npm - @geekmidas/cli - Versions diffs - 10.0.0-alpha.122 → 10.0.0-alpha.124 - Mend

@geekmidas/cli 10.0.0-alpha.122 → 10.0.0-alpha.124

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (263) hide show

package/dist/SubscriberGenerator-COAVPgM-.mjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SubscriberGenerator-COAVPgM-.mjs","names":[],"sources":["../src/types.ts","../src/generators/subscriberRoute.ts","../src/reconcile/fakes.ts","../src/generators/SubscriberGenerator.ts"],"sourcesContent":["import type {\n\tDevConfig,\n\tSecretsConfig,\n\tStagesConfig,\n\tTestConfig,\n} from './workspace/types.js';\n\nexport type MainProvider = 'aws' | 'server';\n\nexport type Routes = string | string[];\n\n/**\n * Supported event backend types.\n *\n * - `pgboss`: Reuses PostgreSQL with a dedicated user/schema. Auto-enables db service.\n * - `sns`: Adds the AWS emulator (floci) container; each topic and queue is\n * created on it and addressed by its own string.\n * - `rabbitmq`: Adds RabbitMQ container.\n *\n * Each topic and queue resolves its own `<ID>_PUBLISHER_CONNECTION_STRING`,\n * which its producers and its consumers both read. pg-boss and RabbitMQ also\n * resolve `EVENT_PUBLISHER_CONNECTION_STRING`, the one broker crons schedule\n * through.\n */\nexport type EventsBackend = 'pgboss' | 'sns' | 'rabbitmq';\n\n/**\n * Where a declared cache actually lives.\n *\n * A deployment choice, not an application one — the same code caches into any\n * of these — so it is config here beside `events` rather than a field on the\n * construct. Each backend is consistent between local and deployed, which is\n * the property worth having: a cache that behaves differently in the two places\n * is worse than a slower one.\n *\n * - `upstash` (default) — HTTP with a token. Reachable from a Lambda with no\n * VPC and no connection pool, which is why it is the default; locally the\n * `serverless-redis-http` proxy in front of Redis speaks the same protocol.\n * - `elasticache` — the Redis wire protocol, inside a VPC. Locally, plain Redis.\n * - `db` — a table in the database the app already declared. No infrastructure\n * at all, and the same relationship pg-boss has to Postgres: it creates its\n * own table on first use and needs a declared database to live in.\n * - `redis` — a Redis the stack runs beside the apps, on its network. It holds\n * *every* declared cache, one declared from a database included, so the\n * cache never competes with the database for its connections. Only the\n * compose target selects it today (`gkm compose`).\n */\nexport type CacheBackend = 'upstash' | 'elasticache' | 'db' | 'redis';\n\n/**\n * The backends a deploy target defaults to — every one but the compose\n * stack's own Redis, which only that target runs.\n */\nexport type TargetCacheBackend = Exclude<CacheBackend, 'redis'>;\n\n/** Whether `value` names a cache backend. */\nexport function isCacheBackend(value: string): value is CacheBackend {\n\treturn (\n\t\tvalue === 'upstash' ||\n\t\tvalue === 'elasticache' ||\n\t\tvalue === 'db' ||\n\t\tvalue === 'redis'\n\t);\n}\n\n/**\n * Whether a backend holds every declared cache, a cache declared from a\n * database (`database.cache('Sessions')`) included.\n *\n * Every other backend leaves such a cache where its declaration put it: the\n * declaration is the stronger statement. The stack's own Redis is the\n * exception, because a stack that runs one runs it *for* the cache — a table\n * beside it would be a second cache nobody asked for.\n */\nexport function holdsEveryCache(backend: CacheBackend): boolean {\n\treturn backend === 'redis';\n}\n\n/**\n * Where a declared bucket actually lives.\n *\n * The fourth of these selectors and the last to arrive, which is why\n * `UPLOADS_URL` had no answer on a container target: there was nothing to\n * choose with. Like the others it changes no application code — the `s3://`\n * scheme picks the driver, and every one of these speaks it.\n *\n * - `s3` — a real bucket. Nothing is created on the host; the URL is composed\n * against credentials you already hold, the same way `resend` is an API key\n * rather than infrastructure.\n * - `r2` — Cloudflare's, reached through the same S3 API and differing only in\n * its endpoint.\n * - `minio` — a container. Everything the app declares lives on the box, which\n * is what makes a single-host deploy self-contained, and what makes it a\n * single disk with no replication. Locally this is what every backend is.\n */\nexport type StorageBackend = 'minio' | 's3' | 'r2';\n\n/**\n * The backend a project gets when it says nothing, by where it deploys.\n *\n * Flat defaults could not be right for both: `upstash` on a single box means a\n * SaaS round-trip for a cache the database could have held, and `minio` on AWS\n * means running a bucket beside S3. So the default is a function of the target,\n * and an app that says nothing gets the obvious answer in both places — which\n * is the whole of what \"zero config\" can mean once there is more than one\n * target.\n *\n * `server` covers Dokploy and a bare host alike: the question these answer is\n * whether the app is next to a managed cloud or next to its own containers, and\n * on that question the two are the same.\n *\n * A per-construct, per-stage override is the layer above this — see\n * `constructs-outstanding.md` — so two buckets in one app can differ. This is\n * only what happens when nobody has said anything at all.\n */\nexport const DEFAULT_CACHE: Record<MainProvider, TargetCacheBackend> = {\n\t// Reachable from a Lambda with no VPC and no connection pool.\n\taws: 'upstash',\n\t// The database is already there and already has a connection pool open to\n\t// it. Anything else is a second service to run for a table.\n\tserver: 'db',\n};\n\n/**\n * Which broker carries a declared queue or topic, by target.\n *\n * Whether there are events at all is the manifest's answer — a declared\n * `Topic` or `Queue` — so this only ever answers the second question. AWS\n * deploys them to SNS and SQS, and locally the AWS emulator stands in, so the\n * broker a developer runs is the one production has. A server has a Postgres\n * already, and pg-boss keeps its queues there.\n */\nexport const DEFAULT_EVENTS: Record<MainProvider, EventsBackend> = {\n\taws: 'sns',\n\tserver: 'pgboss',\n};\n\n/** Where a bucket lives when nobody said — see {@link DEFAULT_CACHE}. */\nexport const DEFAULT_STORAGE: Record<MainProvider, StorageBackend> = {\n\taws: 's3',\n\tserver: 'minio',\n};\n\n/**\n * Who delivers a declared app's mail.\n *\n * Unlike a cache, this changes *nothing* about the client. Every backend speaks\n * SMTP, so the declaration's `smtp://` URL is true of all of them and only the\n * provisioner differs — which is the same reason the declaration has no\n * `provider` field and there is no `ses://` scheme.\n *\n * - `ses` (default) — the only backend that can be a *chain* of resources: an\n * identity, a user, an access key, and an SMTP password derived from it,\n * because SES issues IAM credentials rather than SMTP ones. Hand it a URL and\n * it uses that instead, which is what you want when the credentials already\n * exist — provisioning a second set of sending credentials for an identity\n * that already has them is not a thing to do by default.\n * - `resend` — an API key you hold, composed into an SMTP URL. Nothing to\n * provision: a SaaS account is not infrastructure.\n * - `smtp` — a URL supplied whole, for a relay somebody else runs.\n *\n * Locally every one of them is Mailpit, because locally none of it matters.\n */\nexport type EmailBackend = 'resend' | 'ses' | 'smtp';\n\n/**\n * Who delivers mail when nobody said.\n *\n * Flat, unlike the others, and deliberately: mail is a SaaS on every target.\n * There is no self-hosted preset to default a container deploy to — Mailpit is\n * a development inbox, not a sender — so `server` has no answer of its own to\n * give and would only be `ses` written twice.\n */\nexport const DEFAULT_EMAIL: EmailBackend = 'ses';\n\n/** Supported docker-compose service names */\nexport type ComposeServiceName =\n\t| 'postgres'\n\t| 'redis'\n\t| 'rabbitmq'\n\t| 'minio'\n\t| 'mailpit'\n\t| 'localstack';\n\nexport interface DockerConfig {\n\t/** Container registry URL (e.g., 'ghcr.io/myorg') */\n\tregistry?: string;\n\t/** Docker image name (default: derived from package.json name) */\n\timageName?: string;\n\t/** Base Docker image (default: 'node:22-alpine') */\n\tbaseImage?: string;\n\t/** Container port (default: 3000) */\n\tport?: number;\n}\n\nexport type Runtime = 'node' | 'bun';\n\nexport interface TelescopeConfig {\n\t/** Enable/disable telescope (default: true in development) */\n\tenabled?: boolean;\n\t/** Port for telescope to use (defaults to server port) */\n\tport?: number;\n\t/** Path prefix for telescope UI (default: /__telescope) */\n\tpath?: string;\n\t/** Ignore patterns for telescope (e.g., ['/health', '/metrics']) */\n\tignore?: string[];\n\t/** Record request/response bodies (default: true) */\n\trecordBody?: boolean;\n\t/** Maximum entries to keep in memory (default: 1000) */\n\tmaxEntries?: number;\n\t/** Enable WebSocket for real-time updates (default: true, requires @hono/node-ws for Node.js) */\n\twebsocket?: boolean;\n}\n\nexport interface OpenApiConfig {\n\t/** Enable OpenAPI generation (default: true) */\n\tenabled?: boolean;\n\t/** API title */\n\ttitle?: string;\n\t/** API version */\n\tversion?: string;\n\t/** API description */\n\tdescription?: string;\n}\n\nexport interface HooksConfig {\n\t/**\n\t * Path to a module exporting server lifecycle hooks.\n\t * The module should export `beforeSetup` and/or `afterSetup` functions.\n\t *\n\t * @example\n\t * ```typescript\n\t * // src/config/hooks.ts\n\t * import type { Hono } from 'hono';\n\t * import type { Logger } from '@geekmidas/logger';\n\t * import type { EnvironmentParser } from '@geekmidas/envkit';\n\t *\n\t * // Called BEFORE gkm endpoints are registered\n\t * export function beforeSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t * app.use('*', cors());\n\t * app.get('/custom/health', (c) => c.json({ status: 'ok' }));\n\t * }\n\t *\n\t * // Called AFTER gkm endpoints are registered\n\t * export function afterSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t * app.notFound((c) => c.json({ error: 'Not found' }, 404));\n\t * app.onError((err, c) => c.json({ error: err.message }, 500));\n\t * }\n\t * ```\n\t */\n\tserver?: string;\n}\n\nexport interface GkmConfig {\n\t/**\n\t * What this app is called, and therefore how everything it declares is named.\n\t *\n\t * The same field `sst.config.ts` carries, doing the same job: every physical\n\t * name is `{stage}-{name}-{construct}`, so `Database` in the `production`\n\t * stage of `kitchen-sink` is `production-kitchen-sink-database` on AWS and on\n\t * Dokploy alike. One statement, in the config, rather than a rule each\n\t * provider restates.\n\t *\n\t * `defineWorkspace` has always had this. A single-app config did not, so its\n\t * names fell back to whatever the directory happened to be called — the\n\t * monorepo's package name for the project and the app's for the application,\n\t * two accidents of layout standing in for a decision.\n\t *\n\t * Defaults to the package.json name with any scope stripped, then the\n\t * directory name.\n\t */\n\tname?: string;\n\t/** The project's stages: which one is local, which deploy */\n\tstages: StagesConfig;\n\t/** Encrypted secrets, and where deployed stages' secrets are stored */\n\tsecrets?: SecretsConfig;\n\t/** What `gkm test` hands a feature test: where the factories are. */\n\ttest?: TestConfig;\n\t/** How `gkm dev` is reached: the discovery endpoint's port and origins. */\n\tdev?: DevConfig;\n\t/**\n\t * Constructs glob pattern — one glob, every kind.\n\t *\n\t * What reconcile reads to derive the containers a stage needs: a database\n\t * implies Postgres, objects imply MinIO, mail implies Mailpit. A glob per\n\t * kind cannot find a resource, because a declared `ObjectStorage` has no\n\t * kind to be listed under.\n\t *\n\t * @example './src/**\\/*.ts'\n\t */\n\tconstructs: Routes;\n\t/**\n\t * Server lifecycle hooks for customizing the Hono app.\n\t * Allows adding custom routes, middleware, error handlers, etc.\n\t *\n\t * @example\n\t * hooks: {\n\t * server: './src/config/hooks'\n\t * }\n\t */\n\thooks?: HooksConfig;\n\t/**\n\t * Telescope configuration for debugging/monitoring.\n\t * Can be:\n\t * - A string path to a module that exports a Telescope instance (recommended)\n\t * - A boolean to enable/disable with defaults\n\t * - A TelescopeConfig object for inline configuration\n\t */\n\ttelescope?: string | boolean | TelescopeConfig;\n\t/**\n\t * OpenAPI generation configuration.\n\t * Can be:\n\t * - A boolean to enable/disable with defaults (output: ./src/api/openapi.ts)\n\t * - An OpenApiConfig object for customization\n\t *\n\t * When enabled, OpenAPI spec is generated on startup and regenerated on route changes.\n\t *\n\t * @example\n\t * openapi: true\n\t *\n\t * @example\n\t * openapi: {\n\t * output: './src/api/openapi.ts',\n\t * title: 'My API',\n\t * version: '1.0.0',\n\t * }\n\t */\n\topenapi?: boolean | OpenApiConfig;\n\t/** Runtime to use for dev server (default: 'node') */\n\truntime?: Runtime;\n\t/**\n\t * Environment file(s) to load for development.\n\t * Can be:\n\t * - A string path to a single env file (e.g., '.env.local')\n\t * - An array of paths to load in order (later files override earlier)\n\t * - Defaults to '.env' if not specified\n\t *\n\t * @example\n\t * env: '.env.local'\n\t *\n\t * @example\n\t * env: ['.env', '.env.local']\n\t */\n\tenv?: string | string[];\n\t/**\n\t * Docker deployment configuration.\n\t * Used by `gkm docker` and `gkm prepack` commands.\n\t *\n\t * @example\n\t * docker: {\n\t * registry: 'ghcr.io/myorg',\n\t * imageName: 'my-api',\n\t * compose: {\n\t * services: ['postgres', 'redis']\n\t * }\n\t * }\n\t */\n\tdocker?: DockerConfig;\n\t/**\n\t * Where this app deploys, and what the target needs to know.\n\t *\n\t * Absent until now, which meant a single-app project could not configure a\n\t * Dokploy deploy at all: the wrap that turns one into a workspace hardcoded\n\t * `{ default: 'dokploy' }` and dropped everything else, so there was no\n\t * endpoint, no registry and no domain — and `resolveHost` failed with \"no\n\t * domain configured for stage\" on a config that had nowhere to put one.\n\t *\n\t * The same shape a workspace config uses, so moving from one to the other is\n\t * a rename rather than a rewrite.\n\t */\n\tdeploy?: import('./workspace/types').DeployConfig;\n\t/** Each deployed stage's base domain — the same field a workspace has. */\n\tdomains?: import('./workspace/types').DomainsConfig;\n\t/** Each root domain's DNS provider — the same field a workspace has. */\n\tdns?: import('./workspace/types').WorkspaceDnsConfig;\n}\n\nexport interface BuildOptions {\n\t/** Overrides the deploy target's: a Dockerfile builds a server regardless. */\n\tprovider?: MainProvider;\n\t/**\n\t * Overrides the target's cache backend for the drivers the entry\n\t * registers — set by the Dockerfiles `gkm compose` writes, whose stack runs\n\t * its own Redis.\n\t */\n\tcache?: CacheBackend;\n\tenableOpenApi?: boolean;\n\t/** Build for production (no dev tools, bundled output) */\n\tproduction?: boolean;\n\t/** Skip bundling step in production build */\n\tskipBundle?: boolean;\n\t/** Stage for secrets injection (e.g., 'production', 'staging') */\n\tstage?: string;\n\t/**\n\t * When true, optional environment variables (those with `.optional()` or\n\t * `.default()` in the envParser) are suffixed with `?` within each\n\t * construct's `environment` array in the manifest (e.g. `PORT?`).\n\t * Defaults to false.\n\t */\n\tmarkOptional?: boolean;\n\t/**\n\t * Where the apps' own build scripts (turbo) run. Defaults to a\n\t * `LocalSandbox` on the workspace: this machine, with an allowlisted\n\t * environment.\n\t */\n\tsandbox?: import('./sandbox/sandbox').Sandbox;\n}\n\n/** Result from build command when secrets are injected */\nexport interface BuildResult {\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n// The deployment manifest types are a shared, dependency-free data contract\n// in `@geekmidas/manifest`, re-exported here for back-compat with existing\n// `@geekmidas/cli` imports.\nexport type {\n\tCronInfo,\n\tFunctionInfo,\n\tQueueInfo,\n\tRouteInfo,\n\tSubscriberInfo,\n\tTopicInfo,\n} from '@geekmidas/manifest';\n","/**\n * Where SNS pushes a topic subscriber's messages, on the server that runs it:\n * named after the subscriber's export.\n *\n * One definition for both sides — the generated server mounts the route, and\n * the stack exposes exactly these paths on a worker's host — so the path the\n * edge lets through and the path the worker answers cannot drift.\n */\nexport const SUBSCRIBER_ROUTE_PREFIX = '/__gkm/subscribers/';\n\n/** The route a subscriber's pushes arrive on. */\nexport function subscriberRoute(exportName: string): string {\n\treturn `${SUBSCRIBER_ROUTE_PREFIX}${exportName}`;\n}\n\n/**\n * Where the deploy hands a server the SNS subscriptions it made for its\n * routes: a JSON object of subscriber export → subscription ARN. Against SNS\n * itself a server mounts a route only for a subscription recorded here, and\n * refuses a notification that names another.\n */\nexport const SNS_SUBSCRIPTIONS_KEY = 'GKM_SNS_SUBSCRIPTIONS';\n\n/**\n * Where a local object store posts a bucket's events, on the process that runs\n * the bucket's subscribers: named after the bucket. Never on a public host —\n * MinIO reaches it over the stack's network, or the host's.\n */\nexport const OBJECTS_ROUTE_PREFIX = '/__gkm/objects/';\n\n/** The route a bucket's events are posted to. */\nexport function objectsRoute(bucketId: string): string {\n\treturn `${OBJECTS_ROUTE_PREFIX}${bucketId}`;\n}\n","/**\n * Fakes, read from where the convention puts them.\n *\n * `test/fakes/<id>.ts` default-exports `fake.app(…)` or `fake.image(…)` for an\n * external API, and `fake.credential(…)` for a credential. The construct never\n * names it — that is what keeps a fake out of a deployed bundle — so this is\n * the one place it is found, by the same rule that finds a database's factory\n * in `test/factories/<id>.ts`.