@geekmidas/cli 10.0.0-alpha.15 → 10.0.0-alpha.17

package/dist/storage-TP0x118M.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-TP0x118M.mjs","names":[],"sources":["../src/secrets/keystore.ts","../src/secrets/storage.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { chmod, mkdir, readFile, rm, writeFile } from 'node:fs/promises';\nimport { homedir } from 'node:os';\nimport { basename, join } from 'node:path';\n\n/** Key length for AES-256 encryption */\nconst KEY_LENGTH = 32; // 256 bits\n\n/**\n * Get the keystore directory for a project.\n * Keys are stored at ~/.gkm/{project-name}/\n *\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the keystore directory\n */\nexport function getKeystoreDir(projectName?: string): string {\n\tconst name = projectName ?? basename(process.cwd());\n\treturn join(homedir(), '.gkm', name);\n}\n\n/**\n * Get the path to a stage's encryption key.\n *\n * @param stage - Stage name (e.g., 'development', 'production')\n * @param projectName - Name of the project (defaults to current directory name)\n * @returns Path to the key file\n */\nexport function getKeyPath(stage: string, projectName?: string): string {\n\treturn join(getKeystoreDir(projectName), `${stage}.key`);\n}\n\n/**\n * Check if a key exists for a stage.\n */\nexport function keyExists(stage: string, projectName?: string): boolean {\n\treturn existsSync(getKeyPath(stage, projectName));\n}\n\n/**\n * Generate a new encryption key for a stage.\n * The key is stored at ~/.gkm/{project-name}/{stage}.key with restricted permissions.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The generated key as a hex string\n */\nexport async function generateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst keyDir = getKeystoreDir(projectName);\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\t// Ensure keystore directory exists with restricted permissions\n\tawait mkdir(keyDir, { recursive: true, mode: 0o700 });\n\n\t// Generate random key\n\tconst key = randomBytes(KEY_LENGTH).toString('hex');\n\n\t// Write key with restricted permissions (owner read/write only)\n\tawait writeFile(keyPath, key, { mode: 0o600, encoding: 'utf-8' });\n\n\t// Ensure permissions are set correctly (in case file existed)\n\tawait chmod(keyPath, 0o600);\n\n\treturn key;\n}\n\n/**\n * Read an encryption key for a stage.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string, or null if not found\n */\nexport async function readKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string | null> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (!existsSync(keyPath)) {\n\t\treturn null;\n\t}\n\n\tconst key = await readFile(keyPath, 'utf-8');\n\treturn key.trim();\n}\n\n/**\n * Read an encryption key for a stage, throwing if not found.\n */\nexport async function requireKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst key = await readKey(stage, projectName);\n\n\tif (!key) {\n\t\tconst name = projectName ?? basename(process.cwd());\n\t\tthrow new Error(\n\t\t\t`Encryption key not found for stage \"${stage}\" in project \"${name}\". ` +\n\t\t\t\t`Expected key at: ${getKeyPath(stage, projectName)}`,\n\t\t);\n\t}\n\n\treturn key;\n}\n\n/**\n * Delete a key for a stage.\n */\nexport async function deleteKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<void> {\n\tconst keyPath = getKeyPath(stage, projectName);\n\n\tif (existsSync(keyPath)) {\n\t\tawait rm(keyPath);\n\t}\n}\n\n/**\n * Get or create a key for a stage.\n * If the key already exists, it is returned. Otherwise, a new key is generated.\n *\n * @param stage - Stage name\n * @param projectName - Project name (defaults to current directory name)\n * @returns The key as a hex string\n */\nexport async function getOrCreateKey(\n\tstage: string,\n\tprojectName?: string,\n): Promise<string> {\n\tconst existingKey = await readKey(stage, projectName);\n\n\tif (existingKey) {\n\t\treturn existingKey;\n\t}\n\n\treturn generateKey(stage, projectName);\n}\n","import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { basename, join } from 'node:path';\nimport { getOrCreateKey, readKey } from './keystore';\nimport type { EmbeddableSecrets, StageSecrets } from './types';\n\n/** Default secrets directory relative to project root */\nconst SECRETS_DIR = '.gkm/secrets';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/** Encrypted secrets file structure */\ninterface EncryptedSecretsFile {\n\t/** Version for future format changes */\n\tversion: 1;\n\t/** Base64 encoded encrypted data (ciphertext + auth tag) */\n\tencrypted: string;\n\t/** Hex encoded IV */\n\tiv: string;\n}\n\n/**\n * Get the secrets directory path.\n */\nexport function getSecretsDir(cwd = process.cwd()): string {\n\treturn join(cwd, SECRETS_DIR);\n}\n\n/**\n * Get the secrets file path for a stage.\n */\nexport function getSecretsPath(stage: string, cwd = process.cwd()): string {\n\treturn join(getSecretsDir(cwd), `${stage}.json`);\n}\n\n/**\n * Check if secrets exist for a stage.\n */\nexport function secretsExist(stage: string, cwd = process.cwd()): boolean {\n\treturn existsSync(getSecretsPath(stage, cwd));\n}\n\n/**\n * Initialize an empty StageSecrets object for a stage.\n */\nexport function initStageSecrets(stage: string): StageSecrets {\n\tconst now = new Date().toISOString();\n\treturn {\n\t\tstage,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tservices: {},\n\t\turls: {},\n\t\tcustom: {},\n\t};\n}\n\n/**\n * Encrypt secrets using a key.\n */\nfunction encryptSecretsData(\n\tsecrets: StageSecrets,\n\tkeyHex: string,\n): EncryptedSecretsFile {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tversion: 1,\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets using a key.