@geekmidas/cli 10.0.0-alpha.36 → 10.0.0-alpha.38

package/dist/reconcile-yNq6Shau.mjs

@@ -1,279 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { mkdir, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { randomBytes } from "node:crypto";
-//#region src/secrets/generator.ts
-/**
-* Generate a secure random password using URL-safe base64 characters.
-* @param length Password length (default: 32)
-*/
-function generateSecurePassword(length = 32) {
-	return randomBytes(Math.ceil(length * 3 / 4)).toString("base64url").slice(0, length);
-}
-/** Default service configurations (localhost for local dev via Docker port mapping) */
-const SERVICE_DEFAULTS = {
-	postgres: {
-		host: "localhost",
-		port: 5432,
-		username: "app",
-		database: "app"
-	},
-	redis: {
-		host: "localhost",
-		port: 6379,
-		username: "default"
-	},
-	minio: {
-		host: "localhost",
-		port: 9e3,
-		username: "app",
-		bucket: "app"
-	},
-	mailpit: {
-		host: "localhost",
-		port: 1025,
-		username: "app"
-	},
-	localstack: {
-		host: "localhost",
-		port: 4566,
-		username: "localstack",
-		region: "us-east-1"
-	}
-};
-/** Default credentials for pgboss (not a Docker service, reuses postgres) */
-const PGBOSS_DEFAULTS = {
-	host: "localhost",
-	port: 5432,
-	username: "pgboss",
-	database: "app"
-};
-/**
-* Generate credentials for a specific service.
-*/
-function generateServiceCredentials(service) {
-	return {
-		...SERVICE_DEFAULTS[service],
-		password: generateSecurePassword()
-	};
-}
-/**
-* Generate credentials for multiple services.
-*/
-function generateServicesCredentials(services) {
-	const result = {};
-	for (const service of services) result[service] = generateServiceCredentials(service);
-	return result;
-}
-/**
-* Generate connection URL for PostgreSQL.
-*/
-function generatePostgresUrl(creds) {
-	const { username, password, host, port, database } = creds;
-	return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;
-}
-/**
-* Generate connection URL for Redis.
-*/
-function generateRedisUrl(creds) {
-	const { password, host, port } = creds;
-	return `redis://:${encodeURIComponent(password)}@${host}:${port}`;
-}
-/**
-* Generate endpoint URL for MinIO (S3-compatible).
-*/
-function generateMinioEndpoint(creds) {
-	const { host, port } = creds;
-	return `http://${host}:${port}`;
-}
-/**
-* Generate connection URL for pg-boss (uses PostgreSQL protocol).
-* Format: pgboss://user:pass@host:port/db?schema=pgboss
-*/
-function generatePgBossUrl(creds) {
-	const { username, password, host, port, database } = creds;
-	return `pgboss://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=pgboss`;
-}
-/**
-* Generate connection URLs from service credentials.
-*/
-function generateConnectionUrls(services) {
-	const urls = {};
-	if (services.postgres) urls.DATABASE_URL = generatePostgresUrl(services.postgres);
-	if (services.redis) urls.REDIS_URL = generateRedisUrl(services.redis);
-	if (services.minio) urls.STORAGE_ENDPOINT = generateMinioEndpoint(services.minio);
-	if (services.pgboss) {
-		const pgbossUrl = generatePgBossUrl(services.pgboss);
-		urls.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;
-		urls.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;
-	}
-	if (services.mailpit) {
-		urls.SMTP_HOST = services.mailpit.host;
-		urls.SMTP_PORT = String(services.mailpit.port);
-	}
-	return urls;
-}
-/**
-* Create a new StageSecrets object with generated credentials.
-* @param stage - The deployment stage (e.g., 'development', 'production')
-* @param services - List of services to generate credentials for
-* @param options - Optional configuration
-* @param options.projectName - Project name used to derive the database name (e.g., 'myapp' → 'myapp_dev')
-*/
-function createStageSecrets(stage, services, options) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	const serviceCredentials = generateServicesCredentials(services);
-	if (options?.projectName) {
-		if (serviceCredentials.postgres) serviceCredentials.postgres.database = `${options.projectName.replace(/-/g, "_")}_dev`;
-		if (serviceCredentials.minio) {
-			serviceCredentials.minio.bucket = options.projectName;
-			serviceCredentials.minio.username = options.projectName;
-		}
-	}
-	if (serviceCredentials.postgres && !serviceCredentials.pgboss) serviceCredentials.pgboss = {
-		...PGBOSS_DEFAULTS,
-		password: generateSecurePassword(),
-		host: serviceCredentials.postgres.host,
-		port: serviceCredentials.postgres.port,
-		database: serviceCredentials.postgres.database
-	};
-	return {
-		stage,
-		createdAt: now,
-		updatedAt: now,
-		services: serviceCredentials,
-		urls: generateConnectionUrls(serviceCredentials),
-		custom: {}
-	};
-}
-/**
-* Rotate password for a specific service.
-*/
-function rotateServicePassword(secrets, service) {
-	const currentCreds = secrets.services[service];
-	if (!currentCreds) throw new Error(`Service "${service}" not configured in secrets`);
-	const newCreds = {
-		...currentCreds,
-		password: generateSecurePassword()
-	};
-	const newServices = {
-		...secrets.services,
-		[service]: newCreds
-	};
-	return {
-		...secrets,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		services: newServices,
-		urls: generateConnectionUrls(newServices)
-	};
-}
-//#endregion
-//#region src/setup/fullstack-secrets.ts
-/**
-* Generate a secure random password for database users.
-* Uses a combination of timestamp and random bytes for uniqueness.
-*/
-function generateDbPassword() {
-	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
-}
-/**
-* Generate database URL for an app.
-* All apps connect to the same database, but use different users/schemas.
-*/
-function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
-	return `postgresql://${appName.replace(/-/g, "_")}:${password}@${host}:${port}/${`${projectName.replace(/-/g, "_")}_dev`}`;
-}
-/**
-* Generate fullstack-aware custom secrets for a workspace.
