@geekmidas/cli 10.0.0-alpha.2 → 10.0.0-alpha.21

package/dist/reconcile/public.d.cts

@@ -1,8 +1,6 @@
-import { CacheBackend, EmailBackend } from "../types-abJQuk7m.cjs";
+import { n as EmailBackend, t as CacheBackend } from "../types-N7c2O2m7.cjs";
 import { ConstructManifest, Declaration, RouteInfo } from "@geekmidas/manifest";
-
 //#region src/reconcile/discover.d.ts
-
 /** The construct face discovery needs: an id, and the ability to declare. */
 interface Declarable {
   id: string;
@@ -15,7 +13,7 @@ interface Declarable {
  * `service` is still a construct, and requiring one would exclude the kinds that
  * own no address.
  */
-declare function isDeclarable(value: unknown): value is Declarable;
+export declare function isDeclarable(value: unknown): value is Declarable;
 interface DiscoverOptions {
   /** The glob(s) to search. One pattern, not one per kind. */
   patterns: string | readonly string[];
@@ -55,12 +53,11 @@ interface ConstructSource {
  *
  * @throws {DuplicateConstruct} when two exports claim one id.
  */
-declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
-/** Two constructs claiming one id. */
+export declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
 //#endregion
 //#region src/reconcile/emit.d.ts
 /** Where the build writes it, relative to the app root. */
-declare const MANIFEST_PATH = ".gkm/manifest.ts";
+export declare const MANIFEST_PATH = ".gkm/manifest.ts";
 /**
  * Fold the build's generated routes into the surface that serves them.
  *
@@ -89,37 +86,22 @@ declare const MANIFEST_PATH = ".gkm/manifest.ts";
  * document's contents depend on which `--provider` ran last. A manifest must not
  * do that.
  */
-declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
+export declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
   perRoute: boolean;
 }): ConstructManifest;
-/**
- * Fold in the compute the build generated: functions, crons, queue workers and
- * topic subscribers.
- *
- * All four are named by their *export*, the same way an endpoint's handler is —
- * `CronGenerator` uses the export key as the name — so none of them can declare
- * themselves and all of them are the build's to add. That is why a `Function`
- * has no `declare()` and never will.
- *
- * A worker and a subscriber **nest** inside the queue or topic that triggers
- * them, because position carries the trigger. A function and a cron are
- * top-level, because nothing triggers them but a caller or a clock.
- */
-
 /**
  * The manifest as TypeScript source.
  *
  * Pure, so what gets written can be asserted without touching a filesystem.
  */
-declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
+export declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
 /** Write it where the deploy config expects to import it from. */
-declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
+export declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
 /** The choices that are deployment config rather than declaration. */
 interface Backends {
   cache?: CacheBackend;
   email?: EmailBackend;
 }
-//# sourceMappingURL=emit.d.ts.map
 //#endregion
-export { DiscoverOptions, MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };
+export type { DiscoverOptions };
 //# sourceMappingURL=public.d.cts.map

package/dist/reconcile/public.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"sourcesContent":[],"mappings":";;;;;;AAiGU,UAnEA,UAAA,CAmEA;;aAjEE;;ACKZ;AA8BA;;;;;AAIoB;AA2JJ,iBDxLA,YAAA,CCwLc,KAAA,EAAA,OAAA,CAAA,EAAA,KAAA,IDxLyB,UCwLzB;AAAA,UD5Kb,eAAA,CC4Ka;EAAA;EACF,QACjB,EAAA,MAAA,GAAA,SAAA,MAAA,EAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EA8BF;;;;;AAIZ;EAUO,SAAA,CAAA,EAAQ,OAAA;EAAA;;;AAEJ;;;;;;;;YDtMV,eAAe;;;UAIT,eAAA;;;;;;;;;;;;;;iBAeK,QAAA,UACZ,kBACP,QAAQ;;;;AC5DX;AA8BgB,cA9BH,aAAA,GA8Ba,kBAAA;;;;;AAIN;AA2JpB;;;;AAEwB;AA8BxB;;;;;AAIU;AAUV;;;;AAEqB;;;;;;;;iBA/ML,UAAA,WACL,oCACO;;IAEf;;;;;;;;;;;;;;;;;;;;iBA2Ja,cAAA,WACL,8BACA;;iBA8BW,mBAAA,WACX,+CAEA,WACR;;UAUc,QAAA;UACR;UACA"}
+{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"mappings":";;;;UA8BU;EACT;EACA,WAAW;;;;;;;;;wBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;UAIT;;EAEhB;;EAEA;;;;;;;;;;wBAWqB,SACrB,SAAS,kBACP,QAAQ;;;;qBC5DE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8BG,WACf,UAAU,mBACV,iBAAiB,aACjB;EAAW;IACT;;;;;;wBA2Ja,eACf,UAAU,mBACV,WAAU;;wBA8BW,oBACrB,UAAU,mBACV,iBACA,WAAU,WACR;;UAUc;EAChB,QAAQ;EACR,QAAQ"}