\n */\n\nimport { access } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { pathToFileURL } from 'node:url';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport { kebabCase } from '@geekmidas/manifest';\nimport { GkmError } from '../errors';\nimport type { Plan } from './plan';\n\n/** Where a project keeps its external APIs' fakes, relative to its root. */\nexport const DEFAULT_FAKES_DIR = 'test/fakes';\n\n/** One external API's fake, as the local target needs it. */\nexport interface LocalFake {\n\t/** The file it was read from — what the harness and `gkm dev` import. */\n\tfile: string;\n\t/** The image to run, for a fake the provider publishes. */\n\timage?: string;\n\t/** The port that image listens on inside its container. */\n\tport?: number;\n\t/** What the fake accepts, as the JSON `<ID>_CREDENTIALS` holds. */\n\tcredentials: string;\n}\n\n/** The marker `fake.app` and `fake.image` set — the same registered symbol. */\nconst FAKE = Symbol.for('@geekmidas/constructs/fake');\n\ninterface FakeExport {\n\tkind: 'app' | 'image' | 'credential';\n\timage?: string;\n\tport?: number;\n\tcredentials: unknown;\n}\n\n/**\n * The fake for every external API the manifest declares, keyed by id.\n *\n * @throws {NoFake} when an external API has no file, since a local stage would\n * otherwise have nothing to call.\n * @throws {NotAFake} when the file's default export is not one.\n */\nexport async function readFakes(\n\troot: string,\n\tmanifest: ConstructManifest,\n): Promise<Record<string, LocalFake>> {\n\tconst fakes: Record<string, LocalFake> = {};\n\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tif (declaration?.kind !== 'external-api') continue;\n\n\t\tconst file = await fakeFile(join(root, DEFAULT_FAKES_DIR), id);\n\t\tif (!file) throw new NoFake(id, `${fakeBase(root, id)}.ts`);\n\t\tconst value = await importFake(file);\n\t\tif (value.kind === 'credential') throw new NotAFake(file);\n\n\t\tfakes[id] = {\n\t\t\tfile,\n\t\t\t...(value.kind === 'image'\n\t\t\t\t? { image: value.image, port: value.port }\n\t\t\t\t: {}),\n\t\t\tcredentials: JSON.stringify(value.credentials),\n\t\t};\n\t}\n\n\treturn fakes;\n}\n\n/**\n * Each credential's fake value, as the JSON `<ID>_CREDENTIALS` holds, keyed by\n * id — for the credentials that have a fake. Unlike an external API's, a\n * credential's fake is optional here: a stage that stores the real value\n * needs none. The test stage's own check (`assertTestCredentials`) is what\n * refuses one with neither.\n *\n * @throws {NotAFake} when the file's default export is not a credential's fake.\n */\nexport async function readCredentialFakes(\n\troot: string,\n\tmanifest: ConstructManifest,\n): Promise<Record<string, string>> {\n\tconst values: Record<string, string> = {};\n\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tif (declaration?.kind !== 'credential') continue;\n\n\t\tconst file = await fakeFile(join(root, DEFAULT_FAKES_DIR), id);\n\t\tif (!file) continue;\n\t\tconst value = await importFake(file);\n\t\tif (value.kind !== 'credential') throw new NotAFake(file);\n\n\t\tvalues[id] = JSON.stringify(value.credentials);\n\t}\n\n\treturn values;\n}\n\n/**\n * A credential the test stage has no value for: no fake, and nothing stored.\n * Raised when the stage is set up, before a test reaches it — not as a schema\n * error inside the handler that first asked.\n */\nexport class CredentialHasNoTestValue extends GkmError {\n\tconstructor(\n\t\treadonly id: string,\n\t\treadonly key: string,\n\t\treadonly file: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${id}' is a credential, and the test stage has no value for ${key}: ` +\n\t\t\t\t`no fake, and none stored — a stage set up fresh, as CI's ` +\n\t\t\t\t`auto-setup does, holds no third party's credentials. Give it a ` +\n\t\t\t\t`fake: create ${file}, default-exporting ` +\n\t\t\t\t`fake.credential(…) from @geekmidas/constructs/credential. It is ` +\n\t\t\t\t`read only by gkm test and gkm dev --fake; a deployed stage still ` +\n\t\t\t\t`needs the real value (gkm secrets:add --stage <stage>).`,\n\t\t);\n\t\tthis.name = 'CredentialHasNoTestValue';\n\t}\n}\n\n/**\n * Every credential the test stage must hand its suite, with the value it\n * resolved — a fake's, or one the stage stores.\n *\n * @throws {CredentialHasNoTestValue} for the first one with neither.\n */\nexport function assertTestCredentials(\n\troot: string,\n\tplan: Pick<Plan, 'resources'>,\n\tenv: Readonly<Record<string, string | undefined>>,\n): Record<string, string> {\n\tconst values: Record<string, string> = {};\n\n\tfor (const { id, kind, envKey } of plan.resources) {\n\t\tif (kind !== 'credential') continue;\n\n\t\tconst value = env[envKey];\n\t\tif (value === undefined) {\n\t\t\tthrow new CredentialHasNoTestValue(\n\t\t\t\tid,\n\t\t\t\tenvKey,\n\t\t\t\t`${fakeBase(root, id)}.ts`,\n\t\t\t);\n\t\t}\n\t\tvalues[envKey] = value;\n\t}\n\n\treturn values;\n}\n\n/** `<root>/test/fakes/<id>`, without an extension. */\nfunction fakeBase(root: string, id: string): string {\n\treturn join(root, DEFAULT_FAKES_DIR, kebabCase(id));\n}\n\n/** The first of `<id>.ts`, `.mts`, `.js`, `.mjs` that exists. */\nasync function fakeFile(\n\tfolder: string,\n\tid: string,\n): Promise<string | undefined> {\n\tconst base = join(folder, kebabCase(id));\n\tfor (const extension of ['.ts', '.mts', '.js', '.mjs']) {\n\t\tconst file = `${base}${extension}`;\n\t\tconst exists = await access(file).then(\n\t\t\t() => true,\n\t\t\t() => false,\n\t\t);\n\t\tif (exists) return file;\n\t}\n\n\treturn undefined;\n}\n\n/**\n * A fake file's default export.\n *\n * @throws {NotAFake} when it is not a fake.\n */\nasync function importFake(file: string): Promise<FakeExport> {\n\tconst module = (await import(pathToFileURL(file).href)) as {\n\t\tdefault?: unknown;\n\t};\n\tconst value = module.default;\n\tif (!isFakeExport(value)) throw new NotAFake(file);\n\treturn value;\n}\n\nfunction isFakeExport(value: unknown): value is FakeExport {\n\treturn (\n\t\ttypeof value === 'object' &&\n\t\tvalue !== null &&\n\t\t(value as { [FAKE]?: unknown })[FAKE] === true\n\t);\n}\n\n/** An external API with no fake for a local stage to call. */\nexport class NoFake extends GkmError {\n\tconstructor(\n\t\treadonly id: string,\n\t\treadonly file: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${id}' is an external API, and a local stage calls its fake rather ` +\n\t\t\t\t`than the provider — but there is none. Create ${file}, ` +\n\t\t\t\t`default-exporting fake.app(…) or fake.image(…) from ` +\n\t\t\t\t`@geekmidas/constructs/external-api.`,\n\t\t);\n\t\tthis.name = 'NoFake';\n\t}\n}\n\n/** A file in the fakes folder whose default export is not a fake. */\nexport class NotAFake extends GkmError {\n\tconstructor(readonly file: string) {\n\t\tsuper(\n\t\t\t`${file} is where a fake lives, and its default export is not one ` +\n\t\t\t\t`for its construct. For an external API, export default ` +\n\t\t\t\t`fake.app(handler, { credentials }) or ` +\n\t\t\t\t`fake.image(image, { port, credentials }); for a credential, ` +\n\t\t\t\t`fake.credential(value).`,\n\t\t);\n\t\tthis.name = 'NotAFake';\n\t}\n}\n","import { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join, relative } from 'node:path';\nimport { Subscriber } from '@geekmidas/constructs/subscribers';\nimport { canonicalId } from '@geekmidas/manifest';\nimport type { BuildContext } from '../build/types';\nimport {\n\tsubscriberConnectionKey,\n\tsubscriberTokenKey,\n} from '../reconcile/edges.js';\nimport type { SubscriberInfo } from '../types';\nimport { runtimeFor } from './EndpointGenerator.js';\nimport {\n\tConstructGenerator,\n\ttype GeneratedConstruct,\n\ttype GeneratorOptions,\n} from './Generator';\nimport {\n\tOBJECTS_ROUTE_PREFIX,\n\tSNS_SUBSCRIPTIONS_KEY,\n\tSUBSCRIBER_ROUTE_PREFIX,\n} from './subscriberRoute.js';\n\nexport class SubscriberGenerator extends ConstructGenerator<\n\tSubscriber<any, any, any, any, any, any, any>,\n\tSubscriberInfo[]\n> {\n\tisConstruct(\n\t\tvalue: any,\n\t): value is Subscriber<any, any, any, any, any, any, any> {\n\t\treturn Subscriber.isSubscriber(value);\n\t}\n\n\tasync build(\n\t\tcontext: BuildContext,\n\t\tconstructs: GeneratedConstruct<\n\t\t\tSubscriber<any, any, any, any, any, any, any>\n\t\t>[],\n\t\toutputDir: string,\n\t\toptions?: GeneratorOptions,\n\t): Promise<SubscriberInfo[]> {\n\t\tconst target = options?.target ?? 'aws';\n\t\tconst logger = console;\n\t\tconst subscriberInfos: SubscriberInfo[] = [];\n\n\t\tfor (const { key, construct } of constructs) {\n\t\t\tassertDoesNotFeedItself(key, construct);\n\t\t}\n\n\t\tif (target === 'server') {\n\t\t\t// Generate subscribers.ts for server-based polling (even if empty).\n\t\t\t// A bucket's subscriber is pushed to by the topic the storage\n\t\t\t// publishes to, whatever broker carries the app's own events.\n\t\t\tawait this.generateServerSubscribersFile(\n\t\t\t\toutputDir,\n\t\t\t\tconstructs,\n\t\t\t\t(context.eventsBackends?.includes('sns') ?? false) ||\n\t\t\t\t\tconstructs.some(({ construct }) => construct.bucketName),\n\t\t\t);\n\n\t\t\tlogger.log(\n\t\t\t\t`Generated server subscribers file with ${constructs.length} subscribers (polling mode)`,\n\t\t\t);\n\n\t\t\t// Return empty array as server subscribers don't have individual handlers\n\t\t\treturn subscriberInfos;\n\t\t}\n\n\t\tif (constructs.length === 0) {\n\t\t\treturn subscriberInfos;\n\t\t}\n\n\t\t// Create subscribers subdirectory\n\t\tconst subscribersDir = join(outputDir, 'subscribers');\n\t\tawait mkdir(subscribersDir, { recursive: true });\n\n\t\t// Generate subscriber handlers\n\t\tfor (const { key, construct, path } of constructs) {\n\t\t\tconst handlerFile = await this.generateSubscriberHandler(\n\t\t\t\tsubscribersDir,\n\t\t\t\tpath.relative,\n\t\t\t\tkey,\n\t\t\t\tconstruct,\n\t\t\t\tcontext,\n\t\t\t\tconstruct.owner,\n\t\t\t);\n\n\t\t\tsubscriberInfos.push({\n\t\t\t\tname: key,\n\t\t\t\thandler: relative(options?.root ?? process.cwd(), handlerFile).replace(\n\t\t\t\t\t/\\.ts$/,\n\t\t\t\t\t'.handler',\n\t\t\t\t),\n\t\t\t\tsubscribedEvents: construct.subscribedEvents || [],\n\t\t\t\t// A subscriber bound to a topic (via `s.topic(topic)`) records the\n\t\t\t\t// binding so infra wires the SNS subscription.\n\t\t\t\t...(construct.topicName\n\t\t\t\t\t? { transport: 'topic' as const, topic: construct.topicName }\n\t\t\t\t\t: {}),\n\t\t\t\t// A subscriber bound to a bucket records it, and the keys it\n\t\t\t\t// watches, so infra wires the bucket's notifications.\n\t\t\t\t...(construct.bucketName\n\t\t\t\t\t? {\n\t\t\t\t\t\t\ttransport: 'topic' as const,\n\t\t\t\t\t\t\tbucket: construct.bucketName,\n\t\t\t\t\t\t\t...construct.objectFilter,\n\t\t\t\t\t\t}\n\t\t\t\t\t: {}),\n\t\t\t\ttimeout: construct.timeout,\n\t\t\t\tmemorySize: construct.memorySize,\n\t\t\t\tenvironment: await construct.getEnvironment({\n\t\t\t\t\tmarkOptional: context.markOptional,\n\t\t\t\t}),\n\t\t\t\tdependencies: construct.constructs,\n\t\t\t});\n\n\t\t\tlogger.log(`Generated subscriber handler: ${key}`);\n\t\t}\n\n\t\treturn subscriberInfos;\n\t}\n\n\tprivate async generateSubscriberHandler(\n\t\toutputDir: string,\n\t\tsourceFile: string,\n\t\texportName: string,\n\t\t_subscriber: Subscriber<any, any, any, any, any, any, any>,\n\t\tcontext: BuildContext,\n\t\t/** The construct that owns this — its worker, or its surface. */\n\t\towner: string | undefined,\n\t): Promise<string> {\n\t\tconst handlerFileName = `${exportName}.ts`;\n\t\tconst handlerPath = join(outputDir, handlerFileName);\n\n\t\tconst relativePath = relative(dirname(handlerPath), sourceFile);\n\t\tconst importPath = relativePath.replace(/\\.ts$/, '.js');\n\n\t\t// Imports the construct that owns this, and binds `envParser` and\n\t\t// `logger` off it — the objects it was declared with, rather than a\n\t\t// module path printed in from config.\n\t\tconst runtime = runtimeFor(context, dirname(handlerPath), owner);\n\n\t\tconst content = `import { AWSLambdaSubscriber } from '@geekmidas/constructs/aws';\nimport { ${exportName} } from '${importPath}';\n${runtime.imports}\n${context.storageDrivers?.imports ?? ''}\n${runtime.bindings}\n${context.storageDrivers?.setup ? `\\n// The handler registers the drivers its target needs.\\n${context.storageDrivers.setup}\\n` : ''}\nconst adapter = new AWSLambdaSubscriber(envParser, ${exportName});\n\nexport const handler = adapter.handler;\n`;\n\n\t\tawait writeFile(handlerPath, content);\n\t\treturn handlerPath;\n\t}\n\n\tprivate async generateServerSubscribersFile(\n\t\toutputDir: string,\n\t\tsubscribers: GeneratedConstruct<\n\t\t\tSubscriber<any, any, any, any, any, any, any>\n\t\t>[],\n\t\t/**\n\t\t * The broker is SNS, so a subscriber is pushed to over HTTP. Only then is\n\t\t * the push code generated: it imports the SNS client, which a bundle for\n\t\t * any other broker must never have to resolve.\n\t\t */\n\t\tpush: boolean,\n\t): Promise<string> {\n\t\tawait mkdir(outputDir, { recursive: true });\n\t\tconst subscribersPath = join(outputDir, 'subscribers.ts');\n\n\t\t// Nothing to run, so nothing to import. Every app gets this file, and\n\t\t// `@geekmidas/events` is only installed by one that declared a Topic or\n\t\t// a Queue — importing it here crashed every dev server that had not.\n\t\tif (subscribers.length === 0) {\n\t\t\tawait writeFile(\n\t\t\t\tsubscribersPath,\n\t\t\t\t`/**\n * Generated subscribers setup — this app declares none.\n */\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\n\nexport async function setupSubscribers(\n _app: unknown,\n _envParser: EnvironmentParser<any>,\n _logger: Logger,\n): Promise<(port: number) => Promise<void>> {\n return async () => {};\n}\n\nexport function subscribersStatus(): { failed: string[]; connections: unknown[] } {\n return { failed: [], connections: [] };\n}\n\nexport async function stopSubscribers(): Promise<void> {}\n`,\n\t\t\t);\n\t\t\treturn subscribersPath;\n\t\t}\n\n\t\tconst importsByFile = new Map<string, string[]>();\n\t\tfor (const { path, key } of subscribers) {\n\t\t\tconst importPath = relative(\n\t\t\t\tdirname(subscribersPath),\n\t\t\t\tpath.relative,\n\t\t\t).replace(/\\.ts$/, '.js');\n\t\t\timportsByFile.set(importPath, [\n\t\t\t\t...(importsByFile.get(importPath) ?? []),\n\t\t\t\tkey,\n\t\t\t]);\n\t\t}\n\t\tconst imports = Array.from(importsByFile.entries())\n\t\t\t.map(\n\t\t\t\t([importPath, exports]) =>\n\t\t\t\t\t`import { ${exports.join(', ')} } from '${importPath}';`,\n\t\t\t)\n\t\t\t.join('\\n');\n\n\t\t// Each subscriber reaches the topic it is bound to, by that topic's own\n\t\t// key — resolved here, at build time, from the binding. A bucket's\n\t\t// subscriber reaches the bucket's events, which carry no `type`\n\t\t// attribute for SNS to filter on: it filters what it is sent itself.\n\t\tconst entries = subscribers\n\t\t\t.map(({ key, construct }) => {\n\t\t\t\tconst connectionKey = subscriberConnectionKey(construct);\n\t\t\t\tconst tokenKey = subscriberTokenKey(construct);\n\t\t\t\tconst topic = construct.topicName ?? construct.bucketName;\n\t\t\t\tconst bucket = construct.bucketName\n\t\t\t\t\t? canonicalId(construct.bucketName)\n\t\t\t\t\t: undefined;\n\t\t\t\treturn ` { id: '${key}', subscriber: ${key}, topic: ${\n\t\t\t\t\ttopic ? `'${topic}'` : 'undefined'\n\t\t\t\t}, connectionKey: ${\n\t\t\t\t\tconnectionKey ? `'${connectionKey}'` : 'undefined'\n\t\t\t\t}, filtered: ${construct.bucketName ? 'false' : 'true'}, bucket: ${\n\t\t\t\t\tbucket ? `'${bucket}'` : 'undefined'\n\t\t\t\t}, tokenKey: ${tokenKey ? `'${tokenKey}'` : 'undefined'} },`;\n\t\t\t})\n\t\t\t.join('\\n');\n\n\t\tconst content = `/**\n * Generated subscribers setup.\n *\n * Each subscriber is run against the topic it is bound to, through that\n * topic's own connection string:\n *\n * - **sns://** — pushed, not polled. The subscriber gets an HTTP route on this\n * server, subscribed to the topic with a filter policy of the events it\n * named, so SNS fans out to each subscriber. The route runs the subscriber\n * through the same adaptor a Lambda subscription does. Against SNS itself\n * the deploy made the subscription and recorded its ARN in\n * ${SNS_SUBSCRIPTIONS_KEY}: a route is mounted only for a recorded one, its\n * confirmation goes through the API, and nothing is subscribed from here.\n * Against an emulator, where nothing deploys, the route subscribes itself.\n * - **anything else** (pgboss://, rabbitmq://, sqs://) — polled. On pg-boss\n * each subscriber drains a queue of its own, \\`<topic>/<subscriber>\\`, so\n * every subscriber sees every event; replicas of one subscriber share it.\n *\n * A bucket's subscriber is polled the same way, under the bucket's name, when\n * the bucket is in a local object store: the store posts each event to\n * \\`${OBJECTS_ROUTE_PREFIX}<Bucket>\\` on this server, with the bucket's token, and\n * the event is relayed onto the broker as \\`object.created\\` or\n * \\`object.deleted\\` — so every subscriber of the bucket sees it.\n *\n * GKM_SUBSCRIBERS=off (\\`gkm dev --no-subscribers\\`) runs none of them.\n * GKM_SUBSCRIBER_PUSH_URL is the address an emulator pushes to, defaulting to\n * this server through host.docker.internal.\n */\nimport { timingSafeEqual } from 'node:crypto';\nimport { connect } from 'node:net';\nimport type { EnvironmentParser } from '@geekmidas/envkit';\nimport type { Logger } from '@geekmidas/logger';\nimport { EventConnectionFactory, Publisher, Subscriber } from '@geekmidas/events';\nimport type { EventConnection } from '@geekmidas/events';\nimport { ServiceDiscovery } from '@geekmidas/services';\n${imports}\n\nconst subscribers = [\n${entries}\n];\n\n// What was opened, and what could not be: a worker's health check reads both,\n// and its shutdown closes what was opened.\nconst connections = new Map<string, EventConnection>();\nconst failed: string[] = [];\n\n/**\n * The subscriptions the deploy made against SNS itself, by subscriber: which\n * routes to mount, and the ARN each one's notifications must name.\n */\nfunction recordedSubscriptions(logger: Logger): Record<string, string> {\n const raw = process.env.${SNS_SUBSCRIPTIONS_KEY};\n if (!raw) return {};\n try {\n const parsed = JSON.parse(raw);\n if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed;\n } catch {}\n logger.error('${SNS_SUBSCRIPTIONS_KEY} is not a JSON object of subscriber → subscription ARN');\n return {};\n}\n\n/** The route a subscriber's pushes arrive on. */\nexport const SUBSCRIBER_ROUTE = (id: string) => \\`${SUBSCRIBER_ROUTE_PREFIX}\\${id}\\`;\n\n/** The route a local object store posts a bucket's events to. */\nexport const OBJECTS_ROUTE = (bucket: string) => \\`${OBJECTS_ROUTE_PREFIX}\\${bucket}\\`;\n\n// The buckets whose events this server relays: one route each, however many\n// subscribers watch the bucket.\nconst relays = new Set<string>();\n\n/**\n * Mount the route a local object store posts one bucket's events to, and\n * relay each event onto the broker under the bucket's name.\n *\n * Answered 2xx only once every event is published: the store keeps what it\n * was not told it delivered, and sends it again.