\n */\nfunction decryptSecretsData(\n\tdata: EncryptedSecretsFile,\n\tkeyHex: string,\n): StageSecrets {\n\tconst key = Buffer.from(keyHex, 'hex');\n\tconst ivBuffer = Buffer.from(data.iv, 'hex');\n\tconst combined = Buffer.from(data.encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as StageSecrets;\n}\n\n/**\n * Read secrets for a stage (encrypted).\n * Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key\n *\n * @returns StageSecrets or null if not found\n */\nexport async function readStageSecrets(\n\tstage: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets | null> {\n\tconst path = getSecretsPath(stage, cwd);\n\n\tif (!existsSync(path)) {\n\t\treturn null;\n\t}\n\n\tconst content = await readFile(path, 'utf-8');\n\tconst data = JSON.parse(content);\n\n\t// Check if this is an encrypted file (has version field)\n\tif (data.version === 1 && data.encrypted && data.iv) {\n\t\tconst projectName = basename(cwd);\n\t\tconst key = await readKey(stage, projectName);\n\n\t\tif (!key) {\n\t\t\tthrow new Error(\n\t\t\t\t`Decryption key not found for stage \"${stage}\". ` +\n\t\t\t\t\t`Expected key at: ~/.gkm/${projectName}/${stage}.key`,\n\t\t\t);\n\t\t}\n\n\t\treturn decryptSecretsData(data as EncryptedSecretsFile, key);\n\t}\n\n\t// Legacy: unencrypted format (for backwards compatibility)\n\treturn data as StageSecrets;\n}\n\n/**\n * Write secrets for a stage (encrypted).\n * Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key\n */\nexport async function writeStageSecrets(\n\tsecrets: StageSecrets,\n\tcwd = process.cwd(),\n): Promise<void> {\n\tconst dir = getSecretsDir(cwd);\n\tconst path = getSecretsPath(secrets.stage, cwd);\n\tconst projectName = basename(cwd);\n\n\t// Ensure directory exists\n\tawait mkdir(dir, { recursive: true });\n\n\t// Get or create encryption key\n\tconst key = await getOrCreateKey(secrets.stage, projectName);\n\n\t// Encrypt and write\n\tconst encrypted = encryptSecretsData(secrets, key);\n\tawait writeFile(path, JSON.stringify(encrypted, null, 2), 'utf-8');\n}\n\n/**\n * Convert StageSecrets to embeddable format (flat key-value pairs).\n * This is what gets encrypted and embedded in the bundle.\n */\nexport function toEmbeddableSecrets(secrets: StageSecrets): EmbeddableSecrets {\n\treturn {\n\t\t...secrets.urls,\n\t\t...secrets.custom,\n\t\t// Also include individual service credentials if needed\n\t\t...(secrets.services.postgres && {\n\t\t\tPOSTGRES_USER: secrets.services.postgres.username,\n\t\t\tPOSTGRES_PASSWORD: secrets.services.postgres.password,\n\t\t\tPOSTGRES_DB: secrets.services.postgres.database ?? 'app',\n\t\t\tPOSTGRES_HOST: secrets.services.postgres.host,\n\t\t\tPOSTGRES_PORT: String(secrets.services.postgres.port),\n\t\t}),\n\t\t...(secrets.services.redis && {\n\t\t\tREDIS_PASSWORD: secrets.services.redis.password,\n\t\t\tREDIS_HOST: secrets.services.redis.host,\n\t\t\tREDIS_PORT: String(secrets.services.redis.port),\n\t\t}),\n\t\t...(secrets.services.rabbitmq && {\n\t\t\tRABBITMQ_USER: secrets.services.rabbitmq.username,\n\t\t\tRABBITMQ_PASSWORD: secrets.services.rabbitmq.password,\n\t\t\tRABBITMQ_HOST: secrets.services.rabbitmq.host,\n\t\t\tRABBITMQ_PORT: String(secrets.services.rabbitmq.port),\n\t\t\tRABBITMQ_VHOST: secrets.services.rabbitmq.vhost ?? '/',\n\t\t}),\n\t\t...(secrets.services.minio && {\n\t\t\tSTORAGE_ACCESS_KEY_ID: secrets.services.minio.username,\n\t\t\tSTORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,\n\t\t\tSTORAGE_BUCKET: secrets.services.minio.bucket ?? 'app',\n\t\t\tSTORAGE_REGION: 'eu-west-1',\n\t\t\tSTORAGE_FORCE_PATH_STYLE: 'true',\n\t\t}),\n\t\t...(secrets.services.mailpit && {\n\t\t\tSMTP_HOST: secrets.services.mailpit.host,\n\t\t\tSMTP_PORT: String(secrets.services.mailpit.port),\n\t\t\tSMTP_USER: secrets.services.mailpit.username,\n\t\t\tSMTP_PASS: secrets.services.mailpit.password,\n\t\t\tSMTP_SECURE: 'false',\n\t\t\tMAIL_FROM: 'noreply@localhost',\n\t\t}),\n\t\t...(secrets.services.localstack && {\n\t\t\tAWS_ACCESS_KEY_ID:\n\t\t\t\tsecrets.services.localstack.accessKeyId ??\n\t\t\t\tsecrets.services.localstack.username,\n\t\t\tAWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,\n\t\t\tAWS_REGION: secrets.services.localstack.region ?? 'us-east-1',\n\t\t\tAWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`,\n\t\t}),\n\t\t...(secrets.services.pgboss && {\n\t\t\tPGBOSS_DB_USER: secrets.services.pgboss.username,\n\t\t\tPGBOSS_DB_PASSWORD: secrets.services.pgboss.password,\n\t\t}),\n\t};\n}\n\n/**\n * Update a custom secret in the secrets file.\n */\nexport async function setCustomSecret(\n\tstage: string,\n\tkey: string,\n\tvalue: string,\n\tcwd = process.cwd(),\n): Promise<StageSecrets> {\n\tconst secrets = await readStageSecrets(stage, cwd);\n\n\tif (!secrets) {\n\t\tthrow new Error(\n\t\t\t`Secrets not found for stage \"${stage}\". Run \"gkm secrets:init --stage ${stage}\" first.`,\n\t\t);\n\t}\n\n\tconst updated: StageSecrets = {\n\t\t...secrets,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tcustom: {\n\t\t\t...secrets.custom,\n\t\t\t[key]: value,\n\t\t},\n\t};\n\n\tawait writeStageSecrets(updated, cwd);\n\treturn updated;\n}\n\n/**\n * Mask a password for display (show first 4 and last 2 chars).\n */\nexport function maskPassword(password: string): string {\n\tif (password.length <= 8) {\n\t\treturn '********';\n\t}\n\treturn `${password.slice(0, 4)}${'*'.repeat(password.length - 6)}${password.slice(-2)}`;\n}\n\n/**\n * Result of environment variable validation.\n */\nexport interface EnvValidationResult {\n\t/** Whether all required environment variables are present */\n\tvalid: boolean;\n\t/** List of missing environment variable names */\n\tmissing: string[];\n\t/** List of environment variables that are provided */\n\tprovided: string[];\n\t/** List of environment variables that were required */\n\trequired: string[];\n}\n\n/**\n * Validate that all required environment variables are present in secrets.