package/dist/reconcile/public.d.mts

@@ -1,8 +1,6 @@
-import { CacheBackend, EmailBackend } from "../types-C-arnQ1r.mjs";
+import { n as EmailBackend, t as CacheBackend } from "../types-7R81hu0i.mjs";
 import { ConstructManifest, Declaration, RouteInfo } from "@geekmidas/manifest";
-
 //#region src/reconcile/discover.d.ts
-
 /** The construct face discovery needs: an id, and the ability to declare. */
 interface Declarable {
   id: string;
@@ -15,7 +13,7 @@ interface Declarable {
  * `service` is still a construct, and requiring one would exclude the kinds that
  * own no address.
  */
-declare function isDeclarable(value: unknown): value is Declarable;
+export declare function isDeclarable(value: unknown): value is Declarable;
 interface DiscoverOptions {
   /** The glob(s) to search. One pattern, not one per kind. */
   patterns: string | readonly string[];
@@ -55,12 +53,11 @@ interface ConstructSource {
  *
  * @throws {DuplicateConstruct} when two exports claim one id.
  */
-declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
-/** Two constructs claiming one id. */
+export declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
 //#endregion
 //#region src/reconcile/emit.d.ts
 /** Where the build writes it, relative to the app root. */
-declare const MANIFEST_PATH = ".gkm/manifest.ts";
+export declare const MANIFEST_PATH = ".gkm/manifest.ts";
 /**
  * Fold the build's generated routes into the surface that serves them.
  *
@@ -89,37 +86,22 @@ declare const MANIFEST_PATH = ".gkm/manifest.ts";
  * document's contents depend on which `--provider` ran last. A manifest must not
  * do that.
  */
-declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
+export declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
   perRoute: boolean;
 }): ConstructManifest;
-/**
- * Fold in the compute the build generated: functions, crons, queue workers and
- * topic subscribers.
- *
- * All four are named by their *export*, the same way an endpoint's handler is —
- * `CronGenerator` uses the export key as the name — so none of them can declare
- * themselves and all of them are the build's to add. That is why a `Function`
- * has no `declare()` and never will.
- *
- * A worker and a subscriber **nest** inside the queue or topic that triggers
- * them, because position carries the trigger. A function and a cron are
- * top-level, because nothing triggers them but a caller or a clock.
- */
-
 /**
  * The manifest as TypeScript source.
  *
  * Pure, so what gets written can be asserted without touching a filesystem.
  */
-declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
+export declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
 /** Write it where the deploy config expects to import it from. */
-declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
+export declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
 /** The choices that are deployment config rather than declaration. */
 interface Backends {
   cache?: CacheBackend;
   email?: EmailBackend;
 }
-//# sourceMappingURL=emit.d.ts.map
 //#endregion
-export { DiscoverOptions, MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };
+export type { DiscoverOptions };
 //# sourceMappingURL=public.d.mts.map

package/dist/reconcile/public.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"sourcesContent":[],"mappings":";;;;;;AAiGU,UAnEA,UAAA,CAmEA;;aAjEE;;ACKZ;AA8BA;;;;;AAIoB;AA2JJ,iBDxLA,YAAA,CCwLc,KAAA,EAAA,OAAA,CAAA,EAAA,KAAA,IDxLyB,UCwLzB;AAAA,UD5Kb,eAAA,CC4Ka;EAAA;EACF,QACjB,EAAA,MAAA,GAAA,SAAA,MAAA,EAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EA8BF;;;;;AAIZ;EAUO,SAAA,CAAA,EAAQ,OAAA;EAAA;;;AAEJ;;;;;;;;YDtMV,eAAe;;;UAIT,eAAA;;;;;;;;;;;;;;iBAeK,QAAA,UACZ,kBACP,QAAQ;;;;AC5DX;AA8BgB,cA9BH,aAAA,GA8Ba,kBAAA;;;;;AAIN;AA2JpB;;;;AAEwB;AA8BxB;;;;;AAIU;AAUV;;;;AAEqB;;;;;;;;iBA/ML,UAAA,WACL,oCACO;;IAEf;;;;;;;;;;;;;;;;;;;;iBA2Ja,cAAA,WACL,8BACA;;iBA8BW,mBAAA,WACX,+CAEA,WACR;;UAUc,QAAA;UACR;UACA"}
+{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"mappings":";;;;UA8BU;EACT;EACA,WAAW;;;;;;;;;wBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;UAIT;;EAEhB;;EAEA;;;;;;;;;;wBAWqB,SACrB,SAAS,kBACP,QAAQ;;;;qBC5DE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8BG,WACf,UAAU,mBACV,iBAAiB,aACjB;EAAW;IACT;;;;;;wBA2Ja,eACf,UAAU,mBACV,WAAU;;wBA8BW,oBACrB,UAAU,mBACV,iBACA,WAAU,WACR;;UAUc;EAChB,QAAQ;EACR,QAAQ"}

package/dist/reconcile/public.mjs

@@ -1,4 +1,3 @@
-import { discover, isDeclarable } from "../discover-CAlFgYec.mjs";
-import { MANIFEST_PATH, manifestModule, withRoutes, writeManifestModule } from "../emit-CiZS_5Ub.mjs";
-
-export { MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };
+import { n as isDeclarable, t as discover } from "../discover-CK-n3w6b.mjs";
+import { a as writeManifestModule, i as withRoutes, n as manifestModule, t as MANIFEST_PATH } from "../emit-Bzq7JsMP.mjs";
+export { MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };

package/dist/{fullstack-secrets-D1o9-G5l.mjs → reconcile-gb1lz1Dk.mjs}

@@ -1,7 +1,7 @@
-import { generateSecurePassword } from "./generator-VE2JrFlY.mjs";
-import { dirname, join } from "node:path";
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { i as generateSecurePassword } from "./generator-LfZU7NlU.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
-
+import { dirname, join } from "node:path";
 //#region src/setup/fullstack-secrets.ts
 /**
 * Generate a secure random password for database users.
@@ -15,22 +15,20 @@ function generateDbPassword() {
 * All apps connect to the same database, but use different users/schemas.
 */
 function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
-	const userName = appName.replace(/-/g, "_");
-	const dbName = `${projectName.replace(/-/g, "_")}_dev`;
-	return `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;
+	return `postgresql://${appName.replace(/-/g, "_")}:${password}@${host}:${port}/${`${projectName.replace(/-/g, "_")}_dev`}`;
 }
 /**
 * Generate fullstack-aware custom secrets for a workspace.
 *
 * Generates:
-* - Common secrets: NODE_ENV, PORT, LOG_LEVEL, JWT_SECRET
+* - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command
+*   decides that; see `gkm init`)
 * - Per-app database passwords and URLs for backend apps with db service
 * - Better-auth secrets for apps using the better-auth framework
 */
 function generateFullstackCustomSecrets(workspace, containers = []) {
 	const hasDb = containers.includes("postgres");
 	const customs = {
-		NODE_ENV: "development",
 		PORT: "3000",
 		LOG_LEVEL: "debug",
 		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -40,8 +38,8 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
 		if (appConfig.type === "web") {
 			frontendPorts.push(appConfig.port);
-			const upperName$1 = appName.toUpperCase();
-			customs[`${upperName$1}_URL`] = `http://localhost:${appConfig.port}`;
+			const upperName = appName.toUpperCase();
+			customs[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;
 			continue;
 		}
 		if (appConfig.type === "mobile") continue;
@@ -56,10 +54,7 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
 		}
 	}
-	if (customs.BETTER_AUTH_SECRET) {
-		const allPorts = Object.values(workspace.apps).map((a) => a.port);
-		customs.BETTER_AUTH_TRUSTED_ORIGINS = allPorts.map((p) => `http://localhost:${p}`).join(",");
-	}
+	if (customs.BETTER_AUTH_SECRET) customs.BETTER_AUTH_TRUSTED_ORIGINS = Object.values(workspace.apps).map((a) => a.port).map((p) => `http://localhost:${p}`).join(",");
 	return customs;
 }
 /**
@@ -81,7 +76,38 @@ ${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
 	await mkdir(dirname(envPath), { recursive: true });
 	await writeFile(envPath, envContent);
 }
-
 //#endregion
-export { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets, writeDockerEnvFromSecrets };
-//# sourceMappingURL=fullstack-secrets-D1o9-G5l.mjs.map
+//#region src/secrets/reconcile.ts
+var reconcile_exports = /* @__PURE__ */ __exportAll({ reconcileMissingSecrets: () => reconcileMissingSecrets });
+/**
+* Reconcile missing custom secrets for a workspace.
+*
+* Compares current secrets against what generateFullstackCustomSecrets()
+* would produce and backfills any missing keys without overwriting
+* existing values.
+*
+* @returns ReconcileResult if keys were added, null if secrets are up-to-date
+*/
+function reconcileMissingSecrets(secrets, workspace, containers = []) {
+	if (!(Object.keys(workspace.apps).length > 1)) return null;
+	const expectedCustom = generateFullstackCustomSecrets(workspace, containers);
+	const addedKeys = [];
+	const mergedCustom = { ...secrets.custom };
+	for (const [key, value] of Object.entries(expectedCustom)) if (!(key in mergedCustom)) {
+		mergedCustom[key] = value;
+		addedKeys.push(key);
+	}
+	if (addedKeys.length === 0) return null;
+	return {
+		secrets: {
+			...secrets,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			custom: mergedCustom
+		},
+		addedKeys
+	};
+}
+//#endregion
+export { writeDockerEnvFromSecrets as i, reconcile_exports as n, generateFullstackCustomSecrets as r, reconcileMissingSecrets as t };
+
+//# sourceMappingURL=reconcile-gb1lz1Dk.mjs.map

