {
 		if (error.name !== "NoSuchEntityException") throw error;
-		const { Role } = await iam.send(new __aws_sdk_client_iam.CreateRoleCommand({
+		const { Role } = await iam.send(new _aws_sdk_client_iam.CreateRoleCommand({
 			RoleName: name,
 			AssumeRolePolicyDocument: trust,
 			Description: "Deploys from GitHub Actions (gkm deploy:github)",
-			MaxSessionDuration: 3600 * 2
+			MaxSessionDuration: 7200
 		}));
 		arn = Role.Arn;
 	}
-	await iam.send(new __aws_sdk_client_iam.AttachRolePolicyCommand({
+	await iam.send(new _aws_sdk_client_iam.AttachRolePolicyCommand({
 		RoleName: name,
 		PolicyArn: policyArn
 	}));
@@ -111,7 +117,7 @@ async function iamFor(profile, endpoint) {
 			secretAccessKey: "test"
 		};
 	}
-	return new __aws_sdk_client_iam.IAMClient(config);
+	return new _aws_sdk_client_iam.IAMClient(config);
 }
 async function deployGithubCommand(options, deps = {}) {
 	const gh = deps.gh ?? defaultGh;
@@ -126,7 +132,7 @@ async function deployGithubCommand(options, deps = {}) {
 		".nameWithOwner"
 	]);
 	const role = roleName(workspace.name, options.stage);
-	const policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;
+	const policyArn = options.policyArn ?? "arn:aws:iam::aws:policy/AdministratorAccess";
 	const keyPath = require_keystore.getKeyPath(options.stage, workspace.name);
 	const hasKey = (0, node_fs.existsSync)(keyPath);
 	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
@@ -141,11 +147,10 @@ async function deployGithubCommand(options, deps = {}) {
 		return { repo };
 	}
 	const iam = deps.iam ?? await iamFor(options.profile);
-	const providerArn = await ensureOidcProvider(iam).catch((error) => {
+	const roleArn = await ensureRole(iam, role, trustPolicy(await ensureOidcProvider(iam).catch((error) => {
 		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
 		throw error;
-	});
-	const roleArn = await ensureRole(iam, role, trustPolicy(providerArn, repo, options.stage), policyArn);
+	}), repo, options.stage), policyArn);
 	logger.log(`\n  ✓ AWS: ${roleArn}`);
 	gh([
 		"api",
@@ -185,13 +190,14 @@ async function deployGithubCommand(options, deps = {}) {
 }
 /** The profile's SSO login has lapsed; the fix is one command away. */
 var SsoSessionExpired = class extends Error {
+	profile;
 	constructor(profile) {
 		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
 		this.profile = profile;
 		this.name = "SsoSessionExpired";
 	}
 };
-
 //#endregion
 exports.deployGithubCommand = deployGithubCommand;
-//# sourceMappingURL=github-BThvbf2W.cjs.map
+
+//# sourceMappingURL=github-BfflNPVe.cjs.map

package/dist/{github-BThvbf2W.cjs.map → github-BfflNPVe.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"github-BThvbf2W.cjs","names":["defaultGh: Gh","project: string","stage: string","providerArn: string","repo: string","iam: IAMClient","ListOpenIDConnectProvidersCommand","CreateOpenIDConnectProviderCommand","name: string","trust: string","policyArn: string","arn: string","GetRoleCommand","UpdateAssumeRolePolicyCommand","CreateRoleCommand","AttachRolePolicyCommand","profile?: string","endpoint?: string","config: IAMClientConfig","IAMClient","options: DeployGithubOptions","deps: { iam?: IAMClient; gh?: Gh; cwd?: string }","profile: string"],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as\n * `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath } from '../secrets/keystore.