@geekmidas/cli 10.0.0-alpha.4 → 10.0.0-alpha.41

package/dist/reconcile/public.cjs

@@ -1,9 +1,9 @@
-const require_discover = require('../discover-DTmFeloL.cjs');
-const require_emit = require('../emit-CbcRolsa.cjs');
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_discover = require("../discover-B0f_kuNN.cjs");
+const require_emit = require("../emit-BdoPFjZf.cjs");
 exports.MANIFEST_PATH = require_emit.MANIFEST_PATH;
 exports.discover = require_discover.discover;
 exports.isDeclarable = require_discover.isDeclarable;
 exports.manifestModule = require_emit.manifestModule;
 exports.withRoutes = require_emit.withRoutes;
-exports.writeManifestModule = require_emit.writeManifestModule;
+exports.writeManifestModule = require_emit.writeManifestModule;

package/dist/reconcile/public.d.cts

@@ -1,8 +1,6 @@
-import { CacheBackend, EmailBackend } from "../types-BhIl-COG.cjs";
+import { n as EmailBackend, t as CacheBackend } from "../types-DfdYe31u.cjs";
 import { ConstructManifest, Declaration, RouteInfo } from "@geekmidas/manifest";
-
 //#region src/reconcile/discover.d.ts
-
 /** The construct face discovery needs: an id, and the ability to declare. */
 interface Declarable {
   id: string;
@@ -15,7 +13,7 @@ interface Declarable {
  * `service` is still a construct, and requiring one would exclude the kinds that
  * own no address.
  */
-declare function isDeclarable(value: unknown): value is Declarable;
+export declare function isDeclarable(value: unknown): value is Declarable;
 interface DiscoverOptions {
   /** The glob(s) to search. One pattern, not one per kind. */
   patterns: string | readonly string[];
@@ -39,6 +37,18 @@ interface DiscoverOptions {
    * caller, which wants the manifest and nothing else, is unchanged.
    */
   sources?: Record<string, ConstructSource>;
+  /**
+   * Filled in, when provided, with the ids each owner's runnables declared an
+   * edge to — keyed by the surface an endpoint was built from, or the worker
+   * a cron or subscriber was.
+   *
+   * A runnable is not a declaration: a surface's endpoints are found by the
+   * glob, not listed by the surface, so its node says `endpoints: []` until a
+   * build folds the routes in. Anything deciding what an app's process reaches
+   * — which keys its container is given — needs those edges before any build,
+   * and discovery is already importing the files they are in.
+   */
+  runnables?: Record<string, string[]>;
 }
 /** Where a construct was declared, and under what name. */
 interface ConstructSource {
@@ -46,6 +56,13 @@ interface ConstructSource {
   file: string;
   /** The name it was exported as — what an import statement has to say. */
   exportName: string;
+  /**
+   * The exported construct itself.
+   *
+   * What a declaration cannot say — whether it serves itself — the object can
+   * be asked, and discovery already imported it.
+   */
+  construct: unknown;
 }
 /**
  * Build the construct manifest for a project.
@@ -55,12 +72,11 @@ interface ConstructSource {
  *
  * @throws {DuplicateConstruct} when two exports claim one id.
  */
-declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
-/** Two constructs claiming one id. */
+export declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
 //#endregion
 //#region src/reconcile/emit.d.ts
 /** Where the build writes it, relative to the app root. */
-declare const MANIFEST_PATH = ".gkm/manifest.ts";
+export declare const MANIFEST_PATH = ".gkm/manifest.ts";
 /**
  * Fold the build's generated routes into the surface that serves them.
  *
@@ -89,37 +105,22 @@ declare const MANIFEST_PATH = ".gkm/manifest.ts";
  * document's contents depend on which `--provider` ran last. A manifest must not
  * do that.
  */
-declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
+export declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
   perRoute: boolean;
 }): ConstructManifest;
-/**
- * Fold in the compute the build generated: functions, crons, queue workers and
- * topic subscribers.
- *
- * All four are named by their *export*, the same way an endpoint's handler is —
- * `CronGenerator` uses the export key as the name — so none of them can declare
- * themselves and all of them are the build's to add. That is why a `Function`
- * has no `declare()` and never will.
- *
- * A worker and a subscriber **nest** inside the queue or topic that triggers
- * them, because position carries the trigger. A function and a cron are
- * top-level, because nothing triggers them but a caller or a clock.
- */
-
 /**
  * The manifest as TypeScript source.
  *
  * Pure, so what gets written can be asserted without touching a filesystem.
  */
-declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
+export declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
 /** Write it where the deploy config expects to import it from. */
-declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
+export declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
 /** The choices that are deployment config rather than declaration. */
 interface Backends {
   cache?: CacheBackend;
   email?: EmailBackend;
 }
-//# sourceMappingURL=emit.d.ts.map
 //#endregion
-export { DiscoverOptions, MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };
+export type { DiscoverOptions };
 //# sourceMappingURL=public.d.cts.map