-*
-* Generates:
-* - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command
-*   decides that; see `gkm init`)
-* - Per-app database passwords and URLs for backend apps with db service
-* - Better-auth secrets for apps using the better-auth framework
-*/
-function generateFullstackCustomSecrets(workspace, containers = []) {
-	const hasDb = containers.includes("postgres");
-	const customs = {
-		PORT: "3000",
-		LOG_LEVEL: "debug",
-		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
-	};
-	if (!hasDb) return customs;
-	const frontendPorts = [];
-	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
-		if (appConfig.type === "web") {
-			frontendPorts.push(appConfig.port);
-			const upperName = appName.toUpperCase();
-			customs[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;
-			continue;
-		}
-		if (appConfig.type === "mobile") continue;
-		const password = generateDbPassword();
-		const upperName = appName.toUpperCase();
-		customs[`${upperName}_DATABASE_URL`] = generateDbUrl(appName, password, workspace.name);
-		customs[`${upperName}_DB_PASSWORD`] = password;
-		if (appConfig.framework === "better-auth") {
-			customs.AUTH_PORT = String(appConfig.port);
-			customs.AUTH_URL = `http://localhost:${appConfig.port}`;
-			customs.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;
-			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
-		}
-	}
-	if (customs.BETTER_AUTH_SECRET) customs.BETTER_AUTH_TRUSTED_ORIGINS = Object.values(workspace.apps).map((a) => a.port).map((p) => `http://localhost:${p}`).join(",");
-	return customs;
-}
-/**
-* Extract *_DB_PASSWORD keys from secrets and write docker/.env.
-*
-* The docker/.env file contains database passwords that the PostgreSQL
-* init script reads to create per-app database users.
-*/
-async function writeDockerEnvFromSecrets(secrets, workspaceRoot) {
-	const dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) => key.endsWith("_DB_PASSWORD"));
-	if (secrets.services.pgboss && !dbPasswordEntries.some(([key]) => key === "PGBOSS_DB_PASSWORD")) dbPasswordEntries.push(["PGBOSS_DB_PASSWORD", secrets.services.pgboss.password]);
-	if (dbPasswordEntries.length === 0) return;
-	const envContent = `# Auto-generated docker environment file
-# Contains database passwords for docker-compose postgres init
-# This file is gitignored - do not commit to version control
-${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
-`;
-	const envPath = join(workspaceRoot, "docker", ".env");
-	await mkdir(dirname(envPath), { recursive: true });
-	await writeFile(envPath, envContent);
-}
-//#endregion
-//#region src/secrets/reconcile.ts
-var reconcile_exports = /* @__PURE__ */ __exportAll({ reconcileMissingSecrets: () => reconcileMissingSecrets });
-/**
-* Reconcile missing custom secrets for a workspace.
-*
-* Compares current secrets against what generateFullstackCustomSecrets()
-* would produce and backfills any missing keys without overwriting
-* existing values.
-*
-* @returns ReconcileResult if keys were added, null if secrets are up-to-date
-*/
-function reconcileMissingSecrets(secrets, workspace, containers = []) {
-	if (!(Object.keys(workspace.apps).length > 1)) return null;
-	const expectedCustom = generateFullstackCustomSecrets(workspace, containers);
-	const addedKeys = [];
-	const mergedCustom = { ...secrets.custom };
-	for (const [key, value] of Object.entries(expectedCustom)) if (!(key in mergedCustom)) {
-		mergedCustom[key] = value;
-		addedKeys.push(key);
-	}
-	if (addedKeys.length === 0) return null;
-	return {
-		secrets: {
-			...secrets,
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			custom: mergedCustom
-		},
-		addedKeys
-	};
-}
-//#endregion
-export { createStageSecrets as a, generateServiceCredentials as c, writeDockerEnvFromSecrets as i, rotateServicePassword as l, reconcile_exports as n, generateConnectionUrls as o, generateFullstackCustomSecrets as r, generateSecurePassword as s, reconcileMissingSecrets as t };
-
-//# sourceMappingURL=reconcile-yNq6Shau.mjs.map

package/dist/reconcile-yNq6Shau.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"reconcile-yNq6Shau.mjs","names":[],"sources":["../src/secrets/generator.ts","../src/setup/fullstack-secrets.ts","../src/secrets/reconcile.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport type {\n\tSecretServiceName,\n\tServiceCredentials,\n\tStageSecrets,\n} from './types';\n\n/**\n * Generate a secure random password using URL-safe base64 characters.\n * @param length Password length (default: 32)\n */\nexport function generateSecurePassword(length = 32): string {\n\treturn randomBytes(Math.ceil((length * 3) / 4))\n\t\t.toString('base64url')\n\t\t.slice(0, length);\n}\n\n/** Default service configurations (localhost for local dev via Docker port mapping) */\nconst SERVICE_DEFAULTS: Record<\n\tSecretServiceName,\n\tOmit<ServiceCredentials, 'password'>\n> = {\n\tpostgres: {\n\t\thost: 'localhost',\n\t\tport: 5432,\n\t\tusername: 'app',\n\t\tdatabase: 'app',\n\t},\n\tredis: {\n\t\thost: 'localhost',\n\t\tport: 6379,\n\t\tusername: 'default',\n\t},\n\tminio: {\n\t\thost: 'localhost',\n\t\tport: 9000,\n\t\tusername: 'app',\n\t\tbucket: 'app',\n\t},\n\tmailpit: {\n\t\thost: 'localhost',\n\t\tport: 1025,\n\t\tusername: 'app',\n\t},\n\tlocalstack: {\n\t\thost: 'localhost',\n\t\tport: 4566,\n\t\tusername: 'localstack',\n\t\tregion: 'us-east-1',\n\t},\n};\n\n/** Default credentials for pgboss (not a Docker service, reuses postgres) */\nconst PGBOSS_DEFAULTS: Omit<ServiceCredentials, 'password'> = {\n\thost: 'localhost',\n\tport: 5432,\n\tusername: 'pgboss',\n\tdatabase: 'app',\n};\n\n/**\n * Generate credentials for a specific service.