\n */\nasync function mountObjectRelay(\n app: { post: (path: string, handler: (c: any) => unknown) => unknown },\n relay: { bucket: string; topic: string; connection: EventConnection; tokenKey: string },\n logger: Logger,\n): Promise<void> {\n const token = process.env[relay.tokenKey];\n if (!token) {\n logger.error(\n { bucket: relay.bucket, tokenKey: relay.tokenKey },\n 'No token for this bucket: the events its object store posts cannot be received',\n );\n failed.push(\\`\\${relay.bucket}#events\\`);\n return;\n }\n const { toObjectEvents } = await import('@geekmidas/storage/events');\n const publisher = await Publisher.fromConnection(relay.connection, { topic: relay.topic });\n const expected = Buffer.from(\\`Bearer \\${token}\\`);\n\n app.post(OBJECTS_ROUTE(relay.bucket), async (c: any) => {\n // Compared in constant time: the route is not public, but it is the one\n // way to put an event in front of every subscriber of the bucket.\n const given = Buffer.from(c.req.header('authorization') ?? '');\n if (given.length !== expected.length || !timingSafeEqual(given, expected)) {\n return c.json({ status: 'refused' }, 401);\n }\n\n let messages: Awaited<ReturnType<typeof toObjectEvents>>;\n try {\n messages = toObjectEvents(JSON.parse(await c.req.text()));\n } catch (error) {\n logger.warn({ err: error, bucket: relay.bucket }, 'Refused an object notification that did not parse');\n return c.json({ status: 'malformed' }, 400);\n }\n\n try {\n if (messages.length > 0) await publisher.publish(messages as any);\n } catch (error) {\n // The store sends it again.\n logger.error({ err: error, bucket: relay.bucket }, 'Failed to relay object events');\n return c.json({ status: 'failed' }, 500);\n }\n return c.json({ status: 'ok', relayed: messages.length }, 200);\n });\n logger.info({ bucket: relay.bucket }, 'Relaying object events');\n}\n\n/** Resolves once something is accepting connections on the port. */\nasync function listening(port: number): Promise<void> {\n for (let attempt = 0; attempt < 100; attempt++) {\n const open = await new Promise<boolean>((resolve) => {\n const socket = connect(port, '127.0.0.1');\n socket.once('connect', () => { socket.end(); resolve(true); });\n socket.once('error', () => resolve(false));\n });\n if (open) return;\n await new Promise((resolve) => setTimeout(resolve, 50));\n }\n}\n\n/**\n * Mount each pushed subscriber's route and start each polled one. Returns what\n * to run once the server is listening: subscribing a route makes SNS send its\n * confirmation at once, so the route has to be reachable first.\n */\nexport async function setupSubscribers(\n app: { post: (path: string, handler: (c: any) => unknown) => unknown },\n envParser: EnvironmentParser<any>,\n logger: Logger,\n): Promise<(port: number) => Promise<void>> {\n if (process.env.GKM_SUBSCRIBERS === 'off') {\n logger.info('Subscribers are off (--no-subscribers)');\n return async () => {};\n }\n\n const serviceDiscovery = ServiceDiscovery.getInstance(envParser);\n const recorded = recordedSubscriptions(logger);\n const afterListening: ((port: number) => Promise<void>)[] = [];\n\n for (const { id, subscriber, topic, connectionKey, filtered, bucket, tokenKey } of subscribers) {\n const events = subscriber.subscribedEvents || [];\n if (events.length === 0) {\n logger.warn({ subscriber: id }, 'Subscriber has no subscribed events, skipping');\n continue;\n }\n const connectionString = connectionKey ? process.env[connectionKey] : undefined;\n if (!connectionString) {\n logger.error(\n { subscriber: id, connectionKey },\n 'No connection string for the topic or bucket this subscriber is bound to',\n );\n failed.push(id);\n continue;\n }\n\n try {\n${\n\tpush\n\t\t? ` if (connectionString.startsWith('sns:')) {\n const { SNSConnection, snsUrl, subscribeHttpEndpoint, confirmSubscription } = await import('@geekmidas/events/sns');\n const { SnsPushSubscriberAdaptor } = await import('@geekmidas/constructs/subscribers');\n const address = snsUrl.parse(connectionString);\n const route = SUBSCRIBER_ROUTE(id);\n const mount = (adaptor: InstanceType<typeof SnsPushSubscriberAdaptor>) =>\n app.post(route, async (c: any) => {\n const body = JSON.parse(await c.req.text());\n const response = await adaptor.handle(body, {\n subscriptionArn: c.req.header('x-amz-sns-subscription-arn'),\n });\n return c.json(response.body, response.status);\n });\n\n if (!address.endpoint) {\n // SNS itself: the deploy subscribed this route and recorded the ARN.\n // Nothing is subscribed from here, so this server's credentials need\n // only sns:ConfirmSubscription on the topic.\n const subscriptionArn = recorded[id];\n if (!subscriptionArn) {\n logger.error(\n { subscriber: id },\n 'No subscription recorded for this subscriber in ${SNS_SUBSCRIPTIONS_KEY}: deploy it so SNS has a route to push to',\n );\n failed.push(id);\n continue;\n }\n const connection = await SNSConnection.fromConnectionString(connectionString);\n mount(\n new SnsPushSubscriberAdaptor(envParser, subscriber, {\n topicArn: address.topicArn,\n verify: true,\n subscriptionArn,\n // As the topic's owner, so only the owner can unsubscribe the\n // route — not whoever holds a notification's UnsubscribeURL.\n confirm: (message) => confirmSubscription(connection, message),\n }),\n );\n logger.info({ subscriber: id, events }, 'Subscriber mounted for push');\n continue;\n }\n\n // An emulator signs nothing, and nothing deploys its subscriptions:\n // decided by the address this server was configured with, never by\n // anything a request says about itself.\n mount(\n new SnsPushSubscriberAdaptor(envParser, subscriber, {\n topicArn: address.topicArn,\n verify: false,\n emulatorEndpoint: address.endpoint,\n }),\n );\n\n afterListening.push(async (port) => {\n const base =\n process.env.GKM_SUBSCRIBER_PUSH_URL ?? \\`http://host.docker.internal:\\${port}\\`;\n const connection = await SNSConnection.fromConnectionString(connectionString);\n await subscribeHttpEndpoint(connection, {\n endpoint: new URL(route, base).toString(),\n ...(filtered ? { events } : {}),\n });\n logger.info({ subscriber: id, events }, 'Subscriber subscribed for push');\n });\n continue;\n }\n`\n\t\t: ` if (connectionString.startsWith('sns:')) {\n // Built for a broker other than SNS, so this entry registered no SNS\n // driver and has no push route to offer.\n logger.error(\n { subscriber: id, connectionKey },\n 'This build has no SNS driver: it was built for a target whose broker is not SNS',\n );\n failed.push(id);\n continue;\n }\n`\n}\n\n let connection = connections.get(connectionString);\n if (!connection) {\n connection = await EventConnectionFactory.fromConnectionString(connectionString);\n connections.set(connectionString, connection);\n }\n // Named, so a broker with one address for everything (pg-boss) gives\n // this subscriber a queue of its own: fan-out, not competition.\n const eventSubscriber = await Subscriber.fromConnection(connection, {\n topic,\n subscription: id,\n });\n const services = subscriber.services.length > 0\n ? await serviceDiscovery.register(subscriber.services)\n : {};\n // The subscriber's database — the worker's, or its own — as \\`db\\`. A\n // pushed subscriber gets it from the adaptor above instead.\n const db = subscriber.databaseService\n ? (await serviceDiscovery.register([subscriber.databaseService]))[\n subscriber.databaseService.serviceName\n ]\n : undefined;\n\n await eventSubscriber.subscribe(events, async (event) => {\n try {\n await subscriber.handler({\n events: [event],\n services: services as any,\n logger: subscriber.logger,\n db,\n } as any);\n } catch (error) {\n logger.error({ err: error, event, subscriber: id }, 'Failed to process event');\n // Rethrown so the transport keeps the event for a retry — as a queue\n // consumer's failure does, and as a pushed subscriber's 500 does.\n throw error;\n }\n });\n logger.info({ subscriber: id, events }, 'Subscriber started polling');\n\n // A bucket in a local object store publishes nothing for this to poll:\n // the store posts its events here, and they are relayed onto the broker.\n if (bucket && tokenKey && topic && !relays.has(bucket)) {\n relays.add(bucket);\n await mountObjectRelay(app, { bucket, topic, connection, tokenKey }, logger);\n }\n } catch (error) {\n // The message too: a missing module's code alone does not say which.\n logger.error(\n { err: error, subscriber: id },\n 'Failed to set up subscriber',\n );\n failed.push(id);\n }\n }\n\n return async (port) => {\n if (afterListening.length === 0) return;\n await listening(port);\n for (const subscribe of afterListening) {\n await subscribe(port).catch((error) => {\n logger.error({ err: error }, 'Failed to subscribe for push');\n });\n }\n };\n}\n\n/** The subscribers that could not start, and the connections that did. */\nexport function subscribersStatus(): { failed: string[]; connections: EventConnection[] } {\n return { failed: [...failed], connections: [...connections.values()] };\n}\n\n/**\n * Stop polling, let the events in flight finish, and close each broker\n * connection — pg-boss's graceful stop does all three. The caller bounds it.\n */\nexport async function stopSubscribers(): Promise<void> {\n const open = [...connections.values()];\n connections.clear();\n await Promise.all(open.map((connection) => connection.close()));\n}\n`;\n\n\t\tawait writeFile(subscribersPath, content);\n\t\treturn subscribersPath;\n\t}\n}\n\n/**\n * A bucket's subscriber that writes back into the keys it watches.\n *\n * Every write it makes is a new object event, which runs it again — forever,\n * and billed per run. The rule is the one the build can check: a subscriber\n * that depends on the bucket it watches must watch a prefix, so what it writes\n * can go elsewhere. A thumbnailer watching `uploads/` writes `thumbnails/`.\n */\nexport class ObjectSubscriberFeedsItself extends Error {\n\tconstructor(\n\t\treadonly subscriber: string,\n\t\treadonly bucket: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${subscriber}' watches every key in '${bucket}' and depends on it, ` +\n\t\t\t\t`so each object it writes runs it again. Watch a prefix — ` +\n\t\t\t\t`.on([...], { prefix: 'uploads/' }) — and write outside it.`,\n\t\t);\n\t\tthis.name = 'ObjectSubscriberFeedsItself';\n\t}\n}\n\nfunction assertDoesNotFeedItself(\n\tkey: string,\n\tconstruct: Subscriber<any, any, any, any, any, any, any>,\n): void {\n\tconst bucket = construct.bucketName;\n\tif (!bucket || construct.objectFilter?.prefix) return;\n\tconst depends = (construct.constructs ?? []).some(\n\t\t(id: string) => canonicalId(id) === canonicalId(bucket),\n\t);\n\tif (depends) throw new ObjectSubscriberFeedsItself(key, bucket);\n}\n"],"mappings":";;;;;;;;;;AAwDA,SAAgB,eAAe,OAAsC;CACpE,OACC,UAAU,aACV,UAAU,iBACV,UAAU,QACV,UAAU;AAEZ;;;;;;;;;;AAWA,SAAgB,gBAAgB,SAAgC;CAC/D,OAAO,YAAY;AACpB;;;;;;;;;;;;;;;;;;;AAuCA,MAAa,gBAA0D;CAEtE,KAAK;CAGL,QAAQ;AACT;;;;;;;;;;AAWA,MAAa,iBAAsD;CAClE,KAAK;CACL,QAAQ;AACT;;AAGA,MAAa,kBAAwD;CACpE,KAAK;CACL,QAAQ;AACT;;;;;;;;;;;ACrIA,MAAa,0BAA0B;;AAGvC,SAAgB,gBAAgB,YAA4B;CAC3D,OAAO,GAAG,0BAA0B;AACrC;;;;;;;AAQA,MAAa,wBAAwB;;;;;;AAOrC,MAAa,uBAAuB;;AAGpC,SAAgB,aAAa,UAA0B;CACtD,OAAO,GAAG,uBAAuB;AAClC;;;;;;;;;;;;;ACdA,MAAa,oBAAoB;;AAejC,MAAM,OAAO,OAAO,IAAI,4BAA4B;;;;;;;;AAgBpD,eAAsB,UACrB,MACA,UACqC;CACrC,MAAM,QAAmC,CAAC;CAE1C,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,IAAI,aAAa,SAAS,gBAAgB;EAE1C,MAAM,OAAO,MAAM,SAAS,KAAK,MAAM,iBAAiB,GAAG,EAAE;EAC7D,IAAI,CAAC,MAAM,MAAM,IAAI,OAAO,IAAI,GAAG,SAAS,MAAM,EAAE,EAAE,IAAI;EAC1D,MAAM,QAAQ,MAAM,WAAW,IAAI;EACnC,IAAI,MAAM,SAAS,cAAc,MAAM,IAAI,SAAS,IAAI;EAExD,MAAM,MAAM;GACX;GACA,GAAI,MAAM,SAAS,UAChB;IAAE,OAAO,MAAM;IAAO,MAAM,MAAM;GAAK,IACvC,CAAC;GACJ,aAAa,KAAK,UAAU,MAAM,WAAW;EAC9C;CACD;CAEA,OAAO;AACR;;;;;;;;;;AAWA,eAAsB,oBACrB,MACA,UACkC;CAClC,MAAM,SAAiC,CAAC;CAExC,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,IAAI,aAAa,SAAS,cAAc;EAExC,MAAM,OAAO,MAAM,SAAS,KAAK,MAAM,iBAAiB,GAAG,EAAE;EAC7D,IAAI,CAAC,MAAM;EACX,MAAM,QAAQ,MAAM,WAAW,IAAI;EACnC,IAAI,MAAM,SAAS,cAAc,MAAM,IAAI,SAAS,IAAI;EAExD,OAAO,MAAM,KAAK,UAAU,MAAM,WAAW;CAC9C;CAEA,OAAO;AACR;;;;;;AAOA,IAAa,2BAAb,cAA8C,SAAS;CAE5C;CACA;CACA;CAHV,YACC,IACA,KACA,MACC;EACD,MACC,IAAI,GAAG,yDAAyD,IAAI,yIAGnD,KAAK,6MAIvB;EAZS,KAAA,KAAA;EACA,KAAA,MAAA;EACA,KAAA,OAAA;EAWT,KAAK,OAAO;CACb;AACD;;;;;;;AAQA,SAAgB,sBACf,MACA,MACA,KACyB;CACzB,MAAM,SAAiC,CAAC;CAExC,KAAK,MAAM,EAAE,IAAI,MAAM,YAAY,KAAK,WAAW;EAClD,IAAI,SAAS,cAAc;EAE3B,MAAM,QAAQ,IAAI;EAClB,IAAI,UAAU,KAAA,GACb,MAAM,IAAI,yBACT,IACA,QACA,GAAG,SAAS,MAAM,EAAE,EAAE,IACvB;EAED,OAAO,UAAU;CAClB;CAEA,OAAO;AACR;;AAGA,SAAS,SAAS,MAAc,IAAoB;CACnD,OAAO,KAAK,MAAM,mBAAmB,UAAU,EAAE,CAAC;AACnD;;AAGA,eAAe,SACd,QACA,IAC8B;CAC9B,MAAM,OAAO,KAAK,QAAQ,UAAU,EAAE,CAAC;CACvC,KAAK,MAAM,aAAa;EAAC;EAAO;EAAQ;EAAO;CAAM,GAAG;EACvD,MAAM,OAAO,GAAG,OAAO;EAKvB,IAAI,MAJiB,OAAO,IAAI,CAAC,CAAC,WAC3B,YACA,KACP,GACY,OAAO;CACpB;AAGD;;;;;;AAOA,eAAe,WAAW,MAAmC;CAI5D,MAAM,SAAQ,MAHQ,OAAO,cAAc,IAAI,CAAC,CAAC,MAAA,CAG5B;CACrB,IAAI,CAAC,aAAa,KAAK,GAAG,MAAM,IAAI,SAAS,IAAI;CACjD,OAAO;AACR;AAEA,SAAS,aAAa,OAAqC;CAC1D,OACC,OAAO,UAAU,YACjB,UAAU,QACT,MAA+B,UAAU;AAE5C;;AAGA,IAAa,SAAb,cAA4B,SAAS;CAE1B;CACA;CAFV,YACC,IACA,MACC;EACD,MACC,IAAI,GAAG,8GAC2C,KAAK,0FAGxD;EARS,KAAA,KAAA;EACA,KAAA,OAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,WAAb,cAA8B,SAAS;CACjB;CAArB,YAAY,MAAuB;EAClC,MACC,GAAG,KAAK,2OAKT;EAPoB,KAAA,OAAA;EAQpB,KAAK,OAAO;CACb;AACD;;;AClNA,IAAa,sBAAb,cAAyC,mBAGvC;CACD,YACC,OACyD;EACzD,OAAO,WAAW,aAAa,KAAK;CACrC;CAEA,MAAM,MACL,SACA,YAGA,WACA,SAC4B;EAC5B,MAAM,SAAS,SAAS,UAAU;EAClC,MAAM,SAAS;EACf,MAAM,kBAAoC,CAAC;EAE3C,KAAK,MAAM,EAAE,KAAK,eAAe,YAChC,wBAAwB,KAAK,SAAS;EAGvC,IAAI,WAAW,UAAU;GAIxB,MAAM,KAAK,8BACV,WACA,aACC,QAAQ,gBAAgB,SAAS,KAAK,KAAK,UAC3C,WAAW,MAAM,EAAE,gBAAgB,UAAU,UAAU,CACzD;GAEA,OAAO,IACN,0CAA0C,WAAW,OAAO,4BAC7D;GAGA,OAAO;EACR;EAEA,IAAI,WAAW,WAAW,GACzB,OAAO;EAIR,MAAM,iBAAiB,KAAK,WAAW,aAAa;EACpD,MAAM,MAAM,gBAAgB,EAAE,WAAW,KAAK,CAAC;EAG/C,KAAK,MAAM,EAAE,KAAK,WAAW,UAAU,YAAY;GAClD,MAAM,cAAc,MAAM,KAAK,0BAC9B,gBACA,KAAK,UACL,KACA,WACA,SACA,UAAU,KACX;GAEA,gBAAgB,KAAK;IACpB,MAAM;IACN,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,GAAG,WAAW,CAAC,CAAC,QAC9D,SACA,UACD;IACA,kBAAkB,UAAU,oBAAoB,CAAC;IAGjD,GAAI,UAAU,YACX;KAAE,WAAW;KAAkB,OAAO,UAAU;IAAU,IAC1D,CAAC;IAGJ,GAAI,UAAU,aACX;KACA,WAAW;KACX,QAAQ,UAAU;KAClB,GAAG,UAAU;IACd,IACC,CAAC;IACJ,SAAS,UAAU;IACnB,YAAY,UAAU;IACtB,aAAa,MAAM,UAAU,eAAe,EAC3C,cAAc,QAAQ,aACvB,CAAC;IACD,cAAc,UAAU;GACzB,CAAC;GAED,OAAO,IAAI,iCAAiC,KAAK;EAClD;EAEA,OAAO;CACR;CAEA,MAAc,0BACb,WACA,YACA,YACA,aACA,SAEA,OACkB;EAClB,MAAM,kBAAkB,GAAG,WAAW;EACtC,MAAM,cAAc,KAAK,WAAW,eAAe;EAGnD,MAAM,aADe,SAAS,QAAQ,WAAW,GAAG,UACtB,CAAC,CAAC,QAAQ,SAAS,KAAK;EAKtD,MAAM,UAAU,WAAW,SAAS,QAAQ,WAAW,GAAG,KAAK;EAE/D,MAAM,UAAU;WACP,WAAW,WAAW,WAAW;EAC1C,QAAQ,QAAQ;EAChB,QAAQ,gBAAgB,WAAW,GAAG;EACtC,QAAQ,SAAS;EACjB,QAAQ,gBAAgB,QAAQ,6DAA6D,QAAQ,eAAe,MAAM,MAAM,GAAG;qDAChF,WAAW;;;;EAK9D,MAAM,UAAU,aAAa,OAAO;EACpC,OAAO;CACR;CAEA,MAAc,8BACb,WACA,aAQA,MACkB;EAClB,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;EAC1C,MAAM,kBAAkB,KAAK,WAAW,gBAAgB;EAKxD,IAAI,YAAY,WAAW,GAAG;GAC7B,MAAM,UACL,iBACA;;;;;;;;;;;;;;;;;;;CAoBD;GACA,OAAO;EACR;EAEA,MAAM,gCAAgB,IAAI,IAAsB;EAChD,KAAK,MAAM,EAAE,MAAM,SAAS,aAAa;GACxC,MAAM,aAAa,SAClB,QAAQ,eAAe,GACvB,KAAK,QACN,CAAC,CAAC,QAAQ,SAAS,KAAK;GACxB,cAAc,IAAI,YAAY,CAC7B,GAAI,cAAc,IAAI,UAAU,KAAK,CAAC,GACtC,GACD,CAAC;EACF;EACA,MAAM,UAAU,MAAM,KAAK,cAAc,QAAQ,CAAC,CAAC,CACjD,KACC,CAAC,YAAY,aACb,YAAY,QAAQ,KAAK,IAAI,EAAE,WAAW,WAAW,GACvD,CAAC,CACA,KAAK,IAAI;EAMX,MAAM,UAAU,YACd,KAAK,EAAE,KAAK,gBAAgB;GAC5B,MAAM,gBAAgB,wBAAwB,SAAS;GACvD,MAAM,WAAW,mBAAmB,SAAS;GAC7C,MAAM,QAAQ,UAAU,aAAa,UAAU;GAC/C,MAAM,SAAS,UAAU,aACtB,YAAY,UAAU,UAAU,IAChC,KAAA;GACH,OAAO,YAAY,IAAI,iBAAiB,IAAI,WAC3C,QAAQ,IAAI,MAAM,KAAK,YACvB,mBACA,gBAAgB,IAAI,cAAc,KAAK,YACvC,cAAc,UAAU,aAAa,UAAU,OAAO,YACtD,SAAS,IAAI,OAAO,KAAK,YACzB,cAAc,WAAW,IAAI,SAAS,KAAK,YAAY;EACzD,CAAC,CAAC,CACD,KAAK,IAAI;EAEX,MAAM,UAAU;;;;;;;;;;;OAWX,sBAAsB;;;;;;;;;OAStB,qBAAqB;;;;;;;;;;;;;;;EAe1B,QAAQ;;;EAGR,QAAQ;;;;;;;;;;;;;4BAakB,sBAAsB;;;;;;kBAMhC,sBAAsB;;;;;oDAKY,wBAAwB;;;qDAGvB,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6GzE,OACG;;;;;;;;;;;;;;;;;;;;;;iEAsB6D,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4CnF;;;;;;;;;;EAWH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoFC,MAAM,UAAU,iBAAiB,OAAO;EACxC,OAAO;CACR;AACD;;;;;;;;;AAUA,IAAa,8BAAb,cAAiD,MAAM;CAE5C;CACA;CAFV,YACC,YACA,QACC;EACD,MACC,IAAI,WAAW,0BAA0B,OAAO,yIAGjD;EAPS,KAAA,aAAA;EACA,KAAA,SAAA;EAOT,KAAK,OAAO;CACb;AACD;AAEA,SAAS,wBACR,KACA,WACO;CACP,MAAM,SAAS,UAAU;CACzB,IAAI,CAAC,UAAU,UAAU,cAAc,QAAQ;CAI/C,KAHiB,UAAU,cAAc,CAAC,EAAA,CAAG,MAC3C,OAAe,YAAY,EAAE,MAAM,YAAY,MAAM,CAE7C,GAAG,MAAM,IAAI,4BAA4B,KAAK,MAAM;AAC/D"}

package/dist/{add-DlFUKdjX.cjs → add-BFjb6mMq.cjs} RENAMED Viewed

@@ -1,13 +1,13 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_workspace = require("./workspace-BwqQnool.cjs");
-const require_dns = require("./dns-CfEZHt7r.cjs");
+const require_workspace = require("./workspace-C82GLPnf.cjs");
+const require_snsSubscriptions = require("./snsSubscriptions-CSkteK2J.cjs");
 const require_schemas = require("./schemas-BQ_v0lEX.cjs");
-const require_seeds = require("./seeds-CFG-f24B.cjs");
+const require_seeds = require("./seeds-DOfxmDRO.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_discover = require("./discover-DozUKs8f.cjs");
+const require_discover = require("./discover-ojkcbxHw.cjs");
 const require_config = require("./config.cjs");
-const require_credentialSchemas = require("./credentialSchemas-B67WJOOm.cjs");
+const require_credentialSchemas = require("./credentialSchemas-AhIBuQxQ.cjs");
 let node_net = require("node:net");
 let _geekmidas_manifest = require("@geekmidas/manifest");
 let prompts = require("prompts");
@@ -144,7 +144,7 @@ async function secretsAddCommand(options, io = defaultIo()) {
 		supplied: stored?.custom ?? {},
 		...domain ? { domain } : {},
 		providers: require_seeds.stageProviderNotes(workspace, stage),
-		...!local && domain && require_dns.deploysWithCompose(workspace) ? { server: true } : {}
+		...!local && domain && require_snsSubscriptions.deploysWithCompose(workspace) ? { server: true } : {}
 	});
 	const scope = [...all.filter((k) => !k.set), ...all.filter((k) => k.set)];
 	const keys = options.missing ? scope.filter((k) => !k.set) : scope;
@@ -716,4 +716,4 @@ async function askFields(ask, io, shape) {
 //#endregion
 exports.secretsAddCommand = secretsAddCommand;
-//# sourceMappingURL=add-DlFUKdjX.cjs.map
+//# sourceMappingURL=add-BFjb6mMq.cjs.map