\n *\n * @param requiredVars - Array of environment variable names required by the application\n * @param secrets - Stage secrets to validate against\n * @returns Validation result with missing and provided variables\n *\n * @example\n * ```typescript\n * const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];\n * const secrets = await readStageSecrets('production');\n * const result = validateEnvironmentVariables(required, secrets);\n *\n * if (!result.valid) {\n *   console.error(`Missing environment variables: ${result.missing.join(', ')}`);\n * }\n * ```\n */\nexport function validateEnvironmentVariables(\n\trequiredVars: string[],\n\tsecrets: StageSecrets,\n): EnvValidationResult {\n\tconst embeddable = toEmbeddableSecrets(secrets);\n\tconst availableVars = new Set(Object.keys(embeddable));\n\n\tconst missing: string[] = [];\n\tconst provided: string[] = [];\n\n\tfor (const varName of requiredVars) {\n\t\tif (availableVars.has(varName)) {\n\t\t\tprovided.push(varName);\n\t\t} else {\n\t\t\tmissing.push(varName);\n\t\t}\n\t}\n\n\treturn {\n\t\tvalid: missing.length === 0,\n\t\tmissing: missing.sort(),\n\t\tprovided: provided.sort(),\n\t\trequired: [...requiredVars].sort(),\n\t};\n}\n"],"mappings":";;;;;;;;AAOA,MAAM,aAAa;;;;;;;;AASnB,SAAgB,eAAe,aAA8B;CAC5D,MAAM,OAAO,eAAe,SAAS,QAAQ,IAAI,CAAC;CAClD,OAAO,KAAK,QAAQ,GAAG,QAAQ,IAAI;AACpC;;;;;;;;AASA,SAAgB,WAAW,OAAe,aAA8B;CACvE,OAAO,KAAK,eAAe,WAAW,GAAG,GAAG,MAAM,KAAK;AACxD;;;;;;;;;AAiBA,eAAsB,YACrB,OACA,aACkB;CAClB,MAAM,SAAS,eAAe,WAAW;CACzC,MAAM,UAAU,WAAW,OAAO,WAAW;CAG7C,MAAM,MAAM,QAAQ;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CAGpD,MAAM,MAAM,YAAY,UAAU,CAAC,CAAC,SAAS,KAAK;CAGlD,MAAM,UAAU,SAAS,KAAK;EAAE,MAAM;EAAO,UAAU;CAAQ,CAAC;CAGhE,MAAM,MAAM,SAAS,GAAK;CAE1B,OAAO;AACR;;;;;;;;AASA,eAAsB,QACrB,OACA,aACyB;CACzB,MAAM,UAAU,WAAW,OAAO,WAAW;CAE7C,IAAI,CAAC,WAAW,OAAO,GACtB,OAAO;CAIR,QAAO,MADW,SAAS,SAAS,OAAO,EAAA,CAChC,KAAK;AACjB;;;;;;;;;AA4CA,eAAsB,eACrB,OACA,aACkB;CAClB,MAAM,cAAc,MAAM,QAAQ,OAAO,WAAW;CAEpD,IAAI,aACH,OAAO;CAGR,OAAO,YAAY,OAAO,WAAW;AACtC;;;;;;;;;;;;;;;;ACvIA,MAAM,cAAc;;AAGpB,MAAM,YAAY;AAClB,MAAM,YAAY;;;;AAgBlB,SAAgB,cAAc,MAAM,QAAQ,IAAI,GAAW;CAC1D,OAAO,KAAK,KAAK,WAAW;AAC7B;;;;AAKA,SAAgB,eAAe,OAAe,MAAM,QAAQ,IAAI,GAAW;CAC1E,OAAO,KAAK,cAAc,GAAG,GAAG,GAAG,MAAM,MAAM;AAChD;;;;AAKA,SAAgB,aAAa,OAAe,MAAM,QAAQ,IAAI,GAAY;CACzE,OAAO,WAAW,eAAe,OAAO,GAAG,CAAC;AAC7C;;;;AAKA,SAAgB,iBAAiB,OAA6B;CAC7D,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CACnC,OAAO;EACN;EACA,WAAW;EACX,WAAW;EACX,UAAU,CAAC;EACX,MAAM,CAAC;EACP,QAAQ,CAAC;CACV;AACD;;;;AAKA,SAAS,mBACR,SACA,QACuB;CACvB,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK;CACrC,MAAM,KAAK,YAAY,SAAS;CAGhC,MAAM,YAAY,KAAK,UAAU,OAAO;CAGxC,MAAM,SAAS,eAAe,WAAW,KAAK,EAAE;CAChD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,OAAO,GAChC,OAAO,MAAM,CACd,CAAC;CAGD,MAAM,UAAU,OAAO,WAAW;CAKlC,OAAO;EACN,SAAS;EACT,WAJgB,OAAO,OAAO,CAAC,YAAY,OAAO,CAIhC,CAAC,CAAC,SAAS,QAAQ;EACrC,IAAI,GAAG,SAAS,KAAK;CACtB;AACD;;;;AAKA,SAAS,mBACR,MACA,QACe;CACf,MAAM,MAAM,OAAO,KAAK,QAAQ,KAAK;CACrC,MAAM,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;CAC3C,MAAM,WAAW,OAAO,KAAK,KAAK,WAAW,QAAQ;CAGrD,MAAM,aAAa,SAAS,SAAS,GAAG,GAAgB;CACxD,MAAM,UAAU,SAAS,SAAS,GAAgB;CAGlD,MAAM,WAAW,iBAAiB,WAAW,KAAK,QAAQ;CAC1D,SAAS,WAAW,OAAO;CAE3B,MAAM,YAAY,OAAO,OAAO,CAC/B,SAAS,OAAO,UAAU,GAC1B,SAAS,MAAM,CAChB,CAAC;CAED,OAAO,KAAK,MAAM,UAAU,SAAS,OAAO,CAAC;AAC9C;;;;;;;AAQA,eAAsB,iBACrB,OACA,MAAM,QAAQ,IAAI,GACa;CAC/B,MAAM,OAAO,eAAe,OAAO,GAAG;CAEtC,IAAI,CAAC,WAAW,IAAI,GACnB,OAAO;CAGR,MAAM,UAAU,MAAM,SAAS,MAAM,OAAO;CAC5C,MAAM,OAAO,KAAK,MAAM,OAAO;CAG/B,IAAI,KAAK,YAAY,KAAK,KAAK,aAAa,KAAK,IAAI;EACpD,MAAM,cAAc,SAAS,GAAG;EAChC,MAAM,MAAM,MAAM,QAAQ,OAAO,WAAW;EAE5C,IAAI,CAAC,KACJ,MAAM,IAAI,MACT,uCAAuC,MAAM,6BACjB,YAAY,GAAG,MAAM,KAClD;EAGD,OAAO,mBAAmB,MAA8B,GAAG;CAC5D;CAGA,OAAO;AACR;;;;;AAMA,eAAsB,kBACrB,SACA,MAAM,QAAQ,IAAI,GACF;CAChB,MAAM,MAAM,cAAc,GAAG;CAC7B,MAAM,OAAO,eAAe,QAAQ,OAAO,GAAG;CAC9C,MAAM,cAAc,SAAS,GAAG;CAGhC,MAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;CAMpC,MAAM,YAAY,mBAAmB,SAAS,MAH5B,eAAe,QAAQ,OAAO,WAAW,CAGV;CACjD,MAAM,UAAU,MAAM,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,OAAO;AAClE;;;;;AAMA,SAAgB,oBAAoB,SAA0C;CAC7E,OAAO;EACN,GAAG,QAAQ;EACX,GAAG,QAAQ;EAEX,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,aAAa,QAAQ,SAAS,SAAS,YAAY;GACnD,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,IAAI;EACrD;EACA,GAAI,QAAQ,SAAS,SAAS;GAC7B,gBAAgB,QAAQ,SAAS,MAAM;GACvC,YAAY,QAAQ,SAAS,MAAM;GACnC,YAAY,OAAO,QAAQ,SAAS,MAAM,IAAI;EAC/C;EACA,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,IAAI;GACpD,gBAAgB,QAAQ,SAAS,SAAS,SAAS;EACpD;EACA,GAAI,QAAQ,SAAS,SAAS;GAC7B,uBAAuB,QAAQ,SAAS,MAAM;GAC9C,2BAA2B,QAAQ,SAAS,MAAM;GAClD,gBAAgB,QAAQ,SAAS,MAAM,UAAU;GACjD,gBAAgB;GAChB,0BAA0B;EAC3B;EACA,GAAI,QAAQ,SAAS,WAAW;GAC/B,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,OAAO,QAAQ,SAAS,QAAQ,IAAI;GAC/C,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,QAAQ,SAAS,QAAQ;GACpC,aAAa;GACb,WAAW;EACZ;EACA,GAAI,QAAQ,SAAS,cAAc;GAClC,mBACC,QAAQ,SAAS,WAAW,eAC5B,QAAQ,SAAS,WAAW;GAC7B,uBAAuB,QAAQ,SAAS,WAAW;GACnD,YAAY,QAAQ,SAAS,WAAW,UAAU;GAClD,kBAAkB,UAAU,QAAQ,SAAS,WAAW,KAAK,GAAG,QAAQ,SAAS,WAAW;EAC7F;EACA,GAAI,QAAQ,SAAS,UAAU;GAC9B,gBAAgB,QAAQ,SAAS,OAAO;GACxC,oBAAoB,QAAQ,SAAS,OAAO;EAC7C;CACD;AACD;;;;AAKA,eAAsB,gBACrB,OACA,KACA,OACA,MAAM,QAAQ,IAAI,GACM;CACxB,MAAM,UAAU,MAAM,iBAAiB,OAAO,GAAG;CAEjD,IAAI,CAAC,SACJ,MAAM,IAAI,MACT,gCAAgC,MAAM,mCAAmC,MAAM,SAChF;CAGD,MAAM,UAAwB;EAC7B,GAAG;EACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,QAAQ;GACP,GAAG,QAAQ;IACV,MAAM;EACR;CACD;CAEA,MAAM,kBAAkB,SAAS,GAAG;CACpC,OAAO;AACR;;;;AAKA,SAAgB,aAAa,UAA0B;CACtD,IAAI,SAAS,UAAU,GACtB,OAAO;CAER,OAAO,GAAG,SAAS,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,SAAS,SAAS,CAAC,IAAI,SAAS,MAAM,EAAE;AACrF;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,6BACf,cACA,SACsB;CACtB,MAAM,aAAa,oBAAoB,OAAO;CAC9C,MAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC;CAErD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAqB,CAAC;CAE5B,KAAK,MAAM,WAAW,cACrB,IAAI,cAAc,IAAI,OAAO,GAC5B,SAAS,KAAK,OAAO;MAErB,QAAQ,KAAK,OAAO;CAItB,OAAO;EACN,OAAO,QAAQ,WAAW;EAC1B,SAAS,QAAQ,KAAK;EACtB,UAAU,SAAS,KAAK;EACxB,UAAU,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK;CAClC;AACD"}