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\tconst keyPath = getKeyPath(options.stage, workspace.name);\n\tconst hasKey = existsSync(keyPath);\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tlogger.log(\n\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t);\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\treadFileSync(keyPath, 'utf-8').trim(),\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;;AAgCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;;;;;AAMjB,MAAa,qBAAqB;AAgBlC,MAAMA,YAAgB,CAAC,MAAM,UAC5B,qCAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,mBACD,CAAE,IACF;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAO;CAAW;AACtD,EAAC,CAAC,MAAM;;AAGV,SAAgB,SAASC,SAAiBC,OAAuB;AAChE,QAAO,CAAC,EAAE,QAAQ,UAAU,MAAM,EAChC,aAAa,CACb,QAAQ,qBAAqB,IAAI,CACjC,MAAM,GAAG,GAAG;AACd;;;;;;;AAQD,SAAgB,YACfC,aACAC,MACAF,OACS;AACT,QAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAa;GACrC,QAAQ;GACR,WAAW,EACV,cAAc;MACX,EAAE,iBAAiB,QAAQ;MAC3B,EAAE,iBAAiB,SAAS,OAAO,KAAK,eAAe,MAAM;GAC/D,EACD;EACD,CACD;CACD,EAAC;AACF;;AAGD,eAAsB,mBAAmBG,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAE,GAAE,GAAG,MAAM,IAAI,KACpD,IAAIC,uDAAkC,CAAE,GACxC;CACD,MAAM,WAAW,0BAA0B,KAAK,CAAC,MAChD,EAAE,KAAK,UAAU,gBAAgB,iBAAiB,EAAE,CACpD,EAAE;AACH,KAAI,SAAU,QAAO;CAErB,MAAM,UAAU,MAAM,IAAI,KACzB,IAAIC,wDAAmC;EACtC,MAAM,UAAU,iBAAiB;EACjC,cAAc,CAAC,QAAS;CACxB,GACD;AACD,QAAO,QAAQ;AACf;;AAGD,eAAsB,WACrBF,KACAG,MACAC,OACAC,WACkB;CAClB,IAAIC;AACJ,KAAI;EACH,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAAK,IAAIC,oCAAe,EAAE,UAAU,KAAM,GAAE;AACvE,QAAM,IAAI,KACT,IAAIC,mDAA8B;GACjC,UAAU;GACV,gBAAgB;EAChB,GACD;AACD,QAAM,KAAM;CACZ,SAAQ,OAAO;AACf,MAAK,MAA4B,SAAS,wBACzC,OAAM;EAEP,MAAM,EAAE,MAAM,GAAG,MAAM,IAAI,KAC1B,IAAIC,uCAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB,OAAO;EAC3B,GACD;AACD,QAAM,KAAM;CACZ;AAGD,OAAM,IAAI,KACT,IAAIC,6CAAwB;EAAE,UAAU;EAAM,WAAW;CAAW,GACpE;AACD,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,OACrBC,SACAC,UACqB;CACrB,MAAMC,SAA0B,EAAE,QAAQ,YAAa;AACvD,KAAI,SAAS;EACZ,MAAM,EAAE,SAAS,GAAG,MAAM,OAAO;AACjC,SAAO,cAAc,QAAQ,EAAE,QAAS,EAAC;CACzC;AACD,KAAI,UAAU;AACb,SAAO,WAAW;AAClB,SAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAQ;CACrE;AACD,QAAO,IAAIC,+BAAU;AACrB;AAED,eAAsB,oBACrBC,SACAC,OAAmD,CAAE,GACP;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,WAAW,GAAG,MAAM,mCAAoB,KAAK,IAAI;AACzD,uCAAoB,UAAU,QAAQ,QAAQ,MAAM;CAEpD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAiB,EAAC;CACxE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,MAAM;CACpD,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,UAAU,4BAAW,QAAQ,OAAO,UAAU,KAAK;CACzD,MAAM,SAAS,wBAAW,QAAQ;AAElC,QAAO,KAAK,+BAA+B,QAAQ,MAAM,KAAK;AAC9D,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KAAK,kBAAkB,QAAQ,WAAW,wBAAwB,EAAE;AAC3E,QAAO,KAAK,kBAAkB,KAAK,EAAE;AACrC,QAAO,KACL,kBAAkB,UAAU,EAAE,QAAQ,YAAY,KAAK,sCAAsC,EAC9F;AACD,QAAO,KAAK,uBAAuB,KAAK,eAAe,QAAQ,MAAM,OAAO;AAC5E,QAAO,KACL,kBAAkB,SAAS,