@geekmidas/cli 10.0.0-alpha.46 → 10.0.0-alpha.48

package/bin/gkm.mjs

@@ -19,6 +19,10 @@ if (
 	const { createRequire } = await import('node:module');
 	const require = createRequire(import.meta.url);
 	const tsxPath = pathToFileURL(require.resolve('tsx')).href;
+	// Before tsx, so tsx reads each `.tsx` through it and compiles its JSX the
+	// way the file's own tsconfig says. See `owning-tsconfig-jsx.mjs`.
+	const jsxPath = new URL('./owning-tsconfig-jsx-register.mjs', import.meta.url)
+		.href;
 
 	const { execFileSync } = await import('node:child_process');
 	try {
@@ -26,7 +30,11 @@ if (
 			stdio: 'inherit',
 			env: {
 				...process.env,
-				NODE_OPTIONS: `${nodeOptions} --import ${tsxPath}`.trim(),
+				// `--import=<url>`, never `--import <url>`: Next.js re-parses
+				// NODE_OPTIONS for its workers, and with two space-separated imports
+				// its parser glued them into one specifier `next build` could not find.
+				NODE_OPTIONS:
+					`${nodeOptions} --import=${jsxPath} --import=${tsxPath}`.trim(),
 			},
 		});
 	} catch (e) {

package/bin/owning-tsconfig-jsx-register.mjs

@@ -0,0 +1,18 @@
+/**
+ * The `--import` that installs `owning-tsconfig-jsx.mjs` — it must come before
+ * tsx's own `--import`, so that tsx reads the source through it.
+ *
+ * Registered with `module.register()` whatever tsx chose: tsx's in-thread hooks
+ * (`registerHooks`, Node 22.22.3+ / 24.11.1+) hand off to the off-thread chain
+ * when they load a file, and on older Node tsx registers off-thread too, after
+ * this — so either way this hook is asked after tsx, for the file's source.
+ */
+
+import { register } from 'node:module';
+import { isInternalThread } from 'node:worker_threads';
+
+// As tsx guards its own: where Node runs preloads in the hooks thread too,
+// registering from there would hook the hooks.
+if (!isInternalThread) {
+	register('./owning-tsconfig-jsx.mjs', import.meta.url);
+}