package/dist/transfer-4A4S2hcw.mjs

@@ -0,0 +1,122 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { w as assertDeployedStage } from "./workspace-DI-M3BnN.mjs";
+import { n as readStageSecrets, s as writeStageSecrets } from "./storage-TP0x118M.mjs";
+import { t as reconcileMissingSecrets } from "./reconcile-fmoluZmZ.mjs";
+//#region src/secrets/store.ts
+/** The encrypted file under `.gkm/secrets/`, and its key under `~/.gkm/`. */
+var FileSecretsStore = class {
+	root;
+	constructor(root) {
+		this.root = root;
+	}
+	pull(stage) {
+		return readStageSecrets(stage, this.root);
+	}
+	push(_stage, secrets) {
+		return writeStageSecrets(secrets, this.root);
+	}
+};
+/**
+* The store a stage's secrets live in.
+*
+* The local stage is always the file: its secrets belong to the machine
+* running `gkm dev`. A deployed stage uses `secrets.store`.
+*/
+async function secretsStoreFor(workspace, stage, options = {}) {
+	const configured = workspace.secrets.store ?? "file";
+	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root);
+	if (configured.provider !== "ssm") return configured.provider;
+	const { SsmSecretsStore } = await import("./ssm-BKN1Cg4z.mjs");
+	return new SsmSecretsStore({
+		project: workspace.name,
+		region: configured.region,
+		...options.profile ? { profile: options.profile } : {}
+	});
+}
+/** Whether a stage's secrets live somewhere other than this machine. */
+function isRemoteStore(workspace, stage) {
+	const configured = workspace.secrets.store ?? "file";
+	return stage !== workspace.stages.local && configured !== "file";
+}
+//#endregion
+//#region src/secrets/transfer.ts
+/**
+* Moving a deployed stage's secrets between this machine and its store.
+*
+* `push` sends the encrypted local copy to the stage's store; `pull` brings it
+* back and writes the local copy a deploy reads — generating a key for it if
+* the machine has none, which is what a fresh CI runner needs. Both reconcile
+* the keys the workspace now derives, so a store never lags a new construct.
+*/
+var transfer_exports = /* @__PURE__ */ __exportAll({
+	NoLocalSecrets: () => NoLocalSecrets,
+	NoRemoteSecretsStore: () => NoRemoteSecretsStore,
+	NoStoredSecrets: () => NoStoredSecrets,
+	pullStageSecrets: () => pullStageSecrets,
+	pushStageSecrets: () => pushStageSecrets
+});
+/** A push or pull for a stage with nowhere to push or pull from. */
+var NoRemoteSecretsStore = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Stage "${stage}" keeps its secrets in the local file, so there is nothing to push or pull. Set secrets.store in gkm.config.ts (e.g. { provider: 'ssm', region: 'eu-west-1' }) for deployed stages.`);
+		this.stage = stage;
+		this.name = "NoRemoteSecretsStore";
+	}
+};
+/** A push for a stage whose secrets this machine does not have. */
+var NoLocalSecrets = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No secrets for stage "${stage}" on this machine. Run gkm secrets:init --stage ${stage} first.`);
+		this.stage = stage;
+		this.name = "NoLocalSecrets";
+	}
+};
+/** A pull for a stage the store holds nothing for. */
+var NoStoredSecrets = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The store holds no secrets for stage "${stage}". Push them first: gkm secrets:push --stage ${stage}.`);
+		this.stage = stage;
+		this.name = "NoStoredSecrets";
+	}
+};
+async function reconcile(secrets, workspace, stage) {
+	const { derivedContainers } = await import("./credentials-fJP5-fa1.mjs").then((n) => n.h);
+	const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
+	return result ? {
+		secrets: result.secrets,
+		addedKeys: result.addedKeys
+	} : {
+		secrets,
+		addedKeys: []
+	};
+}
+function remoteOnly(workspace, stage) {
+	assertDeployedStage(workspace.stages, stage);
+	if (!isRemoteStore(workspace, stage)) throw new NoRemoteSecretsStore(stage);
+}
+/** Send this machine's secrets for a deployed stage to its store. */
+async function pushStageSecrets(workspace, stage, options = {}) {
+	remoteOnly(workspace, stage);
+	const local = await readStageSecrets(stage, workspace.root);
+	if (!local) throw new NoLocalSecrets(stage);
+	const result = await reconcile(local, workspace, stage);
+	if (result.addedKeys.length) await writeStageSecrets(result.secrets, workspace.root);
+	await (await secretsStoreFor(workspace, stage, options)).push(stage, result.secrets);
+	return result;
+}
+/** Bring a deployed stage's secrets from its store into the local copy. */
+async function pullStageSecrets(workspace, stage, options = {}) {
+	remoteOnly(workspace, stage);
+	const stored = await (await secretsStoreFor(workspace, stage, options)).pull(stage);
+	if (!stored) throw new NoStoredSecrets(stage);
+	const result = await reconcile(stored, workspace, stage);
+	await writeStageSecrets(result.secrets, workspace.root);
+	return result;
+}
+//#endregion
+export { isRemoteStore as a, transfer_exports as i, pullStageSecrets as n, pushStageSecrets as r, NoStoredSecrets as t };
+
+//# sourceMappingURL=transfer-4A4S2hcw.mjs.map