package/dist/{add-DlFUKdjX.cjs.map → add-BFjb6mMq.cjs.map} RENAMED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"add-DlFUKdjX.cjs","names":["appKey","appEnvKeys","workerEnvKeys","provideKey","stageServiceDeclarations","requiredStageKeys","GkmError","loadWorkspaceSettings","constructGlobs","discover","secretsStoreFor","stageProviderNotes","deploysWithCompose","stageProvider","provisionCommand","initStageSecrets","loadCredentialSchemas","isIPv4","SERVER_IPV4_KEY","isIPv6","SERVER_IPV6_KEY","s3Parse","s3Build","issueLine"],"sources":["../src/secrets/stageKeys.ts","../src/secrets/add.ts"],"sourcesContent":["/*\n The keys a workspace's stage must be given — across every app, each once,\n * with who reads it and whether the stage holds it.\n \n The keys themselves are `requiredStageKeys`'s, and the mail and storage\n * constructs `stageServiceDeclarations`' — the lists a deploy's readiness\n * check refuses a stage by. What this adds is the workspace: which third\n * parties' credentials its apps and workers read (`appEnvKeys`,\n * `workerEnvKeys`) and which of the keys the stage has set.\n /\n\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport {\n\ttype CredentialDeclaration,\n\trequiredStageKeys,\n\ttype StageKey,\n\ttype StageProviderNotes,\n\tstageServiceDeclarations,\n} from '../deploy/devServices';\nimport { appEnvKeys, workerEnvKeys } from '../reconcile/apps';\nimport { appKey } from '../workspace/derive';\n\n/* A stage key, and whether the stage's secrets hold it. /\nexport interface WorkspaceStageKey extends StageKey {\n\tset: boolean;\n}\n\nexport interface WorkspaceStageKeysInput {\n\tmanifest: ConstructManifest;\n\t/* Each owner's runnables' edges, from discovery. /\n\trunnables?: Readonly<Record<string, readonly string[]>>;\n\t/* Whether the stage is the workspace's local one. /\n\tlocal: boolean;\n\t/* What the stage's secrets hold, by key. /\n\tsupplied: Readonly<Record<string, string>>;\n\t/* The stage's base domain, for the examples. /\n\tdomain?: string;\n\t/* What the stage's providers say — a missing key's hint. /\n\tproviders?: StageProviderNotes;\n\t/* The stage serves a domain from its own server: `GKM_SERVER_IPV4`. /\n\tserver?: boolean;\n}\n\n/\n Every key the stage must be given: each mail and storage construct's —\n * the deploy's own list, `stageServiceDeclarations` — and each third party's\n * credentials an app reads.\n /\nexport function workspaceStageKeys(\n\tinput: WorkspaceStageKeysInput,\n): WorkspaceStageKey[] {\n\tconst { manifest } = input;\n\n\t// What each process's environment holds: each app's, and each worker's —\n\t// whose crons and consumers run in a process of their own.\n\tconst reads = new Map<string, Set<string>>();\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tconst { kind } = declaration;\n\t\tconst name = appKey(id);\n\t\tconst keys =\n\t\t\tkind === 'rest-api' \|\| kind === 'site' \|\| kind === 'mobile-app'\n\t\t\t\t? appEnvKeys(manifest, name, input.runnables)\n\t\t\t\t: kind === 'worker'\n\t\t\t\t\t? workerEnvKeys(manifest, id, input.runnables)\n\t\t\t\t\t: undefined;\n\t\tif (keys) reads.set(name, keys);\n\t}\n\n\tconst readers = (id: string) => {\n\t\tconst key = provideKey(id, 'credentials');\n\t\treturn [...reads]\n\t\t\t.filter(([, env]) => env.has(key))\n\t\t\t.map(([app]) => app)\n\t\t\t.sort();\n\t};\n\n\tconst credentials: CredentialDeclaration[] = [];\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tconst { kind } = declaration;\n\t\tif (kind !== 'external-api' && kind !== 'credential') continue;\n\t\tconst apps = readers(id);\n\t\tif (apps.length > 0) credentials.push({ id, kind, apps });\n\t}\n\t// Mail and storage: the list a deploy's readiness check refuses by.\n\tconst services = stageServiceDeclarations({\n\t\tmanifest,\n\t\t...(input.runnables ? { runnables: input.runnables } : {}),\n\t});\n\n\treturn requiredStageKeys({\n\t\tlocal: input.local,\n\t\tservices,\n\t\tcredentials,\n\t\t...(input.domain ? { domain: input.domain } : {}),\n\t\t...(input.providers ? { providers: input.providers } : {}),\n\t\t...(input.server ? { server: true } : {}),\n\t}).map((key) => ({ ...key, set: input.supplied[key.key] !== undefined }));\n}\n","/\n `gkm secrets:add --stage <stage>` — the secrets a stage must be given,\n * built key by key.\n \n It offers exactly the keys a deploy would refuse the stage without\n * (`requiredStageKeys`), across every app in the workspace, each once: the\n * stage's buckets, mail and file servers where it is deployed, and every\n * third party's credentials. A key is built by what it is — a bucket from its\n * provider, mail from its SMTP server, credentials field by field from their\n * construct's schema — checked, and saved through the stage's own store, the\n * one `gkm secrets:set` writes. No value is ever printed.\n \n The keys are walked one at a time — unset ones first — and each is a\n * checkpoint: set it now, skip it, or stop here. A key is saved the moment it\n * is built, so stopping, Ctrl-C or a failure keeps every key before it, and\n * running the command again picks up what is still missing. A key a provider\n * on the stage creates (a bucket under `deploy.objects.<stage>`, written by\n * the deploy) is not a checkpoint: it is listed, with what creates it.\n \n `--json` asks nothing: it prints the keys, for a script or an agent to set\n * with `gkm secrets:set`.\n /\n\nimport { isIPv4, isIPv6 } from 'node:net';\nimport {\n\ttype S3Address,\n\tbuild as s3Build,\n\tparse as s3Parse,\n} from '@geekmidas/storage/s3-url';\nimport prompts, { type PromptObject } from 'prompts';\nimport { z } from 'zod';\nimport { SERVER_IPV4_KEY, SERVER_IPV6_KEY } from '../compose/dnsConfig.js';\nimport { loadWorkspaceSettings } from '../config';\nimport { GkmError } from '../errors';\nimport { stageProvider } from '../providers/config.js';\nimport { deploysWithCompose } from '../providers/dns.js';\nimport { provisionCommand, stageProviderNotes } from '../providers/notes.js';\nimport { discover } from '../reconcile/discover';\nimport { constructGlobs } from '../reconcile/workspace';\nimport { assertDeployedStage } from '../workspace/stages';\nimport {\n\ttype CredentialSchemaInfo,\n\ttype CredentialSchemas,\n\tissueLine,\n\tloadCredentialSchemas,\n} from './credentialSchemas';\nimport { type WorkspaceStageKey, workspaceStageKeys } from './stageKeys';\nimport { initStageSecrets } from './storage';\nimport { secretsStoreFor } from './store';\n\nexport interface SecretsAddOptions {\n\tstage: string;\n\t/* Only the keys the stage has not set. /\n\tmissing?: boolean;\n\t/* Print the keys as JSON and ask nothing. /\n\tjson?: boolean;\n\t/* The workspace — the current directory when absent. /\n\tcwd?: string;\n\t/* The CLI's home, for a file store's keys. Defaults to `GKM_HOME`. /\n\thome?: string;\n}\n\n/* Where the command writes, and whether there is anyone to ask. /\nexport interface SecretsAddIo {\n\t/* A line for the person at the terminal. /\n\tlog(line: string): void;\n\t/* `--json`'s output. /\n\twrite(chunk: string): void;\n\t/* Whether prompts can be answered. /\n\tinteractive: boolean;\n}\n\n/* What a run of the command came to. /\nexport interface SecretsAddResult {\n\t/* The keys offered, in the order they were walked. /\n\tkeys: WorkspaceStageKey[];\n\t/* The keys saved, in the order they were built. /\n\tsaved: string[];\n\t/* The keys skipped at their checkpoint. /\n\tskipped: string[];\n\t/* The keys the stage must still be given, once the run is over. /\n\tmissing: string[];\n}\n\n/* One key as `--json` prints it. /\nexport interface StageKeyJson {\n\tkey: string;\n\tkind: WorkspaceStageKey['kind'];\n\tconstruct: string;\n\tapps: string[];\n\tset: boolean;\n\t/* A provider on the stage creates it: the deploy, `gkm deploy --stage <stage>`. /\n\tprovisioned?: true;\n}\n\n/* `gkm secrets:add` with nobody at a terminal to answer it. /\nexport class SecretsAddNeedsTerminal extends GkmError {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`gkm secrets:add asks for each key, and there is no terminal to ask ` +\n\t\t\t\t`at. List what the stage needs with ` +\n\t\t\t\t`gkm secrets:add --stage ${stage} --missing --json, and set each ` +\n\t\t\t\t`with gkm secrets:set <KEY> <value> --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'SecretsAddNeedsTerminal';\n\t}\n}\n\n/\n The person stopped the builder at a prompt (Ctrl-C). Every key saved\n * before it is kept; the run ends with what was saved and what is missing.\n /\nexport class SecretsAddCancelled extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`Stopped. Every key saved to the stage '${stage}' before it is kept.`,\n\t\t);\n\t\tthis.name = 'SecretsAddCancelled';\n\t}\n}\n\nconst defaultIo = (): SecretsAddIo => ({\n\tlog: (line) => console.log(line),\n\twrite: (chunk) => {\n\t\tprocess.stdout.write(chunk);\n\t},\n\tinteractive: process.stdin.isTTY === true && process.stdout.isTTY === true,\n});\n\n/* `gkm secrets:add`. /\nexport async function secretsAddCommand(\n\toptions: SecretsAddOptions,\n\tio: SecretsAddIo = defaultIo(),\n): Promise<SecretsAddResult> {\n\tconst { stage } = options;\n\tconst workspace = await loadWorkspaceSettings(options.cwd ?? process.cwd());\n\tconst local = stage === workspace.stages.local;\n\tif (!local) assertDeployedStage(workspace.stages, stage);\n\n\tconst patterns = constructGlobs(workspace);\n\tconst runnables: Record<string, string[]> = {};\n\tconst manifest = await discover({\n\t\tpatterns,\n\t\tcwd: workspace.root,\n\t\trunnables,\n\t});\n\n\tconst store = await secretsStoreFor(workspace, stage, {\n\t\t...(options.home ? { home: options.home } : {}),\n\t});\n\tconst stored = await store.read(stage);\n\tconst domain = workspace.domains?.[stage];\n\n\tconst all = workspaceStageKeys({\n\t\tmanifest,\n\t\trunnables,\n\t\tlocal,\n\t\tsupplied: stored?.custom ?? {},\n\t\t...(domain ? { domain } : {}),\n\t\tproviders: stageProviderNotes(workspace, stage),\n\t\t// A compose stage that serves a domain names its server.\n\t\t...(!local && domain && deploysWithCompose(workspace)\n\t\t\t? { server: true }\n\t\t\t: {}),\n\t});\n\t// Unset keys first: a run is for what the stage still lacks.\n\tconst scope = [...all.filter((k) => !k.set), ...all.filter((k) => k.set)];\n\tconst keys = options.missing ? scope.filter((k) => !k.set) : scope;\n\n\t// A key a provider on the stage writes — the deploy creates its bucket.\n\tconst objects = stageProvider(workspace as never, 'objects', stage);\n\tconst provisioned = (k: WorkspaceStageKey) =>\n\t\tobjects.mode === 'provider' &&\n\t\tk.hint !== undefined &&\n\t\t(k.kind === 'bucket' \|\| k.kind === 'file-server');\n\n\tif (options.json) {\n\t\tconst listed: StageKeyJson[] = keys.map((k) => ({\n\t\t\tkey: k.key,\n\t\t\tkind: k.kind,\n\t\t\tconstruct: k.id,\n\t\t\tapps: [...(k.apps ?? [])],\n\t\t\tset: k.set,\n\t\t\t...(provisioned(k) ? { provisioned: true as const } : {}),\n\t\t}));\n\t\tio.write(`${JSON.stringify(listed, null, 2)}\\n`);\n\t\treturn { keys, saved: [], skipped: [], missing: [] };\n\t}\n\n\tif (!io.interactive) throw new SecretsAddNeedsTerminal(stage);\n\n\t// A provisioned key is no checkpoint: it is listed, with what creates it.\n\tconst offered = keys.filter((k) => !provisioned(k));\n\tconst created = keys.filter(provisioned);\n\tif (created.length > 0 && objects.mode === 'provider') {\n\t\tio.log('Not offered — a provider on the stage creates them:');\n\t\tfor (const k of created) {\n\t\t\tio.log(\n\t\t\t\t` ${k.key} — created by ${provisionCommand(stage)} ` +\n\t\t\t\t\t`(deploy.objects.${stage} is ${objects.name})`,\n\t\t\t);\n\t\t}\n\t}\n\n\tif (offered.length === 0) {\n\t\tio.log(\n\t\t\tall.every(provisioned)\n\t\t\t\t? `Nothing to add: no construct on '${stage}' needs a key only the stage can supply.`\n\t\t\t\t: `Nothing to add: the stage '${stage}' has every key it needs.`,\n\t\t);\n\t\treturn { keys: offered, saved: [], skipped: [], missing: [] };\n\t}\n\n\tconst ask = asker(stage);\n\tlet current = stored ?? initStageSecrets(stage);\n\tconst saved: string[] = [];\n\tconst skipped: string[] = [];\n\tconst has = (key: string) => current.custom?.[key] !== undefined;\n\tlet schemas: CredentialSchemas \| undefined;\n\n\t// Each key is saved as soon as it is built: what is set survives a stop.\n\tconst save = async (values: Record<string, string>) => {\n\t\tcurrent = {\n\t\t\t...current,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: { ...current.custom, ...values },\n\t\t};\n\t\tawait store.write(stage, current);\n\t\tsaved.push(...Object.keys(values));\n\t\tio.log(` ✓ Saved ${Object.keys(values).join(', ')}.`);\n\t};\n\n\tconst walk = async () => {\n\t\tfor (const [index, entry] of offered.entries()) {\n\t\t\tio.log(`\\n[${index + 1}/${offered.length}] ${entry.key} — ${entry.what}`);\n\t\t\tif (entry.hint) io.log(` ${entry.hint}`);\n\n\t\t\tconst step = await ask<'set' \| 'skip' \| 'stop'>({\n\t\t\t\ttype: 'select',\n\t\t\t\tmessage: `${entry.key} ${KIND_LABEL[entry.kind]} '${entry.id}'${entry.apps?.length ? ` · ${entry.apps.join(', ')}` : ''}${entry.set ? ' · set' : ''}`,\n\t\t\t\tchoices: [\n\t\t\t\t\t{ title: 'Set it now', value: 'set' },\n\t\t\t\t\t{ title: 'Skip', value: 'skip' },\n\t\t\t\t\t{ title: 'Stop here', value: 'stop' },\n\t\t\t\t],\n\t\t\t\tinitial: 0,\n\t\t\t});\n\t\t\tif (step === 'stop') return;\n\t\t\tif (step !== 'set') {\n\t\t\t\tskipped.push(entry.key);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (entry.set) {\n\t\t\t\tconst overwrite: boolean = await ask({\n\t\t\t\t\ttype: 'confirm',\n\t\t\t\t\tmessage: `${entry.key} is set. Replace it?`,\n\t\t\t\t\tinitial: false,\n\t\t\t\t});\n\t\t\t\tif (!overwrite) {\n\t\t\t\t\tskipped.push(entry.key);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tswitch (entry.kind) {\n\t\t\t\tcase 'bucket':\n\t\t\t\t\tawait save(await buildBucket(ask, io, entry, has));\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'email':\n\t\t\t\t\tawait save({\n\t\t\t\t\t\t[entry.key]: entry.key.endsWith('_FROM')\n\t\t\t\t\t\t\t? await askFrom(ask, io)\n\t\t\t\t\t\t\t: await buildSmtpUrl(ask, io),\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'file-server':\n\t\t\t\t\tawait save({\n\t\t\t\t\t\t[entry.key]: await askHttpUrl(ask, io, 'Its public URL'),\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'server':\n\t\t\t\t\tawait save(await buildServer(ask, io, has));\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'external-api':\n\t\t\t\tcase 'credential':\n\t\t\t\t\tschemas ??= await loadCredentialSchemas({\n\t\t\t\t\t\troot: workspace.root,\n\t\t\t\t\t\tpatterns,\n\t\t\t\t\t});\n\t\t\t\t\tawait save({\n\t\t\t\t\t\t[entry.key]: await buildCredentials(ask, io, entry, schemas),\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t};\n\n\ttry {\n\t\tawait walk();\n\t} catch (error) {\n\t\tif (!(error instanceof SecretsAddCancelled)) throw error;\n\t\tio.log(`\\n${error.message}`);\n\t}\n\n\tconst missing = all\n\t\t.filter((k) => !provisioned(k) && !has(k.key))\n\t\t.map((k) => k.key);\n\tio.log('');\n\tio.log(\n\t\tsaved.length > 0\n\t\t\t? `✓ Saved to the stage '${stage}' (${store.name} store): ${saved.join(', ')}`\n\t\t\t: 'Nothing was saved.',\n\t);\n\tif (skipped.length > 0) io.log(` Skipped: ${skipped.join(', ')}`);\n\tif (missing.length > 0) {\n\t\tio.log(` Still missing: ${missing.join(', ')}`);\n\t\tio.log(\n\t\t\t` Run gkm secrets:add --stage ${stage} --missing again to pick up where this left off.`,\n\t\t);\n\t}\n\treturn { keys: offered, saved, skipped, missing };\n}\n\nconst KIND_LABEL: Record<WorkspaceStageKey['kind'], string> = {\n\tbucket: 'bucket',\n\temail: 'email',\n\t'file-server': 'file server',\n\t'external-api': 'external API',\n\tcredential: 'credential',\n\tserver: 'server address',\n};\n\n/* The server's IPv4 address, and — if it has one — its IPv6 address. /\nasync function buildServer(\n\task: Ask,\n\tio: SecretsAddIo,\n\thas: (key: string) => boolean,\n): Promise<Record<string, string>> {\n\tconst ipv4 = text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{ type: 'text', message: \"The server's public IPv4 address\" },\n\t\t\t(value) =>\n\t\t\t\tisIPv4(text(value))\n\t\t\t\t\t? undefined\n\t\t\t\t\t: 'An IPv4 address is required, e.g. 203.0.113.10.',\n\t\t),\n\t);\n\tconst values: Record<string, string> = { [SERVER_IPV4_KEY]: ipv4 };\n\tif (has(SERVER_IPV6_KEY)) return values;\n\tconst ipv6 = text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{\n\t\t\t\ttype: 'text',\n\t\t\t\tmessage: 'Its public IPv6 address (empty for none — no AAAA records)',\n\t\t\t},\n\t\t\t(value) =>\n\t\t\t\t!text(value) \|\| isIPv6(text(value))\n\t\t\t\t\t? undefined\n\t\t\t\t\t: 'An IPv6 address, e.g. 2001:db8::10, or nothing.',\n\t\t),\n\t);\n\tif (ipv6) values[SERVER_IPV6_KEY] = ipv6;\n\treturn values;\n}\n\n/* One question, answered — or the run stopped. /\ntype Ask = <T = string>(question: Omit<PromptObject, 'name'>) => Promise<T>;\n\nfunction asker(stage: string): Ask {\n\treturn async <T>(question: Omit<PromptObject, 'name'>) => {\n\t\tconst answers = await prompts(\n\t\t\t{ ...question, name: 'value' } as PromptObject,\n\t\t\t{\n\t\t\t\tonCancel: () => {\n\t\t\t\t\tthrow new SecretsAddCancelled(stage);\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\t\treturn answers.value as T;\n\t};\n}\n\n/* Ask until `accept` takes the answer; `accept` returns why it did not. /\nasync function askUntil<T>(\n\task: Ask,\n\tio: SecretsAddIo,\n\tquestion: Omit<PromptObject, 'name'>,\n\taccept: (value: T) => string \| undefined,\n): Promise<T> {\n\tfor (;;) {\n\t\tconst value = await ask<T>(question);\n\t\tconst problem = accept(value);\n\t\tif (!problem) return value;\n\t\tio.log(` ✗ ${problem}`);\n\t}\n}\n\nconst required =\n\t(what: string) =>\n\t(value: string \| undefined): string \| undefined =>\n\t\tvalue?.trim() ? undefined : `${what} is required.`;\n\nconst text = (value: unknown) => String(value ?? '').trim();\n\n/* An `http(s)://` URL. /\nconst HttpUrl = z.url({ protocol: /^https?$/ });\n\nasync function askHttpUrl(\n\task: Ask,\n\tio: SecretsAddIo,\n\tmessage: string,\n): Promise<string> {\n\treturn text(\n\t\tawait askUntil<string>(ask, io, { type: 'text', message }, (value) =>\n\t\t\tHttpUrl.safeParse(text(value)).success\n\t\t\t\t? undefined\n\t\t\t\t: 'An http:// or https:// URL is required.',\n\t\t),\n\t);\n}\n\nasync function askFrom(ask: Ask, io: SecretsAddIo): Promise<string> {\n\treturn text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{ type: 'text', message: 'The address it sends from' },\n\t\t\t(value) =>\n\t\t\t\tz.email().safeParse(text(value)).success\n\t\t\t\t\t? undefined\n\t\t\t\t\t: 'An email address is required, e.g. noreply@example.com.',\n\t\t),\n\t);\n}\n\n/* A mail service whose SMTP settings are known: only its secrets are asked. /\ntype MailService = 'resend' \| 'ses' \| 'postmark' \| 'mailgun' \| 'other';\n\n/\n An SMTP server as the URL `@geekmidas/emailkit` reads: `smtp://` for\n * STARTTLS, `smtps://` for TLS from the first byte, with the user and\n * password percent-encoded.\n \n A known service fills in its own host, port and user; each from its docs:\n * - Resend: smtp.resend.com, 465 implicit TLS, user `resend`, password the\n * API key — https://resend.com/docs/send-with-smtp\n * - Amazon SES: email-smtp.