package/bin/owning-tsconfig-jsx.mjs

@@ -0,0 +1,108 @@
+/**
+ * Compile a `.tsx` file's JSX the way the tsconfig that owns it says to.
+ *
+ * tsx applies one tsconfig to the whole process — the one in the directory the
+ * command ran from — and only to the files that tsconfig's `include` covers.
+ * `gkm dev` runs each app from its own directory, so a construct's template in
+ * the workspace (`constructs/templates/MagicLink.tsx`) was outside the app's
+ * `include` and compiled with esbuild's defaults: the classic runtime, which
+ * calls `React.createElement` in a file that never imported React, because the
+ * root tsconfig's `"jsx": "react-jsx"` said it need not. It threw
+ * `React is not defined` at render under `gkm dev` and rendered under
+ * `gkm test`, where Vitest compiles each file with its nearest tsconfig.
+ *
+ * Pointing tsx at the root tsconfig instead would only move the problem: an
+ * app may set its own `jsx` or `jsxImportSource` (a Hono app's `hono/jsx`), and
+ * one tsconfig per process is the same mistake `adjacent-tsconfig.mjs` exists
+ * to undo for path aliases. tsx has no per-file tsconfig, but esbuild — which
+ * tsx compiles with — honours JSX pragmas in a file over its options. So this
+ * hook, registered before tsx so that it sits between tsx and the file on disk,
+ * appends the owning tsconfig's JSX settings to the source as pragmas.
+ *
+ * The owning tsconfig is the nearest one above the file, as Vitest and
+ * `adjacent-tsconfig.mjs` choose it. A file that already carries its own JSX
+ * pragma, or whose tsconfig asks for nothing a pragma can say (`preserve`, or
+ * no `jsx` at all), is left exactly as it is. The pragma goes at the end, so no
+ * line of the file moves and its stack traces still point at the right place.
+ *
+ * Only ESM sources pass through here: for a CommonJS module tsx reads the file
+ * itself, and those keep the process tsconfig's behaviour.
+ */
+
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getTsconfig } from 'get-tsconfig';
+
+const JSX_SOURCE = /\.[jt]sx$/;
+/** A pragma the file chose for itself, which this hook never overrides. */
+const OWN_PRAGMA = /@jsx(?:Runtime|ImportSource|Frag)?\s/;
+
+/** Directory → the pragma its owning tsconfig implies, or `null`. */
+const pragmas = new Map();
+/** Shared with `get-tsconfig`, so a config `extends` is read once. */
+const tsconfigCache = new Map();
+
+/**
+ * The pragma comment that tells esbuild what these compiler options tell
+ * TypeScript, or `null` when there is nothing to say.
+ */
+export function jsxPragma(compilerOptions = {}) {
+	const jsx = compilerOptions.jsx?.toLowerCase();
+
+	if (jsx === 'react-jsx' || jsx === 'react-jsxdev') {
+		const source = compilerOptions.jsxImportSource ?? 'react';
+		return `/* @jsxRuntime automatic @jsxImportSource ${source} */`;
+	}
+
+	if (jsx === 'react') {
+		const parts = ['@jsxRuntime classic'];
+		if (compilerOptions.jsxFactory) {
+			parts.push(`@jsx ${compilerOptions.jsxFactory}`);
+		}
+		if (compilerOptions.jsxFragmentFactory) {
+			parts.push(`@jsxFrag ${compilerOptions.jsxFragmentFactory}`);
+		}
+		return `/* ${parts.join(' ')} */`;
+	}
+
+	// `preserve` and `react-native` leave JSX in the output, which no pragma
+	// can ask for; without `jsx` TypeScript compiles no `.tsx` at all.
+	return null;
+}
+
+function pragmaFor(directory) {
+	if (!pragmas.has(directory)) {
+		const tsconfig = getTsconfig(directory, 'tsconfig.json', tsconfigCache);
+		pragmas.set(directory, jsxPragma(tsconfig?.config.compilerOptions));
+	}
+	return pragmas.get(directory);
+}
+
+/** The JSX file at this URL, when it is one of the project's own. */
+function jsxFilePath(url) {
+	if (!url.startsWith('file:')) return null;
+
+	const path = fileURLToPath(url.split(/[?#]/)[0]);
+	if (!JSX_SOURCE.test(path) || path.includes('/node_modules/')) return null;
+
+	return path;
+}
+
+/** For `module.register()`, so it runs behind tsx however tsx registered. */
+export async function load(url, context, nextLoad) {
+	const loaded = await nextLoad(url, context);
+
+	const path = jsxFilePath(url);
+	if (!path || loaded.source == null) return loaded;
+
+	const pragma = pragmaFor(dirname(path));
+	if (!pragma) return loaded;
+
+	const source =
+		typeof loaded.source === 'string'
+			? loaded.source
+			: new TextDecoder().decode(loaded.source);
+	if (OWN_PRAGMA.test(source)) return loaded;
+
+	return { ...loaded, source: `${source}\n${pragma}\n` };
+}

package/dist/backends-B9V2XD2M.cjs

@@ -0,0 +1,82 @@
+const require_ready = require("./ready-lr2Fm-ep.cjs");
+//#region src/workspace/backends.ts
+/**
+* Which backend each declared kind resolves to — decided by where the project
+* deploys, and by nothing else.
+*
+* These used to be read out of a `services:` block, where one key answered two
+* questions: *does this exist* and *what backs it*. The first is the manifest's
+* — a declared `Cache` is why there is a cache — and the second is the deploy
+* target's, because the right cache for a Lambda is not the right cache for a
+* box already running Postgres. With both answered elsewhere there was nothing
+* left for the block to say, so it is gone and these read the target.
+*
+* Mail has no answer here at all: every provider speaks SMTP, so the provider
+* is whichever one the stage's mail URL points at.
+*/
+/**
+* Which family of defaults a workspace's deploy target belongs to.
+*
+* One question, asked once: **does this target run containers the project
+* controls?** Dokploy and a bare server do, so a bucket or a cache can live
+* beside the app; AWS, Vercel and Cloudflare do not, so the default has to be
+* something managed. That is the whole of the distinction, and it is why
+* `MainProvider` is the right axis rather than the deploy target's own name —
+* three targets share one answer.
+*
+* An AWS deploy names `deploy.default: 'sst'`, because it goes through SST.
+*/
+function providerOf(workspace) {
+	const target = workspace.deploy?.default;
+	return target === "dokploy" || target === "server" ? "server" : "aws";
+}
+/**
+* The cache backend a target implies.
+*
+* The same answer locally and deployed: a local `gkm dev` for an AWS app still
+* uses the Upstash protocol, because a backend that differed between the two
+* would be worse than a slower one.
+*/
+function cacheBackendFor(on) {
+	return require_ready.DEFAULT_CACHE[on];
+}
+/** Where a declared bucket lives on a target. */
+function storageBackendFor(on) {
+	return require_ready.DEFAULT_STORAGE[on];
+}
+/**
+* Which broker carries declared queues and topics on a target.
+*
+* Only consulted when something declares one; a project with no `Topic` or
+* `Queue` has no events at all, whatever the target.
+*/
+function eventsBackendFor(on) {
+	return require_ready.DEFAULT_EVENTS[on];
+}
+//#endregion
+Object.defineProperty(exports, "cacheBackendFor", {
+	enumerable: true,
+	get: function() {
+		return cacheBackendFor;
+	}
+});
+Object.defineProperty(exports, "eventsBackendFor", {
+	enumerable: true,
+	get: function() {
+		return eventsBackendFor;
+	}
+});
+Object.defineProperty(exports, "providerOf", {
+	enumerable: true,
+	get: function() {
+		return providerOf;
+	}
+});
+Object.defineProperty(exports, "storageBackendFor", {
+	enumerable: true,
+	get: function() {
+		return storageBackendFor;
+	}
+});
+
+//# sourceMappingURL=backends-B9V2XD2M.cjs.map