package/dist/transfer-4A4S2hcw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer-4A4S2hcw.mjs","names":[],"sources":["../src/secrets/store.ts","../src/secrets/transfer.ts"],"sourcesContent":["/**\n * Where a stage's secrets live when they are not only on one machine.\n *\n * A deployed stage has to reach its secrets from wherever it is deployed from\n * — a teammate's laptop today, a CI runner tomorrow — and `.gkm/` is not\n * committed, so the encrypted file on the machine that created them is not a\n * home for them. A store is: `push` puts a stage's secrets there, `pull`\n * brings them back, and the deploy reads the local copy `pull` writes.\n *\n * The same shape deploy state has (`StateProvider`): one interface, a backend\n * per place, and a custom object for any place this package does not ship.\n */\n\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { readStageSecrets, writeStageSecrets } from './storage.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsStore {\n\t/** The stage's secrets, or null if the store holds none for it. */\n\tpull(stage: string): Promise<StageSecrets | null>;\n\t/** Replace the stage's secrets in the store. */\n\tpush(stage: string, secrets: StageSecrets): Promise<void>;\n}\n\n/** Secrets in SSM Parameter Store, in the account of the active credentials. */\nexport interface SsmSecretsStoreConfig {\n\tprovider: 'ssm';\n\tregion: string;\n}\n\n/** Any other backend: an object implementing {@link SecretsStore}. */\nexport interface CustomSecretsStoreConfig {\n\tprovider: SecretsStore;\n}\n\n/**\n * `secrets.store` in gkm.config.ts.\n *\n * `'file'` — the default — keeps each stage's secrets in the encrypted\n * `.gkm/secrets/<stage>.json` beside its key in `~/.gkm/`. It cannot serve a\n * deploy from CI while `.gkm/` is gitignored; `ssm` or a custom store can.\n */\nexport type SecretsStoreConfig =\n\t| 'file'\n\t| SsmSecretsStoreConfig\n\t| CustomSecretsStoreConfig;\n\n/** The encrypted file under `.gkm/secrets/`, and its key under `~/.gkm/`. */\nexport class FileSecretsStore implements SecretsStore {\n\tconstructor(private readonly root: string) {}\n\n\tpull(stage: string): Promise<StageSecrets | null> {\n\t\treturn readStageSecrets(stage, this.root);\n\t}\n\n\tpush(_stage: string, secrets: StageSecrets): Promise<void> {\n\t\treturn writeStageSecrets(secrets, this.root);\n\t}\n}\n\nexport interface SecretsStoreOptions {\n\t/**\n\t * The AWS profile for the stage's account. Only that profile is used —\n\t * never AWS_* from the environment — so a store cannot quietly land in\n\t * whichever account the shell was exported for.\n\t */\n\tprofile?: string;\n}\n\n/**\n * The store a stage's secrets live in.\n *\n * The local stage is always the file: its secrets belong to the machine\n * running `gkm dev`. A deployed stage uses `secrets.store`.\n */\nexport async function secretsStoreFor(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SecretsStoreOptions = {},\n): Promise<SecretsStore> {\n\tconst configured = workspace.secrets.store ?? 'file';\n\n\tif (stage === workspace.stages.local || configured === 'file') {\n\t\treturn new FileSecretsStore(workspace.root);\n\t}\n\n\tif (configured.provider !== 'ssm') {\n\t\treturn configured.provider;\n\t}\n\n\tconst { SsmSecretsStore } = await import('./ssm.js');\n\treturn new SsmSecretsStore({\n\t\tproject: workspace.name,\n\t\tregion: configured.region,\n\t\t...(options.profile ? { profile: options.profile } : {}),\n\t});\n}\n\n/** Whether a stage's secrets live somewhere other than this machine. */\nexport function isRemoteStore(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n): boolean {\n\tconst configured = workspace.secrets.store ?? 'file';\n\treturn stage !== workspace.stages.local && configured !== 'file';\n}\n","/**\n * Moving a deployed stage's secrets between this machine and its store.\n *\n * `push` sends the encrypted local copy to the stage's store; `pull` brings it\n * back and writes the local copy a deploy reads — generating a key for it if\n * the machine has none, which is what a fresh CI runner needs. Both reconcile\n * the keys the workspace now derives, so a store never lags a new construct.\n */\n\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { reconcileMissingSecrets } from './reconcile.js';\nimport { readStageSecrets, writeStageSecrets } from './storage.js';\nimport {\n\tisRemoteStore,\n\ttype SecretsStoreOptions,\n\tsecretsStoreFor,\n} from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface TransferResult {\n\tsecrets: StageSecrets;\n\t/** Keys the workspace derives that the secrets were missing, now added. */\n\taddedKeys: string[];\n}\n\n/** A push or pull for a stage with nowhere to push or pull from. */\nexport class NoRemoteSecretsStore extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`Stage \"${stage}\" keeps its secrets in the local file, so there is nothing to push or pull. ` +\n\t\t\t\t\"Set secrets.store in gkm.config.ts (e.g. { provider: 'ssm', region: 'eu-west-1' }) for deployed stages.\",\n\t\t);\n\t\tthis.name = 'NoRemoteSecretsStore';\n\t}\n}\n\n/** A push for a stage whose secrets this machine does not have. */\nexport class NoLocalSecrets extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`No secrets for stage \"${stage}\" on this machine. Run gkm secrets:init --stage ${stage} first.