<region>.amazonaws.com, 587 STARTTLS, SMTP\n * credentials — https://docs.aws.amazon.com/ses/latest/dg/smtp-connect.html,\n * https://docs.aws.amazon.com/general/latest/gr/ses.html\n * - Postmark: smtp.postmarkapp.com, 587 STARTTLS, the server API token as\n * user and password —\n * https://postmarkapp.com/developer/user-guide/send-email-with-smtp\n * - Mailgun: smtp.mailgun.org (EU: smtp.eu.mailgun.org), 587 STARTTLS, the\n * domain's SMTP credentials —\n * https://documentation.mailgun.com/docs/mailgun/user-manual/sending-messages/send-smtp,\n * https://documentation.mailgun.com/docs/mailgun/api-reference/api-overview\n /\nasync function buildSmtpUrl(ask: Ask, io: SecretsAddIo): Promise<string> {\n\tconst service = await ask<MailService>({\n\t\ttype: 'select',\n\t\tmessage: 'Which mail service?',\n\t\tchoices: [\n\t\t\t{ title: 'Resend', value: 'resend' },\n\t\t\t{ title: 'Amazon SES', value: 'ses' },\n\t\t\t{ title: 'Postmark', value: 'postmark' },\n\t\t\t{ title: 'Mailgun', value: 'mailgun' },\n\t\t\t{ title: 'Other SMTP server', value: 'other' },\n\t\t],\n\t\tinitial: 0,\n\t});\n\tconst secret = async (message: string, what: string) =>\n\t\ttext(\n\t\t\tawait askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message },\n\t\t\t\trequired(what),\n\t\t\t),\n\t\t);\n\tconst login = async (message: string, what: string) =>\n\t\ttext(\n\t\t\tawait askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'text', message },\n\t\t\t\trequired(what),\n\t\t\t),\n\t\t);\n\n\tswitch (service) {\n\t\tcase 'resend':\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'tls',\n\t\t\t\thost: 'smtp.resend.com',\n\t\t\t\tport: 465,\n\t\t\t\tuser: 'resend',\n\t\t\t\tpassword: await secret('API key (re_…)', 'The API key'),\n\t\t\t});\n\t\tcase 'ses': {\n\t\t\tconst region = await login('Region', 'The region');\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'starttls',\n\t\t\t\thost: `email-smtp.${region}.amazonaws.com`,\n\t\t\t\tport: 587,\n\t\t\t\tuser: await login('SMTP user name', 'The SMTP user name'),\n\t\t\t\tpassword: await secret('SMTP password', 'The SMTP password'),\n\t\t\t});\n\t\t}\n\t\tcase 'postmark': {\n\t\t\tconst token = await secret('Server API token', 'The server API token');\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'starttls',\n\t\t\t\thost: 'smtp.postmarkapp.com',\n\t\t\t\tport: 587,\n\t\t\t\tuser: token,\n\t\t\t\tpassword: token,\n\t\t\t});\n\t\t}\n\t\tcase 'mailgun': {\n\t\t\tconst region = await ask<'us' \| 'eu'>({\n\t\t\t\ttype: 'select',\n\t\t\t\tmessage: 'Region',\n\t\t\t\tchoices: [\n\t\t\t\t\t{ title: 'US (smtp.mailgun.org)', value: 'us' },\n\t\t\t\t\t{ title: 'EU (smtp.eu.mailgun.org)', value: 'eu' },\n\t\t\t\t],\n\t\t\t\tinitial: 0,\n\t\t\t});\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'starttls',\n\t\t\t\thost: region === 'eu' ? 'smtp.eu.mailgun.org' : 'smtp.mailgun.org',\n\t\t\t\tport: 587,\n\t\t\t\tuser: await login(\n\t\t\t\t\t'SMTP login (e.g. postmaster@mg.example.com)',\n\t\t\t\t\t'The SMTP login',\n\t\t\t\t),\n\t\t\t\tpassword: await secret('SMTP password', 'The SMTP password'),\n\t\t\t});\n\t\t}\n\t\tcase 'other':\n\t\t\tbreak;\n\t}\n\n\tconst host = text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{ type: 'text', message: 'SMTP host' },\n\t\t\trequired('The host'),\n\t\t),\n\t);\n\tconst port = await askUntil<string \| number>(\n\t\task,\n\t\tio,\n\t\t{ type: 'text', message: 'Port', initial: '587' },\n\t\t(value) => {\n\t\t\tconst n = Number(value);\n\t\t\treturn Number.isInteger(n) && n > 0 && n < 65536\n\t\t\t\t? undefined\n\t\t\t\t: 'A port number is required.';\n\t\t},\n\t);\n\tconst user = text(\n\t\tawait ask<string>({ type: 'text', message: 'User (empty for none)' }),\n\t);\n\tconst password = user\n\t\t? await ask<string>({ type: 'password', message: 'Password' })\n\t\t: '';\n\tconst tls = await ask<'starttls' \| 'tls'>({\n\t\ttype: 'select',\n\t\tmessage: 'TLS',\n\t\tchoices: [\n\t\t\t{ title: 'STARTTLS (smtp://, usually port 587)', value: 'starttls' },\n\t\t\t{ title: 'TLS on connect (smtps://, usually port 465)', value: 'tls' },\n\t\t],\n\t\tinitial: 0,\n\t});\n\treturn smtpUrl({ tls, host, port: Number(port), user, password });\n}\n\nfunction smtpUrl(server: {\n\ttls: 'starttls' \| 'tls';\n\thost: string;\n\tport: number;\n\tuser?: string;\n\tpassword?: string;\n}): string {\n\tconst url = new URL(\n\t\t`${server.tls === 'tls' ? 'smtps' : 'smtp'}://${server.host}`,\n\t);\n\turl.port = String(server.port);\n\tif (server.user) {\n\t\turl.username = encodeURIComponent(server.user);\n\t\turl.password = encodeURIComponent(server.password ?? '');\n\t}\n\treturn url.toString().replace(/\\/$/, '');\n}\n\n/\n A bucket's URL, from its provider — and, optionally, a key for it alone in\n * the URL, or the stage's shared pair. Credentials are never required: without\n * them the SDK's own chain signs, a role included.\n /\nasync function buildBucket(\n\task: Ask,\n\tio: SecretsAddIo,\n\tentry: WorkspaceStageKey,\n\thas: (key: string) => boolean,\n): Promise<Record<string, string>> {\n\tconst provider = await ask<'s3' \| 'r2' \| 'compatible' \| 'url'>({\n\t\ttype: 'select',\n\t\tmessage: 'Where is the bucket?',\n\t\tchoices: [\n\t\t\t{ title: 'AWS S3', value: 's3' },\n\t\t\t{ title: 'Cloudflare R2', value: 'r2' },\n\t\t\t{ title: 'MinIO, or another S3-compatible store', value: 'compatible' },\n\t\t\t{ title: 'Paste an s3:// URL', value: 'url' },\n\t\t],\n\t\tinitial: 0,\n\t});\n\n\tconst bucketName = async () =>\n\t\ttext(\n\t\t\tawait askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'text', message: 'Bucket name' },\n\t\t\t\trequired('The bucket name'),\n\t\t\t),\n\t\t);\n\n\tlet address: S3Address;\n\tswitch (provider) {\n\t\tcase 's3': {\n\t\t\tconst bucket = await bucketName();\n\t\t\tconst region = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{ type: 'text', message: 'Region', initial: 'eu-west-1' },\n\t\t\t\t\trequired('The region'),\n\t\t\t\t),\n\t\t\t);\n\t\t\taddress = { bucket, region };\n\t\t\tbreak;\n\t\t}\n\t\tcase 'r2': {\n\t\t\tconst account = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: 'text',\n\t\t\t\t\t\tmessage: 'Cloudflare account id, or the R2 endpoint URL',\n\t\t\t\t\t},\n\t\t\t\t\trequired('The account id or endpoint'),\n\t\t\t\t),\n\t\t\t);\n\t\t\tconst bucket = await bucketName();\n\t\t\taddress = {\n\t\t\t\tbucket,\n\t\t\t\tregion: 'auto',\n\t\t\t\tendpoint: /^https?:\\/\\//.test(account)\n\t\t\t\t\t? account\n\t\t\t\t\t: `https://${account}.r2.cloudflarestorage.com`,\n\t\t\t};\n\t\t\tbreak;\n\t\t}\n\t\tcase 'compatible': {\n\t\t\tconst endpoint = await askHttpUrl(ask, io, 'Endpoint URL');\n\t\t\tconst bucket = await bucketName();\n\t\t\tconst region = text(\n\t\t\t\tawait ask<string>({\n\t\t\t\t\ttype: 'text',\n\t\t\t\t\tmessage: 'Region',\n\t\t\t\t\tinitial: 'us-east-1',\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst forcePathStyle = await ask<boolean>({\n\t\t\t\ttype: 'confirm',\n\t\t\t\tmessage: 'Path-style addressing? (MinIO needs it)',\n\t\t\t\tinitial: true,\n\t\t\t});\n\t\t\taddress = {\n\t\t\t\tbucket,\n\t\t\t\t...(region ? { region } : {}),\n\t\t\t\tendpoint,\n\t\t\t\t...(forcePathStyle ? { forcePathStyle } : {}),\n\t\t\t};\n\t\t\tbreak;\n\t\t}\n\t\tcase 'url': {\n\t\t\tconst pasted = await askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message: 'The s3:// URL' },\n\t\t\t\t(value) => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\ts3Parse(text(value));\n\t\t\t\t\t\treturn undefined;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\treturn `Not an s3:// URL the storage client can read (${(error as Error).name}).`;\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t);\n\t\t\taddress = s3Parse(text(pasted));\n\t\t\tbreak;\n\t\t}\n\t}\n\n\tif (!address.accessKeyId) {\n\t\tconst own = await ask<boolean>({\n\t\t\ttype: 'confirm',\n\t\t\tmessage: `A key for '${entry.id}' alone, in its URL? (optional)`,\n\t\t\tinitial: false,\n\t\t});\n\t\tif (own) {\n\t\t\tconst accessKeyId = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{ type: 'text', message: 'Access key id' },\n\t\t\t\t\trequired('The access key id'),\n\t\t\t\t),\n\t\t\t);\n\t\t\tconst secretAccessKey = await askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message: 'Secret access key' },\n\t\t\t\trequired('The secret access key'),\n\t\t\t);\n\t\t\taddress = { ...address, accessKeyId, secretAccessKey };\n\t\t}\n\t}\n\n\tconst values: Record<string, string> = { [entry.key]: s3Build(address) };\n\n\tif (!address.accessKeyId && !has('AWS_ACCESS_KEY_ID')) {\n\t\tconst shared = await ask<boolean>({\n\t\t\ttype: 'confirm',\n\t\t\tmessage:\n\t\t\t\t\"Set the stage's shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY? \" +\n\t\t\t\t'(optional: without them a role signs)',\n\t\t\tinitial: false,\n\t\t});\n\t\tif (shared) {\n\t\t\tvalues.AWS_ACCESS_KEY_ID = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{ type: 'text', message: 'AWS_ACCESS_KEY_ID' },\n\t\t\t\t\trequired('The access key id'),\n\t\t\t\t),\n\t\t\t);\n\t\t\tvalues.AWS_SECRET_ACCESS_KEY = await askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message: 'AWS_SECRET_ACCESS_KEY' },\n\t\t\t\trequired('The secret access key'),\n\t\t\t);\n\t\t}\n\t}\n\n\treturn values;\n}\n\n/* A field whose name says it is a secret, asked for without echo. /\nconst SECRET_FIELD = /secret\|key\|token\|password/i;\n\ninterface JsonSchemaProperty {\n\ttype?: string \| string[];\n\tenum?: unknown[];\n\tdescription?: string;\n}\n\n/* The properties of an object schema, or nothing for any other shape. /\nfunction objectProperties(\n\tinfo: CredentialSchemaInfo \| undefined,\n):\n\t\| { properties: Record<string, JsonSchemaProperty>; required: string[] }\n\t\| undefined {\n\tconst schema = info?.jsonSchema;\n\tif (!schema \|\| schema.type !== 'object') return undefined;\n\tconst properties = schema.properties;\n\tif (!properties \|\| typeof properties !== 'object') return undefined;\n\treturn {\n\t\tproperties: properties as Record<string, JsonSchemaProperty>,\n\t\trequired: Array.isArray(schema.required)\n\t\t\t? (schema.required as string[])\n\t\t\t: [],\n\t};\n}\n\nfunction typesOf(property: JsonSchemaProperty): string[] {\n\tif (Array.isArray(property.type)) return property.type;\n\treturn property.type ? [property.type] : [];\n}\n\n/\n Credentials, field by field where the construct's schema is an object it\n * can describe, and as JSON otherwise — checked against the schema itself\n * before anything is kept, and asked again, with each issue's path, until\n * the schema takes it.\n */\nasync function buildCredentials(\n\task: Ask,\n\tio: SecretsAddIo,\n\tentry: WorkspaceStageKey,\n\tschemas: CredentialSchemas,\n): Promise<string> {\n\tconst info = schemas.schemas.find((s) => s.key === entry.key);\n\tconst shape = objectProperties(info);\n\tif (!info) {\n\t\tio.log(\n\t\t\t` '${entry.id}' exposes no schema to check against; the value is stored as given.`,\n\t\t);\n\t}\n\n\tfor (;;) {\n\t\tconst raw = shape\n\t\t\t? JSON.stringify(await askFields(ask, io, shape))\n\t\t\t: text(\n\t\t\t\t\tawait ask<string>({\n\t\t\t\t\t\ttype: 'password',\n\t\t\t\t\t\tmessage: 'The value, as JSON (or one opaque string)',\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\tconst check = await schemas.check(entry.key, raw);\n\t\tif (check.ok) return raw;\n\t\tio.log(` ✗ The schema of '${entry.id}' refuses it:`);\n\t\tfor (const issue of check.issues) {\n\t\t\tio.log(` ${issueLine(entry.key, issue)}`);\n\t\t}\n\t\tio.log(' Again:');\n\t}\n}\n\nasync function askFields(\n\task: Ask,\n\tio: SecretsAddIo,\n\tshape: {\n\t\tproperties: Record<string, JsonSchemaProperty>;\n\t\trequired: string[];\n\t},\n): Promise<Record<string, unknown>> {\n\tconst value: Record<string, unknown> = {};\n\tfor (const [name, property] of Object.entries(shape.properties)) {\n\t\tconst optional = !shape.required.includes(name);\n\t\tconst label = `${name}${optional ? ' (optional)' : ''}${property.description ? ` — ${property.description}` : ''}`;\n\t\tconst types = typesOf(property);\n\n\t\tif (property.enum?.length) {\n\t\t\tconst choices = property.enum.map((option) => ({\n\t\t\t\ttitle: String(option),\n\t\t\t\tvalue: option,\n\t\t\t}));\n\t\t\tconst picked = await ask<unknown>({\n\t\t\t\ttype: 'select',\n\t\t\t\tmessage: label,\n\t\t\t\tchoices: optional\n\t\t\t\t\t? [{ title: '(none)', value: undefined }, ...choices]\n\t\t\t\t\t: choices,\n\t\t\t} as Omit<PromptObject, 'name'>);\n\t\t\tif (picked !== undefined) value[name] = picked;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (types.includes('boolean')) {\n\t\t\tvalue[name] = await ask<boolean>({\n\t\t\t\ttype: 'confirm',\n\t\t\t\tmessage: label,\n\t\t\t\tinitial: false,\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst numeric = types.includes('number') \|\| types.includes('integer');\n\t\tconst plain = types.length === 0 \|\| types.includes('string');\n\t\tconst answer = await askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{\n\t\t\t\ttype: SECRET_FIELD.test(name) ? 'password' : 'text',\n\t\t\t\tmessage: label,\n\t\t\t},\n\t\t\t(given) => {\n\t\t\t\tconst typed = text(given);\n\t\t\t\tif (!typed) return optional ? undefined : `${name} is required.`;\n\t\t\t\tif (numeric && !plain && Number.isNaN(Number(typed))) {\n\t\t\t\t\treturn `${name} is a number.`;\n\t\t\t\t}\n\t\t\t\tif (!numeric && !plain) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tJSON.parse(typed);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\treturn `${name} is JSON (${types.join(' or ')}).`;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn undefined;\n\t\t\t},\n\t\t);\n\t\tconst typed = text(answer);\n\t\tif (!typed) continue;\n\t\tvalue[name] = plain ? typed : numeric ? Number(typed) : JSON.parse(typed);\n\t}\n\treturn value;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,SAAgB,mBACf,OACsB;CACtB,MAAM,EAAE,aAAa;CAIrB,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,MAAM,EAAE,SAAS;EACjB,MAAM,OAAOA,eAAAA,OAAO,EAAE;EACtB,MAAM,OACL,SAAS,cAAc,SAAS,UAAU,SAAS,eAChDC,cAAAA,WAAW,UAAU,MAAM,MAAM,SAAS,IAC1C,SAAS,WACRC,cAAAA,cAAc,UAAU,IAAI,MAAM,SAAS,IAC3C,KAAA;EACL,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI;CAC/B;CAEA,MAAM,WAAW,OAAe;EAC/B,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,IAAI,aAAa;EACxC,OAAO,CAAC,GAAG,KAAK,CAAC,CACf,QAAQ,GAAG,SAAS,IAAI,IAAI,GAAG,CAAC,CAAC,CACjC,KAAK,CAAC,SAAS,GAAG,CAAC,CACnB,KAAK;CACR;CAEA,MAAM,cAAuC,CAAC;CAC9C,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,MAAM,EAAE,SAAS;EACjB,IAAI,SAAS,kBAAkB,SAAS,cAAc;EACtD,MAAM,OAAO,QAAQ,EAAE;EACvB,IAAI,KAAK,SAAS,GAAG,YAAY,KAAK;GAAE;GAAI;GAAM;EAAK,CAAC;CACzD;CAEA,MAAM,WAAWC,cAAAA,yBAAyB;EACzC;EACA,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACzD,CAAC;CAED,OAAOC,cAAAA,kBAAkB;EACxB,OAAO,MAAM;EACb;EACA;EACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;CACxC,CAAC,CAAC,CAAC,KAAK,SAAS;EAAE,GAAG;EAAK,KAAK,MAAM,SAAS,IAAI,SAAS,KAAA;CAAU,EAAE;AACzE;;;;;;;;;;;;;;;;;;;;;;;;;;ACDA,IAAa,0BAAb,cAA6CC,eAAAA,SAAS;CAChC;CAArB,YAAY,OAAwB;EACnC,MACC,iIAE4B,MAAM,6EACa,MAAM,EACtD;EANoB,KAAA,QAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,IAAa,sBAAb,cAAyC,MAAM;CACzB;CAArB,YAAY,OAAwB;EACnC,MACC,0CAA0C,MAAM,qBACjD;EAHoB,KAAA,QAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,MAAM,mBAAiC;CACtC,MAAM,SAAS,QAAQ,IAAI,IAAI;CAC/B,QAAQ,UAAU;EACjB,QAAQ,OAAO,MAAM,KAAK;CAC3B;CACA,aAAa,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,UAAU;AACvE;;AAGA,eAAsB,kBACrB,SACA,KAAmB,UAAU,GACD;CAC5B,MAAM,EAAE,UAAU;CAClB,MAAM,YAAY,MAAMC,eAAAA,sBAAsB,QAAQ,OAAO,QAAQ,IAAI,CAAC;CAC1E,MAAM,QAAQ,UAAU,UAAU,OAAO;CACzC,IAAI,CAAC,OAAO,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAEvD,MAAM,WAAWC,cAAAA,eAAe,SAAS;CACzC,MAAM,YAAsC,CAAC;CAC7C,MAAM,WAAW,MAAMC,iBAAAA,SAAS;EAC/B;EACA,KAAK,UAAU;EACf;CACD,CAAC;CAED,MAAM,QAAQ,MAAMC,cAAAA,gBAAgB,WAAW,OAAO,EACrD,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC,EAC9C,CAAC;CACD,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK;CACrC,MAAM,SAAS,UAAU,UAAU;CAEnC,MAAM,MAAM,mBAAmB;EAC9B;EACA;EACA;EACA,UAAU,QAAQ,UAAU,CAAC;EAC7B,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,WAAWC,cAAAA,mBAAmB,WAAW,KAAK;EAE9C,GAAI,CAAC,SAAS,UAAUC,YAAAA,mBAAmB,SAAS,IACjD,EAAE,QAAQ,KAAK,IACf,CAAC;CACL,CAAC;CAED,MAAM,QAAQ,CAAC,GAAG,IAAI,QAAQ,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,IAAI,QAAQ,MAAM,EAAE,GAAG,CAAC;CACxE,MAAM,OAAO,QAAQ,UAAU,MAAM,QAAQ,MAAM,CAAC,EAAE,GAAG,IAAI;CAG7D,MAAM,UAAUC,kBAAAA,cAAc,WAAoB,WAAW,KAAK;CAClE,MAAM,eAAe,MACpB,QAAQ,SAAS,cACjB,EAAE,SAAS,KAAA,MACV,EAAE,SAAS,YAAY,EAAE,SAAS;CAEpC,IAAI,QAAQ,MAAM;EACjB,MAAM,SAAyB,KAAK,KAAK,OAAO;GAC/C,KAAK,EAAE;GACP,MAAM,EAAE;GACR,WAAW,EAAE;GACb,MAAM,CAAC,GAAI,EAAE,QAAQ,CAAC,CAAE;GACxB,KAAK,EAAE;GACP,GAAI,YAAY,CAAC,IAAI,EAAE,aAAa,KAAc,IAAI,CAAC;EACxD,EAAE;EACF,GAAG,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,GAAG;EAC/C,OAAO;GAAE;GAAM,OAAO,CAAC;GAAG,SAAS,CAAC;GAAG,SAAS,CAAC;EAAE;CACpD;CAEA,IAAI,CAAC,GAAG,aAAa,MAAM,IAAI,wBAAwB,KAAK;CAG5D,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC,YAAY,CAAC,CAAC;CAClD,MAAM,UAAU,KAAK,OAAO,WAAW;CACvC,IAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,YAAY;EACtD,GAAG,IAAI,qDAAqD;EAC5D,KAAK,MAAM,KAAK,SACf,GAAG,IACF,KAAK,EAAE,IAAI,gBAAgBC,cAAAA,iBAAiB,KAAK,EAAE,mBAC/B,MAAM,MAAM,QAAQ,KAAK,EAC9C;CAEF;CAEA,IAAI,QAAQ,WAAW,GAAG;EACzB,GAAG,IACF,IAAI,MAAM,WAAW,IAClB,oCAAoC,MAAM,4CAC1C,8BAA8B,MAAM,0BACxC;EACA,OAAO;GAAE,MAAM;GAAS,OAAO,CAAC;GAAG,SAAS,CAAC;GAAG,SAAS,CAAC;EAAE;CAC7D;CAEA,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,UAAU,UAAUC,cAAAA,iBAAiB,KAAK;CAC9C,MAAM,QAAkB,CAAC;CACzB,MAAM,UAAoB,CAAC;CAC3B,MAAM,OAAO,QAAgB,QAAQ,SAAS,SAAS,KAAA;CACvD,IAAI;CAGJ,MAAM,OAAO,OAAO,WAAmC;EACtD,UAAU;GACT,GAAG;GACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,QAAQ;IAAE,GAAG,QAAQ;IAAQ,GAAG;GAAO;EACxC;EACA,MAAM,MAAM,MAAM,OAAO,OAAO;EAChC,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,CAAC;EACjC,GAAG,IAAI,aAAa,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;CACtD;CAEA,MAAM,OAAO,YAAY;EACxB,KAAK,MAAM,CAAC,OAAO,UAAU,QAAQ,QAAQ,GAAG;GAC/C,GAAG,IAAI,MAAM,QAAQ,EAAE,GAAG,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAK,MAAM,MAAM;GACxE,IAAI,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,MAAM;GAExC,MAAM,OAAO,MAAM,IAA6B;IAC/C,MAAM;IACN,SAAS,GAAG,MAAM,IAAI,IAAI,WAAW,MAAM,MAAM,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,MAAM,WAAW;IAClJ,SAAS;KACR;MAAE,OAAO;MAAc,OAAO;KAAM;KACpC;MAAE,OAAO;MAAQ,OAAO;KAAO;KAC/B;MAAE,OAAO;MAAa,OAAO;KAAO;IACrC;IACA,SAAS;GACV,CAAC;GACD,IAAI,SAAS,QAAQ;GACrB,IAAI,SAAS,OAAO;IACnB,QAAQ,KAAK,MAAM,GAAG;IACtB;GACD;GACA,IAAI,MAAM,KAML;QAAA,CAAC,MAL4B,IAAI;KACpC,MAAM;KACN,SAAS,GAAG,MAAM,IAAI;KACtB,SAAS;IACV,CAAC,GACe;KACf,QAAQ,KAAK,MAAM,GAAG;KACtB;IACD;;GAGD,QAAQ,MAAM,MAAd;IACC,KAAK;KACJ,MAAM,KAAK,MAAM,YAAY,KAAK,IAAI,OAAO,GAAG,CAAC;KACjD;IACD,KAAK;KACJ,MAAM,KAAK,GACT,MAAM,MAAM,MAAM,IAAI,SAAS,OAAO,IACpC,MAAM,QAAQ,KAAK,EAAE,IACrB,MAAM,aAAa,KAAK,EAAE,EAC9B,CAAC;KACD;IACD,KAAK;KACJ,MAAM,KAAK,GACT,MAAM,MAAM,MAAM,WAAW,KAAK,IAAI,gBAAgB,EACxD,CAAC;KACD;IACD,KAAK;KACJ,MAAM,KAAK,MAAM,YAAY,KAAK,IAAI,GAAG,CAAC;KAC1C;IACD,KAAK;IACL,KAAK;KACJ,YAAY,MAAMC,0BAAAA,sBAAsB;MACvC,MAAM,UAAU;MAChB;KACD,CAAC;KACD,MAAM,KAAK,GACT,MAAM,MAAM,MAAM,iBAAiB,KAAK,IAAI,OAAO,OAAO,EAC5D,CAAC;GAEH;EACD;CACD;CAEA,IAAI;EACH,MAAM,KAAK;CACZ,SAAS,OAAO;EACf,IAAI,EAAE,iBAAiB,sBAAsB,MAAM;EACnD,GAAG,IAAI,KAAK,MAAM,SAAS;CAC5B;CAEA,MAAM,UAAU,IACd,QAAQ,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAC7C,KAAK,MAAM,EAAE,GAAG;CAClB,GAAG,IAAI,EAAE;CACT,GAAG,IACF,MAAM,SAAS,IACZ,yBAAyB,MAAM,KAAK,MAAM,KAAK,WAAW,MAAM,KAAK,IAAI,MACzE,oBACJ;CACA,IAAI,QAAQ,SAAS,GAAG,GAAG,IAAI,cAAc,QAAQ,KAAK,IAAI,GAAG;CACjE,IAAI,QAAQ,SAAS,GAAG;EACvB,GAAG,IAAI,