@geekmidas/cli 10.0.0-alpha.58 → 10.0.0-alpha.59

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/cli",
-  "version": "10.0.0-alpha.58",
+  "version": "10.0.0-alpha.59",
   "description": "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs",
   "private": false,
   "type": "module",
@@ -98,15 +98,15 @@
     "prompts": "~2.4.2",
     "tsx": "~4.23.15",
     "yaml": "~2.9.1",
-    "@geekmidas/cache": "10.0.0-alpha.58",
-    "@geekmidas/constructs": "~10.0.0-alpha.58",
-    "@geekmidas/db": "10.0.0-alpha.58",
-    "@geekmidas/envkit": "~10.0.0-alpha.58",
-    "@geekmidas/errors": "~10.0.0-alpha.58",
-    "@geekmidas/logger": "~10.0.0-alpha.58",
-    "@geekmidas/manifest": "10.0.0-alpha.58",
-    "@geekmidas/schema": "~10.0.0-alpha.58",
-    "@geekmidas/services": "~10.0.0-alpha.58"
+    "@geekmidas/cache": "10.0.0-alpha.59",
+    "@geekmidas/constructs": "~10.0.0-alpha.59",
+    "@geekmidas/db": "10.0.0-alpha.59",
+    "@geekmidas/envkit": "~10.0.0-alpha.59",
+    "@geekmidas/errors": "~10.0.0-alpha.59",
+    "@geekmidas/logger": "~10.0.0-alpha.59",
+    "@geekmidas/manifest": "10.0.0-alpha.59",
+    "@geekmidas/schema": "~10.0.0-alpha.59",
+    "@geekmidas/services": "~10.0.0-alpha.59"
   },
   "devDependencies": {
     "@hono/node-server": "~1.19.5",
@@ -120,11 +120,11 @@
     "typescript": "~7.0.2",
     "vitest": "~5.0.2",
     "zod": "~4.6.5",
-    "@geekmidas/events": "~10.0.0-alpha.58",
-    "@geekmidas/testkit": "10.0.0-alpha.58"
+    "@geekmidas/events": "~10.0.0-alpha.59",
+    "@geekmidas/testkit": "10.0.0-alpha.59"
   },
   "peerDependencies": {
-    "@geekmidas/telescope": "~10.0.0-alpha.58"
+    "@geekmidas/telescope": "~10.0.0-alpha.59"
   },
   "peerDependenciesMeta": {
     "@geekmidas/telescope": {

package/dist/LocalStateProvider-7HR6SS2t.cjs

@@ -1,48 +0,0 @@
-let node_fs_promises = require("node:fs/promises");
-let node_path = require("node:path");
-//#region src/deploy/LocalStateProvider.ts
-/**
-* Local Filesystem State Provider
-*
-* Stores deployment state in .gkm/deploy-{stage}.json files.
-* This is the default provider for local development.
-*/
-/**
-* Get the state file path for a stage.
-*/
-function getStateFilePath(workspaceRoot, stage) {
-	return (0, node_path.join)(workspaceRoot, ".gkm", `deploy-${stage}.json`);
-}
-/**
-* Local filesystem state provider.
-*
-* Stores state in .gkm/deploy-{stage}.json files in the workspace root.
-*/
-var LocalStateProvider = class {
-	workspaceRoot;
-	constructor(workspaceRoot) {
-		this.workspaceRoot = workspaceRoot;
-	}
-	async read(stage) {
-		const filePath = getStateFilePath(this.workspaceRoot, stage);
-		try {
-			const content = await (0, node_fs_promises.readFile)(filePath, "utf-8");
-			return JSON.parse(content);
-		} catch (error) {
-			if (error.code === "ENOENT") return null;
-			console.warn(`Warning: Could not read deploy state: ${error}`);
-			return null;
-		}
-	}
-	async write(stage, state) {
-		const filePath = getStateFilePath(this.workspaceRoot, stage);
-		const dir = (0, node_path.join)(this.workspaceRoot, ".gkm");
-		await (0, node_fs_promises.mkdir)(dir, { recursive: true });
-		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		await (0, node_fs_promises.writeFile)(filePath, JSON.stringify(state, null, 2));
-	}
-};
-//#endregion
-exports.LocalStateProvider = LocalStateProvider;
-
-//# sourceMappingURL=LocalStateProvider-7HR6SS2t.cjs.map

package/dist/LocalStateProvider-7HR6SS2t.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalStateProvider-7HR6SS2t.cjs","names":["join","readFile","mkdir","writeFile"],"sources":["../src/deploy/LocalStateProvider.ts"],"sourcesContent":["/**\n * Local Filesystem State Provider\n *\n * Stores deployment state in .gkm/deploy-{stage}.json files.\n * This is the default provider for local development.\n */\n\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { StateProvider } from './StateProvider';\nimport type { DokployStageState } from './state';\n\n/**\n * Get the state file path for a stage.\n */\nfunction getStateFilePath(workspaceRoot: string, stage: string): string {\n\treturn join(workspaceRoot, '.gkm', `deploy-${stage}.json`);\n}\n\n/**\n * Local filesystem state provider.\n *\n * Stores state in .gkm/deploy-{stage}.json files in the workspace root.\n */\nexport class LocalStateProvider implements StateProvider {\n\tconstructor(private readonly workspaceRoot: string) {}\n\n\tasync read(stage: string): Promise<DokployStageState | null> {\n\t\tconst filePath = getStateFilePath(this.workspaceRoot, stage);\n\n\t\ttry {\n\t\t\tconst content = await readFile(filePath, 'utf-8');\n\t\t\treturn JSON.parse(content) as DokployStageState;\n\t\t} catch (error) {\n\t\t\t// File doesn't exist - return null\n\t\t\tif ((error as NodeJS.ErrnoException).code === 'ENOENT') {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// Log other errors but don't fail\n\t\t\tconsole.warn(`Warning: Could not read deploy state: ${error}`);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync write(stage: string, state: DokployStageState): Promise<void> {\n\t\tconst filePath = getStateFilePath(this.workspaceRoot, stage);\n\t\tconst dir = join(this.workspaceRoot, '.gkm');\n\n\t\t// Ensure .gkm directory exists\n\t\tawait mkdir(dir, { recursive: true });\n\n\t\t// Update last deployed timestamp\n\t\tstate.lastDeployedAt = new Date().toISOString();\n\n\t\tawait writeFile(filePath, JSON.stringify(state, null, 2));\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AAeA,SAAS,iBAAiB,eAAuB,OAAuB;CACvE,QAAA,GAAOA,UAAAA,KAAAA,CAAK,eAAe,QAAQ,UAAU,MAAM,MAAM;AAC1D;;;;;;AAOA,IAAa,qBAAb,MAAyD;CAC3B;CAA7B,YAAY,eAAwC;EAAvB,KAAA,gBAAA;CAAwB;CAErD,MAAM,KAAK,OAAkD;EAC5D,MAAM,WAAW,iBAAiB,KAAK,eAAe,KAAK;EAE3D,IAAI;GACH,MAAM,UAAU,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,UAAU,OAAO;GAChD,OAAO,KAAK,MAAM,OAAO;EAC1B,SAAS,OAAO;GAEf,IAAK,MAAgC,SAAS,UAC7C,OAAO;GAGR,QAAQ,KAAK,yCAAyC,OAAO;GAC7D,OAAO;EACR;CACD;CAEA,MAAM,MAAM,OAAe,OAAyC;EACnE,MAAM,WAAW,iBAAiB,KAAK,eAAe,KAAK;EAC3D,MAAM,OAAA,GAAMD,UAAAA,KAAAA,CAAK,KAAK,eAAe,MAAM;EAG3C,OAAA,GAAME,iBAAAA,MAAAA,CAAM,KAAK,EAAE,WAAW,KAAK,CAAC;EAGpC,MAAM,kCAAiB,IAAI,KAAK,EAAA,CAAE,YAAY;EAE9C,OAAA,GAAMC,iBAAAA,UAAAA,CAAU,UAAU,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;CACzD;AACD"}