`,\n\t\t);\n\t\tthis.name = 'NoLocalSecrets';\n\t}\n}\n\n/** A pull for a stage the store holds nothing for. */\nexport class NoStoredSecrets extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`The store holds no secrets for stage \"${stage}\". Push them first: gkm secrets:push --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoStoredSecrets';\n\t}\n}\n\nasync function reconcile(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n): Promise<TransferResult> {\n\tconst { derivedContainers } = await import('../reconcile/workspace.js');\n\tconst result = reconcileMissingSecrets(\n\t\tsecrets,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\treturn result\n\t\t? { secrets: result.secrets, addedKeys: result.addedKeys }\n\t\t: { secrets, addedKeys: [] };\n}\n\nfunction remoteOnly(workspace: NormalizedWorkspace, stage: string): void {\n\tassertDeployedStage(workspace.stages, stage);\n\tif (!isRemoteStore(workspace, stage)) throw new NoRemoteSecretsStore(stage);\n}\n\n/** Send this machine's secrets for a deployed stage to its store. */\nexport async function pushStageSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SecretsStoreOptions = {},\n): Promise<TransferResult> {\n\tremoteOnly(workspace, stage);\n\n\tconst local = await readStageSecrets(stage, workspace.root);\n\tif (!local) throw new NoLocalSecrets(stage);\n\n\tconst result = await reconcile(local, workspace, stage);\n\tif (result.addedKeys.length) {\n\t\tawait writeStageSecrets(result.secrets, workspace.root);\n\t}\n\n\tconst store = await secretsStoreFor(workspace, stage, options);\n\tawait store.push(stage, result.secrets);\n\treturn result;\n}\n\n/** Bring a deployed stage's secrets from its store into the local copy. */\nexport async function pullStageSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SecretsStoreOptions = {},\n): Promise<TransferResult> {\n\tremoteOnly(workspace, stage);\n\n\tconst store = await secretsStoreFor(workspace, stage, options);\n\tconst stored = await store.pull(stage);\n\tif (!stored) throw new NoStoredSecrets(stage);\n\n\tconst result = await reconcile(stored, workspace, stage);\n\tawait writeStageSecrets(result.secrets, workspace.root);\n\treturn result;\n}\n"],"mappings":";;;;;;AAgDA,IAAa,mBAAb,MAAsD;CACxB;CAA7B,YAAY,MAA+B;EAAd,KAAA,OAAA;CAAe;CAE5C,KAAK,OAA6C;EACjD,OAAO,iBAAiB,OAAO,KAAK,IAAI;CACzC;CAEA,KAAK,QAAgB,SAAsC;EAC1D,OAAO,kBAAkB,SAAS,KAAK,IAAI;CAC5C;AACD;;;;;;;AAiBA,eAAsB,gBACrB,WACA,OACA,UAA+B,CAAC,GACR;CACxB,MAAM,aAAa,UAAU,QAAQ,SAAS;CAE9C,IAAI,UAAU,UAAU,OAAO,SAAS,eAAe,QACtD,OAAO,IAAI,iBAAiB,UAAU,IAAI;CAG3C,IAAI,WAAW,aAAa,OAC3B,OAAO,WAAW;CAGnB,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,OAAO,IAAI,gBAAgB;EAC1B,SAAS,UAAU;EACnB,QAAQ,WAAW;EACnB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;;AAGA,SAAgB,cACf,WACA,OACU;CACV,MAAM,aAAa,UAAU,QAAQ,SAAS;CAC9C,OAAO,UAAU,UAAU,OAAO,SAAS,eAAe;AAC3D;;;;;;;;;;;;;;;;;;;AC9EA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,OAAwB;EACnC,MACC,UAAU,MAAM,oLAEjB;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,OAAwB;EACnC,MACC,yBAAyB,MAAM,kDAAkD,MAAM,QACxF;EAHoB,KAAA,QAAA;EAIpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CACrB;CAArB,YAAY,OAAwB;EACnC,MACC,yCAAyC,MAAM,+CAA+C,MAAM,EACrG;EAHoB,KAAA,QAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,eAAe,UACd,SACA,WACA,OAC0B;CAC1B,MAAM,EAAE,sBAAsB,MAAM,OAAO,6BAA4B,CAAA,MAAA,MAAA,EAAA,CAAA;CACvE,MAAM,SAAS,wBACd,SACA,WACA,MAAM,kBAAkB,WAAW,KAAK,CACzC;CACA,OAAO,SACJ;EAAE,SAAS,OAAO;EAAS,WAAW,OAAO;CAAU,IACvD;EAAE;EAAS,WAAW,CAAC;CAAE;AAC7B;AAEA,SAAS,WAAW,WAAgC,OAAqB;CACxE,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAI,CAAC,cAAc,WAAW,KAAK,GAAG,MAAM,IAAI,qBAAqB,KAAK;AAC3E;;AAGA,eAAsB,iBACrB,WACA,OACA,UAA+B,CAAC,GACN;CAC1B,WAAW,WAAW,KAAK;CAE3B,MAAM,QAAQ,MAAM,iBAAiB,OAAO,UAAU,IAAI;CAC1D,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,KAAK;CAE1C,MAAM,SAAS,MAAM,UAAU,OAAO,WAAW,KAAK;CACtD,IAAI,OAAO,UAAU,QACpB,MAAM,kBAAkB,OAAO,SAAS,UAAU,IAAI;CAIvD,OAAM,MADc,gBAAgB,WAAW,OAAO,OAAO,EAAA,CACjD,KAAK,OAAO,OAAO,OAAO;CACtC,OAAO;AACR;;AAGA,eAAsB,iBACrB,WACA,OACA,UAA+B,CAAC,GACN;CAC1B,WAAW,WAAW,KAAK;CAG3B,MAAM,SAAS,OAAM,MADD,gBAAgB,WAAW,OAAO,OAAO,EAAA,CAClC,KAAK,KAAK;CACrC,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,KAAK;CAE5C,MAAM,SAAS,MAAM,UAAU,QAAQ,WAAW,KAAK;CACvD,MAAM,kBAAkB,OAAO,SAAS,UAAU,IAAI;CACtD,OAAO;AACR"}

package/dist/transfer-DdmtKLzi.cjs

@@ -0,0 +1,151 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_workspace = require("./workspace-B8NLb54N.cjs");
+const require_storage = require("./storage-DgypfSD6.cjs");
+const require_reconcile = require("./reconcile-Cq4cO83R.cjs");
+//#region src/secrets/store.ts
+/** The encrypted file under `.gkm/secrets/`, and its key under `~/.gkm/`. */
+var FileSecretsStore = class {
+	root;
+	constructor(root) {
+		this.root = root;
+	}
+	pull(stage) {
+		return require_storage.readStageSecrets(stage, this.root);
+	}
+	push(_stage, secrets) {
+		return require_storage.writeStageSecrets(secrets, this.root);
+	}
+};
+/**
+* The store a stage's secrets live in.
+*
+* The local stage is always the file: its secrets belong to the machine
+* running `gkm dev`. A deployed stage uses `secrets.store`.
+*/
+async function secretsStoreFor(workspace, stage, options = {}) {
+	const configured = workspace.secrets.store ?? "file";
+	if (stage === workspace.stages.local || configured === "file") return new FileSecretsStore(workspace.root);
+	if (configured.provider !== "ssm") return configured.provider;
+	const { SsmSecretsStore } = await Promise.resolve().then(() => require("./ssm-FxeSAt35.cjs"));
+	return new SsmSecretsStore({
+		project: workspace.name,
+		region: configured.region,
+		...options.profile ? { profile: options.profile } : {}
+	});
+}
+/** Whether a stage's secrets live somewhere other than this machine. */
+function isRemoteStore(workspace, stage) {
+	const configured = workspace.secrets.store ?? "file";
+	return stage !== workspace.stages.local && configured !== "file";
+}
+//#endregion
+//#region src/secrets/transfer.ts
+/**
+* Moving a deployed stage's secrets between this machine and its store.
+*
+* `push` sends the encrypted local copy to the stage's store; `pull` brings it
+* back and writes the local copy a deploy reads — generating a key for it if
+* the machine has none, which is what a fresh CI runner needs. Both reconcile
+* the keys the workspace now derives, so a store never lags a new construct.