oBAAoB,QAAQ,KAAK,IAAI,GAAG;EAC/C,GAAG,IACF,iCAAiC,MAAM,iDACxC;CACD;CACA,OAAO;EAAE,MAAM;EAAS;EAAO;EAAS;CAAQ;AACjD;AAEA,MAAM,aAAwD;CAC7D,QAAQ;CACR,OAAO;CACP,eAAe;CACf,gBAAgB;CAChB,YAAY;CACZ,QAAQ;AACT;;AAGA,eAAe,YACd,KACA,IACA,KACkC;CAClC,MAAM,OAAO,KACZ,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAAmC,IAC3D,WAAA,GACAC,SAAAA,OAAAA,CAAO,KAAK,KAAK,CAAC,IACf,KAAA,IACA,iDACL,CACD;CACA,MAAM,SAAiC,GAAGC,kBAAAA,kBAAkB,KAAK;CACjE,IAAI,IAAA,iBAAmB,GAAG,OAAO;CACjC,MAAM,OAAO,KACZ,MAAM,SACL,KACA,IACA;EACC,MAAM;EACN,SAAS;CACV,IACC,UACA,CAAC,KAAK,KAAK,MAAA,GAAKC,SAAAA,OAAAA,CAAO,KAAK,KAAK,CAAC,IAC/B,KAAA,IACA,iDACL,CACD;CACA,IAAI,MAAM,OAAOC,kBAAAA,mBAAmB;CACpC,OAAO;AACR;AAKA,SAAS,MAAM,OAAoB;CAClC,OAAO,OAAU,aAAyC;EASzD,QAAO,OAAA,GARe,QAAA,QAAA,CACrB;GAAE,GAAG;GAAU,MAAM;EAAQ,GAC7B,EACC,gBAAgB;GACf,MAAM,IAAI,oBAAoB,KAAK;EACpC,EACD,CACD,EAAA,CACe;CAChB;AACD;;AAGA,eAAe,SACd,KACA,IACA,UACA,QACa;CACb,SAAS;EACR,MAAM,QAAQ,MAAM,IAAO,QAAQ;EACnC,MAAM,UAAU,OAAO,KAAK;EAC5B,IAAI,CAAC,SAAS,OAAO;EACrB,GAAG,IAAI,OAAO,SAAS;CACxB;AACD;AAEA,MAAM,YACJ,UACA,UACA,OAAO,KAAK,IAAI,KAAA,IAAY,GAAG,KAAK;AAEtC,MAAM,QAAQ,UAAmB,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;;AAG1D,MAAM,UAAA,gBAAA,IAAgB,EAAE,UAAU,WAAW,CAAC;AAE9C,eAAe,WACd,KACA,IACA,SACkB;CAClB,OAAO,KACN,MAAM,SAAiB,KAAK,IAAI;EAAE,MAAM;EAAQ;CAAQ,IAAI,UAC3D,QAAQ,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,UAC5B,KAAA,IACA,yCACJ,CACD;AACD;AAEA,eAAe,QAAQ,KAAU,IAAmC;CACnE,OAAO,KACN,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAA4B,IACpD,UAAA,gBAAA,MACQ,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,UAC9B,KAAA,IACA,yDACL,CACD;AACD;;;;;;;;;;;;;;;;;;;;AAwBA,eAAe,aAAa,KAAU,IAAmC;CACxE,MAAM,UAAU,MAAM,IAAiB;EACtC,MAAM;EACN,SAAS;EACT,SAAS;GACR;IAAE,OAAO;IAAU,OAAO;GAAS;GACnC;IAAE,OAAO;IAAc,OAAO;GAAM;GACpC;IAAE,OAAO;IAAY,OAAO;GAAW;GACvC;IAAE,OAAO;IAAW,OAAO;GAAU;GACrC;IAAE,OAAO;IAAqB,OAAO;GAAQ;EAC9C;EACA,SAAS;CACV,CAAC;CACD,MAAM,SAAS,OAAO,SAAiB,SACtC,KACC,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAY;CAAQ,GAC5B,SAAS,IAAI,CACd,CACD;CACD,MAAM,QAAQ,OAAO,SAAiB,SACrC,KACC,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ;CAAQ,GACxB,SAAS,IAAI,CACd,CACD;CAED,QAAQ,SAAR;EACC,KAAK,UACJ,OAAO,QAAQ;GACd,KAAK;GACL,MAAM;GACN,MAAM;GACN,MAAM;GACN,UAAU,MAAM,OAAO,kBAAkB,aAAa;EACvD,CAAC;EACF,KAAK,OAEJ,OAAO,QAAQ;GACd,KAAK;GACL,MAAM,cAAc,MAHA,MAAM,UAAU,YAAY,EAGrB;GAC3B,MAAM;GACN,MAAM,MAAM,MAAM,kBAAkB,oBAAoB;GACxD,UAAU,MAAM,OAAO,iBAAiB,mBAAmB;EAC5D,CAAC;EAEF,KAAK,YAAY;GAChB,MAAM,QAAQ,MAAM,OAAO,oBAAoB,sBAAsB;GACrE,OAAO,QAAQ;IACd,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;GACX,CAAC;EACF;EACA,KAAK,WAUJ,OAAO,QAAQ;GACd,KAAK;GACL,MAAM,MAXc,IAAiB;IACrC,MAAM;IACN,SAAS;IACT,SAAS,CACR;KAAE,OAAO;KAAyB,OAAO;IAAK,GAC9C;KAAE,OAAO;KAA4B,OAAO;IAAK,CAClD;IACA,SAAS;GACV,CAAC,MAGiB,OAAO,wBAAwB;GAChD,MAAM;GACN,MAAM,MAAM,MACX,+CACA,gBACD;GACA,UAAU,MAAM,OAAO,iBAAiB,mBAAmB;EAC5D,CAAC;CAIH;CAEA,MAAM,OAAO,KACZ,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAAY,GACrC,SAAS,UAAU,CACpB,CACD;CACA,MAAM,OAAO,MAAM,SAClB,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;EAAQ,SAAS;CAAM,IAC/C,UAAU;EACV,MAAM,IAAI,OAAO,KAAK;EACtB,OAAO,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,QACxC,KAAA,IACA;CACJ,CACD;CACA,MAAM,OAAO,KACZ,MAAM,IAAY;EAAE,MAAM;EAAQ,SAAS;CAAwB,CAAC,CACrE;CACA,MAAM,WAAW,OACd,MAAM,IAAY;EAAE,MAAM;EAAY,SAAS;CAAW,CAAC,IAC3D;CAUH,OAAO,QAAQ;EAAE,KAAA,MATC,IAAwB;GACzC,MAAM;GACN,SAAS;GACT,SAAS,CACR;IAAE,OAAO;IAAwC,OAAO;GAAW,GACnE;IAAE,OAAO;IAA+C,OAAO;GAAM,CACtE;GACA,SAAS;EACV,CAAC;EACqB;EAAM,MAAM,OAAO,IAAI;EAAG;EAAM;CAAS,CAAC;AACjE;AAEA,SAAS,QAAQ,QAMN;CACV,MAAM,MAAM,IAAI,IACf,GAAG,OAAO,QAAQ,QAAQ,UAAU,OAAO,KAAK,OAAO,MACxD;CACA,IAAI,OAAO,OAAO,OAAO,IAAI;CAC7B,IAAI,OAAO,MAAM;EAChB,IAAI,WAAW,mBAAmB,OAAO,IAAI;EAC7C,IAAI,WAAW,mBAAmB,OAAO,YAAY,EAAE;CACxD;CACA,OAAO,IAAI,SAAS,CAAC,CAAC,QAAQ,OAAO,EAAE;AACxC;;;;;;AAOA,eAAe,YACd,KACA,IACA,OACA,KACkC;CAClC,MAAM,WAAW,MAAM,IAAwC;EAC9D,MAAM;EACN,SAAS;EACT,SAAS;GACR;IAAE,OAAO;IAAU,OAAO;GAAK;GAC/B;IAAE,OAAO;IAAiB,OAAO;GAAK;GACtC;IAAE,OAAO;IAAyC,OAAO;GAAa;GACtE;IAAE,OAAO;IAAsB,OAAO;GAAM;EAC7C;EACA,SAAS;CACV,CAAC;CAED,MAAM,aAAa,YAClB,KACC,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAAc,GACvC,SAAS,iBAAiB,CAC3B,CACD;CAED,IAAI;CACJ,QAAQ,UAAR;EACC,KAAK;GAUJ,UAAU;IAAE,QAAA,MATS,WAAW;IASZ,QARL,KACd,MAAM,SACL,KACA,IACA;KAAE,MAAM;KAAQ,SAAS;KAAU,SAAS;IAAY,GACxD,SAAS,YAAY,CACtB,CAEwB;GAAE;GAC3B;EAED,KAAK,MAAM;GACV,MAAM,UAAU,KACf,MAAM,SACL,KACA,IACA;IACC,MAAM;IACN,SAAS;GACV,GACA,SAAS,4BAA4B,CACtC,CACD;GAEA,UAAU;IACT,QAAA,MAFoB,WAAW;IAG/B,QAAQ;IACR,UAAU,eAAe,KAAK,OAAO,IAClC,UACA,WAAW,QAAQ;GACvB;GACA;EACD;EACA,KAAK,cAAc;GAClB,MAAM,WAAW,MAAM,WAAW,KAAK,IAAI,cAAc;GACzD,MAAM,SAAS,MAAM,WAAW;GAChC,MAAM,SAAS,KACd,MAAM,IAAY;IACjB,MAAM;IACN,SAAS;IACT,SAAS;GACV,CAAC,CACF;GACA,MAAM,iBAAiB,MAAM,IAAa;IACzC,MAAM;IACN,SAAS;IACT,SAAS;GACV,CAAC;GACD,UAAU;IACT;IACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B;IACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;GAC5C;GACA;EACD;EACA,KAAK,OAAO;GACX,MAAM,SAAS,MAAM,SACpB,KACA,IACA;IAAE,MAAM;IAAY,SAAS;GAAgB,IAC5C,UAAU;IACV,IAAI;KACH,CAAA,GAAA,0BAAA,MAAA,CAAQ,KAAK,KAAK,CAAC;KACnB;IACD,SAAS,OAAO;KACf,OAAO,iDAAkD,MAAgB,KAAK;IAC/E;GACD,CACD;GACA,WAAA,GAAUC,0BAAAA,MAAAA,CAAQ,KAAK,MAAM,CAAC;GAC9B;EACD;CACD;CAEA,IAAI,CAAC,QAAQ,aAMR;MAAA,MALc,IAAa;GAC9B,MAAM;GACN,SAAS,cAAc,MAAM,GAAG;GAChC,SAAS;EACV,CAAC,GACQ;GACR,MAAM,cAAc,KACnB,MAAM,SACL,KACA,IACA;IAAE,MAAM;IAAQ,SAAS;GAAgB,GACzC,SAAS,mBAAmB,CAC7B,CACD;GACA,MAAM,kBAAkB,MAAM,SAC7B,KACA,IACA;IAAE,MAAM;IAAY,SAAS;GAAoB,GACjD,SAAS,uBAAuB,CACjC;GACA,UAAU;IAAE,GAAG;IAAS;IAAa;GAAgB;EACtD;;CAGD,MAAM,SAAiC,GAAG,MAAM,OAAA,GAAMC,0BAAAA,MAAAA,CAAQ,OAAO,EAAE;CAEvE,IAAI,CAAC,QAAQ,eAAe,CAAC,IAAI,mBAAmB,GAQ/C;MAAA,MAPiB,IAAa;GACjC,MAAM;GACN,SACC;GAED,SAAS;EACV,CAAC,GACW;GACX,OAAO,oBAAoB,KAC1B,MAAM,SACL,KACA,IACA;IAAE,MAAM;IAAQ,SAAS;GAAoB,GAC7C,SAAS,mBAAmB,CAC7B,CACD;GACA,OAAO,wBAAwB,MAAM,SACpC,KACA,IACA;IAAE,MAAM;IAAY,SAAS;GAAwB,GACrD,SAAS,uBAAuB,CACjC;EACD;;CAGD,OAAO;AACR;;AAGA,MAAM,eAAe;;AASrB,SAAS,iBACR,MAGY;CACZ,MAAM,SAAS,MAAM;CACrB,IAAI,CAAC,UAAU,OAAO,SAAS,UAAU,OAAO,KAAA;CAChD,MAAM,aAAa,OAAO;CAC1B,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO,KAAA;CAC1D,OAAO;EACM;EACZ,UAAU,MAAM,QAAQ,OAAO,QAAQ,IACnC,OAAO,WACR,CAAC;CACL;AACD;AAEA,SAAS,QAAQ,UAAwC;CACxD,IAAI,MAAM,QAAQ,SAAS,IAAI,GAAG,OAAO,SAAS;CAClD,OAAO,SAAS,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;AAC3C;;;;;;;AAQA,eAAe,iBACd,KACA,IACA,OACA,SACkB;CAClB,MAAM,OAAO,QAAQ,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,GAAG;CAC5D,MAAM,QAAQ,iBAAiB,IAAI;CACnC,IAAI,CAAC,MACJ,GAAG,IACF,MAAM,MAAM,GAAG,oEAChB;CAGD,SAAS;EACR,MAAM,MAAM,QACT,KAAK,UAAU,MAAM,UAAU,KAAK,IAAI,KAAK,CAAC,IAC9C,KACA,MAAM,IAAY;GACjB,MAAM;GACN,SAAS;EACV,CAAC,CACF;EAEF,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,KAAK,GAAG;EAChD,IAAI,MAAM,IAAI,OAAO;EACrB,GAAG,IAAI,sBAAsB,MAAM,GAAG,cAAc;EACpD,KAAK,MAAM,SAAS,MAAM,QACzB,GAAG,IAAI,SAASC,0BAAAA,UAAU,MAAM,KAAK,KAAK,GAAG;EAE9C,GAAG,IAAI,YAAY;CACpB;AACD;AAEA,eAAe,UACd,KACA,IACA,OAImC;CACnC,MAAM,QAAiC,CAAC;CACxC,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,MAAM,UAAU,GAAG;EAChE,MAAM,WAAW,CAAC,MAAM,SAAS,SAAS,IAAI;EAC9C,MAAM,QAAQ,GAAG,OAAO,WAAW,gBAAgB,KAAK,SAAS,cAAc,MAAM,SAAS,gBAAgB;EAC9G,MAAM,QAAQ,QAAQ,QAAQ;EAE9B,IAAI,SAAS,MAAM,QAAQ;GAC1B,MAAM,UAAU,SAAS,KAAK,KAAK,YAAY;IAC9C,OAAO,OAAO,MAAM;IACpB,OAAO;GACR,EAAE;GACF,MAAM,SAAS,MAAM,IAAa;IACjC,MAAM;IACN,SAAS;IACT,SAAS,WACN,CAAC;KAAE,OAAO;KAAU,OAAO,KAAA;IAAU,GAAG,GAAG,OAAO,IAClD;GACJ,CAA+B;GAC/B,IAAI,WAAW,KAAA,GAAW,MAAM,QAAQ;GACxC;EACD;EAEA,IAAI,MAAM,SAAS,SAAS,GAAG;GAC9B,MAAM,QAAQ,MAAM,IAAa;IAChC,MAAM;IACN,SAAS;IACT,SAAS;GACV,CAAC;GACD;EACD;EAEA,MAAM,UAAU,MAAM,SAAS,QAAQ,KAAK,MAAM,SAAS,SAAS;EACpE,MAAM,QAAQ,MAAM,WAAW,KAAK,MAAM,SAAS,QAAQ;EAC3D,MAAM,SAAS,MAAM,SACpB,KACA,IACA;GACC,MAAM,aAAa,KAAK,IAAI,IAAI,aAAa;GAC7C,SAAS;EACV,IACC,UAAU;GACV,MAAM,QAAQ,KAAK,KAAK;GACxB,IAAI,CAAC,OAAO,OAAO,WAAW,KAAA,IAAY,GAAG,KAAK;GAClD,IAAI,WAAW,CAAC,SAAS,OAAO,MAAM,OAAO,KAAK,CAAC,GAClD,OAAO,GAAG,KAAK;GAEhB,IAAI,CAAC,WAAW,CAAC,OAChB,IAAI;IACH,KAAK,MAAM,KAAK;GACjB,QAAQ;IACP,OAAO,GAAG,KAAK,YAAY,MAAM,KAAK,MAAM,EAAE;GAC/C;EAGF,CACD;EACA,MAAM,QAAQ,KAAK,MAAM;EACzB,IAAI,CAAC,OAAO;EACZ,MAAM,QAAQ,QAAQ,QAAQ,UAAU,OAAO,KAAK,IAAI,KAAK,MAAM,KAAK;CACzE;CACA,OAAO;AACR"}
1	+ {"version":3,"file":"add-BFjb6mMq.cjs","names":["appKey","appEnvKeys","workerEnvKeys","provideKey","stageServiceDeclarations","requiredStageKeys","GkmError","loadWorkspaceSettings","constructGlobs","discover","secretsStoreFor","stageProviderNotes","deploysWithCompose","stageProvider","provisionCommand","initStageSecrets","loadCredentialSchemas","isIPv4","SERVER_IPV4_KEY","isIPv6","SERVER_IPV6_KEY","s3Parse","s3Build","issueLine"],"sources":["../src/secrets/stageKeys.ts","../src/secrets/add.ts"],"sourcesContent":["/*\n The keys a workspace's stage must be given — across every app, each once,\n * with who reads it and whether the stage holds it.\n \n The keys themselves are `requiredStageKeys`'s, and the mail and storage\n * constructs `stageServiceDeclarations`' — the lists a deploy's readiness\n * check refuses a stage by. What this adds is the workspace: which third\n * parties' credentials its apps and workers read (`appEnvKeys`,\n * `workerEnvKeys`) and which of the keys the stage has set.\n /\n\nimport { type ConstructManifest, provideKey } from '@geekmidas/manifest';\nimport {\n\ttype CredentialDeclaration,\n\trequiredStageKeys,\n\ttype StageKey,\n\ttype StageProviderNotes,\n\tstageServiceDeclarations,\n} from '../deploy/devServices';\nimport { appEnvKeys, workerEnvKeys } from '../reconcile/apps';\nimport { appKey } from '../workspace/derive';\n\n/* A stage key, and whether the stage's secrets hold it. /\nexport interface WorkspaceStageKey extends StageKey {\n\tset: boolean;\n}\n\nexport interface WorkspaceStageKeysInput {\n\tmanifest: ConstructManifest;\n\t/* Each owner's runnables' edges, from discovery. /\n\trunnables?: Readonly<Record<string, readonly string[]>>;\n\t/* Whether the stage is the workspace's local one. /\n\tlocal: boolean;\n\t/* What the stage's secrets hold, by key. /\n\tsupplied: Readonly<Record<string, string>>;\n\t/* The stage's base domain, for the examples. /\n\tdomain?: string;\n\t/* What the stage's providers say — a missing key's hint. /\n\tproviders?: StageProviderNotes;\n\t/* The stage serves a domain from its own server: `GKM_SERVER_IPV4`. /\n\tserver?: boolean;\n}\n\n/\n Every key the stage must be given: each mail and storage construct's —\n * the deploy's own list, `stageServiceDeclarations` — and each third party's\n * credentials an app reads.\n /\nexport function workspaceStageKeys(\n\tinput: WorkspaceStageKeysInput,\n): WorkspaceStageKey[] {\n\tconst { manifest } = input;\n\n\t// What each process's environment holds: each app's, and each worker's —\n\t// whose crons and consumers run in a process of their own.\n\tconst reads = new Map<string, Set<string>>();\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tconst { kind } = declaration;\n\t\tconst name = appKey(id);\n\t\tconst keys =\n\t\t\tkind === 'rest-api' \|\| kind === 'site' \|\| kind === 'mobile-app'\n\t\t\t\t? appEnvKeys(manifest, name, input.runnables)\n\t\t\t\t: kind === 'worker'\n\t\t\t\t\t? workerEnvKeys(manifest, id, input.runnables)\n\t\t\t\t\t: undefined;\n\t\tif (keys) reads.set(name, keys);\n\t}\n\n\tconst readers = (id: string) => {\n\t\tconst key = provideKey(id, 'credentials');\n\t\treturn [...reads]\n\t\t\t.filter(([, env]) => env.has(key))\n\t\t\t.map(([app]) => app)\n\t\t\t.sort();\n\t};\n\n\tconst credentials: CredentialDeclaration[] = [];\n\tfor (const [id, declaration] of Object.entries(manifest)) {\n\t\tconst { kind } = declaration;\n\t\tif (kind !== 'external-api' && kind !== 'credential') continue;\n\t\tconst apps = readers(id);\n\t\tif (apps.length > 0) credentials.push({ id, kind, apps });\n\t}\n\t// Mail and storage: the list a deploy's readiness check refuses by.\n\tconst services = stageServiceDeclarations({\n\t\tmanifest,\n\t\t...(input.runnables ? { runnables: input.runnables } : {}),\n\t});\n\n\treturn requiredStageKeys({\n\t\tlocal: input.local,\n\t\tservices,\n\t\tcredentials,\n\t\t...(input.domain ? { domain: input.domain } : {}),\n\t\t...(input.providers ? { providers: input.providers } : {}),\n\t\t...(input.server ? { server: true } : {}),\n\t}).map((key) => ({ ...key, set: input.supplied[key.key] !== undefined }));\n}\n","/\n `gkm secrets:add --stage <stage>` — the secrets a stage must be given,\n * built key by key.\n \n It offers exactly the keys a deploy would refuse the stage without\n * (`requiredStageKeys`), across every app in the workspace, each once: the\n * stage's buckets, mail and file servers where it is deployed, and every\n * third party's credentials. A key is built by what it is — a bucket from its\n * provider, mail from its SMTP server, credentials field by field from their\n * construct's schema — checked, and saved through the stage's own store, the\n * one `gkm secrets:set` writes. No value is ever printed.\n \n The keys are walked one at a time — unset ones first — and each is a\n * checkpoint: set it now, skip it, or stop here. A key is saved the moment it\n * is built, so stopping, Ctrl-C or a failure keeps every key before it, and\n * running the command again picks up what is still missing. A key a provider\n * on the stage creates (a bucket under `deploy.objects.<stage>`, written by\n * the deploy) is not a checkpoint: it is listed, with what creates it.\n \n `--json` asks nothing: it prints the keys, for a script or an agent to set\n * with `gkm secrets:set`.\n /\n\nimport { isIPv4, isIPv6 } from 'node:net';\nimport {\n\ttype S3Address,\n\tbuild as s3Build,\n\tparse as s3Parse,\n} from '@geekmidas/storage/s3-url';\nimport prompts, { type PromptObject } from 'prompts';\nimport { z } from 'zod';\nimport { SERVER_IPV4_KEY, SERVER_IPV6_KEY } from '../compose/dnsConfig.js';\nimport { loadWorkspaceSettings } from '../config';\nimport { GkmError } from '../errors';\nimport { stageProvider } from '../providers/config.js';\nimport { deploysWithCompose } from '../providers/dns.js';\nimport { provisionCommand, stageProviderNotes } from '../providers/notes.js';\nimport { discover } from '../reconcile/discover';\nimport { constructGlobs } from '../reconcile/workspace';\nimport { assertDeployedStage } from '../workspace/stages';\nimport {\n\ttype CredentialSchemaInfo,\n\ttype CredentialSchemas,\n\tissueLine,\n\tloadCredentialSchemas,\n} from './credentialSchemas';\nimport { type WorkspaceStageKey, workspaceStageKeys } from './stageKeys';\nimport { initStageSecrets } from './storage';\nimport { secretsStoreFor } from './store';\n\nexport interface SecretsAddOptions {\n\tstage: string;\n\t/* Only the keys the stage has not set. /\n\tmissing?: boolean;\n\t/* Print the keys as JSON and ask nothing. /\n\tjson?: boolean;\n\t/* The workspace — the current directory when absent. /\n\tcwd?: string;\n\t/* The CLI's home, for a file store's keys. Defaults to `GKM_HOME`. /\n\thome?: string;\n}\n\n/* Where the command writes, and whether there is anyone to ask. /\nexport interface SecretsAddIo {\n\t/* A line for the person at the terminal. /\n\tlog(line: string): void;\n\t/* `--json`'s output. /\n\twrite(chunk: string): void;\n\t/* Whether prompts can be answered. /\n\tinteractive: boolean;\n}\n\n/* What a run of the command came to. /\nexport interface SecretsAddResult {\n\t/* The keys offered, in the order they were walked. /\n\tkeys: WorkspaceStageKey[];\n\t/* The keys saved, in the order they were built. /\n\tsaved: string[];\n\t/* The keys skipped at their checkpoint. /\n\tskipped: string[];\n\t/* The keys the stage must still be given, once the run is over. /\n\tmissing: string[];\n}\n\n/* One key as `--json` prints it. /\nexport interface StageKeyJson {\n\tkey: string;\n\tkind: WorkspaceStageKey['kind'];\n\tconstruct: string;\n\tapps: string[];\n\tset: boolean;\n\t/* A provider on the stage creates it: the deploy, `gkm deploy --stage <stage>`. /\n\tprovisioned?: true;\n}\n\n/* `gkm secrets:add` with nobody at a terminal to answer it. /\nexport class SecretsAddNeedsTerminal extends GkmError {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`gkm secrets:add asks for each key, and there is no terminal to ask ` +\n\t\t\t\t`at. List what the stage needs with ` +\n\t\t\t\t`gkm secrets:add --stage ${stage} --missing --json, and set each ` +\n\t\t\t\t`with gkm secrets:set <KEY> <value> --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'SecretsAddNeedsTerminal';\n\t}\n}\n\n/\n The person stopped the builder at a prompt (Ctrl-C). Every key saved\n * before it is kept; the run ends with what was saved and what is missing.\n /\nexport class SecretsAddCancelled extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`Stopped. Every key saved to the stage '${stage}' before it is kept.`,\n\t\t);\n\t\tthis.name = 'SecretsAddCancelled';\n\t}\n}\n\nconst defaultIo = (): SecretsAddIo => ({\n\tlog: (line) => console.log(line),\n\twrite: (chunk) => {\n\t\tprocess.stdout.write(chunk);\n\t},\n\tinteractive: process.stdin.isTTY === true && process.stdout.isTTY === true,\n});\n\n/* `gkm secrets:add`. /\nexport async function secretsAddCommand(\n\toptions: SecretsAddOptions,\n\tio: SecretsAddIo = defaultIo(),\n): Promise<SecretsAddResult> {\n\tconst { stage } = options;\n\tconst workspace = await loadWorkspaceSettings(options.cwd ?? process.cwd());\n\tconst local = stage === workspace.stages.local;\n\tif (!local) assertDeployedStage(workspace.stages, stage);\n\n\tconst patterns = constructGlobs(workspace);\n\tconst runnables: Record<string, string[]> = {};\n\tconst manifest = await discover({\n\t\tpatterns,\n\t\tcwd: workspace.root,\n\t\trunnables,\n\t});\n\n\tconst store = await secretsStoreFor(workspace, stage, {\n\t\t...(options.home ? { home: options.home } : {}),\n\t});\n\tconst stored = await store.read(stage);\n\tconst domain = workspace.domains?.[stage];\n\n\tconst all = workspaceStageKeys({\n\t\tmanifest,\n\t\trunnables,\n\t\tlocal,\n\t\tsupplied: stored?.custom ?? {},\n\t\t...(domain ? { domain } : {}),\n\t\tproviders: stageProviderNotes(workspace, stage),\n\t\t// A compose stage that serves a domain names its server.\n\t\t...(!local && domain && deploysWithCompose(workspace)\n\t\t\t? { server: true }\n\t\t\t: {}),\n\t});\n\t// Unset keys first: a run is for what the stage still lacks.\n\tconst scope = [...all.filter((k) => !k.set), ...all.filter((k) => k.set)];\n\tconst keys = options.missing ? scope.filter((k) => !k.set) : scope;\n\n\t// A key a provider on the stage writes — the deploy creates its bucket.\n\tconst objects = stageProvider(workspace as never, 'objects', stage);\n\tconst provisioned = (k: WorkspaceStageKey) =>\n\t\tobjects.mode === 'provider' &&\n\t\tk.hint !== undefined &&\n\t\t(k.kind === 'bucket' \|\| k.kind === 'file-server');\n\n\tif (options.json) {\n\t\tconst listed: StageKeyJson[] = keys.map((k) => ({\n\t\t\tkey: k.key,\n\t\t\tkind: k.kind,\n\t\t\tconstruct: k.id,\n\t\t\tapps: [...(k.apps ?? [])],\n\t\t\tset: k.set,\n\t\t\t...