package/dist/LocalStateProvider-D7QyJoLM.mjs

@@ -1,48 +0,0 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-//#region src/deploy/LocalStateProvider.ts
-/**
-* Local Filesystem State Provider
-*
-* Stores deployment state in .gkm/deploy-{stage}.json files.
-* This is the default provider for local development.
-*/
-/**
-* Get the state file path for a stage.
-*/
-function getStateFilePath(workspaceRoot, stage) {
-	return join(workspaceRoot, ".gkm", `deploy-${stage}.json`);
-}
-/**
-* Local filesystem state provider.
-*
-* Stores state in .gkm/deploy-{stage}.json files in the workspace root.
-*/
-var LocalStateProvider = class {
-	workspaceRoot;
-	constructor(workspaceRoot) {
-		this.workspaceRoot = workspaceRoot;
-	}
-	async read(stage) {
-		const filePath = getStateFilePath(this.workspaceRoot, stage);
-		try {
-			const content = await readFile(filePath, "utf-8");
-			return JSON.parse(content);
-		} catch (error) {
-			if (error.code === "ENOENT") return null;
-			console.warn(`Warning: Could not read deploy state: ${error}`);
-			return null;
-		}
-	}
-	async write(stage, state) {
-		const filePath = getStateFilePath(this.workspaceRoot, stage);
-		const dir = join(this.workspaceRoot, ".gkm");
-		await mkdir(dir, { recursive: true });
-		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		await writeFile(filePath, JSON.stringify(state, null, 2));
-	}
-};
-//#endregion
-export { LocalStateProvider };
-
-//# sourceMappingURL=LocalStateProvider-D7QyJoLM.mjs.map

package/dist/LocalStateProvider-D7QyJoLM.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalStateProvider-D7QyJoLM.mjs","names":[],"sources":["../src/deploy/LocalStateProvider.ts"],"sourcesContent":["/**\n * Local Filesystem State Provider\n *\n * Stores deployment state in .gkm/deploy-{stage}.json files.\n * This is the default provider for local development.\n */\n\nimport { mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport type { StateProvider } from './StateProvider';\nimport type { DokployStageState } from './state';\n\n/**\n * Get the state file path for a stage.\n */\nfunction getStateFilePath(workspaceRoot: string, stage: string): string {\n\treturn join(workspaceRoot, '.gkm', `deploy-${stage}.json`);\n}\n\n/**\n * Local filesystem state provider.\n *\n * Stores state in .gkm/deploy-{stage}.json files in the workspace root.\n */\nexport class LocalStateProvider implements StateProvider {\n\tconstructor(private readonly workspaceRoot: string) {}\n\n\tasync read(stage: string): Promise<DokployStageState | null> {\n\t\tconst filePath = getStateFilePath(this.workspaceRoot, stage);\n\n\t\ttry {\n\t\t\tconst content = await readFile(filePath, 'utf-8');\n\t\t\treturn JSON.parse(content) as DokployStageState;\n\t\t} catch (error) {\n\t\t\t// File doesn't exist - return null\n\t\t\tif ((error as NodeJS.ErrnoException).code === 'ENOENT') {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// Log other errors but don't fail\n\t\t\tconsole.warn(`Warning: Could not read deploy state: ${error}`);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync write(stage: string, state: DokployStageState): Promise<void> {\n\t\tconst filePath = getStateFilePath(this.workspaceRoot, stage);\n\t\tconst dir = join(this.workspaceRoot, '.gkm');\n\n\t\t// Ensure .gkm directory exists\n\t\tawait mkdir(dir, { recursive: true });\n\n\t\t// Update last deployed timestamp\n\t\tstate.lastDeployedAt = new Date().toISOString();\n\n\t\tawait writeFile(filePath, JSON.stringify(state, null, 2));\n\t}\n}\n"],"mappings":";;;;;;;;;;;;AAeA,SAAS,iBAAiB,eAAuB,OAAuB;CACvE,OAAO,KAAK,eAAe,QAAQ,UAAU,MAAM,MAAM;AAC1D;;;;;;AAOA,IAAa,qBAAb,MAAyD;CAC3B;CAA7B,YAAY,eAAwC;EAAvB,KAAA,gBAAA;CAAwB;CAErD,MAAM,KAAK,OAAkD;EAC5D,MAAM,WAAW,iBAAiB,KAAK,eAAe,KAAK;EAE3D,IAAI;GACH,MAAM,UAAU,MAAM,SAAS,UAAU,OAAO;GAChD,OAAO,KAAK,MAAM,OAAO;EAC1B,SAAS,OAAO;GAEf,IAAK,MAAgC,SAAS,UAC7C,OAAO;GAGR,QAAQ,KAAK,yCAAyC,OAAO;GAC7D,OAAO;EACR;CACD;CAEA,MAAM,MAAM,OAAe,OAAyC;EACnE,MAAM,WAAW,iBAAiB,KAAK,eAAe,KAAK;EAC3D,MAAM,MAAM,KAAK,KAAK,eAAe,MAAM;EAG3C,MAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;EAGpC,MAAM,kCAAiB,IAAI,KAAK,EAAA,CAAE,YAAY;EAE9C,MAAM,UAAU,UAAU,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;CACzD;AACD"}