+*/
+var transfer_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	NoLocalSecrets: () => NoLocalSecrets,
+	NoRemoteSecretsStore: () => NoRemoteSecretsStore,
+	NoStoredSecrets: () => NoStoredSecrets,
+	pullStageSecrets: () => pullStageSecrets,
+	pushStageSecrets: () => pushStageSecrets
+});
+/** A push or pull for a stage with nowhere to push or pull from. */
+var NoRemoteSecretsStore = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Stage "${stage}" keeps its secrets in the local file, so there is nothing to push or pull. Set secrets.store in gkm.config.ts (e.g. { provider: 'ssm', region: 'eu-west-1' }) for deployed stages.`);
+		this.stage = stage;
+		this.name = "NoRemoteSecretsStore";
+	}
+};
+/** A push for a stage whose secrets this machine does not have. */
+var NoLocalSecrets = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`No secrets for stage "${stage}" on this machine. Run gkm secrets:init --stage ${stage} first.`);
+		this.stage = stage;
+		this.name = "NoLocalSecrets";
+	}
+};
+/** A pull for a stage the store holds nothing for. */
+var NoStoredSecrets = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`The store holds no secrets for stage "${stage}". Push them first: gkm secrets:push --stage ${stage}.`);
+		this.stage = stage;
+		this.name = "NoStoredSecrets";
+	}
+};
+async function reconcile(secrets, workspace, stage) {
+	const { derivedContainers } = await Promise.resolve().then(() => require("./credentials-tvyReUAd.cjs")).then((n) => n.workspace_exports);
+	const result = require_reconcile.reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
+	return result ? {
+		secrets: result.secrets,
+		addedKeys: result.addedKeys
+	} : {
+		secrets,
+		addedKeys: []
+	};
+}
+function remoteOnly(workspace, stage) {
+	require_workspace.assertDeployedStage(workspace.stages, stage);
+	if (!isRemoteStore(workspace, stage)) throw new NoRemoteSecretsStore(stage);
+}
+/** Send this machine's secrets for a deployed stage to its store. */
+async function pushStageSecrets(workspace, stage, options = {}) {
+	remoteOnly(workspace, stage);
+	const local = await require_storage.readStageSecrets(stage, workspace.root);
+	if (!local) throw new NoLocalSecrets(stage);
+	const result = await reconcile(local, workspace, stage);
+	if (result.addedKeys.length) await require_storage.writeStageSecrets(result.secrets, workspace.root);
+	await (await secretsStoreFor(workspace, stage, options)).push(stage, result.secrets);
+	return result;
+}
+/** Bring a deployed stage's secrets from its store into the local copy. */
+async function pullStageSecrets(workspace, stage, options = {}) {
+	remoteOnly(workspace, stage);
+	const stored = await (await secretsStoreFor(workspace, stage, options)).pull(stage);
+	if (!stored) throw new NoStoredSecrets(stage);
+	const result = await reconcile(stored, workspace, stage);
+	await require_storage.writeStageSecrets(result.secrets, workspace.root);
+	return result;
+}
+//#endregion
+Object.defineProperty(exports, "NoStoredSecrets", {
+	enumerable: true,
+	get: function() {
+		return NoStoredSecrets;
+	}
+});
+Object.defineProperty(exports, "isRemoteStore", {
+	enumerable: true,
+	get: function() {
+		return isRemoteStore;
+	}
+});
+Object.defineProperty(exports, "pullStageSecrets", {
+	enumerable: true,
+	get: function() {
+		return pullStageSecrets;
+	}
+});
+Object.defineProperty(exports, "pushStageSecrets", {
+	enumerable: true,
+	get: function() {
+		return pushStageSecrets;
+	}
+});
+Object.defineProperty(exports, "transfer_exports", {
+	enumerable: true,
+	get: function() {
+		return transfer_exports;
+	}
+});
+
+//# sourceMappingURL=transfer-DdmtKLzi.cjs.map

package/dist/transfer-DdmtKLzi.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer-DdmtKLzi.cjs","names":["readStageSecrets","writeStageSecrets","reconcileMissingSecrets","readStageSecrets","writeStageSecrets"],"sources":["../src/secrets/store.ts","../src/secrets/transfer.ts"],"sourcesContent":["/**\n * Where a stage's secrets live when they are not only on one machine.\n *\n * A deployed stage has to reach its secrets from wherever it is deployed from\n * — a teammate's laptop today, a CI runner tomorrow — and `.gkm/` is not\n * committed, so the encrypted file on the machine that created them is not a\n * home for them. A store is: `push` puts a stage's secrets there, `pull`\n * brings them back, and the deploy reads the local copy `pull` writes.\n *\n * The same shape deploy state has (`StateProvider`): one interface, a backend\n * per place, and a custom object for any place this package does not ship.\n */\n\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { readStageSecrets, writeStageSecrets } from './storage.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsStore {\n\t/** The stage's secrets, or null if the store holds none for it. */\n\tpull(stage: string): Promise<StageSecrets | null>;\n\t/** Replace the stage's secrets in the store. */\n\tpush(stage: string, secrets: StageSecrets): Promise<void>;\n}\n\n/** Secrets in SSM Parameter Store, in the account of the active credentials. */\nexport interface SsmSecretsStoreConfig {\n\tprovider: 'ssm';\n\tregion: string;\n}\n\n/** Any other backend: an object implementing {@link SecretsStore}. */\nexport interface CustomSecretsStoreConfig {\n\tprovider: SecretsStore;\n}\n\n/**\n * `secrets.store` in gkm.config.ts.\n *\n * `'file'` — the default — keeps each stage's secrets in the encrypted\n * `.gkm/secrets/<stage>.json` beside its key in `~/.gkm/`. It cannot serve a\n * deploy from CI while `.gkm/` is gitignored; `ssm` or a custom store can.\n */\nexport type SecretsStoreConfig =\n\t| 'file'\n\t| SsmSecretsStoreConfig\n\t| CustomSecretsStoreConfig;\n\n/** The encrypted file under `.gkm/secrets/`, and its key under `~/.gkm/`. */\nexport class FileSecretsStore implements SecretsStore {\n\tconstructor(private readonly root: string) {}\n\n\tpull(stage: string): Promise<StageSecrets | null> {\n\t\treturn readStageSecrets(stage, this.root);\n\t}\n\n\tpush(_stage: string, secrets: StageSecrets): Promise<void> {\n\t\treturn writeStageSecrets(secrets, this.root);\n\t}\n}\n\nexport interface SecretsStoreOptions {\n\t/**\n\t * The AWS profile for the stage's account. Only that profile is used —\n\t * never AWS_* from the environment — so a store cannot quietly land in\n\t * whichever account the shell was exported for.\n\t */\n\tprofile?: string;\n}\n\n/**\n * The store a stage's secrets live in.\n *\n * The local stage is always the file: its secrets belong to the machine\n * running `gkm dev`. A deployed stage uses `secrets.store`.\n */\nexport async function secretsStoreFor(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SecretsStoreOptions = {},\n): Promise<SecretsStore> {\n\tconst configured = workspace.secrets.store ?? 