package/dist/reconcile/public.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"sourcesContent":[],"mappings":";;;;;;AAiGU,UAnEA,UAAA,CAmEA;;aAjEE;;ACKZ;AA8BA;;;;;AAIoB;AA2JJ,iBDxLA,YAAA,CCwLc,KAAA,EAAA,OAAA,CAAA,EAAA,KAAA,IDxLyB,UCwLzB;AAAA,UD5Kb,eAAA,CC4Ka;EAAA;EACF,QACjB,EAAA,MAAA,GAAA,SAAA,MAAA,EAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EA8BF;;;;;AAIZ;EAUO,SAAA,CAAA,EAAQ,OAAA;EAAA;;;AAEJ;;;;;;;;YDtMV,eAAe;;;UAIT,eAAA;;;;;;;;;;;;;;iBAeK,QAAA,UACZ,kBACP,QAAQ;;;;AC5DX;AA8BgB,cA9BH,aAAA,GA8Ba,kBAAA;;;;;AAIN;AA2JpB;;;;AAEwB;AA8BxB;;;;;AAIU;AAUV;;;;AAEqB;;;;;;;;iBA/ML,UAAA,WACL,oCACO;;IAEf;;;;;;;;;;;;;;;;;;;;iBA2Ja,cAAA,WACL,8BACA;;iBA8BW,mBAAA,WACX,+CAEA,WACR;;UAUc,QAAA;UACR;UACA"}
+{"version":3,"file":"public.d.cts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"mappings":";;;;UA8BU;EACT;EACA,WAAW;;;;;;;;;wBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;;;;;;;;;;EAYzB,YAAY;;;UAII;;EAEhB;;EAEA;;;;;;;EAOA;;;;;;;;;;wBAWqB,SACrB,SAAS,kBACP,QAAQ;;;;qBC/EE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8BG,WACf,UAAU,mBACV,iBAAiB,aACjB;EAAW;IACT;;;;;;wBA2Ja,eACf,UAAU,mBACV,WAAU;;wBA8BW,oBACrB,UAAU,mBACV,iBACA,WAAU,WACR;;UAUc;EAChB,QAAQ;EACR,QAAQ"}