package/dist/backends-B9V2XD2M.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backends-B9V2XD2M.cjs","names":["DEFAULT_CACHE","DEFAULT_STORAGE","DEFAULT_EVENTS"],"sources":["../src/workspace/backends.ts"],"sourcesContent":["/**\n * Which backend each declared kind resolves to — decided by where the project\n * deploys, and by nothing else.\n *\n * These used to be read out of a `services:` block, where one key answered two\n * questions: *does this exist* and *what backs it*. The first is the manifest's\n * — a declared `Cache` is why there is a cache — and the second is the deploy\n * target's, because the right cache for a Lambda is not the right cache for a\n * box already running Postgres. With both answered elsewhere there was nothing\n * left for the block to say, so it is gone and these read the target.\n *\n * Mail has no answer here at all: every provider speaks SMTP, so the provider\n * is whichever one the stage's mail URL points at.\n */\n\nimport {\n\ttype CacheBackend,\n\tDEFAULT_CACHE,\n\tDEFAULT_EVENTS,\n\tDEFAULT_STORAGE,\n\ttype EventsBackend,\n\ttype MainProvider,\n\ttype StorageBackend,\n} from '../types.js';\n\n/**\n * Which family of defaults a workspace's deploy target belongs to.\n *\n * One question, asked once: **does this target run containers the project\n * controls?** Dokploy and a bare server do, so a bucket or a cache can live\n * beside the app; AWS, Vercel and Cloudflare do not, so the default has to be\n * something managed. That is the whole of the distinction, and it is why\n * `MainProvider` is the right axis rather than the deploy target's own name —\n * three targets share one answer.\n *\n * An AWS deploy names `deploy.default: 'sst'`, because it goes through SST.\n */\nexport function providerOf(workspace: {\n\tdeploy?: { default?: string } | undefined;\n}): MainProvider {\n\tconst target = workspace.deploy?.default;\n\n\treturn target === 'dokploy' || target === 'server' ? 'server' : 'aws';\n}\n\n/**\n * The cache backend a target implies.\n *\n * The same answer locally and deployed: a local `gkm dev` for an AWS app still\n * uses the Upstash protocol, because a backend that differed between the two\n * would be worse than a slower one.\n */\nexport function cacheBackendFor(on: MainProvider): CacheBackend {\n\treturn DEFAULT_CACHE[on];\n}\n\n/** Where a declared bucket lives on a target. */\nexport function storageBackendFor(on: MainProvider): StorageBackend {\n\treturn DEFAULT_STORAGE[on];\n}\n\n/**\n * Which broker carries declared queues and topics on a target.\n *\n * Only consulted when something declares one; a project with no `Topic` or\n * `Queue` has no events at all, whatever the target.\n */\nexport function eventsBackendFor(on: MainProvider): EventsBackend {\n\treturn DEFAULT_EVENTS[on];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAgB,WAAW,WAEV;CAChB,MAAM,SAAS,UAAU,QAAQ;CAEjC,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW;AACjE;;;;;;;;AASA,SAAgB,gBAAgB,IAAgC;CAC/D,OAAOA,cAAAA,cAAc;AACtB;;AAGA,SAAgB,kBAAkB,IAAkC;CACnE,OAAOC,cAAAA,gBAAgB;AACxB;;;;;;;AAQA,SAAgB,iBAAiB,IAAiC;CACjE,OAAOC,cAAAA,eAAe;AACvB"}