\n */\nexport function generateServiceCredentials(\n\tservice: SecretServiceName,\n): ServiceCredentials {\n\tconst defaults = SERVICE_DEFAULTS[service];\n\treturn {\n\t\t...defaults,\n\t\tpassword: generateSecurePassword(),\n\t};\n}\n\n/**\n * Generate credentials for multiple services.\n */\nexport function generateServicesCredentials(\n\tservices: SecretServiceName[],\n): StageSecrets['services'] {\n\tconst result: StageSecrets['services'] = {};\n\n\tfor (const service of services) {\n\t\tresult[service] = generateServiceCredentials(service);\n\t}\n\n\treturn result;\n}\n\n/**\n * Generate connection URL for PostgreSQL.\n */\nexport function generatePostgresUrl(creds: ServiceCredentials): string {\n\tconst { username, password, host, port, database } = creds;\n\treturn `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}`;\n}\n\n/**\n * Generate connection URL for Redis.\n */\nexport function generateRedisUrl(creds: ServiceCredentials): string {\n\tconst { password, host, port } = creds;\n\treturn `redis://:${encodeURIComponent(password)}@${host}:${port}`;\n}\n\n/**\n * Generate endpoint URL for MinIO (S3-compatible).\n */\nexport function generateMinioEndpoint(creds: ServiceCredentials): string {\n\tconst { host, port } = creds;\n\treturn `http://${host}:${port}`;\n}\n\n/**\n * Generate a LocalStack-compatible access key ID.\n * Must start with 'LSIA' prefix and be at least 20 characters.\n * @see https://docs.localstack.cloud/aws/capabilities/config/credentials/\n */\nexport function generateLocalStackAccessKeyId(): string {\n\tconst suffix = randomBytes(12).toString('base64url').slice(0, 16);\n\treturn `LSIA${suffix}`;\n}\n\n/**\n * Generate connection URL for pg-boss (uses PostgreSQL protocol).\n * Format: pgboss://user:pass@host:port/db?schema=pgboss\n */\nexport function generatePgBossUrl(creds: ServiceCredentials): string {\n\tconst { username, password, host, port, database } = creds;\n\treturn `pgboss://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=pgboss`;\n}\n\n/**\n * Generate connection URLs from service credentials.\n */\nexport function generateConnectionUrls(\n\tservices: StageSecrets['services'],\n): StageSecrets['urls'] {\n\tconst urls: StageSecrets['urls'] = {};\n\n\tif (services.postgres) {\n\t\turls.DATABASE_URL = generatePostgresUrl(services.postgres);\n\t}\n\n\tif (services.redis) {\n\t\turls.REDIS_URL = generateRedisUrl(services.redis);\n\t}\n\n\tif (services.minio) {\n\t\turls.STORAGE_ENDPOINT = generateMinioEndpoint(services.minio);\n\t}\n\n\t// A topic's or queue's own broker URL is reconcile's, derived from the\n\t// declaration. This pair is what a worker's crons schedule through.\n\tif (services.pgboss) {\n\t\tconst pgbossUrl = generatePgBossUrl(services.pgboss);\n\t\turls.EVENT_PUBLISHER_CONNECTION_STRING = pgbossUrl;\n\t\turls.EVENT_SUBSCRIBER_CONNECTION_STRING = pgbossUrl;\n\t}\n\n\tif (services.mailpit) {\n\t\turls.SMTP_HOST = services.mailpit.host;\n\t\turls.SMTP_PORT = String(services.mailpit.port);\n\t}\n\n\treturn urls;\n}\n\n/**\n * Generate LocalStack service credentials with LSIA-prefixed access key.\n */\nexport function generateLocalStackCredentials(): ServiceCredentials {\n\tconst defaults = SERVICE_DEFAULTS.localstack;\n\treturn {\n\t\t...defaults,\n\t\tpassword: generateSecurePassword(),\n\t\taccessKeyId: generateLocalStackAccessKeyId(),\n\t};\n}\n\n/**\n * Create a new StageSecrets object with generated credentials.\n * @param stage - The deployment stage (e.g., 'development', 'production')\n * @param services - List of services to generate credentials for\n * @param options - Optional configuration\n * @param options.projectName - Project name used to derive the database name (e.g., 'myapp' → 'myapp_dev')\n */\nexport function createStageSecrets(\n\tstage: string,\n\tservices: SecretServiceName[],\n\toptions?: { projectName?: string },\n): StageSecrets {\n\tconst now = new Date().toISOString();\n\tconst serviceCredentials = generateServicesCredentials(services);\n\n\t// Override service defaults with project-derived names if provided\n\tif (options?.projectName) {\n\t\tif (serviceCredentials.postgres) {\n\t\t\tserviceCredentials.postgres.database = `${options.projectName.replace(/-/g, '_')}_dev`;\n\t\t}\n\t\tif (serviceCredentials.minio) {\n\t\t\tserviceCredentials.minio.bucket = options.projectName;\n\t\t\tserviceCredentials.minio.username = options.projectName;\n\t\t}\n\t}\n\n\t// Always create pgboss credentials when postgres is available.\n\t// pgboss reuses postgres host/port/database but with a dedicated user,\n\t// so subscribers work out of the box without explicit events config.