package/dist/reconcile/public.d.mts

@@ -1,8 +1,6 @@
-import { CacheBackend, EmailBackend } from "../types-C-arnQ1r.mjs";
+import { n as EmailBackend, t as CacheBackend } from "../types-0R124hrY.mjs";
 import { ConstructManifest, Declaration, RouteInfo } from "@geekmidas/manifest";
-
 //#region src/reconcile/discover.d.ts
-
 /** The construct face discovery needs: an id, and the ability to declare. */
 interface Declarable {
   id: string;
@@ -15,7 +13,7 @@ interface Declarable {
  * `service` is still a construct, and requiring one would exclude the kinds that
  * own no address.
  */
-declare function isDeclarable(value: unknown): value is Declarable;
+export declare function isDeclarable(value: unknown): value is Declarable;
 interface DiscoverOptions {
   /** The glob(s) to search. One pattern, not one per kind. */
   patterns: string | readonly string[];
@@ -39,6 +37,18 @@ interface DiscoverOptions {
    * caller, which wants the manifest and nothing else, is unchanged.
    */
   sources?: Record<string, ConstructSource>;
+  /**
+   * Filled in, when provided, with the ids each owner's runnables declared an
+   * edge to — keyed by the surface an endpoint was built from, or the worker
+   * a cron or subscriber was.
+   *
+   * A runnable is not a declaration: a surface's endpoints are found by the
+   * glob, not listed by the surface, so its node says `endpoints: []` until a
+   * build folds the routes in. Anything deciding what an app's process reaches
+   * — which keys its container is given — needs those edges before any build,
+   * and discovery is already importing the files they are in.
+   */
+  runnables?: Record<string, string[]>;
 }
 /** Where a construct was declared, and under what name. */
 interface ConstructSource {
@@ -46,6 +56,13 @@ interface ConstructSource {
   file: string;
   /** The name it was exported as — what an import statement has to say. */
   exportName: string;
+  /**
+   * The exported construct itself.
+   *
+   * What a declaration cannot say — whether it serves itself — the object can
+   * be asked, and discovery already imported it.
+   */
+  construct: unknown;
 }
 /**
  * Build the construct manifest for a project.
@@ -55,12 +72,11 @@ interface ConstructSource {
  *
  * @throws {DuplicateConstruct} when two exports claim one id.
  */
-declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
-/** Two constructs claiming one id. */
+export declare function discover(options: DiscoverOptions): Promise<ConstructManifest>;
 //#endregion
 //#region src/reconcile/emit.d.ts
 /** Where the build writes it, relative to the app root. */
-declare const MANIFEST_PATH = ".gkm/manifest.ts";
+export declare const MANIFEST_PATH = ".gkm/manifest.ts";
 /**
  * Fold the build's generated routes into the surface that serves them.
  *
@@ -89,37 +105,22 @@ declare const MANIFEST_PATH = ".gkm/manifest.ts";
  * document's contents depend on which `--provider` ran last. A manifest must not
  * do that.
  */
-declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
+export declare function withRoutes(manifest: ConstructManifest, routes: readonly RouteInfo[], options: {
   perRoute: boolean;
 }): ConstructManifest;
-/**
- * Fold in the compute the build generated: functions, crons, queue workers and
- * topic subscribers.
- *
- * All four are named by their *export*, the same way an endpoint's handler is —
- * `CronGenerator` uses the export key as the name — so none of them can declare
- * themselves and all of them are the build's to add. That is why a `Function`
- * has no `declare()` and never will.
- *
- * A worker and a subscriber **nest** inside the queue or topic that triggers
- * them, because position carries the trigger. A function and a cron are
- * top-level, because nothing triggers them but a caller or a clock.
- */
-
 /**
  * The manifest as TypeScript source.
  *
  * Pure, so what gets written can be asserted without touching a filesystem.
  */
-declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
+export declare function manifestModule(manifest: ConstructManifest, backends?: Backends): string;
 /** Write it where the deploy config expects to import it from. */
-declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
+export declare function writeManifestModule(manifest: ConstructManifest, appRoot: string, backends?: Backends): Promise<string>;
 /** The choices that are deployment config rather than declaration. */
 interface Backends {
   cache?: CacheBackend;
   email?: EmailBackend;
 }
-//# sourceMappingURL=emit.d.ts.map
 //#endregion
-export { DiscoverOptions, MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };
+export type { DiscoverOptions };
 //# sourceMappingURL=public.d.mts.map

package/dist/reconcile/public.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"sourcesContent":[],"mappings":";;;;;;AAiGU,UAnEA,UAAA,CAmEA;;aAjEE;;ACKZ;AA8BA;;;;;AAIoB;AA2JJ,iBDxLA,YAAA,CCwLc,KAAA,EAAA,OAAA,CAAA,EAAA,KAAA,IDxLyB,UCwLzB;AAAA,UD5Kb,eAAA,CC4Ka;EAAA;EACF,QACjB,EAAA,MAAA,GAAA,SAAA,MAAA,EAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EA8BF;;;;;AAIZ;EAUO,SAAA,CAAA,EAAQ,OAAA;EAAA;;;AAEJ;;;;;;;;YDtMV,eAAe;;;UAIT,eAAA;;;;;;;;;;;;;;iBAeK,QAAA,UACZ,kBACP,QAAQ;;;;AC5DX;AA8BgB,cA9BH,aAAA,GA8Ba,kBAAA;;;;;AAIN;AA2JpB;;;;AAEwB;AA8BxB;;;;;AAIU;AAUV;;;;AAEqB;;;;;;;;iBA/ML,UAAA,WACL,oCACO;;IAEf;;;;;;;;;;;;;;;;;;;;iBA2Ja,cAAA,WACL,8BACA;;iBA8BW,mBAAA,WACX,+CAEA,WACR;;UAUc,QAAA;UACR;UACA"}
+{"version":3,"file":"public.d.mts","names":[],"sources":["../../src/reconcile/discover.ts","../../src/reconcile/emit.ts"],"mappings":";;;;UA8BU;EACT;EACA,WAAW;;;;;;;;;wBAUI,aAAa,iBAAiB,SAAS;UAYtC;;EAEhB;EACA;;;;;;;EAOA;;;;;;;;;;;;EAYA,UAAU,eAAe;;;;;;;;;;;;EAYzB,YAAY;;;UAII;;EAEhB;;EAEA;;;;;;;EAOA;;;;;;;;;;wBAWqB,SACrB,SAAS,kBACP,QAAQ;;;;qBC/EE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA8BG,WACf,UAAU,mBACV,iBAAiB,aACjB;EAAW;IACT;;;;;;wBA2Ja,eACf,UAAU,mBACV,WAAU;;wBA8BW,oBACrB,UAAU,mBACV,iBACA,WAAU,WACR;;UAUc;EAChB,QAAQ;EACR,QAAQ"}