package/dist/LocalStateStore-BupdV-VN.mjs

@@ -1,163 +0,0 @@
-import { i as DocumentStateStore, l as StateVersionConflict, o as StateLocked, s as StateStoreBusy, u as contentVersion } from "./index.mjs";
-import { mkdir, open, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-//#region src/deploy/LocalStateStore.ts
-/**
-* Local filesystem state store.
-*
-* `.gkm/deploy-<stage>.json` holds the state, `.gkm/deploy-<stage>.lock` the
-* lock. Every file is mode 0600: state holds database passwords and IAM keys.
-*/
-const FILE_MODE = 384;
-/** How long a write waits for another process's write to finish. */
-const MUTEX_TIMEOUT_MS = 5e3;
-/**
-* A write holds the mutex for milliseconds, so one this old was left by a
-* process that died mid-write and is safe to take over.
-*/
-const MUTEX_STALE_MS = 3e4;
-function isCode(error, code) {
-	return error?.code === code;
-}
-var LocalStateStore = class extends DocumentStateStore {
-	workspaceRoot;
-	constructor(workspaceRoot) {
-		super();
-		this.workspaceRoot = workspaceRoot;
-	}
-	get dir() {
-		return join(this.workspaceRoot, ".gkm");
-	}
-	statePath(stage) {
-		return join(this.dir, `deploy-${stage}.json`);
-	}
-	lockPath(stage) {
-		return join(this.dir, `deploy-${stage}.lock`);
-	}
-	backupPath(stage) {
-		return join(this.dir, `deploy-${stage}.v1.json`);
-	}
-	mutexPath(stage) {
-		return join(this.dir, `deploy-${stage}.json.mutex`);
-	}
-	location(stage) {
-		return this.statePath(stage);
-	}
-	async readRaw(stage) {
-		try {
-			const body = await readFile(this.statePath(stage), "utf-8");
-			return {
-				body,
-				version: contentVersion(body)
-			};
-		} catch (error) {
-			if (isCode(error, "ENOENT")) return null;
-			throw error;
-		}
-	}
-	async writeRaw(stage, body, expectedVersion) {
-		await this.ensureDir();
-		return this.withMutex(stage, async () => {
-			const actual = (await this.readRaw(stage))?.version ?? null;
-			if (actual !== expectedVersion) throw new StateVersionConflict(stage, expectedVersion, actual);
-			const target = this.statePath(stage);
-			const temp = `${target}.${randomUUID()}.tmp`;
-			try {
-				const handle = await open(temp, "wx", FILE_MODE);
-				try {
-					await handle.writeFile(body);
-					await handle.sync();
-				} finally {
-					await handle.close();
-				}
-				await rename(temp, target);
-			} catch (error) {
-				await rm(temp, { force: true });
-				throw error;
-			}
-			return contentVersion(body);
-		});
-	}
-	async writeV1Backup(stage, body) {
-		try {
-			await writeFile(this.backupPath(stage), body, {
-				flag: "wx",
-				mode: FILE_MODE
-			});
-		} catch (error) {
-			if (!isCode(error, "EEXIST")) throw error;
-		}
-	}
-	async createLock(stage, holder) {
-		await this.ensureDir();
-		let handle;
-		try {
-			handle = await open(this.lockPath(stage), "wx", FILE_MODE);
-		} catch (error) {
-			if (isCode(error, "EEXIST")) throw new StateLocked(stage, await this.readLock(stage), this.lockPath(stage));
-			throw error;
-		}
-		try {
-			await handle.writeFile(JSON.stringify(holder, null, 2));
-		} finally {
-			await handle.close();
-		}
-	}
-	async readLock(stage) {
-		try {
-			return JSON.parse(await readFile(this.lockPath(stage), "utf-8"));
-		} catch {
-			return null;
-		}
-	}
-	async removeLock(stage, holder) {
-		if (holder) {
-			if ((await this.readLock(stage))?.id !== holder.id) return;
-		}
-		await rm(this.lockPath(stage), { force: true });
-	}
-	async ensureDir() {
-		await mkdir(this.dir, {
-			recursive: true,
-			mode: 448
-		});
-	}
-	/**
-	* Serialises the check-then-rename of a conditional write across
-	* processes. The stage lock is for whole runs; this is for the instant of
-	* a single write, so even writers that skip the lock never interleave.
-	*/
-	async withMutex(stage, fn) {
-		const path = this.mutexPath(stage);
-		const deadline = Date.now() + MUTEX_TIMEOUT_MS;
-		for (;;) try {
-			await (await open(path, "wx", FILE_MODE)).close();
-			break;
-		} catch (error) {
-			if (!isCode(error, "EEXIST")) throw error;
-			if (await this.isStale(path)) {
-				await unlink(path).catch(() => {});
-				continue;
-			}
-			if (Date.now() > deadline) throw new StateStoreBusy(stage, path);
-			await new Promise((resolve) => setTimeout(resolve, 10));
-		}
-		try {
-			return await fn();
-		} finally {
-			await rm(path, { force: true });
-		}
-	}
-	async isStale(path) {
-		try {
-			return Date.now() - (await stat(path)).mtimeMs > MUTEX_STALE_MS;
-		} catch {
-			return false;
-		}
-	}
-};
-//#endregion
-export { LocalStateStore };
-
-//# sourceMappingURL=LocalStateStore-BupdV-VN.mjs.map