WAAW,UAAU,QAAQ,kCAAkC,QAAQ,MAAM,QAAQ,EACjH;AAED,KAAI,QAAQ,QAAQ;AACnB,SAAO,IAAI,oCAAoC;AAC/C,SAAO,EAAE,KAAM;CACf;CAED,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,QAAQ;CACtD,MAAM,cAAc,MAAM,mBAAmB,IAAI,CAAC,MAAM,CAAC,UAAU;AAGlE,MAAI,eAAe,KAAK,OAAO,OAAO,QAAQ,CAAC,IAAI,QAAQ,QAC1D,OAAM,IAAI,kBAAkB,QAAQ;AAErC,QAAM;CACN,EAAC;CACF,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,aAAa,MAAM,QAAQ,MAAM,EAC7C,UACA;AACD,QAAO,KAAK,aAAa,QAAQ,EAAE;AAGnC,IAAG;EAAC;EAAO;EAAY;GAAQ,QAAQ,KAAK,gBAAgB,QAAQ,MAAM;CAAE,EAAC;AAC7E,IAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACA,EAAC;AACF,QAAO,KAAK,2BAA2B,QAAQ,MAAM,iBAAiB;AAEtE,KAAI,QAAQ;AAEX,KACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACA,GACD,0BAAa,SAAS,QAAQ,CAAC,MAAM,CACrC;AACD,SAAO,IAAI,8BAA8B;CACzC,MACA,QAAO,KACL,0BAA0B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,oBACzF;AAGF,QAAO,KACL,iDAAiD,QAAQ,MAAM,6CAChE;AACD,QAAO;EAAE;EAAS;CAAM;AACxB;;AAGD,IAAa,oBAAb,cAAuC,MAAM;CAC5C,YAAqBC,SAAiB;AACrC,SACE,+BAA+B,QAAQ,4DAA4D,QAAQ,EAC5G;EAHmB;AAIpB,OAAK,OAAO;CACZ;AACD"}
+{"version":3,"file":"github-BfflNPVe.cjs","names":["execFileSync","ListOpenIDConnectProvidersCommand","CreateOpenIDConnectProviderCommand","GetRoleCommand","UpdateAssumeRolePolicyCommand","CreateRoleCommand","AttachRolePolicyCommand","IAMClient","loadWorkspaceConfig","getKeyPath","existsSync","readFileSync"],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as\n * `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath } from '../secrets/keystore.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\tconst keyPath = getKeyPath(options.stage, workspace.name);\n\tconst hasKey = existsSync(keyPath);\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tlogger.log(\n\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t);\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\treadFileSync(keyPath, 'utf-8').trim(),\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;AAsBjB,MAAM,aAAiB,MAAM,WAAA,GAC5BA,mBAAAA,aAAAA,CAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,UAAU,KAAA,IACX,CAAC,IACD;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAM;CAAW;AACtD,CAAC,CAAC,CAAC,KAAK;;AAGT,SAAgB,SAAS,SAAiB,OAAuB;CAChE,OAAO,GAAG,QAAQ,UAAU,QAC1B,YAAY,CAAC,CACb,QAAQ,qBAAqB,GAAG,CAAC,CACjC,MAAM,GAAG,EAAE;AACd;;;;;;;AAQA,SAAgB,YACf,aACA,MACA,OACS;CACT,OAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAY;GACpC,QAAQ;GACR,WAAW,EACV,cAAc;KACZ,GAAG,iBAAiB,QAAQ;KAC5B,GAAG,iBAAiB,QAAQ,QAAQ,KAAK,eAAe;GAC1D,EACD;EACD,CACD;CACD,CAAC;AACF;;AAGA,eAAsB,mBAAmB,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAC,MAAM,MAAM,IAAI,KACpD,IAAIC,oBAAAA,kCAAkC,CAAC,CAAC,CACzC;CACA,MAAM,WAAW,0BAA0B,MAAM,MAChD,EAAE,KAAK,SAAS,iBAAiB,kBAAkB,CACpD,CAAC,EAAE;CACH,IAAI,UAAU,OAAO;CAQrB,QAAO,MANe,IAAI,KACzB,IAAIC,oBAAAA,mCAAmC;EACtC,KAAK,WAAW;EAChB,cAAc,CAAC,QAAQ;CACxB,CAAC,CACF,EAAA,CACe;AAChB;;AAGA,eAAsB,WACrB,KACA,MACA,OACA,WACkB;CAClB,IAAI;CACJ,IAAI;EACH,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,IAAIC,oBAAAA,eAAe,EAAE,UAAU,KAAK,CAAC,CAAC;EACtE,MAAM,IAAI,KACT,IAAIC,oBAAAA,8BAA8B;GACjC,UAAU;GACV,gBAAgB;EACjB,CAAC,CACF;EACA,MAAM,KAAM;CACb,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,yBACzC,MAAM;EAEP,MAAM,EAAE,SAAS,MAAM,IAAI,KAC1B,IAAIC,oBAAAA,kBAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB;EACrB,CAAC,CACF;EACA,MAAM,KAAM;CACb;CAGA,MAAM,IAAI,KACT,IAAIC,oBAAAA,wBAAwB;EAAE,UAAU;EAAM,WAAW;CAAU,CAAC,CACrE;CACA,OAAO;AACR;;;;;;;;;;;AAYA,eAAsB,OACrB,SACA,UACqB;CACrB,MAAM,SAA0B,EAAE,QAAQ,YAAY;CACtD,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CACA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAO;CACrE;CACA,OAAO,IAAIC,oBAAAA,UAAU,MAAM;AAC5B;AAEA,eAAsB,oBACrB,SACA,OAAmD,CAAC,GACN;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,cAAc,MAAMC,eAAAA,oBAAoB,KAAK,GAAG;CACxD,kBAAA,oBAAoB,UAAU,QAAQ,QAAQ,KAAK;CAEnD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAgB,CAAC;CACvE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,KAAK;CACnD,MAAM,YAAY,QAAQ,aAAA;CAC1B,MAAM,UAAUC,iBAAAA,WAAW,QAAQ,OAAO,UAAU,IAAI;CACxD,MAAM,UAAA,GAASC,QAAAA,WAAAA,CAAW,OAAO;CAEjC,OAAO,IAAI,gCAAgC,QAAQ,MAAM,IAAI;CAC7D,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IAAI,mBAAmB,QAAQ,WAAW,yBAAyB;CAC1E,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IACN,mBAAmB,YAAY,QAAQ,YAAY,KAAK,uCACzD;CACA,OAAO,IAAI,wBAAwB,KAAK,eAAe,QAAQ,MAAM,MAAM;CAC3E,OAAO,IACN,mBAAmB,SAAS,UAAU,WAAW,QAAQ,kCAAkC,QAAQ,MAAM,SAC1G;CAEA,IAAI,QAAQ,QAAQ;EACnB,OAAO,IAAI,mCAAmC;EAC9C,OAAO,EAAE,KAAK;CACf;CAEA,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,OAAO;CASrD,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,MAXa,mBAAmB,GAAG,CAAC,CAAC,OAAO,UAAU;EAGlE,IAAI,eAAe,KAAK,OAAO,OAAO,OAAO,CAAC,KAAK,QAAQ,SAC1D,MAAM,IAAI,kBAAkB,QAAQ,OAAO;EAE5C,MAAM;CACP,CAAC,GAIyB,MAAM,QAAQ,KAAK,GAC5C,SACD;CACA,OAAO,IAAI,cAAc,SAAS;CAGlC,GAAG;EAAC;EAAO;EAAY;EAAO,SAAS,KAAK,gBAAgB,QAAQ;CAAO,CAAC;CAC5E,GAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACD,CAAC;CACD,OAAO,IAAI,4BAA4B,QAAQ,MAAM,gBAAgB;CAErE,IAAI,QAAQ;EAEX,GACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACD,IAAA,GACAC,QAAAA,aAAAA,CAAa,SAAS,OAAO,CAAC,CAAC,KAAK,CACrC;EACA,OAAO,IAAI,6BAA6B;CACzC,OACC,OAAO,IACN,2BAA2B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,mBAC1F;CAGD,OAAO,IACN,kDAAkD,QAAQ,MAAM,4CACjE;CACA,OAAO;EAAE;EAAS;CAAK;AACxB;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CACvB;CAArB,YAAY,SAA0B;EACrC,MACC,gCAAgC,QAAQ,4DAA4D,SACrG;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD"}

package/dist/{github-DpMZurEK.mjs → github-CRwnxKmD.mjs}

@@ -1,20 +1,28 @@
-import "./discover-BYHQwQqu.mjs";
-import { loadWorkspaceConfig } from "./config-DTsVjKZD.mjs";
-import { assertDeployedStage } from "./workspace-CtnZnWsa.mjs";
-import { getKeyPath } from "./keystore-TxeYM7an.mjs";
+import { o as loadWorkspaceConfig } from "./config-pqGD3hF9.mjs";
+import { w as assertDeployedStage } from "./workspace-CgwmXEtc.mjs";
+import { t as getKeyPath } from "./keystore-B4PRlbgE.mjs";
 import { existsSync, readFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { AttachRolePolicyCommand, CreateOpenIDConnectProviderCommand, CreateRoleCommand, GetRoleCommand, IAMClient, ListOpenIDConnectProvidersCommand, UpdateAssumeRolePolicyCommand } from "@aws-sdk/client-iam";
-
 //#region src/deploy/github.ts
+/**
+* `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.
