@geekmidas/cli 10.0.0-alpha.68 → 10.0.0-alpha.70

package/dist/{SSMStateStore-DjPuKqrm.mjs.map → SSMStateStore-Dvl4A8Up.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"SSMStateStore-DjPuKqrm.mjs","names":[],"sources":["../src/deploy/SSMStateStore.ts"],"sourcesContent":["/**\n * AWS SSM Parameter Store state store.\n *\n * - `/gkm/<workspace>/<stage>/state`: the state, a SecureString.\n * - `/gkm/<workspace>/<stage>/lock`: the lock, created only if absent.\n * - `/gkm/<workspace>/<stage>/state.v1`: the v1 state, kept on migration.\n *\n * SSM has no conditional put, so a write checks the parameter's version\n * before it puts, and checks the version the put returns after: a put that\n * did not land exactly one version above the one it was based on raced\n * another writer, and raises `StateVersionConflict` rather than reporting\n * success. Both writes stay in the parameter's history.\n */\n\nimport {\n\tDeleteParameterCommand,\n\tGetParameterCommand,\n\tParameterAlreadyExists,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { AwsRegion } from './StateProvider';\nimport {\n\tDocumentStateStore,\n\ttype LockHolder,\n\ttype RawState,\n\tStateLocked,\n\ttype StateVersion,\n\tStateVersionConflict,\n} from './StateStore';\n\nexport interface SSMStateStoreOptions {\n\tworkspaceName: string;\n\tregion?: AwsRegion;\n\t/** Uses the default credential chain when omitted. */\n\tprofile?: string;\n\tcredentials?: SSMClientConfig['credentials'];\n\t/** For the local AWS emulator. */\n\tendpoint?: string;\n}\n\nexport class SSMStateStore extends DocumentStateStore {\n\tconstructor(\n\t\treadonly workspaceName: string,\n\t\tprivate readonly client: SSMClient,\n\t) {\n\t\tsuper();\n\t}\n\n\tstatic create(options: SSMStateStoreOptions): SSMStateStore {\n\t\tconst config: SSMClientConfig = {\n\t\t\tregion: options.region,\n\t\t\tendpoint: options.endpoint,\n\t\t};\n\t\tif (options.profile) {\n\t\t\t// Required lazily: only a profile needs the credential providers.\n\t\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: options.profile });\n\t\t} else if (options.credentials) {\n\t\t\tconfig.credentials = options.credentials;\n\t\t}\n\t\treturn new SSMStateStore(options.workspaceName, new SSMClient(config));\n\t}\n\n\tprivate name(stage: string, leaf: string): string {\n\t\treturn `/gkm/${this.workspaceName}/${stage}/${leaf}`;\n\t}\n\n\tprotected location(stage: string): string {\n\t\treturn `ssm:${this.name(stage, 'state')}`;\n\t}\n\n\tprotected async readRaw(stage: string): Promise<RawState | null> {\n\t\tconst parameter = await this.get(this.name(stage, 'state'));\n\t\tif (!parameter) return null;\n\t\treturn { body: parameter.value, version: String(parameter.version) };\n\t}\n\n\tprotected async writeRaw(\n\t\tstage: string,\n\t\tbody: string,\n\t\texpectedVersion: StateVersion | null,\n\t): Promise<StateVersion> {\n\t\tconst Name = this.name(stage, 'state');\n\t\tconst Description = `GKM deployment state for ${this.workspaceName}/${stage}`;\n\n\t\tif (expectedVersion === null) {\n\t\t\ttry {\n\t\t\t\tconst { Version } = await this.client.send(\n\t\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\t\tName,\n\t\t\t\t\t\tValue: body,\n\t\t\t\t\t\tType: 