package/dist/LocalStateStore-BupdV-VN.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalStateStore-BupdV-VN.mjs","names":[],"sources":["../src/deploy/LocalStateStore.ts"],"sourcesContent":["/**\n * Local filesystem state store.\n *\n * `.gkm/deploy-<stage>.json` holds the state, `.gkm/deploy-<stage>.lock` the\n * lock. Every file is mode 0600: state holds database passwords and IAM keys.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport {\n\tmkdir,\n\topen,\n\treadFile,\n\trename,\n\trm,\n\tstat,\n\tunlink,\n\twriteFile,\n} from 'node:fs/promises';\nimport { join } from 'node:path';\nimport {\n\tcontentVersion,\n\tDocumentStateStore,\n\ttype LockHolder,\n\ttype RawState,\n\tStateLocked,\n\tStateStoreBusy,\n\ttype StateVersion,\n\tStateVersionConflict,\n} from './StateStore';\n\nconst FILE_MODE = 0o600;\n\n/** How long a write waits for another process's write to finish. */\nconst MUTEX_TIMEOUT_MS = 5_000;\n/**\n * A write holds the mutex for milliseconds, so one this old was left by a\n * process that died mid-write and is safe to take over.\n */\nconst MUTEX_STALE_MS = 30_000;\n\nfunction isCode(error: unknown, code: string): boolean {\n\treturn (error as NodeJS.ErrnoException)?.code === code;\n}\n\nexport class LocalStateStore extends DocumentStateStore {\n\tconstructor(readonly workspaceRoot: string) {\n\t\tsuper();\n\t}\n\n\tprivate get dir(): string {\n\t\treturn join(this.workspaceRoot, '.gkm');\n\t}\n\n\tstatePath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.json`);\n\t}\n\n\tlockPath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.lock`);\n\t}\n\n\tbackupPath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.v1.json`);\n\t}\n\n\tprivate mutexPath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.json.mutex`);\n\t}\n\n\tprotected location(stage: string): string {\n\t\treturn this.statePath(stage);\n\t}\n\n\tprotected async readRaw(stage: string): Promise<RawState | null> {\n\t\ttry {\n\t\t\tconst body = await readFile(this.statePath(stage), 'utf-8');\n\t\t\treturn { body, version: contentVersion(body) };\n\t\t} catch (error) {\n\t\t\tif (isCode(error, 'ENOENT')) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprotected async writeRaw(\n\t\tstage: string,\n\t\tbody: string,\n\t\texpectedVersion: StateVersion | null,\n\t): Promise<StateVersion> {\n\t\tawait this.ensureDir();\n\t\treturn this.withMutex(stage, async () => {\n\t\t\tconst current = await this.readRaw(stage);\n\t\t\tconst actual = current?.version ?? null;\n\t\t\tif (actual !== expectedVersion) {\n\t\t\t\tthrow new StateVersionConflict(stage, expectedVersion, actual);\n\t\t\t}\n\n\t\t\t// Written beside the target and renamed over it: a reader sees the\n\t\t\t// old file or the new one, never half of either.\n\t\t\tconst target = this.statePath(stage);\n\t\t\tconst temp = `${target}.${randomUUID()}.tmp`;\n\t\t\ttry {\n\t\t\t\tconst handle = await open(temp, 'wx', FILE_MODE);\n\t\t\t\ttry {\n\t\t\t\t\tawait handle.writeFile(body);\n\t\t\t\t\tawait handle.sync();\n\t\t\t\t} finally {\n\t\t\t\t\tawait handle.close();\n\t\t\t\t}\n\t\t\t\tawait rename(temp, target);\n\t\t\t} catch (error) {\n\t\t\t\tawait rm(temp, { force: true });\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn contentVersion(body);\n\t\t});\n\t}\n\n\tprotected async writeV1Backup(stage: string, body: string): Promise<void> {\n\t\ttry {\n\t\t\tawait writeFile(this.backupPath(stage), body, {\n\t\t\t\tflag: 'wx',\n\t\t\t\tmode: FILE_MODE,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\t// The first migration's backup is the one worth keeping.\n\t\t\tif (!isCode(error, 'EEXIST')) throw error;\n\t\t}\n\t}\n\n\tprotected async createLock(stage: string, holder: LockHolder): Promise<void> {\n\t\tawait this.ensureDir();\n\t\tlet handle: Awaited<ReturnType<typeof open>>;\n\t\ttry {\n\t\t\thandle = await open(this.lockPath(stage), 'wx', FILE_MODE);\n\t\t} catch (error) {\n\t\t\tif (isCode(error, 'EEXIST')) {\n\t\t\t\tthrow new StateLocked(\n\t\t\t\t\tstage,\n\t\t\t\t\tawait this.readLock(stage),\n\t\t\t\t\tthis.lockPath(stage),\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t\ttry {\n\t\t\tawait handle.writeFile(JSON.stringify(holder, null, 2));\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t}\n\n\tprotected async readLock(stage: string): Promise<LockHolder | null> {\n\t\ttry {\n\t\t\treturn JSON.parse(\n\t\t\t\tawait readFile(this.lockPath(stage), 'utf-8'),\n\t\t\t) as LockHolder;\n\t\t} catch {\n\t\t\t// Missing, or created by a process that died before writing to it.\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tprotected async removeLock(\n\t\tstage: string,\n\t\tholder: LockHolder | null,\n\t): Promise<void> {\n\t\tif (holder) {\n\t\t\tconst current = await this.readLock(stage);\n\t\t\tif (current?.id !== holder.id) return;\n\t\t}\n\t\tawait rm(this.lockPath(stage), { force: true });\n\t}\n\n\tprivate async ensureDir(): Promise<void> {\n\t\tawait mkdir(this.dir, { recursive: true, mode: 0o700 });\n\t}\n\n\t/**\n\t * Serialises the check-then-rename of a conditional write across\n\t * processes. The stage lock is for whole runs; this is for the instant of\n\t * a single write, so even writers that skip the lock never interleave.\n\t */\n\tprivate async withMutex<T>(stage: string, fn: () => Promise<T>): Promise<T> {\n\t\tconst path = this.mutexPath(stage);\n\t\tconst deadline = Date.now() + MUTEX_TIMEOUT_MS;\n\n\t\tfor (;;) {\n\t\t\ttry {\n\t\t\t\tconst handle = await open(path, 'wx', FILE_MODE);\n\t\t\t\tawait handle.close();\n\t\t\t\tbreak;\n\t\t\t} catch (error) {\n\t\t\t\tif (!isCode(error, 'EEXIST')) throw error;\n\t\t\t\tif (await this.isStale(path)) {\n\t\t\t\t\tawait unlink(path).catch(() => {});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (Date.now() > deadline) throw new StateStoreBusy(stage, path);\n\t\t\t\tawait new Promise((resolve) => setTimeout(resolve, 10));\n\t\t\t}\n\t\t}\n\n\t\ttry {\n\t\t\treturn await fn();\n\t\t} finally {\n\t\t\tawait rm(path, { force: true });\n\t\t}\n\t}\n\n\tprivate async isStale(path: string): Promise<boolean> {\n\t\ttry {\n\t\t\treturn Date.now() - (await stat(path)).mtimeMs > MUTEX_STALE_MS;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;AA8BA,MAAM,YAAY;;AAGlB,MAAM,mBAAmB;;;;;AAKzB,MAAM,iBAAiB;AAEvB,SAAS,OAAO,OAAgB,MAAuB;CACtD,OAAQ,OAAiC,SAAS;AACnD;AAEA,IAAa,kBAAb,cAAqC,mBAAmB;CAClC;CAArB,YAAY,eAAgC;EAC3C,MAAM;EADc,KAAA,gBAAA;CAErB;CAEA,IAAY,MAAc;EACzB,OAAO,KAAK,KAAK,eAAe,MAAM;CACvC;CAEA,UAAU,OAAuB;EAChC,OAAO,KAAK,KAAK,KAAK,UAAU,MAAM,MAAM;CAC7C;CAEA,SAAS,OAAuB;EAC/B,OAAO,KAAK,KAAK,KAAK,UAAU,MAAM,MAAM;CAC7C;CAEA,WAAW,OAAuB;EACjC,OAAO,KAAK,KAAK,KAAK,UAAU,MAAM,SAAS;CAChD;CAEA,UAAkB,OAAuB;EACxC,OAAO,KAAK,KAAK,KAAK,UAAU,MAAM,YAAY;CACnD;CAEA,SAAmB,OAAuB;EACzC,OAAO,KAAK,UAAU,KAAK;CAC5B;CAEA,MAAgB,QAAQ,OAAyC;EAChE,IAAI;GACH,MAAM,OAAO,MAAM,SAAS,KAAK,UAAU,KAAK,GAAG,OAAO;GAC1D,OAAO;IAAE;IAAM,SAAS,eAAe,IAAI;GAAE;EAC9C,SAAS,OAAO;GACf,IAAI,OAAO,OAAO,QAAQ,GAAG,OAAO;GACpC,MAAM;EACP;CACD;CAEA,MAAgB,SACf,OACA,MACA,iBACwB;EACxB,MAAM,KAAK,UAAU;EACrB,OAAO,KAAK,UAAU,OAAO,YAAY;GAExC,MAAM,UAAS,MADO,KAAK,QAAQ,KAAK,EAAA,EAChB,WAAW;GACnC,IAAI,WAAW,iBACd,MAAM,IAAI,qBAAqB,OAAO,iBAAiB,MAAM;GAK9D,MAAM,SAAS,KAAK,UAAU,KAAK;GACnC,MAAM,OAAO,GAAG,OAAO,GAAG,WAAW,EAAE;GACvC,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,MAAM,MAAM,SAAS;IAC/C,IAAI;KACH,MAAM,OAAO,UAAU,IAAI;KAC3B,MAAM,OAAO,KAAK;IACnB,UAAU;KACT,MAAM,OAAO,MAAM;IACpB;IACA,MAAM,OAAO,MAAM,MAAM;GAC1B,SAAS,OAAO;IACf,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;IAC9B,MAAM;GACP;GACA,OAAO,eAAe,IAAI;EAC3B,CAAC;CACF;CAEA,MAAgB,cAAc,OAAe,MAA6B;EACzE,IAAI;GACH,MAAM,UAAU,KAAK,WAAW,KAAK,GAAG,MAAM;IAC7C,MAAM;IACN,MAAM;GACP,CAAC;EACF,SAAS,OAAO;GAEf,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG,MAAM;EACrC;CACD;CAEA,MAAgB,WAAW,OAAe,QAAmC;EAC5E,MAAM,KAAK,UAAU;EACrB,IAAI;EACJ,IAAI;GACH,SAAS,MAAM,KAAK,KAAK,SAAS,KAAK,GAAG,MAAM,SAAS;EAC1D,SAAS,OAAO;GACf,IAAI,OAAO,OAAO,QAAQ,GACzB,MAAM,IAAI,YACT,OACA,MAAM,KAAK,SAAS,KAAK,GACzB,KAAK,SAAS,KAAK,CACpB;GAED,MAAM;EACP;EACA,IAAI;GACH,MAAM,OAAO,UAAU,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;EACvD,UAAU;GACT,MAAM,OAAO,MAAM;EACpB;CACD;CAEA,MAAgB,SAAS,OAA2C;EACnE,IAAI;GACH,OAAO,KAAK,MACX,MAAM,SAAS,KAAK,SAAS,KAAK,GAAG,OAAO,CAC7C;EACD,QAAQ;GAEP,OAAO;EACR;CACD;CAEA,MAAgB,WACf,OACA,QACgB;EAChB,IAAI,QAEC;QAAA,MADkB,KAAK,SAAS,KAAK,EAAA,EAC5B,OAAO,OAAO,IAAI;EAAA;EAEhC,MAAM,GAAG,KAAK,SAAS,KAAK,GAAG,EAAE,OAAO,KAAK,CAAC;CAC/C;CAEA,MAAc,YAA2B;EACxC,MAAM,MAAM,KAAK,KAAK;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;CACvD;;;;;;CAOA,MAAc,UAAa,OAAe,IAAkC;EAC3E,MAAM,OAAO,KAAK,UAAU,KAAK;EACjC,MAAM,WAAW,KAAK,IAAI,IAAI;EAE9B,SACC,IAAI;GAEH,OAAM,MADe,KAAK,MAAM,MAAM,SAAS,EAAA,CAClC,MAAM;GACnB;EACD,SAAS,OAAO;GACf,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG,MAAM;GACpC,IAAI,MAAM,KAAK,QAAQ,IAAI,GAAG;IAC7B,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IACjC;GACD;GACA,IAAI,KAAK,IAAI,IAAI,UAAU,MAAM,IAAI,eAAe,OAAO,IAAI;GAC/D,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EACvD;EAGD,IAAI;GACH,OAAO,MAAM,GAAG;EACjB,UAAU;GACT,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC/B;CACD;CAEA,MAAc,QAAQ,MAAgC;EACrD,IAAI;GACH,OAAO,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,EAAA,CAAG,UAAU;EAClD,QAAQ;GACP,OAAO;EACR;CACD;AACD"}