\n\tif (serviceCredentials.postgres && !serviceCredentials.pgboss) {\n\t\tserviceCredentials.pgboss = {\n\t\t\t...PGBOSS_DEFAULTS,\n\t\t\tpassword: generateSecurePassword(),\n\t\t\thost: serviceCredentials.postgres.host,\n\t\t\tport: serviceCredentials.postgres.port,\n\t\t\tdatabase: serviceCredentials.postgres.database,\n\t\t};\n\t}\n\n\tconst urls = generateConnectionUrls(serviceCredentials);\n\n\treturn {\n\t\tstage,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tservices: serviceCredentials,\n\t\turls,\n\t\tcustom: {},\n\t};\n}\n\n/**\n * Rotate password for a specific service.\n */\nexport function rotateServicePassword(\n\tsecrets: StageSecrets,\n\tservice: SecretServiceName,\n): StageSecrets {\n\tconst currentCreds = secrets.services[service];\n\tif (!currentCreds) {\n\t\tthrow new Error(`Service \"${service}\" not configured in secrets`);\n\t}\n\n\tconst newCreds: ServiceCredentials = {\n\t\t...currentCreds,\n\t\tpassword: generateSecurePassword(),\n\t};\n\n\tconst newServices = {\n\t\t...secrets.services,\n\t\t[service]: newCreds,\n\t};\n\n\treturn {\n\t\t...secrets,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tservices: newServices,\n\t\turls: generateConnectionUrls(newServices),\n\t};\n}\n","import { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { generateSecurePassword } from '../secrets/generator.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\n/**\n * Generate a secure random password for database users.\n * Uses a combination of timestamp and random bytes for uniqueness.\n */\nexport function generateDbPassword(): string {\n\treturn `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;\n}\n\n/**\n * Generate database URL for an app.\n * All apps connect to the same database, but use different users/schemas.\n */\nexport function generateDbUrl(\n\tappName: string,\n\tpassword: string,\n\tprojectName: string,\n\thost = 'localhost',\n\tport = 5432,\n): string {\n\tconst userName = appName.replace(/-/g, '_');\n\tconst dbName = `${projectName.replace(/-/g, '_')}_dev`;\n\treturn `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;\n}\n\n/**\n * Generate fullstack-aware custom secrets for a workspace.\n *\n * Generates:\n * - Common secrets: PORT, LOG_LEVEL, JWT_SECRET (no `NODE_ENV` — the command\n *   decides that; see `gkm init`)\n * - Per-app database passwords and URLs for backend apps with db service\n * - Better-auth secrets for apps using the better-auth framework\n */\nexport function generateFullstackCustomSecrets(\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): Record<string, string> {\n\t// A Postgres exists because something declared a database, not because\n\t// config carried a flag saying so.\n\tconst hasDb = containers.includes('postgres');\n\tconst customs: Record<string, string> = {\n\t\tPORT: '3000',\n\t\tLOG_LEVEL: 'debug',\n\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t};\n\n\tif (!hasDb) {\n\t\treturn customs;\n\t}\n\n\t// Collect all frontend ports for trusted origins\n\tconst frontendPorts: number[] = [];\n\n\tfor (const [appName, appConfig] of Object.entries(workspace.apps)) {\n\t\tif (appConfig.type === 'web') {\n\t\t\tfrontendPorts.push(appConfig.port);\n\t\t\tconst upperName = appName.toUpperCase();\n\t\t\tcustoms[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Mobile apps (Expo, etc.) don't run on a host port the backend\n\t\t// cares about for CORS, and don't need DB credentials.\n\t\tif (appConfig.type === 'mobile') {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Backend apps with database: generate per-app DB passwords and URLs\n\t\tconst password = generateDbPassword();\n\t\tconst upperName = appName.toUpperCase();\n\n\t\tcustoms[`${upperName}_DATABASE_URL`] = generateDbUrl(\n\t\t\tappName,\n\t\t\tpassword,\n\t\t\tworkspace.name,\n\t\t);\n\t\tcustoms[`${upperName}_DB_PASSWORD`] = password;\n\n\t\t// Better-auth framework secrets\n\t\tif (appConfig.framework === 'better-auth') {\n\t\t\tcustoms.AUTH_PORT = String(appConfig.port);\n\t\t\tcustoms.AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t\tcustoms.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;\n\t\t\tcustoms.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t}\n\t}\n\n\t// Generate trusted origins for better-auth (all app ports)\n\tif (customs.BETTER_AUTH_SECRET) {\n\t\tconst allPorts = Object.values(workspace.apps).map((a) => a.port);\n\t\tcustoms.BETTER_AUTH_TRUSTED_ORIGINS = allPorts\n\t\t\t.map((p) => `http://localhost:${p}`)\n\t\t\t.join(',');\n\t}\n\n\treturn customs;\n}\n\n/**\n * Extract *_DB_PASSWORD keys from secrets and write docker/.env.\n *\n * The docker/.env file contains database passwords that the PostgreSQL\n * init script reads to create per-app database users.