package/dist/reconcile-gb1lz1Dk.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-gb1lz1Dk.mjs","names":[],"sources":["../src/setup/fullstack-secrets.ts","../src/secrets/reconcile.ts"],"sourcesContent":["import { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { generateSecurePassword } from '../secrets/generator.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\n/**\n * Generate a secure random password for database users.\n * Uses a combination of timestamp and random bytes for uniqueness.\n */\nexport function generateDbPassword(): string {\n\treturn `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;\n}\n\n/**\n * Generate database URL for an app.\n * All apps connect to the same database, but use different users/schemas.\n */\nexport function generateDbUrl(\n\tappName: string,\n\tpassword: string,\n\tprojectName: string,\n\thost = 'localhost',\n\tport = 5432,\n): string {\n\tconst userName = appName.replace(/-/g, '_');\n\tconst dbName = `${projectName.replace(/-/g, '_')}_dev`;\n\treturn `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;\n}\n\n/**\n * Generate fullstack-aware custom secrets for a workspace.\n *\n * Generates:\n * - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command\n *   decides that; see `gkm init`)\n * - Per-app database passwords and URLs for backend apps with db service\n * - Better-auth secrets for apps using the better-auth framework\n */\nexport function generateFullstackCustomSecrets(\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): Record<string, string> {\n\t// A Postgres exists because something declared a database, not because\n\t// config carried a flag saying so.\n\tconst hasDb = containers.includes('postgres');\n\tconst customs: Record<string, string> = {\n\t\tPORT: '3000',\n\t\tLOG_LEVEL: 'debug',\n\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t};\n\n\tif (!hasDb) {\n\t\treturn customs;\n\t}\n\n\t// Collect all frontend ports for trusted origins\n\tconst frontendPorts: number[] = [];\n\n\tfor (const [appName, appConfig] of Object.entries(workspace.apps)) {\n\t\tif (appConfig.type === 'web') {\n\t\t\tfrontendPorts.push(appConfig.port);\n\t\t\tconst upperName = appName.toUpperCase();\n\t\t\tcustoms[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Mobile apps (Expo, etc.) don't run on a host port the backend\n\t\t// cares about for CORS, and don't need DB credentials.\n\t\tif (appConfig.type === 'mobile') {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Backend apps with database: generate per-app DB passwords and URLs\n\t\tconst password = generateDbPassword();\n\t\tconst upperName = appName.toUpperCase();\n\n\t\tcustoms[`${upperName}_DATABASE_URL`] = generateDbUrl(\n\t\t\tappName,\n\t\t\tpassword,\n\t\t\tworkspace.name,\n\t\t);\n\t\tcustoms[`${upperName}_DB_PASSWORD`] = password;\n\n\t\t// Better-auth framework secrets\n\t\tif (appConfig.framework === 'better-auth') {\n\t\t\tcustoms.AUTH_PORT = String(appConfig.port);\n\t\t\tcustoms.AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t\tcustoms.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;\n\t\t\tcustoms.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t}\n\t}\n\n\t// Generate trusted origins for better-auth (all app ports)\n\tif (customs.BETTER_AUTH_SECRET) {\n\t\tconst allPorts = Object.values(workspace.apps).map((a) => a.port);\n\t\tcustoms.BETTER_AUTH_TRUSTED_ORIGINS = allPorts\n\t\t\t.map((p) => `http://localhost:${p}`)\n\t\t\t.join(',');\n\t}\n\n\treturn customs;\n}\n\n/**\n * Extract *_DB_PASSWORD keys from secrets and write docker/.env.\n *\n * The docker/.env file contains database passwords that the PostgreSQL\n * init script reads to create per-app database users.\n */\nexport async function writeDockerEnvFromSecrets(\n\tsecrets: StageSecrets,\n\tworkspaceRoot: string,\n): Promise<void> {\n\tconst dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) =>\n\t\tkey.endsWith('_DB_PASSWORD'),\n\t);\n\n\t// Always include pgboss password when pgboss credentials exist\n\tif (\n\t\tsecrets.services.pgboss &&\n\t\t!dbPasswordEntries.some(([key]) => key === 'PGBOSS_DB_PASSWORD')\n\t) {\n\t\tdbPasswordEntries.push([\n\t\t\t'PGBOSS_DB_PASSWORD',\n\t\t\tsecrets.services.pgboss.password,\n\t\t]);\n\t}\n\n\tif (dbPasswordEntries.length === 0) {\n\t\treturn;\n\t}\n\n\tconst envContent = `# Auto-generated docker environment file\n# Contains database passwords for docker-compose postgres init\n# This file is gitignored - do not commit to version control\n${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join('\\n')}\n`;\n\n\tconst envPath = join(workspaceRoot, 'docker', '.env');\n\tawait mkdir(dirname(envPath), { recursive: true });\n\tawait writeFile(envPath, envContent);\n}\n","import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace, containers);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;AAUA,SAAgB,qBAA6B;CAC5C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;AAC7G;;;;;AAMA,SAAgB,cACf,SACA,UACA,aACA,OAAO,aACP,OAAO,MACE;CAGT,OAAO,gBAFU,QAAQ,QAAQ,MAAM,GAET,EAAE,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,GAD7C,YAAY,QAAQ,MAAM,GAAG,EAAE;AAElD;;;;;;;;;;AAWA,SAAgB,+BACf,WACA,aAAgC,CAAC,GACR;CAGzB,MAAM,QAAQ,WAAW,SAAS,UAAU;CAC5C,MAAM,UAAkC;EACvC,MAAM;EACN,WAAW;EACX,YAAY,OAAO,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;CACpE;CAEA,IAAI,CAAC,OACJ,OAAO;CAIR,MAAM,gBAA0B,CAAC;CAEjC,KAAK,MAAM,CAAC,SAAS,cAAc,OAAO,QAAQ,UAAU,IAAI,GAAG;EAClE,IAAI,UAAU,SAAS,OAAO;GAC7B,cAAc,KAAK,UAAU,IAAI;GACjC,MAAM,YAAY,QAAQ,YAAY;GACtC,QAAQ,GAAG,UAAU,SAAS,oBAAoB,UAAU;GAC5D;EACD;EAIA,IAAI,UAAU,SAAS,UACtB;EAID,MAAM,WAAW,mBAAmB;EACpC,MAAM,YAAY,QAAQ,YAAY;EAEtC,QAAQ,GAAG,UAAU,kBAAkB,cACtC,SACA,UACA,UAAU,IACX;EACA,QAAQ,GAAG,UAAU,iBAAiB;EAGtC,IAAI,UAAU,cAAc,eAAe;GAC1C,QAAQ,YAAY,OAAO,UAAU,IAAI;GACzC,QAAQ,WAAW,oBAAoB,UAAU;GACjD,QAAQ,qBAAqB,eAAe,KAAK,IAAI,EAAE,GAAG,uBAAuB,EAAE;GACnF,QAAQ,kBAAkB,oBAAoB,UAAU;EACzD;CACD;CAGA,IAAI,QAAQ,oBAEX,QAAQ,8BADS,OAAO,OAAO,UAAU,IAAI,CAAC,CAAC,KAAK,MAAM,EAAE,IACf,CAAC,CAC5C,KAAK,MAAM,oBAAoB,GAAG,CAAC,CACnC,KAAK,GAAG;CAGX,OAAO;AACR;;;;;;;AAQA,eAAsB,0BACrB,SACA,eACgB;CAChB,MAAM,oBAAoB,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,QAAQ,CAAC,SACjE,IAAI,SAAS,cAAc,CAC5B;CAGA,IACC,QAAQ,SAAS,UACjB,CAAC,kBAAkB,MAAM,CAAC,SAAS,QAAQ,oBAAoB,GAE/D,kBAAkB,KAAK,CACtB,sBACA,QAAQ,SAAS,OAAO,QACzB,CAAC;CAGF,IAAI,kBAAkB,WAAW,GAChC;CAGD,MAAM,aAAa;;;EAGlB,kBAAkB,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE;;CAGvE,MAAM,UAAU,KAAK,eAAe,UAAU,MAAM;CACpD,MAAM,MAAM,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;CACjD,MAAM,UAAU,SAAS,UAAU;AACpC;;;;;;;;;;;;;AC1HA,SAAgB,wBACf,SACA,WACA,aAAgC,CAAC,GACR;CAEzB,IAAI,EADe,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAEvD,OAAO;CAGR,MAAM,iBAAiB,+BAA+B,WAAW,UAAU;CAC3E,MAAM,YAAsB,CAAC;CAC7B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAO;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,GACvD,IAAI,EAAE,OAAO,eAAe;EAC3B,aAAa,OAAO;EACpB,UAAU,KAAK,GAAG;CACnB;CAGD,IAAI,UAAU,WAAW,GACxB,OAAO;CAGR,OAAO;EACN,SAAS;GACR,GAAG;GACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,QAAQ;EACT;EACA;CACD;AACD"}