'file';\n\n\tif (stage === workspace.stages.local || configured === 'file') {\n\t\treturn new FileSecretsStore(workspace.root);\n\t}\n\n\tif (configured.provider !== 'ssm') {\n\t\treturn configured.provider;\n\t}\n\n\tconst { SsmSecretsStore } = await import('./ssm.js');\n\treturn new SsmSecretsStore({\n\t\tproject: workspace.name,\n\t\tregion: configured.region,\n\t\t...(options.profile ? { profile: options.profile } : {}),\n\t});\n}\n\n/** Whether a stage's secrets live somewhere other than this machine. */\nexport function isRemoteStore(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n): boolean {\n\tconst configured = workspace.secrets.store ?? 'file';\n\treturn stage !== workspace.stages.local && configured !== 'file';\n}\n","/**\n * Moving a deployed stage's secrets between this machine and its store.\n *\n * `push` sends the encrypted local copy to the stage's store; `pull` brings it\n * back and writes the local copy a deploy reads — generating a key for it if\n * the machine has none, which is what a fresh CI runner needs. Both reconcile\n * the keys the workspace now derives, so a store never lags a new construct.\n */\n\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { reconcileMissingSecrets } from './reconcile.js';\nimport { readStageSecrets, writeStageSecrets } from './storage.js';\nimport {\n\tisRemoteStore,\n\ttype SecretsStoreOptions,\n\tsecretsStoreFor,\n} from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface TransferResult {\n\tsecrets: StageSecrets;\n\t/** Keys the workspace derives that the secrets were missing, now added. */\n\taddedKeys: string[];\n}\n\n/** A push or pull for a stage with nowhere to push or pull from. */\nexport class NoRemoteSecretsStore extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`Stage \"${stage}\" keeps its secrets in the local file, so there is nothing to push or pull. ` +\n\t\t\t\t\"Set secrets.store in gkm.config.ts (e.g. { provider: 'ssm', region: 'eu-west-1' }) for deployed stages.\",\n\t\t);\n\t\tthis.name = 'NoRemoteSecretsStore';\n\t}\n}\n\n/** A push for a stage whose secrets this machine does not have. */\nexport class NoLocalSecrets extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`No secrets for stage \"${stage}\" on this machine. Run gkm secrets:init --stage ${stage} first.`,\n\t\t);\n\t\tthis.name = 'NoLocalSecrets';\n\t}\n}\n\n/** A pull for a stage the store holds nothing for. */\nexport class NoStoredSecrets extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`The store holds no secrets for stage \"${stage}\". Push them first: gkm secrets:push --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoStoredSecrets';\n\t}\n}\n\nasync function reconcile(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n): Promise<TransferResult> {\n\tconst { derivedContainers } = await import('../reconcile/workspace.js');\n\tconst result = reconcileMissingSecrets(\n\t\tsecrets,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\treturn result\n\t\t? { secrets: result.secrets, addedKeys: result.addedKeys }\n\t\t: { secrets, addedKeys: [] };\n}\n\nfunction remoteOnly(workspace: NormalizedWorkspace, stage: string): void {\n\tassertDeployedStage(workspace.stages, stage);\n\tif (!isRemoteStore(workspace, stage)) throw new NoRemoteSecretsStore(stage);\n}\n\n/** Send this machine's secrets for a deployed stage to its store. */\nexport async function pushStageSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SecretsStoreOptions = {},\n): Promise<TransferResult> {\n\tremoteOnly(workspace, stage);\n\n\tconst local = await readStageSecrets(stage, workspace.root);\n\tif (!local) throw new NoLocalSecrets(stage);\n\n\tconst result = await reconcile(local, workspace, stage);\n\tif (result.addedKeys.length) {\n\t\tawait writeStageSecrets(result.secrets, workspace.root);\n\t}\n\n\tconst store = await secretsStoreFor(workspace, stage, options);\n\tawait store.push(stage, result.secrets);\n\treturn result;\n}\n\n/** Bring a deployed stage's secrets from its store into the local copy. */\nexport async function pullStageSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SecretsStoreOptions = {},\n): Promise<TransferResult> {\n\tremoteOnly(workspace, stage);\n\n\tconst store = await secretsStoreFor(workspace, stage, options);\n\tconst stored = await store.pull(stage);\n\tif (!stored) throw new NoStoredSecrets(stage);\n\n\tconst result = await reconcile(stored, workspace, stage);\n\tawait writeStageSecrets(result.secrets, workspace.root);\n\treturn result;\n}\n"],"mappings":";;;;;;AAgDA,IAAa,mBAAb,MAAsD;CACxB;CAA7B,YAAY,MAA+B;EAAd,KAAA,OAAA;CAAe;CAE5C,KAAK,OAA6C;EACjD,OAAOA,gBAAAA,iBAAiB,OAAO,KAAK,IAAI;CACzC;CAEA,KAAK,QAAgB,SAAsC;EAC1D,OAAOC,gBAAAA,kBAAkB,SAAS,KAAK,IAAI;CAC5C;AACD;;;;;;;AAiBA,eAAsB,gBACrB,WACA,OACA,UAA+B,CAAC,GACR;CACxB,MAAM,aAAa,UAAU,QAAQ,SAAS;CAE9C,IAAI,UAAU,UAAU,OAAO,SAAS,eAAe,QACtD,OAAO,IAAI,iBAAiB,UAAU,IAAI;CAG3C,IAAI,WAAW,aAAa,OAC3B,OAAO,WAAW;CAGnB,MAAM,EAAE,oBAAoB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,oBAAA,CAAA;CAClC,OAAO,IAAI,gBAAgB;EAC1B,SAAS,UAAU;EACnB,QAAQ,WAAW;EACnB,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;CACvD,CAAC;AACF;;AAGA,SAAgB,cACf,WACA,OACU;CACV,MAAM,aAAa,UAAU,QAAQ,SAAS;CAC9C,OAAO,UAAU,UAAU,OAAO,SAAS,eAAe;AAC3D;;;;;;;;;;;;;;;;;;;AC9EA,IAAa,uBAAb,cAA0C,MAAM;CAC1B;CAArB,YAAY,OAAwB;EACnC,MACC,UAAU,MAAM,oLAEjB;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,iBAAb,cAAoC,MAAM;CACpB;CAArB,YAAY,OAAwB;EACnC,MACC,yBAAyB,MAAM,kDAAkD,MAAM,QACxF;EAHoB,KAAA,QAAA;EAIpB,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,kBAAb,cAAqC,MAAM;CACrB;CAArB,YAAY,OAAwB;EACnC,MACC,yCAAyC,MAAM,+CAA+C,MAAM,EACrG;EAHoB,KAAA,QAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,eAAe,UACd,SACA,WACA,OAC0B;CAC1B,MAAM,EAAE,sBAAsB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,4BAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,iBAAA;CACpC,MAAM,SAASC,kBAAAA,wBACd,SACA,WACA,MAAM,kBAAkB,WAAW,KAAK,CACzC;CACA,OAAO,SACJ;EAAE,SAAS,OAAO;EAAS,WAAW,OAAO;CAAU,IACvD;EAAE;EAAS,WAAW,CAAC;CAAE;AAC7B;AAEA,SAAS,WAAW,WAAgC,OAAqB;CACxE,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAI,CAAC,cAAc,WAAW,KAAK,GAAG,MAAM,IAAI,qBAAqB,KAAK;AAC3E;;AAGA,eAAsB,iBACrB,WACA,OACA,UAA+B,CAAC,GACN;CAC1B,WAAW,WAAW,KAAK;CAE3B,MAAM,QAAQ,MAAMC,gBAAAA,iBAAiB,OAAO,UAAU,IAAI;CAC1D,IAAI,CAAC,OAAO,MAAM,IAAI,eAAe,KAAK;CAE1C,MAAM,SAAS,MAAM,UAAU,OAAO,WAAW,KAAK;CACtD,IAAI,OAAO,UAAU,QACpB,MAAMC,gBAAAA,kBAAkB,OAAO,SAAS,UAAU,IAAI;CAIvD,OAAM,MADc,gBAAgB,WAAW,OAAO,OAAO,EAAA,CACjD,KAAK,OAAO,OAAO,OAAO;CACtC,OAAO;AACR;;AAGA,eAAsB,iBACrB,WACA,OACA,UAA+B,CAAC,GACN;CAC1B,WAAW,WAAW,KAAK;CAG3B,MAAM,SAAS,OAAM,MADD,gBAAgB,WAAW,OAAO,OAAO,EAAA,CAClC,KAAK,KAAK;CACrC,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,KAAK;CAE5C,MAAM,SAAS,MAAM,UAAU,QAAQ,WAAW,KAAK;CACvD,MAAMA,gBAAAA,kBAAkB,OAAO,SAAS,UAAU,IAAI;CACtD,OAAO;AACR"}