\n */\nexport async function writeDockerEnvFromSecrets(\n\tsecrets: StageSecrets,\n\tworkspaceRoot: string,\n): Promise<void> {\n\tconst dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) =>\n\t\tkey.endsWith('_DB_PASSWORD'),\n\t);\n\n\t// Always include pgboss password when pgboss credentials exist\n\tif (\n\t\tsecrets.services.pgboss &&\n\t\t!dbPasswordEntries.some(([key]) => key === 'PGBOSS_DB_PASSWORD')\n\t) {\n\t\tdbPasswordEntries.push([\n\t\t\t'PGBOSS_DB_PASSWORD',\n\t\t\tsecrets.services.pgboss.password,\n\t\t]);\n\t}\n\n\tif (dbPasswordEntries.length === 0) {\n\t\treturn;\n\t}\n\n\tconst envContent = `# Auto-generated docker environment file\n# Contains database passwords for docker-compose postgres init\n# This file is gitignored - do not commit to version control\n${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join('\\n')}\n`;\n\n\tconst envPath = join(workspaceRoot, 'docker', '.env');\n\tawait mkdir(dirname(envPath), { recursive: true });\n\tawait writeFile(envPath, envContent);\n}\n","import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace, containers);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;AAWA,SAAgB,uBAAuB,SAAS,IAAY;CAC3D,OAAO,YAAY,KAAK,KAAM,SAAS,IAAK,CAAC,CAAC,CAAC,CAC7C,SAAS,WAAW,CAAC,CACrB,MAAM,GAAG,MAAM;AAClB;;AAGA,MAAM,mBAGF;CACH,UAAU;EACT,MAAM;EACN,MAAM;EACN,UAAU;EACV,UAAU;CACX;CACA,OAAO;EACN,MAAM;EACN,MAAM;EACN,UAAU;CACX;CACA,OAAO;EACN,MAAM;EACN,MAAM;EACN,UAAU;EACV,QAAQ;CACT;CACA,SAAS;EACR,MAAM;EACN,MAAM;EACN,UAAU;CACX;CACA,YAAY;EACX,MAAM;EACN,MAAM;EACN,UAAU;EACV,QAAQ;CACT;AACD;;AAGA,MAAM,kBAAwD;CAC7D,MAAM;CACN,MAAM;CACN,UAAU;CACV,UAAU;AACX;;;;AAKA,SAAgB,2BACf,SACqB;CAErB,OAAO;EACN,GAFgB,iBAAiB;EAGjC,UAAU,uBAAuB;CAClC;AACD;;;;AAKA,SAAgB,4BACf,UAC2B;CAC3B,MAAM,SAAmC,CAAC;CAE1C,KAAK,MAAM,WAAW,UACrB,OAAO,WAAW,2BAA2B,OAAO;CAGrD,OAAO;AACR;;;;AAKA,SAAgB,oBAAoB,OAAmC;CACtE,MAAM,EAAE,UAAU,UAAU,MAAM,MAAM,aAAa;CACrD,OAAO,gBAAgB,SAAS,GAAG,mBAAmB,QAAQ,EAAE,GAAG,KAAK,GAAG,KAAK,GAAG;AACpF;;;;AAKA,SAAgB,iBAAiB,OAAmC;CACnE,MAAM,EAAE,UAAU,MAAM,SAAS;CACjC,OAAO,YAAY,mBAAmB,QAAQ,EAAE,GAAG,KAAK,GAAG;AAC5D;;;;AAKA,SAAgB,sBAAsB,OAAmC;CACxE,MAAM,EAAE,MAAM,SAAS;CACvB,OAAO,UAAU,KAAK,GAAG;AAC1B;;;;;AAgBA,SAAgB,kBAAkB,OAAmC;CACpE,MAAM,EAAE,UAAU,UAAU,MAAM,MAAM,aAAa;CACrD,OAAO,YAAY,SAAS,GAAG,mBAAmB,QAAQ,EAAE,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS;AACzF;;;;AAKA,SAAgB,uBACf,UACuB;CACvB,MAAM,OAA6B,CAAC;CAEpC,IAAI,SAAS,UACZ,KAAK,eAAe,oBAAoB,SAAS,QAAQ;CAG1D,IAAI,SAAS,OACZ,KAAK,YAAY,iBAAiB,SAAS,KAAK;CAGjD,IAAI,SAAS,OACZ,KAAK,mBAAmB,sBAAsB,SAAS,KAAK;CAK7D,IAAI,SAAS,QAAQ;EACpB,MAAM,YAAY,kBAAkB,SAAS,MAAM;EACnD,KAAK,oCAAoC;EACzC,KAAK,qCAAqC;CAC3C;CAEA,IAAI,SAAS,SAAS;EACrB,KAAK,YAAY,SAAS,QAAQ;EAClC,KAAK,YAAY,OAAO,SAAS,QAAQ,IAAI;CAC9C;CAEA,OAAO;AACR;;;;;;;;AAqBA,SAAgB,mBACf,OACA,UACA,SACe;CACf,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CACnC,MAAM,qBAAqB,4BAA4B,QAAQ;CAG/D,IAAI,SAAS,aAAa;EACzB,IAAI,mBAAmB,UACtB,mBAAmB,SAAS,WAAW,GAAG,QAAQ,YAAY,QAAQ,MAAM,GAAG,EAAE;EAElF,IAAI,mBAAmB,OAAO;GAC7B,mBAAmB,MAAM,SAAS,QAAQ;GAC1C,mBAAmB,MAAM,WAAW,QAAQ;EAC7C;CACD;CAKA,IAAI,mBAAmB,YAAY,CAAC,mBAAmB,QACtD,mBAAmB,SAAS;EAC3B,GAAG;EACH,UAAU,uBAAuB;EACjC,MAAM,mBAAmB,SAAS;EAClC,MAAM,mBAAmB,SAAS;EAClC,UAAU,mBAAmB,SAAS;CACvC;CAKD,OAAO;EACN;EACA,WAAW;EACX,WAAW;EACX,UAAU;EACV,MAPY,uBAAuB,kBAOhC;EACH,QAAQ,CAAC;CACV;AACD;;;;AAKA,SAAgB,sBACf,SACA,SACe;CACf,MAAM,eAAe,QAAQ,SAAS;CACtC,IAAI,CAAC,cACJ,MAAM,IAAI,MAAM,YAAY,QAAQ,4BAA4B;CAGjE,MAAM,WAA+B;EACpC,GAAG;EACH,UAAU,uBAAuB;CAClC;CAEA,MAAM,cAAc;EACnB,GAAG,QAAQ;GACV,UAAU;CACZ;CAEA,OAAO;EACN,GAAG;EACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,UAAU;EACV,MAAM,uBAAuB,WAAW;CACzC;AACD;;;;;;;ACxPA,SAAgB,qBAA6B;CAC5C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;AAC7G;;;;;AAMA,SAAgB,cACf,SACA,UACA,aACA,OAAO,aACP,OAAO,MACE;CAGT,OAAO,gBAFU,QAAQ,QAAQ,MAAM,GAET,EAAE,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,GAD7C,YAAY,QAAQ,MAAM,GAAG,EAAE;AAElD;;;;;;;;;;AAWA,SAAgB,+BACf,WACA,aAAgC,CAAC,GACR;CAGzB,MAAM,QAAQ,WAAW,SAAS,UAAU;CAC5C,MAAM,UAAkC;EACvC,MAAM;EACN,WAAW;EACX,YAAY,OAAO,KAAK,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;CACpE;CAEA,IAAI,CAAC,OACJ,OAAO;CAIR,MAAM,gBAA0B,CAAC;CAEjC,KAAK,MAAM,CAAC,SAAS,cAAc,OAAO,QAAQ,UAAU,IAAI,GAAG;EAClE,IAAI,UAAU,SAAS,OAAO;GAC7B,cAAc,KAAK,UAAU,IAAI;GACjC,MAAM,YAAY,QAAQ,YAAY;GACtC,QAAQ,GAAG,UAAU,SAAS,oBAAoB,UAAU;GAC5D;EACD;EAIA,IAAI,UAAU,SAAS,UACtB;EAID,MAAM,WAAW,mBAAmB;EACpC,MAAM,YAAY,QAAQ,YAAY;EAEtC,QAAQ,GAAG,UAAU,kBAAkB,cACtC,SACA,UACA,UAAU,IACX;EACA,QAAQ,GAAG,UAAU,iBAAiB;EAGtC,IAAI,UAAU,cAAc,eAAe;GAC1C,QAAQ,YAAY,OAAO,UAAU,IAAI;GACzC,QAAQ,WAAW,oBAAoB,UAAU;GACjD,QAAQ,qBAAqB,eAAe,KAAK,IAAI,EAAE,GAAG,uBAAuB,EAAE;GACnF,QAAQ,kBAAkB,oBAAoB,UAAU;EACzD;CACD;CAGA,IAAI,QAAQ,oBAEX,QAAQ,8BADS,OAAO,OAAO,UAAU,IAAI,CAAC,CAAC,KAAK,MAAM,EAAE,IACf,CAAC,CAC5C,KAAK,MAAM,oBAAoB,GAAG,CAAC,CACnC,KAAK,GAAG;CAGX,OAAO;AACR;;;;;;;AAQA,eAAsB,0BACrB,SACA,eACgB;CAChB,MAAM,oBAAoB,OAAO,QAAQ,QAAQ,MAAM,CAAC,CAAC,QAAQ,CAAC,SACjE,IAAI,SAAS,cAAc,CAC5B;CAGA,IACC,QAAQ,SAAS,UACjB,CAAC,kBAAkB,MAAM,CAAC,SAAS,QAAQ,oBAAoB,GAE/D,kBAAkB,KAAK,CACtB,sBACA,QAAQ,SAAS,OAAO,QACzB,CAAC;CAGF,IAAI,kBAAkB,WAAW,GAChC;CAGD,MAAM,aAAa;;;EAGlB,kBAAkB,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE;;CAGvE,MAAM,UAAU,KAAK,eAAe,UAAU,MAAM;CACpD,MAAM,MAAM,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;CACjD,MAAM,UAAU,SAAS,UAAU;AACpC;;;;;;;;;;;;;AC1HA,SAAgB,wBACf,SACA,WACA,aAAgC,CAAC,GACR;CAEzB,IAAI,EADe,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAEvD,OAAO;CAGR,MAAM,iBAAiB,+BAA+B,WAAW,UAAU;CAC3E,MAAM,YAAsB,CAAC;CAC7B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAO;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,GACvD,IAAI,EAAE,OAAO,eAAe;EAC3B,aAAa,OAAO;EACpB,UAAU,KAAK,GAAG;CACnB;CAGD,IAAI,UAAU,WAAW,GACxB,OAAO;CAGR,OAAO;EACN,SAAS;GACR,GAAG;GACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,QAAQ;EACT;EACA;CACD;AACD"}