package/dist/backends-CSuLl0YP.mjs

@@ -0,0 +1,59 @@
+import { d as DEFAULT_EVENTS, f as DEFAULT_STORAGE, u as DEFAULT_CACHE } from "./ready-WfT-eWlm.mjs";
+//#region src/workspace/backends.ts
+/**
+* Which backend each declared kind resolves to — decided by where the project
+* deploys, and by nothing else.
+*
+* These used to be read out of a `services:` block, where one key answered two
+* questions: *does this exist* and *what backs it*. The first is the manifest's
+* — a declared `Cache` is why there is a cache — and the second is the deploy
+* target's, because the right cache for a Lambda is not the right cache for a
+* box already running Postgres. With both answered elsewhere there was nothing
+* left for the block to say, so it is gone and these read the target.
+*
+* Mail has no answer here at all: every provider speaks SMTP, so the provider
+* is whichever one the stage's mail URL points at.
+*/
+/**
+* Which family of defaults a workspace's deploy target belongs to.
+*
+* One question, asked once: **does this target run containers the project
+* controls?** Dokploy and a bare server do, so a bucket or a cache can live
+* beside the app; AWS, Vercel and Cloudflare do not, so the default has to be
+* something managed. That is the whole of the distinction, and it is why
+* `MainProvider` is the right axis rather than the deploy target's own name —
+* three targets share one answer.
+*
+* An AWS deploy names `deploy.default: 'sst'`, because it goes through SST.
+*/
+function providerOf(workspace) {
+	const target = workspace.deploy?.default;
+	return target === "dokploy" || target === "server" ? "server" : "aws";
+}
+/**
+* The cache backend a target implies.
+*
+* The same answer locally and deployed: a local `gkm dev` for an AWS app still
+* uses the Upstash protocol, because a backend that differed between the two
+* would be worse than a slower one.
+*/
+function cacheBackendFor(on) {
+	return DEFAULT_CACHE[on];
+}
+/** Where a declared bucket lives on a target. */
+function storageBackendFor(on) {
+	return DEFAULT_STORAGE[on];
+}
+/**
+* Which broker carries declared queues and topics on a target.
+*
+* Only consulted when something declares one; a project with no `Topic` or
+* `Queue` has no events at all, whatever the target.
+*/
+function eventsBackendFor(on) {
+	return DEFAULT_EVENTS[on];
+}
+//#endregion
+export { storageBackendFor as i, eventsBackendFor as n, providerOf as r, cacheBackendFor as t };
+
+//# sourceMappingURL=backends-CSuLl0YP.mjs.map

package/dist/backends-CSuLl0YP.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"backends-CSuLl0YP.mjs","names":[],"sources":["../src/workspace/backends.ts"],"sourcesContent":["/**\n * Which backend each declared kind resolves to — decided by where the project\n * deploys, and by nothing else.\n *\n * These used to be read out of a `services:` block, where one key answered two\n * questions: *does this exist* and *what backs it*. The first is the manifest's\n * — a declared `Cache` is why there is a cache — and the second is the deploy\n * target's, because the right cache for a Lambda is not the right cache for a\n * box already running Postgres. With both answered elsewhere there was nothing\n * left for the block to say, so it is gone and these read the target.\n *\n * Mail has no answer here at all: every provider speaks SMTP, so the provider\n * is whichever one the stage's mail URL points at.\n */\n\nimport {\n\ttype CacheBackend,\n\tDEFAULT_CACHE,\n\tDEFAULT_EVENTS,\n\tDEFAULT_STORAGE,\n\ttype EventsBackend,\n\ttype MainProvider,\n\ttype StorageBackend,\n} from '../types.js';\n\n/**\n * Which family of defaults a workspace's deploy target belongs to.\n *\n * One question, asked once: **does this target run containers the project\n * controls?** Dokploy and a bare server do, so a bucket or a cache can live\n * beside the app; AWS, Vercel and Cloudflare do not, so the default has to be\n * something managed. That is the whole of the distinction, and it is why\n * `MainProvider` is the right axis rather than the deploy target's own name —\n * three targets share one answer.\n *\n * An AWS deploy names `deploy.default: 'sst'`, because it goes through SST.\n */\nexport function providerOf(workspace: {\n\tdeploy?: { default?: string } | undefined;\n}): MainProvider {\n\tconst target = workspace.deploy?.default;\n\n\treturn target === 'dokploy' || target === 'server' ? 'server' : 'aws';\n}\n\n/**\n * The cache backend a target implies.\n *\n * The same answer locally and deployed: a local `gkm dev` for an AWS app still\n * uses the Upstash protocol, because a backend that differed between the two\n * would be worse than a slower one.\n */\nexport function cacheBackendFor(on: MainProvider): CacheBackend {\n\treturn DEFAULT_CACHE[on];\n}\n\n/** Where a declared bucket lives on a target. */\nexport function storageBackendFor(on: MainProvider): StorageBackend {\n\treturn DEFAULT_STORAGE[on];\n}\n\n/**\n * Which broker carries declared queues and topics on a target.\n *\n * Only consulted when something declares one; a project with no `Topic` or\n * `Queue` has no events at all, whatever the target.\n */\nexport function eventsBackendFor(on: MainProvider): EventsBackend {\n\treturn DEFAULT_EVENTS[on];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAgB,WAAW,WAEV;CAChB,MAAM,SAAS,UAAU,QAAQ;CAEjC,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW;AACjE;;;;;;;;AASA,SAAgB,gBAAgB,IAAgC;CAC/D,OAAO,cAAc;AACtB;;AAGA,SAAgB,kBAAkB,IAAkC;CACnE,OAAO,gBAAgB;AACxB;;;;;;;AAQA,SAAgB,iBAAiB,IAAiC;CACjE,OAAO,eAAe;AACvB"}