package/dist/{fullstack-secrets-C-GGohke.cjs → reconcile-hx_vBvux.cjs}

@@ -1,8 +1,7 @@
-const require_chunk = require('./chunk-CUT6urMc.cjs');
-const require_generator = require('./generator-CNzBw7g5.cjs');
-const node_path = require_chunk.__toESM(require("node:path"));
-const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
-
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_generator = require("./generator-Wdfp0jCS.cjs");
+let node_fs_promises = require("node:fs/promises");
+let node_path = require("node:path");
 //#region src/setup/fullstack-secrets.ts
 /**
 * Generate a secure random password for database users.
@@ -16,22 +15,20 @@ function generateDbPassword() {
 * All apps connect to the same database, but use different users/schemas.
 */
 function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
-	const userName = appName.replace(/-/g, "_");
-	const dbName = `${projectName.replace(/-/g, "_")}_dev`;
-	return `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;
+	return `postgresql://${appName.replace(/-/g, "_")}:${password}@${host}:${port}/${`${projectName.replace(/-/g, "_")}_dev`}`;
 }
 /**
 * Generate fullstack-aware custom secrets for a workspace.
 *
 * Generates:
-* - Common secrets: NODE_ENV, PORT, LOG_LEVEL, JWT_SECRET
+* - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command
+*   decides that; see `gkm init`)
 * - Per-app database passwords and URLs for backend apps with db service
 * - Better-auth secrets for apps using the better-auth framework
 */
 function generateFullstackCustomSecrets(workspace, containers = []) {
 	const hasDb = containers.includes("postgres");
 	const customs = {
-		NODE_ENV: "development",
 		PORT: "3000",
 		LOG_LEVEL: "debug",
 		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -41,8 +38,8 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
 		if (appConfig.type === "web") {
 			frontendPorts.push(appConfig.port);
-			const upperName$1 = appName.toUpperCase();
-			customs[`${upperName$1}_URL`] = `http://localhost:${appConfig.port}`;
+			const upperName = appName.toUpperCase();
+			customs[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;
 			continue;
 		}
 		if (appConfig.type === "mobile") continue;
@@ -57,10 +54,7 @@ function generateFullstackCustomSecrets(workspace, containers = []) {
 			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
 		}
 	}
-	if (customs.BETTER_AUTH_SECRET) {
-		const allPorts = Object.values(workspace.apps).map((a) => a.port);
-		customs.BETTER_AUTH_TRUSTED_ORIGINS = allPorts.map((p) => `http://localhost:${p}`).join(",");
-	}
+	if (customs.BETTER_AUTH_SECRET) customs.BETTER_AUTH_TRUSTED_ORIGINS = Object.values(workspace.apps).map((a) => a.port).map((p) => `http://localhost:${p}`).join(",");
 	return customs;
 }
 /**
@@ -82,30 +76,61 @@ ${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
 	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(envPath), { recursive: true });
 	await (0, node_fs_promises.writeFile)(envPath, envContent);
 }
-
 //#endregion
-Object.defineProperty(exports, 'generateDbPassword', {
-  enumerable: true,
-  get: function () {
-    return generateDbPassword;
-  }
+//#region src/secrets/reconcile.ts
+var reconcile_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ reconcileMissingSecrets: () => reconcileMissingSecrets });
+/**
+* Reconcile missing custom secrets for a workspace.
+*
+* Compares current secrets against what generateFullstackCustomSecrets()
+* would produce and backfills any missing keys without overwriting
+* existing values.
+*
+* @returns ReconcileResult if keys were added, null if secrets are up-to-date
+*/
+function reconcileMissingSecrets(secrets, workspace, containers = []) {
+	if (!(Object.keys(workspace.apps).length > 1)) return null;
+	const expectedCustom = generateFullstackCustomSecrets(workspace, containers);
+	const addedKeys = [];
+	const mergedCustom = { ...secrets.custom };
+	for (const [key, value] of Object.entries(expectedCustom)) if (!(key in mergedCustom)) {
+		mergedCustom[key] = value;
+		addedKeys.push(key);
+	}
+	if (addedKeys.length === 0) return null;
+	return {
+		secrets: {
+			...secrets,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			custom: mergedCustom
+		},
+		addedKeys
+	};
+}
+//#endregion
+Object.defineProperty(exports, "generateFullstackCustomSecrets", {
+	enumerable: true,
+	get: function() {
+		return generateFullstackCustomSecrets;
+	}
 });
-Object.defineProperty(exports, 'generateDbUrl', {
-  enumerable: true,
-  get: function () {
-    return generateDbUrl;
-  }
+Object.defineProperty(exports, "reconcileMissingSecrets", {
+	enumerable: true,
+	get: function() {
+		return reconcileMissingSecrets;
+	}
 });
-Object.defineProperty(exports, 'generateFullstackCustomSecrets', {
-  enumerable: true,
-  get: function () {
-    return generateFullstackCustomSecrets;
-  }
+Object.defineProperty(exports, "reconcile_exports", {
+	enumerable: true,
+	get: function() {
+		return reconcile_exports;
+	}
 });
-Object.defineProperty(exports, 'writeDockerEnvFromSecrets', {
-  enumerable: true,
-  get: function () {
-    return writeDockerEnvFromSecrets;
-  }
+Object.defineProperty(exports, "writeDockerEnvFromSecrets", {
+	enumerable: true,
+	get: function() {
+		return writeDockerEnvFromSecrets;
+	}
 });
-//# sourceMappingURL=fullstack-secrets-C-GGohke.cjs.map
+
+//# sourceMappingURL=reconcile-hx_vBvux.cjs.map