'SecureString',\n\t\t\t\t\t\tDescription,\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn String(Version);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof ParameterAlreadyExists) {\n\t\t\t\t\tconst current = await this.get(Name);\n\t\t\t\t\tthrow new StateVersionConflict(\n\t\t\t\t\t\tstage,\n\t\t\t\t\t\tnull,\n\t\t\t\t\t\tcurrent ? String(current.version) : null,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\tconst current = await this.get(Name);\n\t\tconst actual = current ? String(current.version) : null;\n\t\tif (actual !== expectedVersion) {\n\t\t\tthrow new StateVersionConflict(stage, expectedVersion, actual);\n\t\t}\n\n\t\tconst { Version } = await this.client.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName,\n\t\t\t\tValue: body,\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription,\n\t\t\t}),\n\t\t);\n\t\tif (Version !== Number(expectedVersion) + 1) {\n\t\t\t// Another put landed between the check and this one. Ours is now\n\t\t\t// on top, but the caller that wrote the other believes its write\n\t\t\t// is current — its next write will conflict too, so neither is\n\t\t\t// lost silently.\n\t\t\tthrow new StateVersionConflict(\n\t\t\t\tstage,\n\t\t\t\texpectedVersion,\n\t\t\t\tString((Version ?? 1) - 1),\n\t\t\t);\n\t\t}\n\n\t\t// The version alone is not enough under an emulator, and need not be\n\t\t// on SSM either: two overwrites that raced can both be answered with\n\t\t// the same version, and both would report success. If the parameter is\n\t\t// still at the version this put returned, it has to hold this body —\n\t\t// otherwise the other put is the one that stuck.\n\t\tconst landed = await this.get(Name);\n\t\tif (landed && landed.version === Version && landed.value !== body) {\n\t\t\tthrow new StateVersionConflict(stage, expectedVersion, String(Version));\n\t\t}\n\t\treturn String(Version);\n\t}\n\n\tprotected async writeV1Backup(stage: string, body: string): Promise<void> {\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\tName: this.name(stage, 'state.v1'),\n\t\t\t\t\tValue: body,\n\t\t\t\t\tType: 'SecureString',\n\t\t\t\t\tDescription: `GKM v1 deployment state for ${this.workspaceName}/${stage}, kept on migration`,\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\t// The first migration's backup is the one worth keeping.\n\t\t\tif (!(error instanceof ParameterAlreadyExists)) throw error;\n\t\t}\n\t}\n\n\tprotected async createLock(stage: string, holder: LockHolder): Promise<void> {\n\t\tconst Name = this.name(stage, 'lock');\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\tName,\n\t\t\t\t\tValue: JSON.stringify(holder),\n\t\t\t\t\tType: 'String',\n\t\t\t\t\tDescription: `GKM deploy lock for ${this.workspaceName}/${stage}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterAlreadyExists) {\n\t\t\t\tthrow new StateLocked(stage, await this.readLock(stage), `ssm:${Name}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\n\t\t// A create-only put is atomic on SSM, so the lock is ours. Read it back\n\t\t// anyway: on a store where two racing creates can both succeed (the\n\t\t// local emulator does, a few times in a hundred) the later one has\n\t\t// overwritten the earlier — version 2, someone else's holder — and\n\t\t// taking the lock regardless would give the stage two deploys.