package/dist/encryption-C7OGMve_.cjs

@@ -0,0 +1,91 @@
+const require_config = require("./config-CsYSyUya.cjs");
+const require_workspace = require("./workspace-DEibcoBe.cjs");
+const require_storage = require("./storage-CSGoC3bK.cjs");
+const require_store = require("./store-DQgxT_WR.cjs");
+const require_backends = require("./backends-B9V2XD2M.cjs");
+let _geekmidas_manifest = require("@geekmidas/manifest");
+let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
+//#region src/encryption/index.ts
+/**
+* `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an
+* `Encryption` construct on a server stage.
+*
+* Rotating adds a key in front and keeps every older one, so what they wrote
+* still opens. Retiring removes one, and is the half that makes rotating worth
+* doing: until a key is gone, it still opens everything it ever wrote. It is
+* never automatic, because the only thing that knows nothing is left under a
+* key is the sweep that re-encrypted the column — so it is done after one,
+* deliberately, by name.
+*
+* Neither applies everywhere, and each says so rather than doing something
+* that looks right: a local stage's keyring is derived and would be replaced on
+* the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and
+* never strands a value.
+*/
+const logger = console;
+var LocalKeyringIsDerived = class extends Error {
+	construct;
+	stage;
+	constructor(construct, stage) {
+		super(`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`);
+		this.construct = construct;
+		this.stage = stage;
+		this.name = "LocalKeyringIsDerived";
+	}
+};
+var KmsRotatesItself = class extends Error {
+	construct;
+	constructor(construct) {
+		super(`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`);
+		this.construct = construct;
+		this.name = "KmsRotatesItself";
+	}
+};
+var NoKeyringYet = class extends Error {
+	construct;
+	stage;
+	key;
+	constructor(construct, stage, key) {
+		super(`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`);
+		this.construct = construct;
+		this.stage = stage;
+		this.key = key;
+		this.name = "NoKeyringYet";
+	}
+};
+async function encryptionRotateCommand(construct, options, context = {}) {
+	return updateKeyring(construct, options, context, (id, url) => {
+		const next = (0, _geekmidas_constructs_encryption.rotateKeyring)(id, url);
+		const [current, ...older] = (0, _geekmidas_constructs_encryption.parseKeyring)(id, next).keys.map(({ id }) => id);
+		logger.log(`\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);
+		logger.log(`  Still opening: ${older.join(", ")}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`);
+		return next;
+	});
+}
+async function encryptionRetireCommand(construct, keyId, options, context = {}) {
+	return updateKeyring(construct, options, context, (id, url) => {
+		const next = (0, _geekmidas_constructs_encryption.retireKey)(id, url, keyId);
+		logger.log(`\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`);
+		return next;
+	});
+}
+async function updateKeyring(construct, { stage }, context, update) {
+	const workspace = context.workspace ?? await require_config.loadWorkspaceSettings();
+	const id = (0, _geekmidas_manifest.canonicalId)(construct);
+	if (stage === workspace.stages.local) throw new LocalKeyringIsDerived(id, stage);
+	require_workspace.assertDeployedStage(workspace.stages, stage);
+	if (require_backends.providerOf(workspace) === "aws") throw new KmsRotatesItself(id);
+	const store = context.store ?? await require_store.secretsStoreFor(workspace, stage);
+	const key = (0, _geekmidas_manifest.provideKey)(id, "url");
+	const secrets = await store.read(stage);
+	const url = secrets?.custom[key];
+	if (!secrets || !url) throw new NoKeyringYet(id, stage, key);
+	const next = update(id, url);
+	await store.write(stage, require_storage.withCustomSecret(secrets, key, next));
+	return next;
+}
+//#endregion
+exports.encryptionRetireCommand = encryptionRetireCommand;
+exports.encryptionRotateCommand = encryptionRotateCommand;
+
+//# sourceMappingURL=encryption-C7OGMve_.cjs.map