package/dist/reconcile-hx_vBvux.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-hx_vBvux.cjs","names":["generateSecurePassword","join","mkdir","dirname","writeFile"],"sources":["../src/setup/fullstack-secrets.ts","../src/secrets/reconcile.ts"],"sourcesContent":["import { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { generateSecurePassword } from '../secrets/generator.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\n/**\n * Generate a secure random password for database users.\n * Uses a combination of timestamp and random bytes for uniqueness.\n */\nexport function generateDbPassword(): string {\n\treturn `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;\n}\n\n/**\n * Generate database URL for an app.\n * All apps connect to the same database, but use different users/schemas.\n */\nexport function generateDbUrl(\n\tappName: string,\n\tpassword: string,\n\tprojectName: string,\n\thost = 'localhost',\n\tport = 5432,\n): string {\n\tconst userName = appName.replace(/-/g, '_');\n\tconst dbName = `${projectName.replace(/-/g, '_')}_dev`;\n\treturn `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;\n}\n\n/**\n * Generate fullstack-aware custom secrets for a workspace.\n *\n * Generates:\n * - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command\n *   decides that; see `gkm init`)\n * - Per-app database passwords and URLs for backend apps with db service\n * - Better-auth secrets for apps using the better-auth framework\n */\nexport function generateFullstackCustomSecrets(\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): Record<string, string> {\n\t// A Postgres exists because something declared a database, not because\n\t// config carried a flag saying so.\n\tconst hasDb = containers.includes('postgres');\n\tconst customs: Record<string, string> = {\n\t\tPORT: '3000',\n\t\tLOG_LEVEL: 'debug',\n\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t};\n\n\tif (!hasDb) {\n\t\treturn customs;\n\t}\n\n\t// Collect all frontend ports for trusted origins\n\tconst frontendPorts: number[] = [];\n\n\tfor (const [appName, appConfig] of Object.entries(workspace.apps)) {\n\t\tif (appConfig.type === 'web') {\n\t\t\tfrontendPorts.push(appConfig.port);\n\t\t\tconst upperName = appName.toUpperCase();\n\t\t\tcustoms[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Mobile apps (Expo, etc.) don't run on a host port the backend\n\t\t// cares about for CORS, and don't need DB credentials.\n\t\tif (appConfig.type === 'mobile') {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Backend apps with database: generate per-app DB passwords and URLs\n\t\tconst password = generateDbPassword();\n\t\tconst upperName = appName.toUpperCase();\n\n\t\tcustoms[`${upperName}_DATABASE_URL`] = generateDbUrl(\n\t\t\tappName,\n\t\t\tpassword,\n\t\t\tworkspace.name,\n\t\t);\n\t\tcustoms[`${upperName}_DB_PASSWORD`] = password;\n\n\t\t// Better-auth framework secrets\n\t\tif (appConfig.framework === 'better-auth') {\n\t\t\tcustoms.AUTH_PORT = String(appConfig.port);\n\t\t\tcustoms.AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t\tcustoms.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;\n\t\t\tcustoms.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t}\n\t}\n\n\t// Generate trusted origins for better-auth (all app ports)\n\tif (customs.BETTER_AUTH_SECRET) {\n\t\tconst allPorts = Object.values(workspace.apps).map((a) => a.port);\n\t\tcustoms.BETTER_AUTH_TRUSTED_ORIGINS = allPorts\n\t\t\t.map((p) => `http://localhost:${p}`)\n\t\t\t.join(',');\n\t}\n\n\treturn customs;\n}\n\n/**\n * Extract *_DB_PASSWORD keys from secrets and write docker/.env.