package/dist/LocalStateStore-DDDU0HkI.cjs

@@ -1,163 +0,0 @@
-const require_index = require("./index.cjs");
-let node_fs_promises = require("node:fs/promises");
-let node_path = require("node:path");
-let node_crypto = require("node:crypto");
-//#region src/deploy/LocalStateStore.ts
-/**
-* Local filesystem state store.
-*
-* `.gkm/deploy-<stage>.json` holds the state, `.gkm/deploy-<stage>.lock` the
-* lock. Every file is mode 0600: state holds database passwords and IAM keys.
-*/
-const FILE_MODE = 384;
-/** How long a write waits for another process's write to finish. */
-const MUTEX_TIMEOUT_MS = 5e3;
-/**
-* A write holds the mutex for milliseconds, so one this old was left by a
-* process that died mid-write and is safe to take over.
-*/
-const MUTEX_STALE_MS = 3e4;
-function isCode(error, code) {
-	return error?.code === code;
-}
-var LocalStateStore = class extends require_index.DocumentStateStore {
-	workspaceRoot;
-	constructor(workspaceRoot) {
-		super();
-		this.workspaceRoot = workspaceRoot;
-	}
-	get dir() {
-		return (0, node_path.join)(this.workspaceRoot, ".gkm");
-	}
-	statePath(stage) {
-		return (0, node_path.join)(this.dir, `deploy-${stage}.json`);
-	}
-	lockPath(stage) {
-		return (0, node_path.join)(this.dir, `deploy-${stage}.lock`);
-	}
-	backupPath(stage) {
-		return (0, node_path.join)(this.dir, `deploy-${stage}.v1.json`);
-	}
-	mutexPath(stage) {
-		return (0, node_path.join)(this.dir, `deploy-${stage}.json.mutex`);
-	}
-	location(stage) {
-		return this.statePath(stage);
-	}
-	async readRaw(stage) {
-		try {
-			const body = await (0, node_fs_promises.readFile)(this.statePath(stage), "utf-8");
-			return {
-				body,
-				version: require_index.contentVersion(body)
-			};
-		} catch (error) {
-			if (isCode(error, "ENOENT")) return null;
-			throw error;
-		}
-	}
-	async writeRaw(stage, body, expectedVersion) {
-		await this.ensureDir();
-		return this.withMutex(stage, async () => {
-			const actual = (await this.readRaw(stage))?.version ?? null;
-			if (actual !== expectedVersion) throw new require_index.StateVersionConflict(stage, expectedVersion, actual);
-			const target = this.statePath(stage);
-			const temp = `${target}.${(0, node_crypto.randomUUID)()}.tmp`;
-			try {
-				const handle = await (0, node_fs_promises.open)(temp, "wx", FILE_MODE);
-				try {
-					await handle.writeFile(body);
-					await handle.sync();
-				} finally {
-					await handle.close();
-				}
-				await (0, node_fs_promises.rename)(temp, target);
-			} catch (error) {
-				await (0, node_fs_promises.rm)(temp, { force: true });
-				throw error;
-			}
-			return require_index.contentVersion(body);
-		});
-	}
-	async writeV1Backup(stage, body) {
-		try {
-			await (0, node_fs_promises.writeFile)(this.backupPath(stage), body, {
-				flag: "wx",
-				mode: FILE_MODE
-			});
-		} catch (error) {
-			if (!isCode(error, "EEXIST")) throw error;
-		}
-	}
-	async createLock(stage, holder) {
-		await this.ensureDir();
-		let handle;
-		try {
-			handle = await (0, node_fs_promises.open)(this.lockPath(stage), "wx", FILE_MODE);
-		} catch (error) {
-			if (isCode(error, "EEXIST")) throw new require_index.StateLocked(stage, await this.readLock(stage), this.lockPath(stage));
-			throw error;
-		}
-		try {
-			await handle.writeFile(JSON.stringify(holder, null, 2));
-		} finally {
-			await handle.close();
-		}
-	}
-	async readLock(stage) {
-		try {
-			return JSON.parse(await (0, node_fs_promises.readFile)(this.lockPath(stage), "utf-8"));
-		} catch {
-			return null;
-		}
-	}
-	async removeLock(stage, holder) {
-		if (holder) {
-			if ((await this.readLock(stage))?.id !== holder.id) return;
-		}
-		await (0, node_fs_promises.rm)(this.lockPath(stage), { force: true });
-	}
-	async ensureDir() {
-		await (0, node_fs_promises.mkdir)(this.dir, {
-			recursive: true,
-			mode: 448
-		});
-	}
-	/**
-	* Serialises the check-then-rename of a conditional write across
-	* processes. The stage lock is for whole runs; this is for the instant of
-	* a single write, so even writers that skip the lock never interleave.
-	*/
-	async withMutex(stage, fn) {
-		const path = this.mutexPath(stage);
-		const deadline = Date.now() + MUTEX_TIMEOUT_MS;
-		for (;;) try {
-			await (await (0, node_fs_promises.open)(path, "wx", FILE_MODE)).close();
-			break;
-		} catch (error) {
-			if (!isCode(error, "EEXIST")) throw error;
-			if (await this.isStale(path)) {
-				await (0, node_fs_promises.unlink)(path).catch(() => {});
-				continue;
-			}
-			if (Date.now() > deadline) throw new require_index.StateStoreBusy(stage, path);
-			await new Promise((resolve) => setTimeout(resolve, 10));
-		}
-		try {
-			return await fn();
-		} finally {
-			await (0, node_fs_promises.rm)(path, { force: true });
-		}
-	}
-	async isStale(path) {
-		try {
-			return Date.now() - (await (0, node_fs_promises.stat)(path)).mtimeMs > MUTEX_STALE_MS;
-		} catch {
-			return false;
-		}
-	}
-};
-//#endregion
-exports.LocalStateStore = LocalStateStore;
-
-//# sourceMappingURL=LocalStateStore-DDDU0HkI.cjs.map