+*
+* A stage usually lives in its own AWS account — staging in one, production in
+* another — so this runs once per stage, with that account's profile:
+*
+*   gkm deploy:github --stage staging --profile acme-dev
+*   gkm deploy:github --stage prod    --profile acme-prod
+*
+* In the stage's account it makes sure GitHub's OIDC provider exists, and a
+* role that only this repository's `<stage>` environment can assume. On
+* GitHub it creates that environment and gives it what the generated deploy
+* workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as
+* `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.
+*/
 const logger = console;
 const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
 const AUDIENCE = "sts.amazonaws.com";
-/**
-* What SST needs to create a stack is most of AWS, so this is the default —
-* said out loud in the output, and replaceable with `--policy-arn`.
-*/
-const DEFAULT_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";
 const defaultGh = (args, input) => execFileSync("gh", args, {
 	encoding: "utf-8",
 	...input === void 0 ? {} : {
@@ -55,11 +63,10 @@ async function ensureOidcProvider(iam) {
 	const { OpenIDConnectProviderList = [] } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
 	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
 	if (existing) return existing;
-	const created = await iam.send(new CreateOpenIDConnectProviderCommand({
+	return (await iam.send(new CreateOpenIDConnectProviderCommand({
 		Url: `https://${GITHUB_OIDC_HOST}`,
 		ClientIDList: [AUDIENCE]
-	}));
-	return created.OpenIDConnectProviderArn;
+	}))).OpenIDConnectProviderArn;
 }
 /** The deploy role, created or brought back to this trust and policy. */
 async function ensureRole(iam, name, trust, policyArn) {
@@ -77,7 +84,7 @@ async function ensureRole(iam, name, trust, policyArn) {
 			RoleName: name,
 			AssumeRolePolicyDocument: trust,
 			Description: "Deploys from GitHub Actions (gkm deploy:github)",
-			MaxSessionDuration: 3600 * 2
+			MaxSessionDuration: 7200
 		}));
 		arn = Role.Arn;
 	}
@@ -125,7 +132,7 @@ async function deployGithubCommand(options, deps = {}) {
 		".nameWithOwner"
 	]);
 	const role = roleName(workspace.name, options.stage);
-	const policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;
+	const policyArn = options.policyArn ?? "arn:aws:iam::aws:policy/AdministratorAccess";
 	const keyPath = getKeyPath(options.stage, workspace.name);
 	const hasKey = existsSync(keyPath);
 	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
@@ -140,11 +147,10 @@ async function deployGithubCommand(options, deps = {}) {
 		return { repo };
 	}
 	const iam = deps.iam ?? await iamFor(options.profile);
-	const providerArn = await ensureOidcProvider(iam).catch((error) => {
+	const roleArn = await ensureRole(iam, role, trustPolicy(await ensureOidcProvider(iam).catch((error) => {
 		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
 		throw error;
-	});
-	const roleArn = await ensureRole(iam, role, trustPolicy(providerArn, repo, options.stage), policyArn);
+	}), repo, options.stage), policyArn);
 	logger.log(`\n  ✓ AWS: ${roleArn}`);
 	gh([
 		"api",
@@ -184,13 +190,14 @@ async function deployGithubCommand(options, deps = {}) {