\n *\n * The docker/.env file contains database passwords that the PostgreSQL\n * init script reads to create per-app database users.\n */\nexport async function writeDockerEnvFromSecrets(\n\tsecrets: StageSecrets,\n\tworkspaceRoot: string,\n): Promise<void> {\n\tconst dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) =>\n\t\tkey.endsWith('_DB_PASSWORD'),\n\t);\n\n\t// Always include pgboss password when pgboss credentials exist\n\tif (\n\t\tsecrets.services.pgboss &&\n\t\t!dbPasswordEntries.some(([key]) => key === 'PGBOSS_DB_PASSWORD')\n\t) {\n\t\tdbPasswordEntries.push([\n\t\t\t'PGBOSS_DB_PASSWORD',\n\t\t\tsecrets.services.pgboss.password,\n\t\t]);\n\t}\n\n\tif (dbPasswordEntries.length === 0) {\n\t\treturn;\n\t}\n\n\tconst envContent = `# Auto-generated docker environment file\n# Contains database passwords for docker-compose postgres init\n# This file is gitignored - do not commit to version control\n${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join('\\n')}\n`;\n\n\tconst envPath = join(workspaceRoot, 'docker', '.env');\n\tawait mkdir(dirname(envPath), { recursive: true });\n\tawait writeFile(envPath, envContent);\n}\n","import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace, containers);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;AAUA,SAAgB,qBAA6B;CAC5C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;AAC7G;;;;;AAMA,SAAgB,cACf,SACA,UACA,aACA,OAAO,aACP,OAAO,MACE;CAGT,OAAO,gBAFU,QAAQ,QAAQ,MAAM,GAET,EAAE,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,GAD7C,YAAY,QAAQ,MAAM,GAAG,EAAE;AAElD;;;;;;;;;;AAWA,SAAgB,+BACf,WACA,aAAgC,CAAC,GACR;CAGzB,MAAM,QAAQ,WAAW,SAAS,UAAU;CAC5C,MAAM,UAAkC;EACvC,MAAM;EACN,WAAW;EACX,YAAY,OAAO,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;CACpE;CAEA,IAAI,CAAC,OACJ,OAAO;CAIR,MAAM,gBAA0B,CAAC;CAEjC,KAAK,MAAM,CAAC,SAAS,cAAc,OAAO,QAAQ,UAAU,IAAI,GAAG;EAClE,IAAI,UAAU,SAAS,OAAO;GAC7B,cAAc,KAAK,UAAU,IAAI;GACjC,MAAM,YAAY,QAAQ,YAAY;GACtC,QAAQ,GAAG,UAAU,SAAS,oBAAoB,UAAU;GAC5D;EACD;EAIA,IAAI,UAAU,SAAS,UACtB;EAID,MAAM,WAAW,mBAAmB;EACpC,MAAM,YAAY,QAAQ,YAAY;EAEtC,QAAQ,GAAG,UAAU,kBAAkB,cACtC,SACA,UACA,UAAU,IACX;EACA,QAAQ,GAAG,UAAU,iBAAiB;EAGtC,IAAI,UAAU,cAAc,eAAe;GAC1C,QAAQ,YAAY,OAAO,UAAU,IAAI;GACzC,QAAQ,WAAW,oBAAoB,UAAU;GACjD,QAAQ,qBAAqB,eAAe,KAAK,IAAI,EAAE,GAAGA,kBAAAA,uBAAuB,EAAE;GACnF,QAAQ,kBAAkB,oBAAoB,UAAU;EACzD;CACD;CAGA,IAAI,QAAQ,oBAEX,QAAQ,8BADS,OAAO,OAAO,UAAU,IAAI,CAAC,CAAC,KAAK,MAAM,EAAE,IACf,CAAC,CAC5C,KAAK,MAAM,oBAAoB,GAAG,CAAC,CACnC,KAAK,GAAG;CAGX,OAAO;AACR;;;;;;;AAQA,eAAsB,0BACrB,SACA,eACgB;CAChB,MAAM,oBAAoB,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,QAAQ,CAAC,SACjE,IAAI,SAAS,cAAc,CAC5B;CAGA,IACC,QAAQ,SAAS,UACjB,CAAC,kBAAkB,MAAM,CAAC,SAAS,QAAQ,oBAAoB,GAE/D,kBAAkB,KAAK,CACtB,sBACA,QAAQ,SAAS,OAAO,QACzB,CAAC;CAGF,IAAI,kBAAkB,WAAW,GAChC;CAGD,MAAM,aAAa;;;EAGlB,kBAAkB,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE;;CAGvE,MAAM,WAAA,GAAUC,UAAAA,KAAAA,CAAK,eAAe,UAAU,MAAM;CACpD,OAAA,GAAMC,iBAAAA,MAAAA,EAAAA,GAAMC,UAAAA,QAAAA,CAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;CACjD,OAAA,GAAMC,iBAAAA,UAAAA,CAAU,SAAS,UAAU;AACpC;;;;;;;;;;;;;AC1HA,SAAgB,wBACf,SACA,WACA,aAAgC,CAAC,GACR;CAEzB,IAAI,EADe,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAEvD,OAAO;CAGR,MAAM,iBAAiB,+BAA+B,WAAW,UAAU;CAC3E,MAAM,YAAsB,CAAC;CAC7B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAO;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,GACvD,IAAI,EAAE,OAAO,eAAe;EAC3B,aAAa,OAAO;EACpB,UAAU,KAAK,GAAG;CACnB;CAGD,IAAI,UAAU,WAAW,GACxB,OAAO;CAGR,OAAO;EACN,SAAS;GACR,GAAG;GACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,QAAQ;EACT;EACA;CACD;AACD"}