(provisioned(k) ? { provisioned: true as const } : {}),\n\t\t}));\n\t\tio.write(`${JSON.stringify(listed, null, 2)}\\n`);\n\t\treturn { keys, saved: [], skipped: [], missing: [] };\n\t}\n\n\tif (!io.interactive) throw new SecretsAddNeedsTerminal(stage);\n\n\t// A provisioned key is no checkpoint: it is listed, with what creates it.\n\tconst offered = keys.filter((k) => !provisioned(k));\n\tconst created = keys.filter(provisioned);\n\tif (created.length > 0 && objects.mode === 'provider') {\n\t\tio.log('Not offered — a provider on the stage creates them:');\n\t\tfor (const k of created) {\n\t\t\tio.log(\n\t\t\t\t` ${k.key} — created by ${provisionCommand(stage)} ` +\n\t\t\t\t\t`(deploy.objects.${stage} is ${objects.name})`,\n\t\t\t);\n\t\t}\n\t}\n\n\tif (offered.length === 0) {\n\t\tio.log(\n\t\t\tall.every(provisioned)\n\t\t\t\t? `Nothing to add: no construct on '${stage}' needs a key only the stage can supply.`\n\t\t\t\t: `Nothing to add: the stage '${stage}' has every key it needs.`,\n\t\t);\n\t\treturn { keys: offered, saved: [], skipped: [], missing: [] };\n\t}\n\n\tconst ask = asker(stage);\n\tlet current = stored ?? initStageSecrets(stage);\n\tconst saved: string[] = [];\n\tconst skipped: string[] = [];\n\tconst has = (key: string) => current.custom?.[key] !== undefined;\n\tlet schemas: CredentialSchemas \| undefined;\n\n\t// Each key is saved as soon as it is built: what is set survives a stop.\n\tconst save = async (values: Record<string, string>) => {\n\t\tcurrent = {\n\t\t\t...current,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: { ...current.custom, ...values },\n\t\t};\n\t\tawait store.write(stage, current);\n\t\tsaved.push(...Object.keys(values));\n\t\tio.log(` ✓ Saved ${Object.keys(values).join(', ')}.`);\n\t};\n\n\tconst walk = async () => {\n\t\tfor (const [index, entry] of offered.entries()) {\n\t\t\tio.log(`\\n[${index + 1}/${offered.length}] ${entry.key} — ${entry.what}`);\n\t\t\tif (entry.hint) io.log(` ${entry.hint}`);\n\n\t\t\tconst step = await ask<'set' \| 'skip' \| 'stop'>({\n\t\t\t\ttype: 'select',\n\t\t\t\tmessage: `${entry.key} ${KIND_LABEL[entry.kind]} '${entry.id}'${entry.apps?.length ? ` · ${entry.apps.join(', ')}` : ''}${entry.set ? ' · set' : ''}`,\n\t\t\t\tchoices: [\n\t\t\t\t\t{ title: 'Set it now', value: 'set' },\n\t\t\t\t\t{ title: 'Skip', value: 'skip' },\n\t\t\t\t\t{ title: 'Stop here', value: 'stop' },\n\t\t\t\t],\n\t\t\t\tinitial: 0,\n\t\t\t});\n\t\t\tif (step === 'stop') return;\n\t\t\tif (step !== 'set') {\n\t\t\t\tskipped.push(entry.key);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (entry.set) {\n\t\t\t\tconst overwrite: boolean = await ask({\n\t\t\t\t\ttype: 'confirm',\n\t\t\t\t\tmessage: `${entry.key} is set. Replace it?`,\n\t\t\t\t\tinitial: false,\n\t\t\t\t});\n\t\t\t\tif (!overwrite) {\n\t\t\t\t\tskipped.push(entry.key);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tswitch (entry.kind) {\n\t\t\t\tcase 'bucket':\n\t\t\t\t\tawait save(await buildBucket(ask, io, entry, has));\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'email':\n\t\t\t\t\tawait save({\n\t\t\t\t\t\t[entry.key]: entry.key.endsWith('_FROM')\n\t\t\t\t\t\t\t? await askFrom(ask, io)\n\t\t\t\t\t\t\t: await buildSmtpUrl(ask, io),\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'file-server':\n\t\t\t\t\tawait save({\n\t\t\t\t\t\t[entry.key]: await askHttpUrl(ask, io, 'Its public URL'),\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'server':\n\t\t\t\t\tawait save(await buildServer(ask, io, has));\n\t\t\t\t\tbreak;\n\t\t\t\tcase 'external-api':\n\t\t\t\tcase 'credential':\n\t\t\t\t\tschemas ??= await loadCredentialSchemas({\n\t\t\t\t\t\troot: workspace.root,\n\t\t\t\t\t\tpatterns,\n\t\t\t\t\t});\n\t\t\t\t\tawait save({\n\t\t\t\t\t\t[entry.key]: await buildCredentials(ask, io, entry, schemas),\n\t\t\t\t\t});\n\t\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t};\n\n\ttry {\n\t\tawait walk();\n\t} catch (error) {\n\t\tif (!(error instanceof SecretsAddCancelled)) throw error;\n\t\tio.log(`\\n${error.message}`);\n\t}\n\n\tconst missing = all\n\t\t.filter((k) => !provisioned(k) && !has(k.key))\n\t\t.map((k) => k.key);\n\tio.log('');\n\tio.log(\n\t\tsaved.length > 0\n\t\t\t? `✓ Saved to the stage '${stage}' (${store.name} store): ${saved.join(', ')}`\n\t\t\t: 'Nothing was saved.',\n\t);\n\tif (skipped.length > 0) io.log(` Skipped: ${skipped.join(', ')}`);\n\tif (missing.length > 0) {\n\t\tio.log(` Still missing: ${missing.join(', ')}`);\n\t\tio.log(\n\t\t\t` Run gkm secrets:add --stage ${stage} --missing again to pick up where this left off.`,\n\t\t);\n\t}\n\treturn { keys: offered, saved, skipped, missing };\n}\n\nconst KIND_LABEL: Record<WorkspaceStageKey['kind'], string> = {\n\tbucket: 'bucket',\n\temail: 'email',\n\t'file-server': 'file server',\n\t'external-api': 'external API',\n\tcredential: 'credential',\n\tserver: 'server address',\n};\n\n/* The server's IPv4 address, and — if it has one — its IPv6 address. /\nasync function buildServer(\n\task: Ask,\n\tio: SecretsAddIo,\n\thas: (key: string) => boolean,\n): Promise<Record<string, string>> {\n\tconst ipv4 = text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{ type: 'text', message: \"The server's public IPv4 address\" },\n\t\t\t(value) =>\n\t\t\t\tisIPv4(text(value))\n\t\t\t\t\t? undefined\n\t\t\t\t\t: 'An IPv4 address is required, e.g. 203.0.113.10.',\n\t\t),\n\t);\n\tconst values: Record<string, string> = { [SERVER_IPV4_KEY]: ipv4 };\n\tif (has(SERVER_IPV6_KEY)) return values;\n\tconst ipv6 = text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{\n\t\t\t\ttype: 'text',\n\t\t\t\tmessage: 'Its public IPv6 address (empty for none — no AAAA records)',\n\t\t\t},\n\t\t\t(value) =>\n\t\t\t\t!text(value) \|\| isIPv6(text(value))\n\t\t\t\t\t? undefined\n\t\t\t\t\t: 'An IPv6 address, e.g. 2001:db8::10, or nothing.',\n\t\t),\n\t);\n\tif (ipv6) values[SERVER_IPV6_KEY] = ipv6;\n\treturn values;\n}\n\n/* One question, answered — or the run stopped. /\ntype Ask = <T = string>(question: Omit<PromptObject, 'name'>) => Promise<T>;\n\nfunction asker(stage: string): Ask {\n\treturn async <T>(question: Omit<PromptObject, 'name'>) => {\n\t\tconst answers = await prompts(\n\t\t\t{ ...question, name: 'value' } as PromptObject,\n\t\t\t{\n\t\t\t\tonCancel: () => {\n\t\t\t\t\tthrow new SecretsAddCancelled(stage);\n\t\t\t\t},\n\t\t\t},\n\t\t);\n\t\treturn answers.value as T;\n\t};\n}\n\n/* Ask until `accept` takes the answer; `accept` returns why it did not. /\nasync function askUntil<T>(\n\task: Ask,\n\tio: SecretsAddIo,\n\tquestion: Omit<PromptObject, 'name'>,\n\taccept: (value: T) => string \| undefined,\n): Promise<T> {\n\tfor (;;) {\n\t\tconst value = await ask<T>(question);\n\t\tconst problem = accept(value);\n\t\tif (!problem) return value;\n\t\tio.log(` ✗ ${problem}`);\n\t}\n}\n\nconst required =\n\t(what: string) =>\n\t(value: string \| undefined): string \| undefined =>\n\t\tvalue?.trim() ? undefined : `${what} is required.`;\n\nconst text = (value: unknown) => String(value ?? '').trim();\n\n/* An `http(s)://` URL. /\nconst HttpUrl = z.url({ protocol: /^https?$/ });\n\nasync function askHttpUrl(\n\task: Ask,\n\tio: SecretsAddIo,\n\tmessage: string,\n): Promise<string> {\n\treturn text(\n\t\tawait askUntil<string>(ask, io, { type: 'text', message }, (value) =>\n\t\t\tHttpUrl.safeParse(text(value)).success\n\t\t\t\t? undefined\n\t\t\t\t: 'An http:// or https:// URL is required.',\n\t\t),\n\t);\n}\n\nasync function askFrom(ask: Ask, io: SecretsAddIo): Promise<string> {\n\treturn text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{ type: 'text', message: 'The address it sends from' },\n\t\t\t(value) =>\n\t\t\t\tz.email().safeParse(text(value)).success\n\t\t\t\t\t? undefined\n\t\t\t\t\t: 'An email address is required, e.g. noreply@example.com.',\n\t\t),\n\t);\n}\n\n/* A mail service whose SMTP settings are known: only its secrets are asked. /\ntype MailService = 'resend' \| 'ses' \| 'postmark' \| 'mailgun' \| 'other';\n\n/\n An SMTP server as the URL `@geekmidas/emailkit` reads: `smtp://` for\n * STARTTLS, `smtps://` for TLS from the first byte, with the user and\n * password percent-encoded.\n \n A known service fills in its own host, port and user; each from its docs:\n * - Resend: smtp.resend.com, 465 implicit TLS, user `resend`, password the\n * API key — https://resend.com/docs/send-with-smtp\n * - Amazon SES: email-smtp.<region>.amazonaws.com, 587 STARTTLS, SMTP\n * credentials — https://docs.aws.amazon.com/ses/latest/dg/smtp-connect.html,\n * https://docs.aws.amazon.com/general/latest/gr/ses.html\n * - Postmark: smtp.postmarkapp.com, 587 STARTTLS, the server API token as\n * user and password —\n * https://postmarkapp.com/developer/user-guide/send-email-with-smtp\n * - Mailgun: smtp.mailgun.org (EU: smtp.eu.mailgun.org), 587 STARTTLS, the\n * domain's SMTP credentials —\n * https://documentation.mailgun.com/docs/mailgun/user-manual/sending-messages/send-smtp,\n * https://documentation.mailgun.com/docs/mailgun/api-reference/api-overview\n /\nasync function buildSmtpUrl(ask: Ask, io: SecretsAddIo): Promise<string> {\n\tconst service = await ask<MailService>({\n\t\ttype: 'select',\n\t\tmessage: 'Which mail service?',\n\t\tchoices: [\n\t\t\t{ title: 'Resend', value: 'resend' },\n\t\t\t{ title: 'Amazon SES', value: 'ses' },\n\t\t\t{ title: 'Postmark', value: 'postmark' },\n\t\t\t{ title: 'Mailgun', value: 'mailgun' },\n\t\t\t{ title: 'Other SMTP server', value: 'other' },\n\t\t],\n\t\tinitial: 0,\n\t});\n\tconst secret = async (message: string, what: string) =>\n\t\ttext(\n\t\t\tawait askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message },\n\t\t\t\trequired(what),\n\t\t\t),\n\t\t);\n\tconst login = async (message: string, what: string) =>\n\t\ttext(\n\t\t\tawait askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'text', message },\n\t\t\t\trequired(what),\n\t\t\t),\n\t\t);\n\n\tswitch (service) {\n\t\tcase 'resend':\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'tls',\n\t\t\t\thost: 'smtp.resend.com',\n\t\t\t\tport: 465,\n\t\t\t\tuser: 'resend',\n\t\t\t\tpassword: await secret('API key (re_…)', 'The API key'),\n\t\t\t});\n\t\tcase 'ses': {\n\t\t\tconst region = await login('Region', 'The region');\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'starttls',\n\t\t\t\thost: `email-smtp.${region}.amazonaws.com`,\n\t\t\t\tport: 587,\n\t\t\t\tuser: await login('SMTP user name', 'The SMTP user name'),\n\t\t\t\tpassword: await secret('SMTP password', 'The SMTP password'),\n\t\t\t});\n\t\t}\n\t\tcase 'postmark': {\n\t\t\tconst token = await secret('Server API token', 'The server API token');\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'starttls',\n\t\t\t\thost: 'smtp.postmarkapp.com',\n\t\t\t\tport: 587,\n\t\t\t\tuser: token,\n\t\t\t\tpassword: token,\n\t\t\t});\n\t\t}\n\t\tcase 'mailgun': {\n\t\t\tconst region = await ask<'us' \| 'eu'>({\n\t\t\t\ttype: 'select',\n\t\t\t\tmessage: 'Region',\n\t\t\t\tchoices: [\n\t\t\t\t\t{ title: 'US (smtp.mailgun.org)', value: 'us' },\n\t\t\t\t\t{ title: 'EU (smtp.eu.mailgun.org)', value: 'eu' },\n\t\t\t\t],\n\t\t\t\tinitial: 0,\n\t\t\t});\n\t\t\treturn smtpUrl({\n\t\t\t\ttls: 'starttls',\n\t\t\t\thost: region === 'eu' ? 'smtp.eu.mailgun.org' : 'smtp.mailgun.org',\n\t\t\t\tport: 587,\n\t\t\t\tuser: await login(\n\t\t\t\t\t'SMTP login (e.g. postmaster@mg.example.com)',\n\t\t\t\t\t'The SMTP login',\n\t\t\t\t),\n\t\t\t\tpassword: await secret('SMTP password', 'The SMTP password'),\n\t\t\t});\n\t\t}\n\t\tcase 'other':\n\t\t\tbreak;\n\t}\n\n\tconst host = text(\n\t\tawait askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{ type: 'text', message: 'SMTP host' },\n\t\t\trequired('The host'),\n\t\t),\n\t);\n\tconst port = await askUntil<string \| number>(\n\t\task,\n\t\tio,\n\t\t{ type: 'text', message: 'Port', initial: '587' },\n\t\t(value) => {\n\t\t\tconst n = Number(value);\n\t\t\treturn Number.isInteger(n) && n > 0 && n < 65536\n\t\t\t\t? undefined\n\t\t\t\t: 'A port number is required.';\n\t\t},\n\t);\n\tconst user = text(\n\t\tawait ask<string>({ type: 'text', message: 'User (empty for none)' }),\n\t);\n\tconst password = user\n\t\t? await ask<string>({ type: 'password', message: 'Password' })\n\t\t: '';\n\tconst tls = await ask<'starttls' \| 'tls'>({\n\t\ttype: 'select',\n\t\tmessage: 'TLS',\n\t\tchoices: [\n\t\t\t{ title: 'STARTTLS (smtp://, usually port 587)', value: 'starttls' },\n\t\t\t{ title: 'TLS on connect (smtps://, usually port 465)', value: 'tls' },\n\t\t],\n\t\tinitial: 0,\n\t});\n\treturn smtpUrl({ tls, host, port: Number(port), user, password });\n}\n\nfunction smtpUrl(server: {\n\ttls: 'starttls' \| 'tls';\n\thost: string;\n\tport: number;\n\tuser?: string;\n\tpassword?: string;\n}): string {\n\tconst url = new URL(\n\t\t`${server.tls === 'tls' ? 'smtps' : 'smtp'}://${server.host}`,\n\t);\n\turl.port = String(server.port);\n\tif (server.user) {\n\t\turl.username = encodeURIComponent(server.user);\n\t\turl.password = encodeURIComponent(server.password ?? '');\n\t}\n\treturn url.toString().replace(/\\/$/, '');\n}\n\n/\n A bucket's URL, from its provider — and, optionally, a key for it alone in\n * the URL, or the stage's shared pair. Credentials are never required: without\n * them the SDK's own chain signs, a role included.\n /\nasync function buildBucket(\n\task: Ask,\n\tio: SecretsAddIo,\n\tentry: WorkspaceStageKey,\n\thas: (key: string) => boolean,\n): Promise<Record<string, string>> {\n\tconst provider = await ask<'s3' \| 'r2' \| 'compatible' \| 'url'>({\n\t\ttype: 'select',\n\t\tmessage: 'Where is the bucket?',\n\t\tchoices: [\n\t\t\t{ title: 'AWS S3', value: 's3' },\n\t\t\t{ title: 'Cloudflare R2', value: 'r2' },\n\t\t\t{ title: 'MinIO, or another S3-compatible store', value: 'compatible' },\n\t\t\t{ title: 'Paste an s3:// URL', value: 'url' },\n\t\t],\n\t\tinitial: 0,\n\t});\n\n\tconst bucketName = async () =>\n\t\ttext(\n\t\t\tawait askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'text', message: 'Bucket name' },\n\t\t\t\trequired('The bucket name'),\n\t\t\t),\n\t\t);\n\n\tlet address: S3Address;\n\tswitch (provider) {\n\t\tcase 's3': {\n\t\t\tconst bucket = await bucketName();\n\t\t\tconst region = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{ type: 'text', message: 'Region', initial: 'eu-west-1' },\n\t\t\t\t\trequired('The region'),\n\t\t\t\t),\n\t\t\t);\n\t\t\taddress = { bucket, region };\n\t\t\tbreak;\n\t\t}\n\t\tcase 'r2': {\n\t\t\tconst account = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: 'text',\n\t\t\t\t\t\tmessage: 'Cloudflare account id, or the R2 endpoint URL',\n\t\t\t\t\t},\n\t\t\t\t\trequired('The account id or endpoint'),\n\t\t\t\t),\n\t\t\t);\n\t\t\tconst bucket = await bucketName();\n\t\t\taddress = {\n\t\t\t\tbucket,\n\t\t\t\tregion: 'auto',\n\t\t\t\tendpoint: /^https?:\\/\\//.test(account)\n\t\t\t\t\t? account\n\t\t\t\t\t: `https://${account}.r2.cloudflarestorage.com`,\n\t\t\t};\n\t\t\tbreak;\n\t\t}\n\t\tcase 'compatible': {\n\t\t\tconst endpoint = await askHttpUrl(ask, io, 'Endpoint URL');\n\t\t\tconst bucket = await bucketName();\n\t\t\tconst region = text(\n\t\t\t\tawait ask<string>({\n\t\t\t\t\ttype: 'text',\n\t\t\t\t\tmessage: 'Region',\n\t\t\t\t\tinitial: 'us-east-1',\n\t\t\t\t}),\n\t\t\t);\n\t\t\tconst forcePathStyle = await ask<boolean>({\n\t\t\t\ttype: 'confirm',\n\t\t\t\tmessage: 'Path-style addressing? (MinIO needs it)',\n\t\t\t\tinitial: true,\n\t\t\t});\n\t\t\taddress = {\n\t\t\t\tbucket,\n\t\t\t\t...(region ? { region } : {}),\n\t\t\t\tendpoint,\n\t\t\t\t...(forcePathStyle ? { forcePathStyle } : {}),\n\t\t\t};\n\t\t\tbreak;\n\t\t}\n\t\tcase 'url': {\n\t\t\tconst pasted = await askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message: 'The s3:// URL' },\n\t\t\t\t(value) => {\n\t\t\t\t\ttry {\n\t\t\t\t\t\ts3Parse(text(value));\n\t\t\t\t\t\treturn undefined;\n\t\t\t\t\t} catch (error) {\n\t\t\t\t\t\treturn `Not an s3:// URL the storage client can read (${(error as Error).name}).`;\n\t\t\t\t\t}\n\t\t\t\t},\n\t\t\t);\n\t\t\taddress = s3Parse(text(pasted));\n\t\t\tbreak;\n\t\t}\n\t}\n\n\tif (!address.accessKeyId) {\n\t\tconst own = await ask<boolean>({\n\t\t\ttype: 'confirm',\n\t\t\tmessage: `A key for '${entry.id}' alone, in its URL? (optional)`,\n\t\t\tinitial: false,\n\t\t});\n\t\tif (own) {\n\t\t\tconst accessKeyId = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{ type: 'text', message: 'Access key id' },\n\t\t\t\t\trequired('The access key id'),\n\t\t\t\t),\n\t\t\t);\n\t\t\tconst secretAccessKey = await askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message: 'Secret access key' },\n\t\t\t\trequired('The secret access key'),\n\t\t\t);\n\t\t\taddress = { ...address, accessKeyId, secretAccessKey };\n\t\t}\n\t}\n\n\tconst values: Record<string, string> = { [entry.key]: s3Build(address) };\n\n\tif (!address.accessKeyId && !has('AWS_ACCESS_KEY_ID')) {\n\t\tconst shared = await ask<boolean>({\n\t\t\ttype: 'confirm',\n\t\t\tmessage:\n\t\t\t\t\"Set the stage's shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY? \" +\n\t\t\t\t'(optional: without them a role signs)',\n\t\t\tinitial: false,\n\t\t});\n\t\tif (shared) {\n\t\t\tvalues.AWS_ACCESS_KEY_ID = text(\n\t\t\t\tawait askUntil<string>(\n\t\t\t\t\task,\n\t\t\t\t\tio,\n\t\t\t\t\t{ type: 'text', message: 'AWS_ACCESS_KEY_ID' },\n\t\t\t\t\trequired('The access key id'),\n\t\t\t\t),\n\t\t\t);\n\t\t\tvalues.AWS_SECRET_ACCESS_KEY = await askUntil<string>(\n\t\t\t\task,\n\t\t\t\tio,\n\t\t\t\t{ type: 'password', message: 'AWS_SECRET_ACCESS_KEY' },\n\t\t\t\trequired('The secret access key'),\n\t\t\t);\n\t\t}\n\t}\n\n\treturn values;\n}\n\n/* A field whose name says it is a secret, asked for without echo. /\nconst SECRET_FIELD = /secret\|key\|token\|password/i;\n\ninterface JsonSchemaProperty {\n\ttype?: string \| string[];\n\tenum?: unknown[];\n\tdescription?: string;\n}\n\n/* The properties of an object schema, or nothing for any other shape. /\nfunction objectProperties(\n\tinfo: CredentialSchemaInfo \| undefined,\n):\n\t\| { properties: Record<string, JsonSchemaProperty>; required: string[] }\n\t\| undefined {\n\tconst schema = info?.jsonSchema;\n\tif (!schema \|\| schema.type !== 'object') return undefined;\n\tconst properties = schema.properties;\n\tif (!properties \|\| typeof properties !== 'object') return undefined;\n\treturn {\n\t\tproperties: properties as Record<string, JsonSchemaProperty>,\n\t\trequired: Array.isArray(schema.required)\n\t\t\t? (schema.required as string[])\n\t\t\t: [],\n\t};\n}\n\nfunction typesOf(property: JsonSchemaProperty): string[] {\n\tif (Array.isArray(property.type)) return property.type;\n\treturn property.type ? [property.type] : [];\n}\n\n/\n Credentials, field by field where the construct's schema is an object it\n * can describe, and as JSON otherwise — checked against the schema itself\n * before anything is kept, and asked again, with each issue's path, until\n * the schema takes it.