package/dist/reconcile/public.mjs

@@ -1,4 +1,3 @@
-import { discover, isDeclarable } from "../discover-CAlFgYec.mjs";
-import { MANIFEST_PATH, manifestModule, withRoutes, writeManifestModule } from "../emit-CiZS_5Ub.mjs";
-
-export { MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };
+import { r as isDeclarable, t as discover } from "../discover-BLhf7V_J.mjs";
+import { a as writeManifestModule, i as withRoutes, n as manifestModule, t as MANIFEST_PATH } from "../emit-Bzq7JsMP.mjs";
+export { MANIFEST_PATH, discover, isDeclarable, manifestModule, withRoutes, writeManifestModule };

package/dist/{reconcile-CFs8C_1a.mjs → reconcile--I7V4Klj.mjs}

@@ -1,6 +1,4 @@
-import "./generator-VE2JrFlY.mjs";
-import { generateFullstackCustomSecrets } from "./fullstack-secrets-D1o9-G5l.mjs";
-
+import { t as generateFullstackCustomSecrets } from "./index.mjs";
 //#region src/secrets/reconcile.ts
 /**
 * Reconcile missing custom secrets for a workspace.
@@ -12,8 +10,7 @@ import { generateFullstackCustomSecrets } from "./fullstack-secrets-D1o9-G5l.mjs
 * @returns ReconcileResult if keys were added, null if secrets are up-to-date
 */
 function reconcileMissingSecrets(secrets, workspace, containers = []) {
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (!isMultiApp) return null;
+	if (!(Object.keys(workspace.apps).length > 1)) return null;
 	const expectedCustom = generateFullstackCustomSecrets(workspace, containers);
 	const addedKeys = [];
 	const mergedCustom = { ...secrets.custom };
@@ -31,7 +28,7 @@ function reconcileMissingSecrets(secrets, workspace, containers = []) {
 		addedKeys
 	};
 }
-
 //#endregion
 export { reconcileMissingSecrets };
-//# sourceMappingURL=reconcile-CFs8C_1a.mjs.map
+
+//# sourceMappingURL=reconcile--I7V4Klj.mjs.map

package/dist/reconcile--I7V4Klj.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile--I7V4Klj.mjs","names":[],"sources":["../src/secrets/reconcile.ts"],"sourcesContent":["import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace, containers);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAoBA,SAAgB,wBACf,SACA,WACA,aAAgC,CAAC,GACR;CAEzB,IAAI,EADe,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAEvD,OAAO;CAGR,MAAM,iBAAiB,+BAA+B,WAAW,UAAU;CAC3E,MAAM,YAAsB,CAAC;CAC7B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAO;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,GACvD,IAAI,EAAE,OAAO,eAAe;EAC3B,aAAa,OAAO;EACpB,UAAU,KAAK,GAAG;CACnB;CAGD,IAAI,UAAU,WAAW,GACxB,OAAO;CAGR,OAAO;EACN,SAAS;GACR,GAAG;GACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,QAAQ;EACT;EACA;CACD;AACD"}