package/dist/ssm-BKN1Cg4z.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ssm-BKN1Cg4z.mjs","names":[],"sources":["../src/secrets/ssm.ts"],"sourcesContent":["/**\n * A stage's secrets in SSM Parameter Store, in the stage's own AWS account.\n *\n * One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —\n * encrypted at rest by KMS, so nothing about it needs a key file anywhere.\n * Which account it is in is whichever credentials are active: the stage's\n * OIDC role in a deploy job, or `--profile` on a developer's machine. With\n * staging and production in different accounts, each stage's secrets sit\n * beside its infrastructure, and a staging role cannot read production's.\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SsmSecretsStoreOptions {\n\t/** The workspace name, which scopes the parameter path. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The parameter a stage's secrets are kept in. */\nexport function secretsParameterName(project: string, stage: string): string {\n\treturn `/gkm/${project}/${stage}/secrets`;\n}\n\nexport class SsmSecretsStore implements SecretsStore {\n\tprivate client?: SSMClient;\n\n\tconstructor(private readonly options: SsmSecretsStoreOptions) {}\n\n\tprivate async ssm(): Promise<SSMClient> {\n\t\tif (this.client) return this.client;\n\n\t\tconst config: SSMClientConfig = { region: this.options.region };\n\t\tif (this.options.profile) {\n\t\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: this.options.profile });\n\t\t}\n\t\tif (this.options.endpoint) {\n\t\t\tconfig.endpoint = this.options.endpoint;\n\t\t}\n\n\t\tthis.client = new SSMClient(config);\n\t\treturn this.client;\n\t}\n\n\tasync pull(stage: string): Promise<StageSecrets | null> {\n\t\tconst ssm = await this.ssm();\n\n\t\ttry {\n\t\t\tconst { Parameter } = await ssm.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn Parameter?.Value\n\t\t\t\t? (JSON.parse(Parameter.Value) as StageSecrets)\n\t\t\t\t: null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync push(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst ssm = await this.ssm();\n\n\t\tawait ssm.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\tValue: JSON.stringify(secrets),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAgB,qBAAqB,SAAiB,OAAuB;CAC5E,OAAO,QAAQ,QAAQ,GAAG,MAAM;AACjC;AAEA,IAAa,kBAAb,MAAqD;CAGvB;CAF7B;CAEA,YAAY,SAAkD;EAAjC,KAAA,UAAA;CAAkC;CAE/D,MAAc,MAA0B;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK;EAE7B,MAAM,SAA0B,EAAE,QAAQ,KAAK,QAAQ,OAAO;EAC9D,IAAI,KAAK,QAAQ,SAAS;GACzB,MAAM,EAAE,YAAY,MAAM,OAAO;GACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,KAAK,QAAQ,QAAQ,CAAC;EAC/D;EACA,IAAI,KAAK,QAAQ,UAChB,OAAO,WAAW,KAAK,QAAQ;EAGhC,KAAK,SAAS,IAAI,UAAU,MAAM;EAClC,OAAO,KAAK;CACb;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,MAAM,MAAM,KAAK,IAAI;EAE3B,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,IAAI,KAC/B,IAAI,oBAAoB;IACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;IACtD,gBAAgB;GACjB,CAAC,CACF;GACA,OAAO,WAAW,QACd,KAAK,MAAM,UAAU,KAAK,IAC3B;EACJ,SAAS,OAAO;GACf,IAAI,iBAAiB,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;CAEA,MAAM,KAAK,OAAe,SAAsC;EAG/D,OAAM,MAFY,KAAK,IAAI,EAAA,CAEjB,KACT,IAAI,oBAAoB;GACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;GACtD,OAAO,KAAK,UAAU,OAAO;GAC7B,MAAM;GACN,WAAW;GACX,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;EACzD,CAAC,CACF;CACD;AACD"}

package/dist/ssm-FxeSAt35.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"ssm-FxeSAt35.cjs","names":["SSMClient","GetParameterCommand","ParameterNotFound","PutParameterCommand"],"sources":["../src/secrets/ssm.ts"],"sourcesContent":["/**\n * A stage's secrets in SSM Parameter Store, in the stage's own AWS account.\n *\n * One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —\n * encrypted at rest by KMS, so nothing about it needs a key file anywhere.\n * Which account it is in is whichever credentials are active: the stage's\n * OIDC role in a deploy job, or `--profile` on a developer's machine. With\n * staging and production in different accounts, each stage's secrets sit\n * beside its infrastructure, and a staging role cannot read production's.\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SsmSecretsStoreOptions {\n\t/** The workspace name, which scopes the parameter path. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The parameter a stage's secrets are kept in. */\nexport function secretsParameterName(project: string, stage: string): string {\n\treturn `/gkm/${project}/${stage}/secrets`;\n}\n\nexport class SsmSecretsStore implements SecretsStore {\n\tprivate client?: SSMClient;\n\n\tconstructor(private readonly options: SsmSecretsStoreOptions) {}\n\n\tprivate async ssm(): Promise<SSMClient> {\n\t\tif (this.client) return this.client;\n\n\t\tconst config: SSMClientConfig = { region: this.options.region };\n\t\tif (this.options.profile) {\n\t\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: this.options.profile });\n\t\t}\n\t\tif (this.options.endpoint) {\n\t\t\tconfig.endpoint = this.options.endpoint;\n\t\t}\n\n\t\tthis.client = new SSMClient(config);\n\t\treturn this.client;\n\t}\n\n\tasync pull(stage: string): Promise<StageSecrets | null> {\n\t\tconst ssm = await this.ssm();\n\n\t\ttry {\n\t\t\tconst { Parameter } = await ssm.