 }
 /** The profile's SSO login has lapsed; the fix is one command away. */
 var SsoSessionExpired = class extends Error {
+	profile;
 	constructor(profile) {
 		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
 		this.profile = profile;
 		this.name = "SsoSessionExpired";
 	}
 };
-
 //#endregion
 export { deployGithubCommand };
-//# sourceMappingURL=github-DpMZurEK.mjs.map
+
+//# sourceMappingURL=github-CRwnxKmD.mjs.map

package/dist/github-CRwnxKmD.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-CRwnxKmD.mjs","names":[],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and the stage's secrets key as\n * `GKM_SECRETS_KEY`. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath } from '../secrets/keystore.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\tconst keyPath = getKeyPath(options.stage, workspace.name);\n\tconst hasKey = existsSync(keyPath);\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tlogger.log(\n\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t);\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\treadFileSync(keyPath, 'utf-8').trim(),\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;AAsBjB,MAAM,aAAiB,MAAM,UAC5B,aAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,UAAU,KAAA,IACX,CAAC,IACD;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAM;CAAW;AACtD,CAAC,CAAC,CAAC,KAAK;;AAGT,SAAgB,SAAS,SAAiB,OAAuB;CAChE,OAAO,GAAG,QAAQ,UAAU,QAC1B,YAAY,CAAC,CACb,QAAQ,qBAAqB,GAAG,CAAC,CACjC,MAAM,GAAG,EAAE;AACd;;;;;;;AAQA,SAAgB,YACf,aACA,MACA,OACS;CACT,OAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAY;GACpC,QAAQ;GACR,WAAW,EACV,cAAc;KACZ,GAAG,iBAAiB,QAAQ;KAC5B,GAAG,iBAAiB,QAAQ,QAAQ,KAAK,eAAe;GAC1D,EACD;EACD,CACD;CACD,CAAC;AACF;;AAGA,eAAsB,mBAAmB,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAC,MAAM,MAAM,IAAI,KACpD,IAAI,kCAAkC,CAAC,CAAC,CACzC;CACA,MAAM,WAAW,0BAA0B,MAAM,MAChD,EAAE,KAAK,SAAS,iBAAiB,kBAAkB,CACpD,CAAC,EAAE;CACH,IAAI,UAAU,OAAO;CAQrB,QAAO,MANe,IAAI,KACzB,IAAI,mCAAmC;EACtC,KAAK,WAAW;EAChB,cAAc,CAAC,QAAQ;CACxB,CAAC,CACF,EAAA,CACe;AAChB;;AAGA,eAAsB,WACrB,KACA,MACA,OACA,WACkB;CAClB,IAAI;CACJ,IAAI;EACH,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,KAAK,CAAC,CAAC;EACtE,MAAM,IAAI,KACT,IAAI,8BAA8B;GACjC,UAAU;GACV,gBAAgB;EACjB,CAAC,CACF;EACA,MAAM,KAAM;CACb,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,yBACzC,MAAM;EAEP,MAAM,EAAE,SAAS,MAAM,IAAI,KAC1B,IAAI,kBAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB;EACrB,CAAC,CACF;EACA,MAAM,KAAM;CACb;CAGA,MAAM,IAAI,KACT,IAAI,wBAAwB;EAAE,UAAU;EAAM,WAAW;CAAU,CAAC,CACrE;CACA,OAAO;AACR;;;;;;;;;;;AAYA,eAAsB,OACrB,SACA,UACqB;CACrB,MAAM,SAA0B,EAAE,QAAQ,YAAY;CACtD,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CACA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAO;CACrE;CACA,OAAO,IAAI,UAAU,MAAM;AAC5B;AAEA,eAAsB,oBACrB,SACA,OAAmD,CAAC,GACN;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,cAAc,MAAM,oBAAoB,KAAK,GAAG;CACxD,oBAAoB,UAAU,QAAQ,QAAQ,KAAK;CAEnD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAgB,CAAC;CACvE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,KAAK;CACnD,MAAM,YAAY,QAAQ,aAAA;CAC1B,MAAM,UAAU,WAAW,QAAQ,OAAO,UAAU,IAAI;CACxD,MAAM,SAAS,WAAW,OAAO;CAEjC,OAAO,IAAI,gCAAgC,QAAQ,MAAM,IAAI;CAC7D,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IAAI,mBAAmB,QAAQ,WAAW,yBAAyB;CAC1E,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IACN,mBAAmB,YAAY,QAAQ,YAAY,KAAK,uCACzD;CACA,OAAO,IAAI,wBAAwB,KAAK,eAAe,QAAQ,MAAM,MAAM;CAC3E,OAAO,IACN,mBAAmB,SAAS,UAAU,WAAW,QAAQ,kCAAkC,QAAQ,MAAM,SAC1G;CAEA,IAAI,QAAQ,QAAQ;EACnB,OAAO,IAAI,mCAAmC;EAC9C,OAAO,EAAE,KAAK;CACf;CAEA,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,OAAO;CASrD,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,MAXa,mBAAmB,GAAG,CAAC,CAAC,OAAO,UAAU;EAGlE,IAAI,eAAe,KAAK,OAAO,OAAO,OAAO,CAAC,KAAK,QAAQ,SAC1D,MAAM,IAAI,kBAAkB,QAAQ,OAAO;EAE5C,MAAM;CACP,CAAC,GAIyB,MAAM,QAAQ,KAAK,GAC5C,SACD;CACA,OAAO,IAAI,cAAc,SAAS;CAGlC,GAAG;EAAC;EAAO;EAAY;EAAO,SAAS,KAAK,gBAAgB,QAAQ;CAAO,CAAC;CAC5E,GAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACD,CAAC;CACD,OAAO,IAAI,4BAA4B,QAAQ,MAAM,gBAAgB;CAErE,IAAI,QAAQ;EAEX,GACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACD,GACA,aAAa,SAAS,OAAO,CAAC,CAAC,KAAK,CACrC;EACA,OAAO,IAAI,6BAA6B;CACzC,OACC,OAAO,IACN,2BAA2B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,mBAC1F;CAGD,OAAO,IACN,kDAAkD,QAAQ,MAAM,4CACjE;CACA,OAAO;EAAE;EAAS;CAAK;AACxB;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CACvB;CAArB,YAAY,SAA0B;EACrC,MACC,gCAAgC,QAAQ,4DAA4D,SACrG;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD"}

package/dist/{index-BzJ7QJ9c.d.mts → index-Cd-qeOam.d.mts}

@@ -1,7 +1,5 @@
-import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-DVIx8I1N.mjs";
-
+import { C as WorkspaceInput, E as Framework, S as WorkspaceConfig, a as Routes, g as LoadedConfig, h as InferredWorkspaceConfig, l as AppsRecord, r as GkmConfig, y as NormalizedWorkspace } from "./types-BGo5TaNE.mjs";
 //#region src/workspace/publicEnv.d.ts
-
 /**
  * All public env-var prefixes the toolbox understands.
  *
@@ -30,8 +28,6 @@ declare function getPublicEnvPrefix(framework?: Framework): string;
  * Returns the un-prefixed name, or `null` if no prefix matched.
  */
 declare function stripPublicPrefix(name: string): string | null;
-//# sourceMappingURL=publicEnv.d.ts.map
-
 //#endregion
 //#region src/workspace/index.d.ts
 /**
@@ -165,7 +161,6 @@ declare function getEndpointForStage(dokployConfig: {
   endpoint?: string;
   endpoints?: Record<string, string>;
 } | undefined, stage: string): string | undefined;
-//# sourceMappingURL=index.d.ts.map
 //#endregion
-export { PUBLIC_ENV_PREFIXES, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getEndpointForStage, getPublicEnvPrefix, normalizeWorkspace, processConfig, stripPublicPrefix, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
-//# sourceMappingURL=index-BzJ7QJ9c.d.mts.map
+export { getAppBuildOrder as a, getEndpointForStage as c, workspaceConstructGlobs as d, wrapSingleAppAsWorkspace as f, stripPublicPrefix as h, defineWorkspace as i, normalizeWorkspace as l, getPublicEnvPrefix as m, appConstructGlobs as n, getAppGkmConfig as o, PUBLIC_ENV_PREFIXES as p, constructPatterns as r, getDependencyEnvVars as s, allConstructGlobs as t, processConfig as u };
+//# sourceMappingURL=index-Cd-qeOam.d.mts.map