package/dist/{reconcile-D0pimNiy.cjs → reconcile-CuCQBa5-.cjs}

@@ -1,6 +1,4 @@
-require('./generator-CNzBw7g5.cjs');
-const require_fullstack_secrets = require('./fullstack-secrets-C-GGohke.cjs');
-
+const require_index = require("./index.cjs");
 //#region src/secrets/reconcile.ts
 /**
 * Reconcile missing custom secrets for a workspace.
@@ -12,9 +10,8 @@ const require_fullstack_secrets = require('./fullstack-secrets-C-GGohke.cjs');
 * @returns ReconcileResult if keys were added, null if secrets are up-to-date
 */
 function reconcileMissingSecrets(secrets, workspace, containers = []) {
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (!isMultiApp) return null;
-	const expectedCustom = require_fullstack_secrets.generateFullstackCustomSecrets(workspace, containers);
+	if (!(Object.keys(workspace.apps).length > 1)) return null;
+	const expectedCustom = require_index.generateFullstackCustomSecrets(workspace, containers);
 	const addedKeys = [];
 	const mergedCustom = { ...secrets.custom };
 	for (const [key, value] of Object.entries(expectedCustom)) if (!(key in mergedCustom)) {
@@ -31,7 +28,7 @@ function reconcileMissingSecrets(secrets, workspace, containers = []) {
 		addedKeys
 	};
 }
-
 //#endregion
 exports.reconcileMissingSecrets = reconcileMissingSecrets;
-//# sourceMappingURL=reconcile-D0pimNiy.cjs.map
+
+//# sourceMappingURL=reconcile-CuCQBa5-.cjs.map

package/dist/reconcile-CuCQBa5-.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-CuCQBa5-.cjs","names":["generateFullstackCustomSecrets"],"sources":["../src/secrets/reconcile.ts"],"sourcesContent":["import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace, containers);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAoBA,SAAgB,wBACf,SACA,WACA,aAAgC,CAAC,GACR;CAEzB,IAAI,EADe,OAAO,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAEvD,OAAO;CAGR,MAAM,iBAAiBA,cAAAA,+BAA+B,WAAW,UAAU;CAC3E,MAAM,YAAsB,CAAC;CAC7B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAO;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,cAAc,GACvD,IAAI,EAAE,OAAO,eAAe;EAC3B,aAAa,OAAO;EACpB,UAAU,KAAK,GAAG;CACnB;CAGD,IAAI,UAAU,WAAW,GACxB,OAAO;CAGR,OAAO;EACN,SAAS;GACR,GAAG;GACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,QAAQ;EACT;EACA;CACD;AACD"}

package/dist/rolldown-runtime-BhDjJH2R.mjs

@@ -0,0 +1,15 @@
+import { createRequire } from "node:module";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();
+//#endregion
+export { __require as n, __exportAll as t };

package/dist/{chunk-CUT6urMc.cjs → rolldown-runtime-C0BPl7ul.cjs}

@@ -1,10 +1,19 @@
-//#region rolldown:runtime
+//#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
 var __copyProps = (to, from, except, desc) => {
 	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
 		key = keys[i];
@@ -15,16 +24,20 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
-
 //#endregion
-
-Object.defineProperty(exports, '__toESM', {
-  enumerable: true,
-  get: function () {
-    return __toESM;
-  }
-});
+Object.defineProperty(exports, "__exportAll", {
+	enumerable: true,
+	get: function() {
+		return __exportAll;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});