package/dist/LocalStateStore-DDDU0HkI.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"LocalStateStore-DDDU0HkI.cjs","names":["DocumentStateStore","join","readFile","contentVersion","StateVersionConflict","randomUUID","open","rename","rm","writeFile","StateLocked","mkdir","unlink","StateStoreBusy","stat"],"sources":["../src/deploy/LocalStateStore.ts"],"sourcesContent":["/**\n * Local filesystem state store.\n *\n * `.gkm/deploy-<stage>.json` holds the state, `.gkm/deploy-<stage>.lock` the\n * lock. Every file is mode 0600: state holds database passwords and IAM keys.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport {\n\tmkdir,\n\topen,\n\treadFile,\n\trename,\n\trm,\n\tstat,\n\tunlink,\n\twriteFile,\n} from 'node:fs/promises';\nimport { join } from 'node:path';\nimport {\n\tcontentVersion,\n\tDocumentStateStore,\n\ttype LockHolder,\n\ttype RawState,\n\tStateLocked,\n\tStateStoreBusy,\n\ttype StateVersion,\n\tStateVersionConflict,\n} from './StateStore';\n\nconst FILE_MODE = 0o600;\n\n/** How long a write waits for another process's write to finish. */\nconst MUTEX_TIMEOUT_MS = 5_000;\n/**\n * A write holds the mutex for milliseconds, so one this old was left by a\n * process that died mid-write and is safe to take over.\n */\nconst MUTEX_STALE_MS = 30_000;\n\nfunction isCode(error: unknown, code: string): boolean {\n\treturn (error as NodeJS.ErrnoException)?.code === code;\n}\n\nexport class LocalStateStore extends DocumentStateStore {\n\tconstructor(readonly workspaceRoot: string) {\n\t\tsuper();\n\t}\n\n\tprivate get dir(): string {\n\t\treturn join(this.workspaceRoot, '.gkm');\n\t}\n\n\tstatePath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.json`);\n\t}\n\n\tlockPath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.lock`);\n\t}\n\n\tbackupPath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.v1.json`);\n\t}\n\n\tprivate mutexPath(stage: string): string {\n\t\treturn join(this.dir, `deploy-${stage}.json.mutex`);\n\t}\n\n\tprotected location(stage: string): string {\n\t\treturn this.statePath(stage);\n\t}\n\n\tprotected async readRaw(stage: string): Promise<RawState | null> {\n\t\ttry {\n\t\t\tconst body = await readFile(this.statePath(stage), 'utf-8');\n\t\t\treturn { body, version: contentVersion(body) };\n\t\t} catch (error) {\n\t\t\tif (isCode(error, 'ENOENT')) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tprotected async writeRaw(\n\t\tstage: string,\n\t\tbody: string,\n\t\texpectedVersion: StateVersion | null,\n\t): Promise<StateVersion> {\n\t\tawait this.ensureDir();\n\t\treturn this.withMutex(stage, async () => {\n\t\t\tconst current = await this.readRaw(stage);\n\t\t\tconst actual = current?.version ?? null;\n\t\t\tif (actual !== expectedVersion) {\n\t\t\t\tthrow new StateVersionConflict(stage, expectedVersion, actual);\n\t\t\t}\n\n\t\t\t// Written beside the target and renamed over it: a reader sees the\n\t\t\t// old file or the new one, never half of either.\n\t\t\tconst target = this.statePath(stage);\n\t\t\tconst temp = `${target}.${randomUUID()}.tmp`;\n\t\t\ttry {\n\t\t\t\tconst handle = await open(temp, 'wx', FILE_MODE);\n\t\t\t\ttry {\n\t\t\t\t\tawait handle.writeFile(body);\n\t\t\t\t\tawait handle.sync();\n\t\t\t\t} finally {\n\t\t\t\t\tawait handle.close();\n\t\t\t\t}\n\t\t\t\tawait rename(temp, target);\n\t\t\t} catch (error) {\n\t\t\t\tawait rm(temp, { force: true });\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\treturn contentVersion(body);\n\t\t});\n\t}\n\n\tprotected async writeV1Backup(stage: string, body: string): Promise<void> {\n\t\ttry {\n\t\t\tawait writeFile(this.backupPath(stage), body, {\n\t\t\t\tflag: 'wx',\n\t\t\t\tmode: FILE_MODE,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\t// The first migration's backup is the one worth keeping.\n\t\t\tif (!isCode(error, 'EEXIST')) throw error;\n\t\t}\n\t}\n\n\tprotected async createLock(stage: string, holder: LockHolder): Promise<void> {\n\t\tawait this.ensureDir();\n\t\tlet handle: Awaited<ReturnType<typeof open>>;\n\t\ttry {\n\t\t\thandle = await open(this.lockPath(stage), 'wx', FILE_MODE);\n\t\t} catch (error) {\n\t\t\tif (isCode(error, 'EEXIST')) {\n\t\t\t\tthrow new StateLocked(\n\t\t\t\t\tstage,\n\t\t\t\t\tawait this.readLock(stage),\n\t\t\t\t\tthis.lockPath(stage),\n\t\t\t\t);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t\ttry {\n\t\t\tawait handle.writeFile(JSON.stringify(holder, null, 2));\n\t\t} finally {\n\t\t\tawait handle.close();\n\t\t}\n\t}\n\n\tprotected async readLock(stage: string): Promise<LockHolder | null> {\n\t\ttry {\n\t\t\treturn JSON.parse(\n\t\t\t\tawait readFile(this.lockPath(stage), 'utf-8'),\n\t\t\t) as LockHolder;\n\t\t} catch {\n\t\t\t// Missing, or created by a process that died before writing to it.\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tprotected async removeLock(\n\t\tstage: string,\n\t\tholder: LockHolder | null,\n\t): Promise<void> {\n\t\tif (holder) {\n\t\t\tconst current = await this.readLock(stage);\n\t\t\tif (current?.id !