package/dist/encryption-C7OGMve_.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-C7OGMve_.cjs","names":["rotateKeyring","parseKeyring","retireKey","loadWorkspaceSettings","canonicalId","providerOf","secretsStoreFor","provideKey","withCustomSecret"],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOA,iCAAAA,cAAAA,CAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,UAAA,GAASC,iCAAAA,aAAAA,CAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,QAAA,GAAOC,iCAAAA,UAAAA,CAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAMC,eAAAA,sBAAsB;CACpE,MAAM,MAAA,GAAKC,oBAAAA,YAAAA,CAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,kBAAA,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAIC,iBAAAA,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAMC,cAAAA,gBAAgB,WAAW,KAAK;CACtE,MAAM,OAAA,GAAMC,oBAAAA,WAAAA,CAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAOC,gBAAAA,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}

package/dist/encryption-DyQnPsZN.mjs

@@ -0,0 +1,90 @@
+import { u as loadWorkspaceSettings } from "./config-D8J5rrTb.mjs";
+import { D as assertDeployedStage } from "./workspace-DNzWgM1J.mjs";
+import { a as withCustomSecret } from "./storage-BzaUxmqe.mjs";
+import { n as secretsStoreFor } from "./store-DeGATCS-.mjs";
+import { r as providerOf } from "./backends-CSuLl0YP.mjs";
+import { canonicalId, provideKey } from "@geekmidas/manifest";
+import { parseKeyring, retireKey, rotateKeyring } from "@geekmidas/constructs/encryption";
+//#region src/encryption/index.ts
+/**
+* `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an
+* `Encryption` construct on a server stage.
+*
+* Rotating adds a key in front and keeps every older one, so what they wrote
+* still opens. Retiring removes one, and is the half that makes rotating worth
+* doing: until a key is gone, it still opens everything it ever wrote. It is
+* never automatic, because the only thing that knows nothing is left under a
+* key is the sweep that re-encrypted the column — so it is done after one,
+* deliberately, by name.
+*
+* Neither applies everywhere, and each says so rather than doing something
+* that looks right: a local stage's keyring is derived and would be replaced on
+* the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and
+* never strands a value.
+*/
+const logger = console;
+var LocalKeyringIsDerived = class extends Error {
+	construct;
+	stage;
+	constructor(construct, stage) {
+		super(`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`);
+		this.construct = construct;
+		this.stage = stage;
+		this.name = "LocalKeyringIsDerived";
+	}
+};
+var KmsRotatesItself = class extends Error {
+	construct;
+	constructor(construct) {
+		super(`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`);
+		this.construct = construct;
+		this.name = "KmsRotatesItself";
+	}
+};
+var NoKeyringYet = class extends Error {
+	construct;
+	stage;
+	key;
+	constructor(construct, stage, key) {
+		super(`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`);
+		this.construct = construct;
+		this.stage = stage;
+		this.key = key;
+		this.name = "NoKeyringYet";
+	}
+};
+async function encryptionRotateCommand(construct, options, context = {}) {
+	return updateKeyring(construct, options, context, (id, url) => {
+		const next = rotateKeyring(id, url);
+		const [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);
+		logger.log(`\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);
+		logger.log(`  Still opening: ${older.join(", ")}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`);
+		return next;
+	});
+}
+async function encryptionRetireCommand(construct, keyId, options, context = {}) {
+	return updateKeyring(construct, options, context, (id, url) => {
+		const next = retireKey(id, url, keyId);
+		logger.log(`\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`);
+		return next;
+	});
+}
+async function updateKeyring(construct, { stage }, context, update) {
+	const workspace = context.workspace ?? await loadWorkspaceSettings();
+	const id = canonicalId(construct);
+	if (stage === workspace.stages.local) throw new LocalKeyringIsDerived(id, stage);
+	assertDeployedStage(workspace.stages, stage);
+	if (providerOf(workspace) === "aws") throw new KmsRotatesItself(id);
+	const store = context.store ?? await secretsStoreFor(workspace, stage);
+	const key = provideKey(id, "url");
+	const secrets = await store.read(stage);
+	const url = secrets?.custom[key];
+	if (!secrets || !url) throw new NoKeyringYet(id, stage, key);
+	const next = update(id, url);
+	await store.write(stage, withCustomSecret(secrets, key, next));
+	return next;
+}
+//#endregion
+export { encryptionRetireCommand, encryptionRotateCommand };
+
+//# sourceMappingURL=encryption-DyQnPsZN.mjs.map