package/dist/storage-BzaUxmqe.mjs

@@ -0,0 +1,124 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+//#region src/secrets/storage.ts
+var storage_exports = /* @__PURE__ */ __exportAll({
+	initStageSecrets: () => initStageSecrets,
+	maskPassword: () => maskPassword,
+	toEmbeddableSecrets: () => toEmbeddableSecrets,
+	validateEnvironmentVariables: () => validateEnvironmentVariables,
+	withCustomSecret: () => withCustomSecret
+});
+/**
+* Initialize an empty StageSecrets object for a stage.
+*/
+function initStageSecrets(stage) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		stage,
+		createdAt: now,
+		updatedAt: now,
+		services: {},
+		urls: {},
+		custom: {}
+	};
+}
+/**
+* Convert StageSecrets to embeddable format (flat key-value pairs).
+* This is what gets encrypted and embedded in the bundle.
+*/
+function toEmbeddableSecrets(secrets) {
+	return {
+		...secrets.urls,
+		...secrets.custom,
+		...secrets.services.postgres && {
+			POSTGRES_USER: secrets.services.postgres.username,
+			POSTGRES_PASSWORD: secrets.services.postgres.password,
+			POSTGRES_DB: secrets.services.postgres.database ?? "app",
+			POSTGRES_HOST: secrets.services.postgres.host,
+			POSTGRES_PORT: String(secrets.services.postgres.port)
+		},
+		...secrets.services.redis && {
+			REDIS_PASSWORD: secrets.services.redis.password,
+			REDIS_HOST: secrets.services.redis.host,
+			REDIS_PORT: String(secrets.services.redis.port)
+		},
+		...secrets.services.minio && {
+			STORAGE_ACCESS_KEY_ID: secrets.services.minio.username,
+			STORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,
+			STORAGE_BUCKET: secrets.services.minio.bucket ?? "app",
+			STORAGE_REGION: "eu-west-1",
+			STORAGE_FORCE_PATH_STYLE: "true"
+		},
+		...secrets.services.mailpit && {
+			SMTP_HOST: secrets.services.mailpit.host,
+			SMTP_PORT: String(secrets.services.mailpit.port),
+			SMTP_USER: secrets.services.mailpit.username,
+			SMTP_PASS: secrets.services.mailpit.password,
+			SMTP_SECURE: "false",
+			MAIL_FROM: "noreply@localhost"
+		},
+		...secrets.services.localstack && {
+			AWS_ACCESS_KEY_ID: secrets.services.localstack.accessKeyId ?? secrets.services.localstack.username,
+			AWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,
+			AWS_REGION: secrets.services.localstack.region ?? "us-east-1",
+			AWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`
+		},
+		...secrets.services.pgboss && {
+			PGBOSS_DB_USER: secrets.services.pgboss.username,
+			PGBOSS_DB_PASSWORD: secrets.services.pgboss.password
+		}
+	};
+}
+/** The same secrets with one custom value set, and `updatedAt` moved on. */
+function withCustomSecret(secrets, key, value) {
+	return {
+		...secrets,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom: {
+			...secrets.custom,
+			[key]: value
+		}
+	};
+}
+/**
+* Mask a password for display (show first 4 and last 2 chars).
+*/
+function maskPassword(password) {
+	if (password.length <= 8) return "********";
+	return `${password.slice(0, 4)}${"*".repeat(password.length - 6)}${password.slice(-2)}`;
+}
+/**
+* Validate that all required environment variables are present in secrets.
+*
+* @param requiredVars - Array of environment variable names required by the application
+* @param secrets - Stage secrets to validate against
+* @returns Validation result with missing and provided variables
+*
+* @example
+* ```typescript
+* const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];
+* const secrets = await secretsStoreFor(workspace, 'production').then((s) => s.read('production'));
+* const result = validateEnvironmentVariables(required, secrets);
+*
+* if (!result.valid) {
+*   console.error(`Missing environment variables: ${result.missing.join(', ')}`);
+* }
+* ```
+*/
+function validateEnvironmentVariables(requiredVars, secrets) {
+	const embeddable = toEmbeddableSecrets(secrets);
+	const availableVars = new Set(Object.keys(embeddable));
+	const missing = [];
+	const provided = [];
+	for (const varName of requiredVars) if (availableVars.has(varName)) provided.push(varName);
+	else missing.push(varName);
+	return {
+		valid: missing.length === 0,
+		missing: missing.sort(),
+		provided: provided.sort(),
+		required: [...requiredVars].sort()
+	};
+}
+//#endregion
+export { withCustomSecret as a, toEmbeddableSecrets as i, maskPassword as n, storage_exports as r, initStageSecrets as t };
+
+//# sourceMappingURL=storage-BzaUxmqe.mjs.map