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\t\t\treturn Parameter?.Value\n\t\t\t\t? (JSON.parse(Parameter.Value) as StageSecrets)\n\t\t\t\t: null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync push(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst ssm = await this.ssm();\n\n\t\tawait ssm.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\tValue: JSON.stringify(secrets),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAgB,qBAAqB,SAAiB,OAAuB;CAC5E,OAAO,QAAQ,QAAQ,GAAG,MAAM;AACjC;AAEA,IAAa,kBAAb,MAAqD;CAGvB;CAF7B;CAEA,YAAY,SAAkD;EAAjC,KAAA,UAAA;CAAkC;CAE/D,MAAc,MAA0B;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK;EAE7B,MAAM,SAA0B,EAAE,QAAQ,KAAK,QAAQ,OAAO;EAC9D,IAAI,KAAK,QAAQ,SAAS;GACzB,MAAM,EAAE,YAAY,MAAM,OAAO;GACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,KAAK,QAAQ,QAAQ,CAAC;EAC/D;EACA,IAAI,KAAK,QAAQ,UAChB,OAAO,WAAW,KAAK,QAAQ;EAGhC,KAAK,SAAS,IAAIA,oBAAAA,UAAU,MAAM;EAClC,OAAO,KAAK;CACb;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,MAAM,MAAM,KAAK,IAAI;EAE3B,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,IAAI,KAC/B,IAAIC,oBAAAA,oBAAoB;IACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;IACtD,gBAAgB;GACjB,CAAC,CACF;GACA,OAAO,WAAW,QACd,KAAK,MAAM,UAAU,KAAK,IAC3B;EACJ,SAAS,OAAO;GACf,IAAI,iBAAiBC,oBAAAA,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;CAEA,MAAM,KAAK,OAAe,SAAsC;EAG/D,OAAM,MAFY,KAAK,IAAI,EAAA,CAEjB,KACT,IAAIC,oBAAAA,oBAAoB;GACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;GACtD,OAAO,KAAK,UAAU,OAAO;GAC7B,MAAM;GACN,WAAW;GACX,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;EACzD,CAAC,CACF;CACD;AACD"}

package/dist/storage-BjTLjDDp.mjs

@@ -1,297 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { existsSync } from "node:fs";
-import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { basename, join } from "node:path";
-import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
-//#region src/secrets/keystore.ts
-/** Key length for AES-256 encryption */
-const KEY_LENGTH = 32;
-/**
-* Get the keystore directory for a project.
-* Keys are stored at ~/.gkm/{project-name}/
-*
-* @param projectName - Name of the project (defaults to current directory name)
-* @returns Path to the keystore directory
-*/
-function getKeystoreDir(projectName) {
-	const name = projectName ?? basename(process.cwd());
-	return join(homedir(), ".gkm", name);
-}
-/**
-* Get the path to a stage's encryption key.
-*
-* @param stage - Stage name (e.g., 'development', 'production')
-* @param projectName - Name of the project (defaults to current directory name)
-* @returns Path to the key file
-*/
-function getKeyPath(stage, projectName) {
-	return join(getKeystoreDir(projectName), `${stage}.key`);
-}
-/**
-* Generate a new encryption key for a stage.
-* The key is stored at ~/.gkm/{project-name}/{stage}.key with restricted permissions.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The generated key as a hex string
-*/
-async function generateKey(stage, projectName) {
-	const keyDir = getKeystoreDir(projectName);
-	const keyPath = getKeyPath(stage, projectName);
-	await mkdir(keyDir, {
-		recursive: true,
-		mode: 448
-	});
-	const key = randomBytes(KEY_LENGTH).toString("hex");
-	await writeFile(keyPath, key, {
-		mode: 384,
-		encoding: "utf-8"
-	});
-	await chmod(keyPath, 384);
-	return key;
-}
-/**
-* Read an encryption key for a stage.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The key as a hex string, or null if not found
-*/
-async function readKey(stage, projectName) {
-	const keyPath = getKeyPath(stage, projectName);
-	if (!existsSync(keyPath)) return null;
-	return (await readFile(keyPath, "utf-8")).trim();
-}
-/**
-* Get or create a key for a stage.
-* If the key already exists, it is returned. Otherwise, a new key is generated.
-*
-* @param stage - Stage name
-* @param projectName - Project name (defaults to current directory name)
-* @returns The key as a hex string
-*/
-async function getOrCreateKey(stage, projectName) {
-	const existingKey = await readKey(stage, projectName);
-	if (existingKey) return existingKey;
-	return generateKey(stage, projectName);
-}
-//#endregion
-//#region src/secrets/storage.ts
-var storage_exports = /* @__PURE__ */ __exportAll({
-	getSecretsDir: () => getSecretsDir,
-	getSecretsPath: () => getSecretsPath,
-	initStageSecrets: () => initStageSecrets,
-	maskPassword: () => maskPassword,
-	readStageSecrets: () => readStageSecrets,
-	secretsExist: () => secretsExist,
-	setCustomSecret: () => setCustomSecret,
-	toEmbeddableSecrets: () => toEmbeddableSecrets,
-	validateEnvironmentVariables: () => validateEnvironmentVariables,
-	writeStageSecrets: () => writeStageSecrets
-});
-/** Default secrets directory relative to project root */
-const SECRETS_DIR = ".gkm/secrets";
-/** AES-256-GCM configuration */
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12;
-/**
-* Get the secrets directory path.
-*/
-function getSecretsDir(cwd = process.cwd()) {
-	return join(cwd, SECRETS_DIR);
-}
-/**
-* Get the secrets file path for a stage.
-*/
-function getSecretsPath(stage, cwd = process.cwd()) {
-	return join(getSecretsDir(cwd), `${stage}.json`);
-}
-/**
-* Check if secrets exist for a stage.
-*/
-function secretsExist(stage, cwd = process.cwd()) {
-	return existsSync(getSecretsPath(stage, cwd));
-}
-/**
-* Initialize an empty StageSecrets object for a stage.