package/dist/encryption-DyQnPsZN.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-DyQnPsZN.mjs","names":[],"sources":["../src/encryption/index.ts"],"sourcesContent":["/**\n * `gkm encryption:rotate` and `gkm encryption:retire` — the keyring of an\n * `Encryption` construct on a server stage.\n *\n * Rotating adds a key in front and keeps every older one, so what they wrote\n * still opens. Retiring removes one, and is the half that makes rotating worth\n * doing: until a key is gone, it still opens everything it ever wrote. It is\n * never automatic, because the only thing that knows nothing is left under a\n * key is the sweep that re-encrypted the column — so it is done after one,\n * deliberately, by name.\n *\n * Neither applies everywhere, and each says so rather than doing something\n * that looks right: a local stage's keyring is derived and would be replaced on\n * the next `gkm dev`, and on AWS the key is KMS's, which rotates it itself and\n * never strands a value.\n */\n\nimport {\n\tparseKeyring,\n\tretireKey,\n\trotateKeyring,\n} from '@geekmidas/constructs/encryption';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport { loadWorkspaceSettings } from '../config';\nimport { withCustomSecret } from '../secrets/storage.js';\nimport { type SecretsStore, secretsStoreFor } from '../secrets/store.js';\nimport { providerOf } from '../workspace/backends.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\nconst logger = console;\n\nexport class LocalKeyringIsDerived extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' is the local stage, where ${construct}'s keyring is derived from the project and stage — nothing stored there would be read. Rotate a deployed stage: gkm encryption:rotate ${construct} --stage <stage>.`,\n\t\t);\n\t\tthis.name = 'LocalKeyringIsDerived';\n\t}\n}\n\nexport class KmsRotatesItself extends Error {\n\tconstructor(readonly construct: string) {\n\t\tsuper(\n\t\t\t`${construct} is a KMS key on AWS: KMS rotates it yearly and keeps every version, so no value is ever stranded and there is no key to retire. Nothing to do here.`,\n\t\t);\n\t\tthis.name = 'KmsRotatesItself';\n\t}\n}\n\nexport class NoKeyringYet extends Error {\n\tconstructor(\n\t\treadonly construct: string,\n\t\treadonly stage: string,\n\t\treadonly key: string,\n\t) {\n\t\tsuper(\n\t\t\t`'${stage}' has no ${key} yet. The first deploy generates ${construct}'s keyring: gkm deploy --stage ${stage}.`,\n\t\t);\n\t\tthis.name = 'NoKeyringYet';\n\t}\n}\n\nexport interface EncryptionCommandOptions {\n\tstage: string;\n}\n\n/** Where a command reads and writes; the real ones unless a test says. */\nexport interface EncryptionCommandContext {\n\tworkspace?: NormalizedWorkspace;\n\tstore?: SecretsStore;\n}\n\nexport async function encryptionRotateCommand(\n\tconstruct: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = rotateKeyring(id, url);\n\t\tconst [current, ...older] = parseKeyring(id, next).keys.map(({ id }) => id);\n\n\t\tlogger.log(`\\n✓ ${id} on '${options.stage}' now writes with '${current}'.