package/dist/storage-BzaUxmqe.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-BzaUxmqe.mjs","names":[],"sources":["../src/secrets/storage.ts"],"sourcesContent":["/**\n * What a stage's secrets are, independent of where they are kept: building\n * them, changing them, and handing them to a process. Where they are kept is a\n * {@link SecretsStore}'s business — see `secretsStoreFor`.\n */\n\nimport type { SecretsStore } from './store.js';\nimport type { EmbeddableSecrets, StageSecrets } from './types';\n\n/**\n * Initialize an empty StageSecrets object for a stage.\n */\nexport function initStageSecrets(stage: string): StageSecrets {\n\tconst now = new Date().toISOString();\n\treturn {\n\t\tstage,\n\t\tcreatedAt: now,\n\t\tupdatedAt: now,\n\t\tservices: {},\n\t\turls: {},\n\t\tcustom: {},\n\t};\n}\n\n/**\n * Convert StageSecrets to embeddable format (flat key-value pairs).\n * This is what gets encrypted and embedded in the bundle.\n */\nexport function toEmbeddableSecrets(secrets: StageSecrets): EmbeddableSecrets {\n\treturn {\n\t\t...secrets.urls,\n\t\t...secrets.custom,\n\t\t// Also include individual service credentials if needed\n\t\t...(secrets.services.postgres && {\n\t\t\tPOSTGRES_USER: secrets.services.postgres.username,\n\t\t\tPOSTGRES_PASSWORD: secrets.services.postgres.password,\n\t\t\tPOSTGRES_DB: secrets.services.postgres.database ?? 'app',\n\t\t\tPOSTGRES_HOST: secrets.services.postgres.host,\n\t\t\tPOSTGRES_PORT: String(secrets.services.postgres.port),\n\t\t}),\n\t\t...(secrets.services.redis && {\n\t\t\tREDIS_PASSWORD: secrets.services.redis.password,\n\t\t\tREDIS_HOST: secrets.services.redis.host,\n\t\t\tREDIS_PORT: String(secrets.services.redis.port),\n\t\t}),\n\t\t...(secrets.services.minio && {\n\t\t\tSTORAGE_ACCESS_KEY_ID: secrets.services.minio.username,\n\t\t\tSTORAGE_SECRET_ACCESS_KEY: secrets.services.minio.password,\n\t\t\tSTORAGE_BUCKET: secrets.services.minio.bucket ?? 'app',\n\t\t\tSTORAGE_REGION: 'eu-west-1',\n\t\t\tSTORAGE_FORCE_PATH_STYLE: 'true',\n\t\t}),\n\t\t...(secrets.services.mailpit && {\n\t\t\tSMTP_HOST: secrets.services.mailpit.host,\n\t\t\tSMTP_PORT: String(secrets.services.mailpit.port),\n\t\t\tSMTP_USER: secrets.services.mailpit.username,\n\t\t\tSMTP_PASS: secrets.services.mailpit.password,\n\t\t\tSMTP_SECURE: 'false',\n\t\t\tMAIL_FROM: 'noreply@localhost',\n\t\t}),\n\t\t...(secrets.services.localstack && {\n\t\t\tAWS_ACCESS_KEY_ID:\n\t\t\t\tsecrets.services.localstack.accessKeyId ??\n\t\t\t\tsecrets.services.localstack.username,\n\t\t\tAWS_SECRET_ACCESS_KEY: secrets.services.localstack.password,\n\t\t\tAWS_REGION: secrets.services.localstack.region ?? 'us-east-1',\n\t\t\tAWS_ENDPOINT_URL: `http://${secrets.services.localstack.host}:${secrets.services.localstack.port}`,\n\t\t}),\n\t\t...(secrets.services.pgboss && {\n\t\t\tPGBOSS_DB_USER: secrets.services.pgboss.username,\n\t\t\tPGBOSS_DB_PASSWORD: secrets.services.pgboss.password,\n\t\t}),\n\t};\n}\n\n/** The same secrets with one custom value set, and `updatedAt` moved on. */\nexport function withCustomSecret(\n\tsecrets: StageSecrets,\n\tkey: string,\n\tvalue: string,\n): StageSecrets {\n\treturn {\n\t\t...secrets,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tcustom: { ...secrets.custom, [key]: value },\n\t};\n}\n\n/**\n * Mask a password for display (show first 4 and last 2 chars).\n */\nexport function maskPassword(password: string): string {\n\tif (password.length <= 8) {\n\t\treturn '********';\n\t}\n\treturn `${password.slice(0, 4)}${'*'.repeat(password.length - 6)}${password.slice(-2)}`;\n}\n\n/**\n * Result of environment variable validation.