package/dist/rolldown-runtime-BhDjJH2R.mjs

@@ -0,0 +1,15 @@
+import { createRequire } from "node:module";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
+//#endregion
+export { __require as n, __exportAll as t };

package/dist/{chunk-CUT6urMc.cjs → rolldown-runtime-C0BPl7ul.cjs}

@@ -1,10 +1,19 @@
-//#region rolldown:runtime
+//#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -15,16 +24,20 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
-
 //#endregion
-
-Object.defineProperty(exports, '__toESM', {
-  enumerable: true,
-  get: function () {
-    return __toESM;
-  }
-});
+Object.defineProperty(exports, "__exportAll", {
+	enumerable: true,
+	get: function() {
+		return __exportAll;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});

package/dist/ssm-BKN1Cg4z.mjs

@@ -0,0 +1,60 @@
+import { GetParameterCommand, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
+//#region src/secrets/ssm.ts
+/**
+* A stage's secrets in SSM Parameter Store, in the stage's own AWS account.
+*
+* One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —
+* encrypted at rest by KMS, so nothing about it needs a key file anywhere.
+* Which account it is in is whichever credentials are active: the stage's
+* OIDC role in a deploy job, or `--profile` on a developer's machine. With
+* staging and production in different accounts, each stage's secrets sit
+* beside its infrastructure, and a staging role cannot read production's.
+*/
+/** The parameter a stage's secrets are kept in. */
+function secretsParameterName(project, stage) {
+	return `/gkm/${project}/${stage}/secrets`;
+}
+var SsmSecretsStore = class {
+	options;
+	client;
+	constructor(options) {
+		this.options = options;
+	}
+	async ssm() {
+		if (this.client) return this.client;
+		const config = { region: this.options.region };
+		if (this.options.profile) {
+			const { fromIni } = await import("@aws-sdk/credential-providers");
+			config.credentials = fromIni({ profile: this.options.profile });
+		}
+		if (this.options.endpoint) config.endpoint = this.options.endpoint;
+		this.client = new SSMClient(config);
+		return this.client;
+	}
+	async pull(stage) {
+		const ssm = await this.ssm();
+		try {
+			const { Parameter } = await ssm.send(new GetParameterCommand({
+				Name: secretsParameterName(this.options.project, stage),
+				WithDecryption: true
+			}));
+			return Parameter?.Value ? JSON.parse(Parameter.Value) : null;
+		} catch (error) {
+			if (error instanceof ParameterNotFound) return null;
+			throw error;
+		}
+	}
+	async push(stage, secrets) {
+		await (await this.ssm()).send(new PutParameterCommand({
+			Name: secretsParameterName(this.options.project, stage),
+			Value: JSON.stringify(secrets),
+			Type: "SecureString",
+			Overwrite: true,
+			Description: `gkm secrets for ${this.options.project}/${stage}`
+		}));
+	}
+};
+//#endregion
+export { SsmSecretsStore };
+
+//# sourceMappingURL=ssm-BKN1Cg4z.mjs.map

package/dist/ssm-BKN1Cg4z.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssm-BKN1Cg4z.mjs","names":[],"sources":["../src/secrets/ssm.ts"],"sourcesContent":["/**\n * A stage's secrets in SSM Parameter Store, in the stage's own AWS account.\n *\n * One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —\n * encrypted at rest by KMS, so nothing about it needs a key file anywhere.\n * Which account it is in is whichever credentials are active: the stage's\n * OIDC role in a deploy job, or `--profile` on a developer's machine. With\n * staging and production in different accounts, each stage's secrets sit\n * beside its infrastructure, and a staging role cannot read production's.\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SsmSecretsStoreOptions {\n\t/** The workspace name, which scopes the parameter path. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The parameter a stage's secrets are kept in. */\nexport function secretsParameterName(project: string, stage: string): string {\n\treturn `/gkm/${project}/${stage}/secrets`;\n}\n\nexport class SsmSecretsStore implements SecretsStore {\n\tprivate client?: SSMClient;\n\n\tconstructor(private readonly options: SsmSecretsStoreOptions) {}\n\n\tprivate async ssm(): Promise<SSMClient> {\n\t\tif (this.client) return this.client;\n\n\t\tconst config: SSMClientConfig = { region: this.options.region };\n\t\tif (this.options.profile) {\n\t\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: this.options.profile });\n\t\t}\n\t\tif (this.options.endpoint) {\n\t\t\tconfig.endpoint = this.options.endpoint;\n\t\t}\n\n\t\tthis.client = new SSMClient(config);\n\t\treturn this.client;\n\t}\n\n\tasync pull(stage: string): Promise<StageSecrets | null> {\n\t\tconst ssm = await this.ssm();\n\n\t\ttry {\n\t\t\tconst { Parameter } = await ssm.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn Parameter?.Value\n\t\t\t\t? (JSON.parse(Parameter.Value) as StageSecrets)\n\t\t\t\t: null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync push(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst ssm = await this.ssm();\n\n\t\tawait ssm.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\tValue: JSON.stringify(secrets),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAgB,qBAAqB,SAAiB,OAAuB;CAC5E,OAAO,QAAQ,QAAQ,GAAG,MAAM;AACjC;AAEA,IAAa,kBAAb,MAAqD;CAGvB;CAF7B;CAEA,YAAY,SAAkD;EAAjC,KAAA,UAAA;CAAkC;CAE/D,MAAc,MAA0B;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK;EAE7B,MAAM,SAA0B,EAAE,QAAQ,KAAK,QAAQ,OAAO;EAC9D,IAAI,KAAK,QAAQ,SAAS;GACzB,MAAM,EAAE,YAAY,MAAM,OAAO;GACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,KAAK,QAAQ,QAAQ,CAAC;EAC/D;EACA,IAAI,KAAK,QAAQ,UAChB,OAAO,WAAW,KAAK,QAAQ;EAGhC,KAAK,SAAS,IAAI,UAAU,MAAM;EAClC,OAAO,KAAK;CACb;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,MAAM,MAAM,KAAK,IAAI;EAE3B,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,IAAI,KAC/B,IAAI,oBAAoB;IACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;IACtD,gBAAgB;GACjB,CAAC,CACF;GACA,OAAO,WAAW,QACd,KAAK,MAAM,UAAU,KAAK,IAC3B;EACJ,SAAS,OAAO;GACf,IAAI,iBAAiB,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;CAEA,MAAM,KAAK,OAAe,SAAsC;EAG/D,OAAM,MAFY,KAAK,IAAI,EAAA,CAEjB,KACT,IAAI,oBAAoB;GACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;GACtD,OAAO,KAAK,UAAU,OAAO;GAC7B,MAAM;GACN,WAAW;GACX,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;EACzD,CAAC,CACF;CACD;AACD"}