-*/
-function initStageSecrets(stage) {
-	const now = (/* @__PURE__ */ new Date()).toISOString();
-	return {
-		stage,
-		createdAt: now,
-		updatedAt: now,
-		services: {},
-		urls: {},
-		custom: {}
-	};
-}
-/**
-* Encrypt secrets using a key.
-*/
-function encryptSecretsData(secrets, keyHex) {
-	const key = Buffer.from(keyHex, "hex");
-	const iv = randomBytes(IV_LENGTH);
-	const plaintext = JSON.stringify(secrets);
-	const cipher = createCipheriv(ALGORITHM, key, iv);
-	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-	const authTag = cipher.getAuthTag();
-	return {
-		version: 1,
-		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
-		iv: iv.toString("hex")
-	};
-}
-/**
-* Decrypt secrets using a key.
-*/
-function decryptSecretsData(data, keyHex) {
-	const key = Buffer.from(keyHex, "hex");
-	const ivBuffer = Buffer.from(data.iv, "hex");
-	const combined = Buffer.from(data.encrypted, "base64");
-	const ciphertext = combined.subarray(0, -16);
-	const authTag = combined.subarray(-16);
-	const decipher = createDecipheriv(ALGORITHM, key, ivBuffer);
-	decipher.setAuthTag(authTag);
-	const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-	return JSON.parse(plaintext.toString("utf-8"));
-}
-/**
-* Read secrets for a stage (encrypted).
-* Requires the decryption key to be present at ~/.gkm/{project}/{stage}.key
-*
-* @returns StageSecrets or null if not found
-*/
-async function readStageSecrets(stage, cwd = process.cwd()) {
-	const path = getSecretsPath(stage, cwd);
-	if (!existsSync(path)) return null;
-	const content = await readFile(path, "utf-8");
-	const data = JSON.parse(content);
-	if (data.version === 1 && data.encrypted && data.iv) {
-		const projectName = basename(cwd);
-		const key = await readKey(stage, projectName);
-		if (!key) throw new Error(`Decryption key not found for stage "${stage}". Expected key at: ~/.gkm/${projectName}/${stage}.key`);
-		return decryptSecretsData(data, key);
-	}
-	return data;
-}
-/**
-* Write secrets for a stage (encrypted).
-* Creates or uses existing encryption key at ~/.gkm/{project}/{stage}.key
-*/
-async function writeStageSecrets(secrets, cwd = process.cwd()) {
-	const dir = getSecretsDir(cwd);
-	const path = getSecretsPath(secrets.stage, cwd);
-	const projectName = basename(cwd);
-	await mkdir(dir, { recursive: true });
-	const encrypted = encryptSecretsData(secrets, await getOrCreateKey(secrets.stage, projectName));
-	await writeFile(path, JSON.stringify(encrypted, null, 2), "utf-8");
-}
-/**
-* Convert StageSecrets to embeddable format (flat key-value pairs).
-* This is what gets encrypted and embedded in the bundle.
-*/
-function toEmbeddableSecrets(secrets) {
-	return {
-		...secrets.urls,
-		...secrets.custom,
-		...secrets.services.postgres && {
-			POSTGRES_USER: secrets.services.postgres.username,
-			POSTGRES_PASSWORD: secrets.services.postgres.password,
-			POSTGRES_DB: secrets.services.postgres.database ?? "app",
-			POSTGRES_HOST: secrets.services.postgres.host,
-			POSTGRES_PORT: String(secrets.services.postgres.port)
-		},
-		...secrets.services.redis && {
-			REDIS_PASSWORD: secrets.services.redis.password,
-			REDIS_HOST: secrets.services.redis.host,
-			REDIS_PORT: String(secrets.services.redis.port)
-		},
-		...secrets.services.minio && {
-			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
-			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
-			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
-			STORAGE_REGION: "eu-west-1",
-			STORAGE_FORCE_PATH_STYLE: "true"
-		},
-		...secrets.services.mailpit && {
-			SMTP_HOST: secrets.services.mailpit.host,
-			SMTP_PORT: String(secrets.services.mailpit.port),
-			SMTP_USER: secrets.services.mailpit.username,
-			SMTP_PASS: secrets.services.mailpit.password,
-			SMTP_SECURE: "false",
-			MAIL_FROM: "noreply@localhost"
-		},
-		...secrets.services.localstack && {
-			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
-			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
-			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
-			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
-		},
-		...secrets.services.pgboss && {
-			PGBOSS_DB_USER: secrets.services.pgboss.username,
-			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
-		}
-	};
-}
-/**
-* Update a custom secret in the secrets file.
-*/
-async function setCustomSecret(stage, key, value, cwd = process.cwd()) {
-	const secrets = await readStageSecrets(stage, cwd);
-	if (!secrets) throw new Error(`Secrets not found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
-	const updated = {
-		...secrets,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		custom: {
-			...secrets.custom,
-			[key]: value
-		}
-	};
-	await writeStageSecrets(updated, cwd);
-	return updated;
-}
-/**
-* Mask a password for display (show first 4 and last 2 chars).
-*/
-function maskPassword(password) {
-	if (password.length <= 8) return "********";
-	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
-}
-/**
-* Validate that all required environment variables are present in secrets.
-*
-* @param requiredVars - Array of environment variable names required by the application
-* @param secrets - Stage secrets to validate against
-* @returns Validation result with missing and provided variables
-*
-* @example
-* ```typescript
-* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
-* const secrets = await readStageSecrets('production');
-* const result = validateEnvironmentVariables(required, secrets);
-*
-* if (!result.valid) {
-*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
-* }
-* ```
-*/
-function validateEnvironmentVariables(requiredVars, secrets) {
-	const embeddable = toEmbeddableSecrets(secrets);
-	const availableVars = new Set(Object.keys(embeddable));
-	const missing = [];
-	const provided = [];
-	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
-	else missing.push(varName);
-	return {
-		valid: missing.length === 0,
-		missing: missing.sort(),
-		provided: provided.sort(),
-		required: [...requiredVars].sort()
-	};
-}
-//#endregion
-export { storage_exports as a, getKeyPath as c, setCustomSecret as i, readStageSecrets as n, toEmbeddableSecrets as o, secretsExist as r, writeStageSecrets as s, maskPassword as t };
-
-//# sourceMappingURL=storage-BjTLjDDp.mjs.map