\n */\nexport interface EnvValidationResult {\n\t/** Whether all required environment variables are present */\n\tvalid: boolean;\n\t/** List of missing environment variable names */\n\tmissing: string[];\n\t/** List of environment variables that are provided */\n\tprovided: string[];\n\t/** List of environment variables that were required */\n\trequired: string[];\n}\n\n/**\n * Validate that all required environment variables are present in secrets.\n *\n * @param requiredVars - Array of environment variable names required by the application\n * @param secrets - Stage secrets to validate against\n * @returns Validation result with missing and provided variables\n *\n * @example\n * ```typescript\n * const required = ['DATABASE_URL', 'API_KEY', 'JWT_SECRET'];\n * const secrets = await secretsStoreFor(workspace, 'production').then((s) => s.read('production'));\n * const result = validateEnvironmentVariables(required, secrets);\n *\n * if (!result.valid) {\n *   console.error(`Missing environment variables: ${result.missing.join(', ')}`);\n * }\n * ```\n */\nexport function validateEnvironmentVariables(\n\trequiredVars: string[],\n\tsecrets: StageSecrets,\n): EnvValidationResult {\n\tconst embeddable = toEmbeddableSecrets(secrets);\n\tconst availableVars = new Set(Object.keys(embeddable));\n\n\tconst missing: string[] = [];\n\tconst provided: string[] = [];\n\n\tfor (const varName of requiredVars) {\n\t\tif (availableVars.has(varName)) {\n\t\t\tprovided.push(varName);\n\t\t} else {\n\t\t\tmissing.push(varName);\n\t\t}\n\t}\n\n\treturn {\n\t\tvalid: missing.length === 0,\n\t\tmissing: missing.sort(),\n\t\tprovided: provided.sort(),\n\t\trequired: [...requiredVars].sort(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAYA,SAAgB,iBAAiB,OAA6B;CAC7D,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CACnC,OAAO;EACN;EACA,WAAW;EACX,WAAW;EACX,UAAU,CAAC;EACX,MAAM,CAAC;EACP,QAAQ,CAAC;CACV;AACD;;;;;AAMA,SAAgB,oBAAoB,SAA0C;CAC7E,OAAO;EACN,GAAG,QAAQ;EACX,GAAG,QAAQ;EAEX,GAAI,QAAQ,SAAS,YAAY;GAChC,eAAe,QAAQ,SAAS,SAAS;GACzC,mBAAmB,QAAQ,SAAS,SAAS;GAC7C,aAAa,QAAQ,SAAS,SAAS,YAAY;GACnD,eAAe,QAAQ,SAAS,SAAS;GACzC,eAAe,OAAO,QAAQ,SAAS,SAAS,IAAI;EACrD;EACA,GAAI,QAAQ,SAAS,SAAS;GAC7B,gBAAgB,QAAQ,SAAS,MAAM;GACvC,YAAY,QAAQ,SAAS,MAAM;GACnC,YAAY,OAAO,QAAQ,SAAS,MAAM,IAAI;EAC/C;EACA,GAAI,QAAQ,SAAS,SAAS;GAC7B,uBAAuB,QAAQ,SAAS,MAAM;GAC9C,2BAA2B,QAAQ,SAAS,MAAM;GAClD,gBAAgB,QAAQ,SAAS,MAAM,UAAU;GACjD,gBAAgB;GAChB,0BAA0B;EAC3B;EACA,GAAI,QAAQ,SAAS,WAAW;GAC/B,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,OAAO,QAAQ,SAAS,QAAQ,IAAI;GAC/C,WAAW,QAAQ,SAAS,QAAQ;GACpC,WAAW,QAAQ,SAAS,QAAQ;GACpC,aAAa;GACb,WAAW;EACZ;EACA,GAAI,QAAQ,SAAS,cAAc;GAClC,mBACC,QAAQ,SAAS,WAAW,eAC5B,QAAQ,SAAS,WAAW;GAC7B,uBAAuB,QAAQ,SAAS,WAAW;GACnD,YAAY,QAAQ,SAAS,WAAW,UAAU;GAClD,kBAAkB,UAAU,QAAQ,SAAS,WAAW,KAAK,GAAG,QAAQ,SAAS,WAAW;EAC7F;EACA,GAAI,QAAQ,SAAS,UAAU;GAC9B,gBAAgB,QAAQ,SAAS,OAAO;GACxC,oBAAoB,QAAQ,SAAS,OAAO;EAC7C;CACD;AACD;;AAGA,SAAgB,iBACf,SACA,KACA,OACe;CACf,OAAO;EACN,GAAG;EACH,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,QAAQ;GAAE,GAAG,QAAQ;IAAS,MAAM;EAAM;CAC3C;AACD;;;;AAKA,SAAgB,aAAa,UAA0B;CACtD,IAAI,SAAS,UAAU,GACtB,OAAO;CAER,OAAO,GAAG,SAAS,MAAM,GAAG,CAAC,IAAI,IAAI,OAAO,SAAS,SAAS,CAAC,IAAI,SAAS,MAAM,EAAE;AACrF;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,6BACf,cACA,SACsB;CACtB,MAAM,aAAa,oBAAoB,OAAO;CAC9C,MAAM,gBAAgB,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC;CAErD,MAAM,UAAoB,CAAC;CAC3B,MAAM,WAAqB,CAAC;CAE5B,KAAK,MAAM,WAAW,cACrB,IAAI,cAAc,IAAI,OAAO,GAC5B,SAAS,KAAK,OAAO;MAErB,QAAQ,KAAK,OAAO;CAItB,OAAO;EACN,OAAO,QAAQ,WAAW;EAC1B,SAAS,QAAQ,KAAK;EACtB,UAAU,SAAS,KAAK;EACxB,UAAU,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK;CAClC;AACD"}