`);\n\t\tlogger.log(\n\t\t\t`  Still opening: ${older.join(', ')}. Redeploy to start writing with '${current}', reencrypt what is stored, then: gkm encryption:retire ${id} <key> --stage ${options.stage}`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nexport async function encryptionRetireCommand(\n\tconstruct: string,\n\tkeyId: string,\n\toptions: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext = {},\n): Promise<string> {\n\treturn updateKeyring(construct, options, context, (id, url) => {\n\t\tconst next = retireKey(id, url, keyId);\n\n\t\tlogger.log(\n\t\t\t`\\n✓ ${id} on '${options.stage}' no longer holds '${keyId}'. Anything still under it cannot be read after the next deploy.`,\n\t\t);\n\t\treturn next;\n\t});\n}\n\nasync function updateKeyring(\n\tconstruct: string,\n\t{ stage }: EncryptionCommandOptions,\n\tcontext: EncryptionCommandContext,\n\tupdate: (id: string, url: string) => string,\n): Promise<string> {\n\tconst workspace = context.workspace ?? (await loadWorkspaceSettings());\n\tconst id = canonicalId(construct);\n\n\tif (stage === workspace.stages.local) {\n\t\tthrow new LocalKeyringIsDerived(id, stage);\n\t}\n\tassertDeployedStage(workspace.stages, stage);\n\tif (providerOf(workspace) === 'aws') throw new KmsRotatesItself(id);\n\n\tconst store = context.store ?? (await secretsStoreFor(workspace, stage));\n\tconst key = provideKey(id, 'url');\n\tconst secrets = await store.read(stage);\n\tconst url = secrets?.custom[key];\n\tif (!secrets || !url) throw new NoKeyringYet(id, stage, key);\n\n\tconst next = update(id, url);\n\tawait store.write(stage, withCustomSecret(secrets, key, next));\n\treturn next;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA8BA,MAAM,SAAS;AAEf,IAAa,wBAAb,cAA2C,MAAM;CAEtC;CACA;CAFV,YACC,WACA,OACC;EACD,MACC,IAAI,MAAM,8BAA8B,UAAU,wIAAwI,UAAU,kBACrM;EALS,KAAA,YAAA;EACA,KAAA,QAAA;EAKT,KAAK,OAAO;CACb;AACD;AAEA,IAAa,mBAAb,cAAsC,MAAM;CACtB;CAArB,YAAY,WAA4B;EACvC,MACC,GAAG,UAAU,qJACd;EAHoB,KAAA,YAAA;EAIpB,KAAK,OAAO;CACb;AACD;AAEA,IAAa,eAAb,cAAkC,MAAM;CAE7B;CACA;CACA;CAHV,YACC,WACA,OACA,KACC;EACD,MACC,IAAI,MAAM,WAAW,IAAI,mCAAmC,UAAU,iCAAiC,MAAM,EAC9G;EANS,KAAA,YAAA;EACA,KAAA,QAAA;EACA,KAAA,MAAA;EAKT,KAAK,OAAO;CACb;AACD;AAYA,eAAsB,wBACrB,WACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,OAAO,cAAc,IAAI,GAAG;EAClC,MAAM,CAAC,SAAS,GAAG,SAAS,aAAa,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,SAAS,EAAE;EAE1E,OAAO,IAAI,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,QAAQ,GAAG;EAC1E,OAAO,IACN,oBAAoB,MAAM,KAAK,IAAI,EAAE,oCAAoC,QAAQ,2DAA2D,GAAG,iBAAiB,QAAQ,OACzK;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAsB,wBACrB,WACA,OACA,SACA,UAAoC,CAAC,GACnB;CAClB,OAAO,cAAc,WAAW,SAAS,UAAU,IAAI,QAAQ;EAC9D,MAAM,OAAO,UAAU,IAAI,KAAK,KAAK;EAErC,OAAO,IACN,OAAO,GAAG,OAAO,QAAQ,MAAM,qBAAqB,MAAM,iEAC3D;EACA,OAAO;CACR,CAAC;AACF;AAEA,eAAe,cACd,WACA,EAAE,SACF,SACA,QACkB;CAClB,MAAM,YAAY,QAAQ,aAAc,MAAM,sBAAsB;CACpE,MAAM,KAAK,YAAY,SAAS;CAEhC,IAAI,UAAU,UAAU,OAAO,OAC9B,MAAM,IAAI,sBAAsB,IAAI,KAAK;CAE1C,oBAAoB,UAAU,QAAQ,KAAK;CAC3C,IAAI,WAAW,SAAS,MAAM,OAAO,MAAM,IAAI,iBAAiB,EAAE;CAElE,MAAM,QAAQ,QAAQ,SAAU,MAAM,gBAAgB,WAAW,KAAK;CACtE,MAAM,MAAM,WAAW,IAAI,KAAK;CAChC,MAAM,UAAU,MAAM,MAAM,KAAK,KAAK;CACtC,MAAM,MAAM,SAAS,OAAO;CAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,MAAM,IAAI,aAAa,IAAI,OAAO,GAAG;CAE3D,MAAM,OAAO,OAAO,IAAI,GAAG;CAC3B,MAAM,MAAM,MAAM,OAAO,iBAAiB,SAAS,KAAK,IAAI,CAAC;CAC7D,OAAO;AACR"}