package/dist/index-Cd-qeOam.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-Cd-qeOam.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"mappings":";;;;;;;;;cASa;;;;;;;;;;;;;;;iBAoBG,mBAAmB,YAAY;;;;;iBAoB/B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC4ElB,sBAAsB,cAAc,YACnD,QAAQ,eAAe,SACrB,wBAAwB;;;;iBA8BX,mBACf,QAAQ,iBACR,cACE;;;;;iBA8Ca,yBACf,QAAQ,WACR,cACE;;;;;iBA0Da,cACf,QAAQ,YAAY,iBACpB,cACE;;;;;;;iBA6Ba,wBACf,WAAW;;;;;;;;;;;;iBAkBI,kBACf,WAAW,qBACX;;;;;;;iBAsBe,kBAAkB,WAAW;;iBAa7B,kBAAkB,QAAQ;;;;;iBAiB1B,gBACf,WAAW,qBACX,kBACE;;;;;iBAkCa,iBAAiB,WAAW;;;;;;;;;;iBAmC5B,qBACf,WAAW,qBACX,iBACA,qBACE;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,oBACf;EACK;EAAmB,YAAY;eAEpC"}

package/dist/{index-CfMjtdVC.d.cts → index-D-iAVHx-.d.cts}

@@ -1,7 +1,5 @@
-import { AppsRecord, Framework, GkmConfig, InferredWorkspaceConfig, LoadedConfig, NormalizedWorkspace, Routes, WorkspaceConfig, WorkspaceInput } from "./types-PMP_qXRY.cjs";
-
+import { C as WorkspaceInput, E as Framework, S as WorkspaceConfig, a as Routes, g as LoadedConfig, h as InferredWorkspaceConfig, l as AppsRecord, r as GkmConfig, y as NormalizedWorkspace } from "./types-C5ZNpUad.cjs";
 //#region src/workspace/publicEnv.d.ts
-
 /**
  * All public env-var prefixes the toolbox understands.
  *
@@ -30,8 +28,6 @@ declare function getPublicEnvPrefix(framework?: Framework): string;
  * Returns the un-prefixed name, or `null` if no prefix matched.
  */
 declare function stripPublicPrefix(name: string): string | null;
-//# sourceMappingURL=publicEnv.d.ts.map
-
 //#endregion
 //#region src/workspace/index.d.ts
 /**
@@ -165,7 +161,6 @@ declare function getEndpointForStage(dokployConfig: {
   endpoint?: string;
   endpoints?: Record<string, string>;
 } | undefined, stage: string): string | undefined;
-//# sourceMappingURL=index.d.ts.map
 //#endregion
-export { PUBLIC_ENV_PREFIXES, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getEndpointForStage, getPublicEnvPrefix, normalizeWorkspace, processConfig, stripPublicPrefix, workspaceConstructGlobs, wrapSingleAppAsWorkspace };
-//# sourceMappingURL=index-CfMjtdVC.d.cts.map
+export { getAppBuildOrder as a, getEndpointForStage as c, workspaceConstructGlobs as d, wrapSingleAppAsWorkspace as f, stripPublicPrefix as h, defineWorkspace as i, normalizeWorkspace as l, getPublicEnvPrefix as m, appConstructGlobs as n, getAppGkmConfig as o, PUBLIC_ENV_PREFIXES as p, constructPatterns as r, getDependencyEnvVars as s, allConstructGlobs as t, processConfig as u };
+//# sourceMappingURL=index-D-iAVHx-.d.cts.map

package/dist/index-D-iAVHx-.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-D-iAVHx-.d.cts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"mappings":";;;;;;;;;cASa;;;;;;;;;;;;;;;iBAoBG,mBAAmB,YAAY;;;;;iBAoB/B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBC4ElB,sBAAsB,cAAc,YACnD,QAAQ,eAAe,SACrB,wBAAwB;;;;iBA8BX,mBACf,QAAQ,iBACR,cACE;;;;;iBA8Ca,yBACf,QAAQ,WACR,cACE;;;;;iBA0Da,cACf,QAAQ,YAAY,iBACpB,cACE;;;;;;;iBA6Ba,wBACf,WAAW;;;;;;;;;;;;iBAkBI,kBACf,WAAW,qBACX;;;;;;;iBAsBe,kBAAkB,WAAW;;iBAa7B,kBAAkB,QAAQ;;;;;iBAiB1B,gBACf,WAAW,qBACX,kBACE;;;;;iBAkCa,iBAAiB,WAAW;;;;;;;;;;iBAmC5B,qBACf,WAAW,qBACX,iBACA,qBACE;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,oBACf;EACK;EAAmB,YAAY;eAEpC"}