== holder.id) return;\n\t\t}\n\t\tawait rm(this.lockPath(stage), { force: true });\n\t}\n\n\tprivate async ensureDir(): Promise<void> {\n\t\tawait mkdir(this.dir, { recursive: true, mode: 0o700 });\n\t}\n\n\t/**\n\t * Serialises the check-then-rename of a conditional write across\n\t * processes. The stage lock is for whole runs; this is for the instant of\n\t * a single write, so even writers that skip the lock never interleave.\n\t */\n\tprivate async withMutex<T>(stage: string, fn: () => Promise<T>): Promise<T> {\n\t\tconst path = this.mutexPath(stage);\n\t\tconst deadline = Date.now() + MUTEX_TIMEOUT_MS;\n\n\t\tfor (;;) {\n\t\t\ttry {\n\t\t\t\tconst handle = await open(path, 'wx', FILE_MODE);\n\t\t\t\tawait handle.close();\n\t\t\t\tbreak;\n\t\t\t} catch (error) {\n\t\t\t\tif (!isCode(error, 'EEXIST')) throw error;\n\t\t\t\tif (await this.isStale(path)) {\n\t\t\t\t\tawait unlink(path).catch(() => {});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (Date.now() > deadline) throw new StateStoreBusy(stage, path);\n\t\t\t\tawait new Promise((resolve) => setTimeout(resolve, 10));\n\t\t\t}\n\t\t}\n\n\t\ttry {\n\t\t\treturn await fn();\n\t\t} finally {\n\t\t\tawait rm(path, { force: true });\n\t\t}\n\t}\n\n\tprivate async isStale(path: string): Promise<boolean> {\n\t\ttry {\n\t\t\treturn Date.now() - (await stat(path)).mtimeMs > MUTEX_STALE_MS;\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;AA8BA,MAAM,YAAY;;AAGlB,MAAM,mBAAmB;;;;;AAKzB,MAAM,iBAAiB;AAEvB,SAAS,OAAO,OAAgB,MAAuB;CACtD,OAAQ,OAAiC,SAAS;AACnD;AAEA,IAAa,kBAAb,cAAqCA,cAAAA,mBAAmB;CAClC;CAArB,YAAY,eAAgC;EAC3C,MAAM;EADc,KAAA,gBAAA;CAErB;CAEA,IAAY,MAAc;EACzB,QAAA,GAAOC,UAAAA,KAAAA,CAAK,KAAK,eAAe,MAAM;CACvC;CAEA,UAAU,OAAuB;EAChC,QAAA,GAAOA,UAAAA,KAAAA,CAAK,KAAK,KAAK,UAAU,MAAM,MAAM;CAC7C;CAEA,SAAS,OAAuB;EAC/B,QAAA,GAAOA,UAAAA,KAAAA,CAAK,KAAK,KAAK,UAAU,MAAM,MAAM;CAC7C;CAEA,WAAW,OAAuB;EACjC,QAAA,GAAOA,UAAAA,KAAAA,CAAK,KAAK,KAAK,UAAU,MAAM,SAAS;CAChD;CAEA,UAAkB,OAAuB;EACxC,QAAA,GAAOA,UAAAA,KAAAA,CAAK,KAAK,KAAK,UAAU,MAAM,YAAY;CACnD;CAEA,SAAmB,OAAuB;EACzC,OAAO,KAAK,UAAU,KAAK;CAC5B;CAEA,MAAgB,QAAQ,OAAyC;EAChE,IAAI;GACH,MAAM,OAAO,OAAA,GAAMC,iBAAAA,SAAAA,CAAS,KAAK,UAAU,KAAK,GAAG,OAAO;GAC1D,OAAO;IAAE;IAAM,SAASC,cAAAA,eAAe,IAAI;GAAE;EAC9C,SAAS,OAAO;GACf,IAAI,OAAO,OAAO,QAAQ,GAAG,OAAO;GACpC,MAAM;EACP;CACD;CAEA,MAAgB,SACf,OACA,MACA,iBACwB;EACxB,MAAM,KAAK,UAAU;EACrB,OAAO,KAAK,UAAU,OAAO,YAAY;GAExC,MAAM,UAAS,MADO,KAAK,QAAQ,KAAK,EAAA,EAChB,WAAW;GACnC,IAAI,WAAW,iBACd,MAAM,IAAIC,cAAAA,qBAAqB,OAAO,iBAAiB,MAAM;GAK9D,MAAM,SAAS,KAAK,UAAU,KAAK;GACnC,MAAM,OAAO,GAAG,OAAO,IAAA,GAAGC,YAAAA,WAAAA,CAAW,EAAE;GACvC,IAAI;IACH,MAAM,SAAS,OAAA,GAAMC,iBAAAA,KAAAA,CAAK,MAAM,MAAM,SAAS;IAC/C,IAAI;KACH,MAAM,OAAO,UAAU,IAAI;KAC3B,MAAM,OAAO,KAAK;IACnB,UAAU;KACT,MAAM,OAAO,MAAM;IACpB;IACA,OAAA,GAAMC,iBAAAA,OAAAA,CAAO,MAAM,MAAM;GAC1B,SAAS,OAAO;IACf,OAAA,GAAMC,iBAAAA,GAAAA,CAAG,MAAM,EAAE,OAAO,KAAK,CAAC;IAC9B,MAAM;GACP;GACA,OAAOL,cAAAA,eAAe,IAAI;EAC3B,CAAC;CACF;CAEA,MAAgB,cAAc,OAAe,MAA6B;EACzE,IAAI;GACH,OAAA,GAAMM,iBAAAA,UAAAA,CAAU,KAAK,WAAW,KAAK,GAAG,MAAM;IAC7C,MAAM;IACN,MAAM;GACP,CAAC;EACF,SAAS,OAAO;GAEf,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG,MAAM;EACrC;CACD;CAEA,MAAgB,WAAW,OAAe,QAAmC;EAC5E,MAAM,KAAK,UAAU;EACrB,IAAI;EACJ,IAAI;GACH,SAAS,OAAA,GAAMH,iBAAAA,KAAAA,CAAK,KAAK,SAAS,KAAK,GAAG,MAAM,SAAS;EAC1D,SAAS,OAAO;GACf,IAAI,OAAO,OAAO,QAAQ,GACzB,MAAM,IAAII,cAAAA,YACT,OACA,MAAM,KAAK,SAAS,KAAK,GACzB,KAAK,SAAS,KAAK,CACpB;GAED,MAAM;EACP;EACA,IAAI;GACH,MAAM,OAAO,UAAU,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;EACvD,UAAU;GACT,MAAM,OAAO,MAAM;EACpB;CACD;CAEA,MAAgB,SAAS,OAA2C;EACnE,IAAI;GACH,OAAO,KAAK,MACX,OAAA,GAAMR,iBAAAA,SAAAA,CAAS,KAAK,SAAS,KAAK,GAAG,OAAO,CAC7C;EACD,QAAQ;GAEP,OAAO;EACR;CACD;CAEA,MAAgB,WACf,OACA,QACgB;EAChB,IAAI,QAEC;QAAA,MADkB,KAAK,SAAS,KAAK,EAAA,EAC5B,OAAO,OAAO,IAAI;EAAA;EAEhC,OAAA,GAAMM,iBAAAA,GAAAA,CAAG,KAAK,SAAS,KAAK,GAAG,EAAE,OAAO,KAAK,CAAC;CAC/C;CAEA,MAAc,YAA2B;EACxC,OAAA,GAAMG,iBAAAA,MAAAA,CAAM,KAAK,KAAK;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;CACvD;;;;;;CAOA,MAAc,UAAa,OAAe,IAAkC;EAC3E,MAAM,OAAO,KAAK,UAAU,KAAK;EACjC,MAAM,WAAW,KAAK,IAAI,IAAI;EAE9B,SACC,IAAI;GAEH,OAAM,OAAA,GADeL,iBAAAA,KAAAA,CAAK,MAAM,MAAM,SAAS,EAAA,CAClC,MAAM;GACnB;EACD,SAAS,OAAO;GACf,IAAI,CAAC,OAAO,OAAO,QAAQ,GAAG,MAAM;GACpC,IAAI,MAAM,KAAK,QAAQ,IAAI,GAAG;IAC7B,OAAA,GAAMM,iBAAAA,OAAAA,CAAO,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IACjC;GACD;GACA,IAAI,KAAK,IAAI,IAAI,UAAU,MAAM,IAAIC,cAAAA,eAAe,OAAO,IAAI;GAC/D,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;EACvD;EAGD,IAAI;GACH,OAAO,MAAM,GAAG;EACjB,UAAU;GACT,OAAA,GAAML,iBAAAA,GAAAA,CAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC/B;CACD;CAEA,MAAc,QAAQ,MAAgC;EACrD,IAAI;GACH,OAAO,KAAK,IAAI,KAAK,OAAA,GAAMM,iBAAAA,KAAAA,CAAK,IAAI,EAAA,CAAG,UAAU;EAClD,QAAQ;GACP,OAAO;EACR;CACD;AACD"}