\n */\nasync function buildCredentials(\n\task: Ask,\n\tio: SecretsAddIo,\n\tentry: WorkspaceStageKey,\n\tschemas: CredentialSchemas,\n): Promise<string> {\n\tconst info = schemas.schemas.find((s) => s.key === entry.key);\n\tconst shape = objectProperties(info);\n\tif (!info) {\n\t\tio.log(\n\t\t\t` '${entry.id}' exposes no schema to check against; the value is stored as given.`,\n\t\t);\n\t}\n\n\tfor (;;) {\n\t\tconst raw = shape\n\t\t\t? JSON.stringify(await askFields(ask, io, shape))\n\t\t\t: text(\n\t\t\t\t\tawait ask<string>({\n\t\t\t\t\t\ttype: 'password',\n\t\t\t\t\t\tmessage: 'The value, as JSON (or one opaque string)',\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\tconst check = await schemas.check(entry.key, raw);\n\t\tif (check.ok) return raw;\n\t\tio.log(` ✗ The schema of '${entry.id}' refuses it:`);\n\t\tfor (const issue of check.issues) {\n\t\t\tio.log(` ${issueLine(entry.key, issue)}`);\n\t\t}\n\t\tio.log(' Again:');\n\t}\n}\n\nasync function askFields(\n\task: Ask,\n\tio: SecretsAddIo,\n\tshape: {\n\t\tproperties: Record<string, JsonSchemaProperty>;\n\t\trequired: string[];\n\t},\n): Promise<Record<string, unknown>> {\n\tconst value: Record<string, unknown> = {};\n\tfor (const [name, property] of Object.entries(shape.properties)) {\n\t\tconst optional = !shape.required.includes(name);\n\t\tconst label = `${name}${optional ? ' (optional)' : ''}${property.description ? ` — ${property.description}` : ''}`;\n\t\tconst types = typesOf(property);\n\n\t\tif (property.enum?.length) {\n\t\t\tconst choices = property.enum.map((option) => ({\n\t\t\t\ttitle: String(option),\n\t\t\t\tvalue: option,\n\t\t\t}));\n\t\t\tconst picked = await ask<unknown>({\n\t\t\t\ttype: 'select',\n\t\t\t\tmessage: label,\n\t\t\t\tchoices: optional\n\t\t\t\t\t? [{ title: '(none)', value: undefined }, ...choices]\n\t\t\t\t\t: choices,\n\t\t\t} as Omit<PromptObject, 'name'>);\n\t\t\tif (picked !== undefined) value[name] = picked;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (types.includes('boolean')) {\n\t\t\tvalue[name] = await ask<boolean>({\n\t\t\t\ttype: 'confirm',\n\t\t\t\tmessage: label,\n\t\t\t\tinitial: false,\n\t\t\t});\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst numeric = types.includes('number') \|\| types.includes('integer');\n\t\tconst plain = types.length === 0 \|\| types.includes('string');\n\t\tconst answer = await askUntil<string>(\n\t\t\task,\n\t\t\tio,\n\t\t\t{\n\t\t\t\ttype: SECRET_FIELD.test(name) ? 'password' : 'text',\n\t\t\t\tmessage: label,\n\t\t\t},\n\t\t\t(given) => {\n\t\t\t\tconst typed = text(given);\n\t\t\t\tif (!typed) return optional ? undefined : `${name} is required.`;\n\t\t\t\tif (numeric && !plain && Number.isNaN(Number(typed))) {\n\t\t\t\t\treturn `${name} is a number.`;\n\t\t\t\t}\n\t\t\t\tif (!numeric && !plain) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tJSON.parse(typed);\n\t\t\t\t\t} catch {\n\t\t\t\t\t\treturn `${name} is JSON (${types.join(' or ')}).`;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\treturn undefined;\n\t\t\t},\n\t\t);\n\t\tconst typed = text(answer);\n\t\tif (!typed) continue;\n\t\tvalue[name] = plain ? typed : numeric ? Number(typed) : JSON.parse(typed);\n\t}\n\treturn value;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,SAAgB,mBACf,OACsB;CACtB,MAAM,EAAE,aAAa;CAIrB,MAAM,wBAAQ,IAAI,IAAyB;CAC3C,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,MAAM,EAAE,SAAS;EACjB,MAAM,OAAOA,eAAAA,OAAO,EAAE;EACtB,MAAM,OACL,SAAS,cAAc,SAAS,UAAU,SAAS,eAChDC,cAAAA,WAAW,UAAU,MAAM,MAAM,SAAS,IAC1C,SAAS,WACRC,cAAAA,cAAc,UAAU,IAAI,MAAM,SAAS,IAC3C,KAAA;EACL,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI;CAC/B;CAEA,MAAM,WAAW,OAAe;EAC/B,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,IAAI,aAAa;EACxC,OAAO,CAAC,GAAG,KAAK,CAAC,CACf,QAAQ,GAAG,SAAS,IAAI,IAAI,GAAG,CAAC,CAAC,CACjC,KAAK,CAAC,SAAS,GAAG,CAAC,CACnB,KAAK;CACR;CAEA,MAAM,cAAuC,CAAC;CAC9C,KAAK,MAAM,CAAC,IAAI,gBAAgB,OAAO,QAAQ,QAAQ,GAAG;EACzD,MAAM,EAAE,SAAS;EACjB,IAAI,SAAS,kBAAkB,SAAS,cAAc;EACtD,MAAM,OAAO,QAAQ,EAAE;EACvB,IAAI,KAAK,SAAS,GAAG,YAAY,KAAK;GAAE;GAAI;GAAM;EAAK,CAAC;CACzD;CAEA,MAAM,WAAWC,cAAAA,yBAAyB;EACzC;EACA,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;CACzD,CAAC;CAED,OAAOC,cAAAA,kBAAkB;EACxB,OAAO,MAAM;EACb;EACA;EACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EAC/C,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;CACxC,CAAC,CAAC,CAAC,KAAK,SAAS;EAAE,GAAG;EAAK,KAAK,MAAM,SAAS,IAAI,SAAS,KAAA;CAAU,EAAE;AACzE;;;;;;;;;;;;;;;;;;;;;;;;;;ACDA,IAAa,0BAAb,cAA6CC,eAAAA,SAAS;CAChC;CAArB,YAAY,OAAwB;EACnC,MACC,iIAE4B,MAAM,6EACa,MAAM,EACtD;EANoB,KAAA,QAAA;EAOpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,IAAa,sBAAb,cAAyC,MAAM;CACzB;CAArB,YAAY,OAAwB;EACnC,MACC,0CAA0C,MAAM,qBACjD;EAHoB,KAAA,QAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,MAAM,mBAAiC;CACtC,MAAM,SAAS,QAAQ,IAAI,IAAI;CAC/B,QAAQ,UAAU;EACjB,QAAQ,OAAO,MAAM,KAAK;CAC3B;CACA,aAAa,QAAQ,MAAM,UAAU,QAAQ,QAAQ,OAAO,UAAU;AACvE;;AAGA,eAAsB,kBACrB,SACA,KAAmB,UAAU,GACD;CAC5B,MAAM,EAAE,UAAU;CAClB,MAAM,YAAY,MAAMC,eAAAA,sBAAsB,QAAQ,OAAO,QAAQ,IAAI,CAAC;CAC1E,MAAM,QAAQ,UAAU,UAAU,OAAO;CACzC,IAAI,CAAC,OAAO,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAEvD,MAAM,WAAWC,cAAAA,eAAe,SAAS;CACzC,MAAM,YAAsC,CAAC;CAC7C,MAAM,WAAW,MAAMC,iBAAAA,SAAS;EAC/B;EACA,KAAK,UAAU;EACf;CACD,CAAC;CAED,MAAM,QAAQ,MAAMC,cAAAA,gBAAgB,WAAW,OAAO,EACrD,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC,EAC9C,CAAC;CACD,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK;CACrC,MAAM,SAAS,UAAU,UAAU;CAEnC,MAAM,MAAM,mBAAmB;EAC9B;EACA;EACA;EACA,UAAU,QAAQ,UAAU,CAAC;EAC7B,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,WAAWC,cAAAA,mBAAmB,WAAW,KAAK;EAE9C,GAAI,CAAC,SAAS,UAAUC,yBAAAA,mBAAmB,SAAS,IACjD,EAAE,QAAQ,KAAK,IACf,CAAC;CACL,CAAC;CAED,MAAM,QAAQ,CAAC,GAAG,IAAI,QAAQ,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,IAAI,QAAQ,MAAM,EAAE,GAAG,CAAC;CACxE,MAAM,OAAO,QAAQ,UAAU,MAAM,QAAQ,MAAM,CAAC,EAAE,GAAG,IAAI;CAG7D,MAAM,UAAUC,kBAAAA,cAAc,WAAoB,WAAW,KAAK;CAClE,MAAM,eAAe,MACpB,QAAQ,SAAS,cACjB,EAAE,SAAS,KAAA,MACV,EAAE,SAAS,YAAY,EAAE,SAAS;CAEpC,IAAI,QAAQ,MAAM;EACjB,MAAM,SAAyB,KAAK,KAAK,OAAO;GAC/C,KAAK,EAAE;GACP,MAAM,EAAE;GACR,WAAW,EAAE;GACb,MAAM,CAAC,GAAI,EAAE,QAAQ,CAAC,CAAE;GACxB,KAAK,EAAE;GACP,GAAI,YAAY,CAAC,IAAI,EAAE,aAAa,KAAc,IAAI,CAAC;EACxD,EAAE;EACF,GAAG,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,GAAG;EAC/C,OAAO;GAAE;GAAM,OAAO,CAAC;GAAG,SAAS,CAAC;GAAG,SAAS,CAAC;EAAE;CACpD;CAEA,IAAI,CAAC,GAAG,aAAa,MAAM,IAAI,wBAAwB,KAAK;CAG5D,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC,YAAY,CAAC,CAAC;CAClD,MAAM,UAAU,KAAK,OAAO,WAAW;CACvC,IAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,YAAY;EACtD,GAAG,IAAI,qDAAqD;EAC5D,KAAK,MAAM,KAAK,SACf,GAAG,IACF,KAAK,EAAE,IAAI,gBAAgBC,cAAAA,iBAAiB,KAAK,EAAE,mBAC/B,MAAM,MAAM,QAAQ,KAAK,EAC9C;CAEF;CAEA,IAAI,QAAQ,WAAW,GAAG;EACzB,GAAG,IACF,IAAI,MAAM,WAAW,IAClB,oCAAoC,MAAM,4CAC1C,8BAA8B,MAAM,0BACxC;EACA,OAAO;GAAE,MAAM;GAAS,OAAO,CAAC;GAAG,SAAS,CAAC;GAAG,SAAS,CAAC;EAAE;CAC7D;CAEA,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,UAAU,UAAUC,cAAAA,iBAAiB,KAAK;CAC9C,MAAM,QAAkB,CAAC;CACzB,MAAM,UAAoB,CAAC;CAC3B,MAAM,OAAO,QAAgB,QAAQ,SAAS,SAAS,KAAA;CACvD,IAAI;CAGJ,MAAM,OAAO,OAAO,WAAmC;EACtD,UAAU;GACT,GAAG;GACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,QAAQ;IAAE,GAAG,QAAQ;IAAQ,GAAG;GAAO;EACxC;EACA,MAAM,MAAM,MAAM,OAAO,OAAO;EAChC,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,CAAC;EACjC,GAAG,IAAI,aAAa,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE;CACtD;CAEA,MAAM,OAAO,YAAY;EACxB,KAAK,MAAM,CAAC,OAAO,UAAU,QAAQ,QAAQ,GAAG;GAC/C,GAAG,IAAI,MAAM,QAAQ,EAAE,GAAG,QAAQ,OAAO,IAAI,MAAM,IAAI,KAAK,MAAM,MAAM;GACxE,IAAI,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,MAAM;GAExC,MAAM,OAAO,MAAM,IAA6B;IAC/C,MAAM;IACN,SAAS,GAAG,MAAM,IAAI,IAAI,WAAW,MAAM,MAAM,IAAI,MAAM,GAAG,GAAG,MAAM,MAAM,SAAS,MAAM,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,MAAM,WAAW;IAClJ,SAAS;KACR;MAAE,OAAO;MAAc,OAAO;KAAM;KACpC;MAAE,OAAO;MAAQ,OAAO;KAAO;KAC/B;MAAE,OAAO;MAAa,OAAO;KAAO;IACrC;IACA,SAAS;GACV,CAAC;GACD,IAAI,SAAS,QAAQ;GACrB,IAAI,SAAS,OAAO;IACnB,QAAQ,KAAK,MAAM,GAAG;IACtB;GACD;GACA,IAAI,MAAM,KAML;QAAA,CAAC,MAL4B,IAAI;KACpC,MAAM;KACN,SAAS,GAAG,MAAM,IAAI;KACtB,SAAS;IACV,CAAC,GACe;KACf,QAAQ,KAAK,MAAM,GAAG;KACtB;IACD;;GAGD,QAAQ,MAAM,MAAd;IACC,KAAK;KACJ,MAAM,KAAK,MAAM,YAAY,KAAK,IAAI,OAAO,GAAG,CAAC;KACjD;IACD,KAAK;KACJ,MAAM,KAAK,GACT,MAAM,MAAM,MAAM,IAAI,SAAS,OAAO,IACpC,MAAM,QAAQ,KAAK,EAAE,IACrB,MAAM,aAAa,KAAK,EAAE,EAC9B,CAAC;KACD;IACD,KAAK;KACJ,MAAM,KAAK,GACT,MAAM,MAAM,MAAM,WAAW,KAAK,IAAI,gBAAgB,EACxD,CAAC;KACD;IACD,KAAK;KACJ,MAAM,KAAK,MAAM,YAAY,KAAK,IAAI,GAAG,CAAC;KAC1C;IACD,KAAK;IACL,KAAK;KACJ,YAAY,MAAMC,0BAAAA,sBAAsB;MACvC,MAAM,UAAU;MAChB;KACD,CAAC;KACD,MAAM,KAAK,GACT,MAAM,MAAM,MAAM,iBAAiB,KAAK,IAAI,OAAO,OAAO,EAC5D,CAAC;GAEH;EACD;CACD;CAEA,IAAI;EACH,MAAM,KAAK;CACZ,SAAS,OAAO;EACf,IAAI,EAAE,iBAAiB,sBAAsB,MAAM;EACnD,GAAG,IAAI,KAAK,MAAM,SAAS;CAC5B;CAEA,MAAM,UAAU,IACd,QAAQ,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAC7C,KAAK,MAAM,EAAE,GAAG;CAClB,GAAG,IAAI,EAAE;CACT,GAAG,IACF,MAAM,SAAS,IACZ,yBAAyB,MAAM,KAAK,MAAM,KAAK,WAAW,MAAM,KAAK,IAAI,MACzE,oBACJ;CACA,IAAI,QAAQ,SAAS,GAAG,GAAG,IAAI,cAAc,QAAQ,KAAK,IAAI,GAAG;CACjE,IAAI,QAAQ,SAAS,GAAG;EACvB,GAAG,IAAI,oBAAoB,QAAQ,KAAK,IAAI,GAAG;EAC/C,GAAG,IACF,iCAAiC,MAAM,iDACxC;CACD;CACA,OAAO;EAAE,MAAM;EAAS;EAAO;EAAS;CAAQ;AACjD;AAEA,MAAM,aAAwD;CAC7D,QAAQ;CACR,OAAO;CACP,eAAe;CACf,gBAAgB;CAChB,YAAY;CACZ,QAAQ;AACT;;AAGA,eAAe,YACd,KACA,IACA,KACkC;CAClC,MAAM,OAAO,KACZ,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAAmC,IAC3D,WAAA,GACAC,SAAAA,OAAAA,CAAO,KAAK,KAAK,CAAC,IACf,KAAA,IACA,iDACL,CACD;CACA,MAAM,SAAiC,GAAGC,kBAAAA,kBAAkB,KAAK;CACjE,IAAI,IAAA,iBAAmB,GAAG,OAAO;CACjC,MAAM,OAAO,KACZ,MAAM,SACL,KACA,IACA;EACC,MAAM;EACN,SAAS;CACV,IACC,UACA,CAAC,KAAK,KAAK,MAAA,GAAKC,SAAAA,OAAAA,CAAO,KAAK,KAAK,CAAC,IAC/B,KAAA,IACA,iDACL,CACD;CACA,IAAI,MAAM,OAAOC,kBAAAA,mBAAmB;CACpC,OAAO;AACR;AAKA,SAAS,MAAM,OAAoB;CAClC,OAAO,OAAU,aAAyC;EASzD,QAAO,OAAA,GARe,QAAA,QAAA,CACrB;GAAE,GAAG;GAAU,MAAM;EAAQ,GAC7B,EACC,gBAAgB;GACf,MAAM,IAAI,oBAAoB,KAAK;EACpC,EACD,CACD,EAAA,CACe;CAChB;AACD;;AAGA,eAAe,SACd,KACA,IACA,UACA,QACa;CACb,SAAS;EACR,MAAM,QAAQ,MAAM,IAAO,QAAQ;EACnC,MAAM,UAAU,OAAO,KAAK;EAC5B,IAAI,CAAC,SAAS,OAAO;EACrB,GAAG,IAAI,OAAO,SAAS;CACxB;AACD;AAEA,MAAM,YACJ,UACA,UACA,OAAO,KAAK,IAAI,KAAA,IAAY,GAAG,KAAK;AAEtC,MAAM,QAAQ,UAAmB,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;;AAG1D,MAAM,UAAA,gBAAA,IAAgB,EAAE,UAAU,WAAW,CAAC;AAE9C,eAAe,WACd,KACA,IACA,SACkB;CAClB,OAAO,KACN,MAAM,SAAiB,KAAK,IAAI;EAAE,MAAM;EAAQ;CAAQ,IAAI,UAC3D,QAAQ,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,UAC5B,KAAA,IACA,yCACJ,CACD;AACD;AAEA,eAAe,QAAQ,KAAU,IAAmC;CACnE,OAAO,KACN,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAA4B,IACpD,UAAA,gBAAA,MACQ,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,UAC9B,KAAA,IACA,yDACL,CACD;AACD;;;;;;;;;;;;;;;;;;;;AAwBA,eAAe,aAAa,KAAU,IAAmC;CACxE,MAAM,UAAU,MAAM,IAAiB;EACtC,MAAM;EACN,SAAS;EACT,SAAS;GACR;IAAE,OAAO;IAAU,OAAO;GAAS;GACnC;IAAE,OAAO;IAAc,OAAO;GAAM;GACpC;IAAE,OAAO;IAAY,OAAO;GAAW;GACvC;IAAE,OAAO;IAAW,OAAO;GAAU;GACrC;IAAE,OAAO;IAAqB,OAAO;GAAQ;EAC9C;EACA,SAAS;CACV,CAAC;CACD,MAAM,SAAS,OAAO,SAAiB,SACtC,KACC,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAY;CAAQ,GAC5B,SAAS,IAAI,CACd,CACD;CACD,MAAM,QAAQ,OAAO,SAAiB,SACrC,KACC,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ;CAAQ,GACxB,SAAS,IAAI,CACd,CACD;CAED,QAAQ,SAAR;EACC,KAAK,UACJ,OAAO,QAAQ;GACd,KAAK;GACL,MAAM;GACN,MAAM;GACN,MAAM;GACN,UAAU,MAAM,OAAO,kBAAkB,aAAa;EACvD,CAAC;EACF,KAAK,OAEJ,OAAO,QAAQ;GACd,KAAK;GACL,MAAM,cAAc,MAHA,MAAM,UAAU,YAAY,EAGrB;GAC3B,MAAM;GACN,MAAM,MAAM,MAAM,kBAAkB,oBAAoB;GACxD,UAAU,MAAM,OAAO,iBAAiB,mBAAmB;EAC5D,CAAC;EAEF,KAAK,YAAY;GAChB,MAAM,QAAQ,MAAM,OAAO,oBAAoB,sBAAsB;GACrE,OAAO,QAAQ;IACd,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;GACX,CAAC;EACF;EACA,KAAK,WAUJ,OAAO,QAAQ;GACd,KAAK;GACL,MAAM,MAXc,IAAiB;IACrC,MAAM;IACN,SAAS;IACT,SAAS,CACR;KAAE,OAAO;KAAyB,OAAO;IAAK,GAC9C;KAAE,OAAO;KAA4B,OAAO;IAAK,CAClD;IACA,SAAS;GACV,CAAC,MAGiB,OAAO,wBAAwB;GAChD,MAAM;GACN,MAAM,MAAM,MACX,+CACA,gBACD;GACA,UAAU,MAAM,OAAO,iBAAiB,mBAAmB;EAC5D,CAAC;CAIH;CAEA,MAAM,OAAO,KACZ,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAAY,GACrC,SAAS,UAAU,CACpB,CACD;CACA,MAAM,OAAO,MAAM,SAClB,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;EAAQ,SAAS;CAAM,IAC/C,UAAU;EACV,MAAM,IAAI,OAAO,KAAK;EACtB,OAAO,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,QACxC,KAAA,IACA;CACJ,CACD;CACA,MAAM,OAAO,KACZ,MAAM,IAAY;EAAE,MAAM;EAAQ,SAAS;CAAwB,CAAC,CACrE;CACA,MAAM,WAAW,OACd,MAAM,IAAY;EAAE,MAAM;EAAY,SAAS;CAAW,CAAC,IAC3D;CAUH,OAAO,QAAQ;EAAE,KAAA,MATC,IAAwB;GACzC,MAAM;GACN,SAAS;GACT,SAAS,CACR;IAAE,OAAO;IAAwC,OAAO;GAAW,GACnE;IAAE,OAAO;IAA+C,OAAO;GAAM,CACtE;GACA,SAAS;EACV,CAAC;EACqB;EAAM,MAAM,OAAO,IAAI;EAAG;EAAM;CAAS,CAAC;AACjE;AAEA,SAAS,QAAQ,QAMN;CACV,MAAM,MAAM,IAAI,IACf,GAAG,OAAO,QAAQ,QAAQ,UAAU,OAAO,KAAK,OAAO,MACxD;CACA,IAAI,OAAO,OAAO,OAAO,IAAI;CAC7B,IAAI,OAAO,MAAM;EAChB,IAAI,WAAW,mBAAmB,OAAO,IAAI;EAC7C,IAAI,WAAW,mBAAmB,OAAO,YAAY,EAAE;CACxD;CACA,OAAO,IAAI,SAAS,CAAC,CAAC,QAAQ,OAAO,EAAE;AACxC;;;;;;AAOA,eAAe,YACd,KACA,IACA,OACA,KACkC;CAClC,MAAM,WAAW,MAAM,IAAwC;EAC9D,MAAM;EACN,SAAS;EACT,SAAS;GACR;IAAE,OAAO;IAAU,OAAO;GAAK;GAC/B;IAAE,OAAO;IAAiB,OAAO;GAAK;GACtC;IAAE,OAAO;IAAyC,OAAO;GAAa;GACtE;IAAE,OAAO;IAAsB,OAAO;GAAM;EAC7C;EACA,SAAS;CACV,CAAC;CAED,MAAM,aAAa,YAClB,KACC,MAAM,SACL,KACA,IACA;EAAE,MAAM;EAAQ,SAAS;CAAc,GACvC,SAAS,iBAAiB,CAC3B,CACD;CAED,IAAI;CACJ,QAAQ,UAAR;EACC,KAAK;GAUJ,UAAU;IAAE,QAAA,MATS,WAAW;IASZ,QARL,KACd,MAAM,SACL,KACA,IACA;KAAE,MAAM;KAAQ,SAAS;KAAU,SAAS;IAAY,GACxD,SAAS,YAAY,CACtB,CAEwB;GAAE;GAC3B;EAED,KAAK,MAAM;GACV,MAAM,UAAU,KACf,MAAM,SACL,KACA,IACA;IACC,MAAM;IACN,SAAS;GACV,GACA,SAAS,4BAA4B,CACtC,CACD;GAEA,UAAU;IACT,QAAA,MAFoB,WAAW;IAG/B,QAAQ;IACR,UAAU,eAAe,KAAK,OAAO,IAClC,UACA,WAAW,QAAQ;GACvB;GACA;EACD;EACA,KAAK,cAAc;GAClB,MAAM,WAAW,MAAM,WAAW,KAAK,IAAI,cAAc;GACzD,MAAM,SAAS,MAAM,WAAW;GAChC,MAAM,SAAS,KACd,MAAM,IAAY;IACjB,MAAM;IACN,SAAS;IACT,SAAS;GACV,CAAC,CACF;GACA,MAAM,iBAAiB,MAAM,IAAa;IACzC,MAAM;IACN,SAAS;IACT,SAAS;GACV,CAAC;GACD,UAAU;IACT;IACA,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;IAC3B;IACA,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;GAC5C;GACA;EACD;EACA,KAAK,OAAO;GACX,MAAM,SAAS,MAAM,SACpB,KACA,IACA;IAAE,MAAM;IAAY,SAAS;GAAgB,IAC5C,UAAU;IACV,IAAI;KACH,CAAA,GAAA,0BAAA,MAAA,CAAQ,KAAK,KAAK,CAAC;KACnB;IACD,SAAS,OAAO;KACf,OAAO,iDAAkD,MAAgB,KAAK;IAC/E;GACD,CACD;GACA,WAAA,GAAUC,0BAAAA,MAAAA,CAAQ,KAAK,MAAM,CAAC;GAC9B;EACD;CACD;CAEA,IAAI,CAAC,QAAQ,aAMR;MAAA,MALc,IAAa;GAC9B,MAAM;GACN,SAAS,cAAc,MAAM,GAAG;GAChC,SAAS;EACV,CAAC,GACQ;GACR,MAAM,cAAc,KACnB,MAAM,SACL,KACA,IACA;IAAE,MAAM;IAAQ,SAAS;GAAgB,GACzC,SAAS,mBAAmB,CAC7B,CACD;GACA,MAAM,kBAAkB,MAAM,SAC7B,KACA,IACA;IAAE,MAAM;IAAY,SAAS;GAAoB,GACjD,SAAS,uBAAuB,CACjC;GACA,UAAU;IAAE,GAAG;IAAS;IAAa;GAAgB;EACtD;;CAGD,MAAM,SAAiC,GAAG,MAAM,OAAA,GAAMC,0BAAAA,MAAAA,CAAQ,OAAO,EAAE;CAEvE,IAAI,CAAC,QAAQ,eAAe,CAAC,IAAI,mBAAmB,GAQ/C;MAAA,MAPiB,IAAa;GACjC,MAAM;GACN,SACC;GAED,SAAS;EACV,CAAC,GACW;GACX,OAAO,oBAAoB,KAC1B,MAAM,SACL,KACA,IACA;IAAE,MAAM;IAAQ,SAAS;GAAoB,GAC7C,SAAS,mBAAmB,CAC7B,CACD;GACA,OAAO,wBAAwB,MAAM,SACpC,KACA,IACA;IAAE,MAAM;IAAY,SAAS;GAAwB,GACrD,SAAS,uBAAuB,CACjC;EACD;;CAGD,OAAO;AACR;;AAGA,MAAM,eAAe;;AASrB,SAAS,iBACR,MAGY;CACZ,MAAM,SAAS,MAAM;CACrB,IAAI,CAAC,UAAU,OAAO,SAAS,UAAU,OAAO,KAAA;CAChD,MAAM,aAAa,OAAO;CAC1B,IAAI,CAAC,cAAc,OAAO,eAAe,UAAU,OAAO,KAAA;CAC1D,OAAO;EACM;EACZ,UAAU,MAAM,QAAQ,OAAO,QAAQ,IACnC,OAAO,WACR,CAAC;CACL;AACD;AAEA,SAAS,QAAQ,UAAwC;CACxD,IAAI,MAAM,QAAQ,SAAS,IAAI,GAAG,OAAO,SAAS;CAClD,OAAO,SAAS,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;AAC3C;;;;;;;AAQA,eAAe,iBACd,KACA,IACA,OACA,SACkB;CAClB,MAAM,OAAO,QAAQ,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,GAAG;CAC5D,MAAM,QAAQ,iBAAiB,IAAI;CACnC,IAAI,CAAC,MACJ,GAAG,IACF,MAAM,MAAM,GAAG,oEAChB;CAGD,SAAS;EACR,MAAM,MAAM,QACT,KAAK,UAAU,MAAM,UAAU,KAAK,IAAI,KAAK,CAAC,IAC9C,KACA,MAAM,IAAY;GACjB,MAAM;GACN,SAAS;EACV,CAAC,CACF;EAEF,MAAM,QAAQ,MAAM,QAAQ,MAAM,MAAM,KAAK,GAAG;EAChD,IAAI,MAAM,IAAI,OAAO;EACrB,GAAG,IAAI,sBAAsB,MAAM,GAAG,cAAc;EACpD,KAAK,MAAM,SAAS,MAAM,QACzB,GAAG,IAAI,SAASC,0BAAAA,UAAU,MAAM,KAAK,KAAK,GAAG;EAE9C,GAAG,IAAI,YAAY;CACpB;AACD;AAEA,eAAe,UACd,KACA,IACA,OAImC;CACnC,MAAM,QAAiC,CAAC;CACxC,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,MAAM,UAAU,GAAG;EAChE,MAAM,WAAW,CAAC,MAAM,SAAS,SAAS,IAAI;EAC9C,MAAM,QAAQ,GAAG,OAAO,WAAW,gBAAgB,KAAK,SAAS,cAAc,MAAM,SAAS,gBAAgB;EAC9G,MAAM,QAAQ,QAAQ,QAAQ;EAE9B,IAAI,SAAS,MAAM,QAAQ;GAC1B,MAAM,UAAU,SAAS,KAAK,KAAK,YAAY;IAC9C,OAAO,OAAO,MAAM;IACpB,OAAO;GACR,EAAE;GACF,MAAM,SAAS,MAAM,IAAa;IACjC,MAAM;IACN,SAAS;IACT,SAAS,WACN,CAAC;KAAE,OAAO;KAAU,OAAO,KAAA;IAAU,GAAG,GAAG,OAAO,IAClD;GACJ,CAA+B;GAC/B,IAAI,WAAW,KAAA,GAAW,MAAM,QAAQ;GACxC;EACD;EAEA,IAAI,MAAM,SAAS,SAAS,GAAG;GAC9B,MAAM,QAAQ,MAAM,IAAa;IAChC,MAAM;IACN,SAAS;IACT,SAAS;GACV,CAAC;GACD;EACD;EAEA,MAAM,UAAU,MAAM,SAAS,QAAQ,KAAK,MAAM,SAAS,SAAS;EACpE,MAAM,QAAQ,MAAM,WAAW,KAAK,MAAM,SAAS,QAAQ;EAC3D,MAAM,SAAS,MAAM,SACpB,KACA,IACA;GACC,MAAM,aAAa,KAAK,IAAI,IAAI,aAAa;GAC7C,SAAS;EACV,IACC,UAAU;GACV,MAAM,QAAQ,KAAK,KAAK;GACxB,IAAI,CAAC,OAAO,OAAO,WAAW,KAAA,IAAY,GAAG,KAAK;GAClD,IAAI,WAAW,CAAC,SAAS,OAAO,MAAM,OAAO,KAAK,CAAC,GAClD,OAAO,GAAG,KAAK;GAEhB,IAAI,CAAC,WAAW,CAAC,OAChB,IAAI;IACH,KAAK,MAAM,KAAK;GACjB,QAAQ;IACP,OAAO,GAAG,KAAK,YAAY,MAAM,KAAK,MAAM,EAAE;GAC/C;EAGF,CACD;EACA,MAAM,QAAQ,KAAK,MAAM;EACzB,IAAI,CAAC,OAAO;EACZ,MAAM,QAAQ,QAAQ,QAAQ,UAAU,OAAO,KAAK,IAAI,KAAK,MAAM,KAAK;CACzE;CACA,OAAO;AACR"}

package/dist/{add-Bu6FkaTn.mjs → add-CIjmgzkb.mjs} RENAMED Viewed

@@ -1,12 +1,12 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { N as assertDeployedStage, U as stageProvider, ft as SERVER_IPV4_KEY, pt as SERVER_IPV6_KEY } from "./workspace-D1QbNd55.mjs";
-import { S as deploysWithCompose } from "./dns-BgxvvcQa.mjs";
+import { N as assertDeployedStage, U as stageProvider, ft as SERVER_IPV4_KEY, pt as SERVER_IPV6_KEY } from "./workspace-DUnnVjqC.mjs";
+import { L as deploysWithCompose } from "./snsSubscriptions-CvBIGGp0.mjs";
 import { _ as url, o as email } from "./schemas-BCwKKA42.mjs";
-import { Bt as initStageSecrets, Lt as secretsStoreFor, M as provisionCommand, N as stageProviderNotes, ft as constructGlobs, it as stageServiceDeclarations, lt as workerEnvKeys, ot as appEnvKeys, rt as requiredStageKeys } from "./seeds-oY0qDqui.mjs";
+import { Bt as initStageSecrets, Lt as secretsStoreFor, M as provisionCommand, N as stageProviderNotes, ft as constructGlobs, it as stageServiceDeclarations, lt as workerEnvKeys, ot as appEnvKeys, rt as requiredStageKeys } from "./seeds-rG-Evfz9.mjs";
 import { t as appKey } from "./derive-B4vDpzgP.mjs";
-import { i as discover } from "./discover-C5roJuc9.mjs";
+import { i as discover } from "./discover-BvJOVsYG.mjs";
 import { loadWorkspaceSettings } from "./config.mjs";
-import { i as issueLine, o as loadCredentialSchemas } from "./credentialSchemas-DDOLRCLF.mjs";
+import { i as issueLine, o as loadCredentialSchemas } from "./credentialSchemas-DLKbxYBy.mjs";
 import { isIPv4, isIPv6 } from "node:net";
 import { provideKey } from "@geekmidas/manifest";
 import prompts from "prompts";
@@ -714,4 +714,4 @@ async function askFields(ask, io, shape) {
 //#endregion
 export { secretsAddCommand };
-//# sourceMappingURL=add-Bu6FkaTn.mjs.map
+//# sourceMappingURL=add-CIjmgzkb.mjs.map