package/dist/SSMStateProvider-B0Hu1MKZ.mjs

@@ -1,75 +0,0 @@
-import { n as __require } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { GetParameterCommand, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
-//#region src/deploy/SSMStateProvider.ts
-/**
-* AWS SSM Parameter Store State Provider
-*
-* Stores deployment state as SecureString parameters in AWS SSM.
-* Uses AWS-managed KMS key for encryption (free tier).
-*
-* Parameter naming: /gkm/{workspaceName}/{stage}/state
-*/
-/**
-* AWS SSM Parameter Store state provider.
-*
-* Stores state as encrypted SecureString parameters.
-* Parameter path: /gkm/{workspaceName}/{stage}/state
-*/
-var SSMStateProvider = class SSMStateProvider {
-	workspaceName;
-	client;
-	constructor(workspaceName, client) {
-		this.workspaceName = workspaceName;
-		this.client = client;
-	}
-	/**
-	* Create an SSMStateProvider with a new SSMClient.
-	*/
-	static create(options) {
-		const clientConfig = {
-			region: options.region,
-			endpoint: options.endpoint
-		};
-		if (options.profile) {
-			const { fromIni } = __require("@aws-sdk/credential-providers");
-			clientConfig.credentials = fromIni({ profile: options.profile });
-		} else if (options.credentials) clientConfig.credentials = options.credentials;
-		const client = new SSMClient(clientConfig);
-		return new SSMStateProvider(options.workspaceName, client);
-	}
-	/**
-	* Get the SSM parameter name for a stage.
-	*/
-	getParameterName(stage) {
-		return `/gkm/${this.workspaceName}/${stage}/state`;
-	}
-	async read(stage) {
-		const parameterName = this.getParameterName(stage);
-		try {
-			const response = await this.client.send(new GetParameterCommand({
-				Name: parameterName,
-				WithDecryption: true
-			}));
-			if (!response.Parameter?.Value) return null;
-			return JSON.parse(response.Parameter.Value);
-		} catch (error) {
-			if (error instanceof ParameterNotFound) return null;
-			throw error;
-		}
-	}
-	async write(stage, state) {
-		const parameterName = this.getParameterName(stage);
-		state.lastDeployedAt = (/* @__PURE__ */ new Date()).toISOString();
-		await this.client.send(new PutParameterCommand({
-			Name: parameterName,
-			Value: JSON.stringify(state),
-			Type: "SecureString",
-			Overwrite: true,
-			Description: `GKM deployment state for ${this.workspaceName}/${stage}`
-		}));
-	}
-};
-//#endregion
-export { SSMStateProvider };
-
-//# sourceMappingURL=SSMStateProvider-B0Hu1MKZ.mjs.map

package/dist/SSMStateProvider-B0Hu1MKZ.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"SSMStateProvider-B0Hu1MKZ.mjs","names":[],"sources":["../src/deploy/SSMStateProvider.ts"],"sourcesContent":["/**\n * AWS SSM Parameter Store State Provider\n *\n * Stores deployment state as SecureString parameters in AWS SSM.\n * Uses AWS-managed KMS key for encryption (free tier).\n *\n * Parameter naming: /gkm/{workspaceName}/{stage}/state\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { AwsRegion, StateProvider } from './StateProvider';\nimport type { DokployStageState } from './state';\n\nexport interface SSMStateProviderOptions {\n\t/** Workspace name (used in parameter path) */\n\tworkspaceName: string;\n\t/** AWS region */\n\tregion?: AwsRegion;\n\t/** AWS profile name (optional - uses default credential chain if not provided) */\n\tprofile?: string;\n\t/** AWS credentials (optional - uses default credential chain if not provided) */\n\tcredentials?: SSMClientConfig['credentials'];\n\t/** Custom endpoint (for LocalStack or other S3-compatible services) */\n\tendpoint?: string;\n}\n\n/**\n * AWS SSM Parameter Store state provider.\n *\n * Stores state as encrypted SecureString parameters.\n * Parameter path: /gkm/{workspaceName}/{stage}/state\n */\nexport class SSMStateProvider implements StateProvider {\n\tconstructor(\n\t\treadonly workspaceName: string,\n\t\tprivate readonly client: SSMClient,\n\t) {}\n\n\t/**\n\t * Create an SSMStateProvider with a new SSMClient.\n\t */\n\tstatic create(options: SSMStateProviderOptions): SSMStateProvider {\n\t\tconst clientConfig: SSMClientConfig = {\n\t\t\tregion: options.region,\n\t\t\tendpoint: options.endpoint,\n\t\t};\n\n\t\t// Use profile credentials if specified, otherwise use provided credentials or default chain\n\t\tif (options.profile) {\n\t\t\t// Dynamic import to avoid requiring @aws-sdk/credential-providers when not using profiles\n\t\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\t\tclientConfig.credentials = fromIni({ profile: options.profile });\n\t\t} else if (options.credentials) {\n\t\t\tclientConfig.credentials = options.credentials;\n\t\t}\n\n\t\tconst client = new SSMClient(clientConfig);\n\t\treturn new SSMStateProvider(options.workspaceName, client);\n\t}\n\n\t/**\n\t * Get the SSM parameter name for a stage.\n\t */\n\tprivate getParameterName(stage: string): string {\n\t\treturn `/gkm/${this.workspaceName}/${stage}/state`;\n\t}\n\n\tasync read(stage: string): Promise<DokployStageState | null> {\n\t\tconst parameterName = this.getParameterName(stage);\n\n\t\ttry {\n\t\t\tconst response = await this.client.send(\n\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\tName: parameterName,\n\t\t\t\t\tWithDecryption: true,\n\t\t\t\t}),\n\t\t\t);\n\n\t\t\tif (!response.Parameter?.Value) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn JSON.parse(response.Parameter.Value) as DokployStageState;\n\t\t} catch (error) {\n\t\t\t// Parameter doesn't exist - return null (new deployment)\n\t\t\tif (error instanceof ParameterNotFound) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\t// Re-throw other errors (permission denied, network, etc.)\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, state: DokployStageState): Promise<void> {\n\t\tconst parameterName = this.getParameterName(stage);\n\n\t\t// Update last deployed timestamp\n\t\tstate.lastDeployedAt = new Date().toISOString();\n\n\t\tawait this.client.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName: parameterName,\n\t\t\t\tValue: JSON.stringify(state),\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription: `GKM deployment state for ${this.workspaceName}/${stage}`,\n\t\t\t}),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAsCA,IAAa,mBAAb,MAAa,iBAA0C;CAE5C;CACQ;CAFlB,YACC,eACA,QACC;EAFQ,KAAA,gBAAA;EACQ,KAAA,SAAA;CACf;;;;CAKH,OAAO,OAAO,SAAoD;EACjE,MAAM,eAAgC;GACrC,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACnB;EAGA,IAAI,QAAQ,SAAS;GAEpB,MAAM,EAAE,YAAA,UAAoB,+BAA+B;GAC3D,aAAa,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAChE,OAAO,IAAI,QAAQ,aAClB,aAAa,cAAc,QAAQ;EAGpC,MAAM,SAAS,IAAI,UAAU,YAAY;EACzC,OAAO,IAAI,iBAAiB,QAAQ,eAAe,MAAM;CAC1D;;;;CAKA,iBAAyB,OAAuB;EAC/C,OAAO,QAAQ,KAAK,cAAc,GAAG,MAAM;CAC5C;CAEA,MAAM,KAAK,OAAkD;EAC5D,MAAM,gBAAgB,KAAK,iBAAiB,KAAK;EAEjD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,OAAO,KAClC,IAAI,oBAAoB;IACvB,MAAM;IACN,gBAAgB;GACjB,CAAC,CACF;GAEA,IAAI,CAAC,SAAS,WAAW,OACxB,OAAO;GAGR,OAAO,KAAK,MAAM,SAAS,UAAU,KAAK;EAC3C,SAAS,OAAO;GAEf,IAAI,iBAAiB,mBACpB,OAAO;GAIR,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,OAAyC;EACnE,MAAM,gBAAgB,KAAK,iBAAiB,KAAK;EAGjD,MAAM,kCAAiB,IAAI,KAAK,EAAA,CAAE,YAAY;EAE9C,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;GACvB,MAAM;GACN,OAAO,KAAK,UAAU,KAAK;GAC3B,MAAM;GACN,WAAW;GACX,aAAa,4BAA4B,KAAK,cAAc,GAAG;EAChE,CAAC,CACF;CACD;AACD"}