\n\t\tconst created = await this.get(Name);\n\t\tconst recorded = created ? parseHolder(created.value) : null;\n\t\tif (created?.version !== 1 || recorded?.id !== holder.id) {\n\t\t\tthrow new StateLocked(stage, recorded, `ssm:${Name}`);\n\t\t}\n\t}\n\n\tprotected async readLock(stage: string): Promise<LockHolder | null> {\n\t\tconst parameter = await this.get(this.name(stage, 'lock'));\n\t\treturn parameter ? parseHolder(parameter.value) : null;\n\t}\n\n\tprotected async removeLock(\n\t\tstage: string,\n\t\tholder: LockHolder | null,\n\t): Promise<void> {\n\t\tif (holder) {\n\t\t\tconst current = await this.readLock(stage);\n\t\t\tif (current?.id !== holder.id) return;\n\t\t}\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew DeleteParameterCommand({ Name: this.name(stage, 'lock') }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ParameterNotFound)) throw error;\n\t\t}\n\t}\n\n\tprivate async get(\n\t\tName: string,\n\t): Promise<{ value: string; version: number } | null> {\n\t\ttry {\n\t\t\tconst { Parameter } = await this.client.send(\n\t\t\t\tnew GetParameterCommand({ Name, WithDecryption: true }),\n\t\t\t);\n\t\t\tif (Parameter?.Value === undefined) return null;\n\t\t\treturn { value: Parameter.Value, version: Parameter.Version ?? 1 };\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n\nfunction parseHolder(value: string): LockHolder | null {\n\ttry {\n\t\treturn JSON.parse(value) as LockHolder;\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2CA,IAAa,gBAAb,MAAa,sBAAsB,mBAAmB;CAE3C;CACQ;CAFlB,YACC,eACA,QACC;EACD,MAAM;EAHG,KAAA,gBAAA;EACQ,KAAA,SAAA;CAGlB;CAEA,OAAO,OAAO,SAA8C;EAC3D,MAAM,SAA0B;GAC/B,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACnB;EACA,IAAI,QAAQ,SAAS;GAEpB,MAAM,EAAE,YAAA,UAAoB,+BAA+B;GAC3D,OAAO,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAC1D,OAAO,IAAI,QAAQ,aAClB,OAAO,cAAc,QAAQ;EAE9B,OAAO,IAAI,cAAc,QAAQ,eAAe,IAAI,UAAU,MAAM,CAAC;CACtE;CAEA,KAAa,OAAe,MAAsB;EACjD,OAAO,QAAQ,KAAK,cAAc,GAAG,MAAM,GAAG;CAC/C;CAEA,SAAmB,OAAuB;EACzC,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO;CACvC;CAEA,MAAgB,QAAQ,OAAyC;EAChE,MAAM,YAAY,MAAM,KAAK,IAAI,KAAK,KAAK,OAAO,OAAO,CAAC;EAC1D,IAAI,CAAC,WAAW,OAAO;EACvB,OAAO;GAAE,MAAM,UAAU;GAAO,SAAS,OAAO,UAAU,OAAO;EAAE;CACpE;CAEA,MAAgB,SACf,OACA,MACA,iBACwB;EACxB,MAAM,OAAO,KAAK,KAAK,OAAO,OAAO;EACrC,MAAM,cAAc,4BAA4B,KAAK,cAAc,GAAG;EAEtE,IAAI,oBAAoB,MACvB,IAAI;GACH,MAAM,EAAE,YAAY,MAAM,KAAK,OAAO,KACrC,IAAI,oBAAoB;IACvB;IACA,OAAO;IACP,MAAM;IACN;GACD,CAAC,CACF;GACA,OAAO,OAAO,OAAO;EACtB,SAAS,OAAO;GACf,IAAI,iBAAiB,wBAAwB;IAC5C,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;IACnC,MAAM,IAAI,qBACT,OACA,MACA,UAAU,OAAO,QAAQ,OAAO,IAAI,IACrC;GACD;GACA,MAAM;EACP;EAGD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;EACnC,MAAM,SAAS,UAAU,OAAO,QAAQ,OAAO,IAAI;EACnD,IAAI,WAAW,iBACd,MAAM,IAAI,qBAAqB,OAAO,iBAAiB,MAAM;EAG9D,MAAM,EAAE,YAAY,MAAM,KAAK,OAAO,KACrC,IAAI,oBAAoB;GACvB;GACA,OAAO;GACP,MAAM;GACN,WAAW;GACX;EACD,CAAC,CACF;EACA,IAAI,YAAY,OAAO,eAAe,IAAI,GAKzC,MAAM,IAAI,qBACT,OACA,iBACA,QAAQ,WAAW,KAAK,CAAC,CAC1B;EAQD,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI;EAClC,IAAI,UAAU,OAAO,YAAY,WAAW,OAAO,UAAU,MAC5D,MAAM,IAAI,qBAAqB,OAAO,iBAAiB,OAAO,OAAO,CAAC;EAEvE,OAAO,OAAO,OAAO;CACtB;CAEA,MAAgB,cAAc,OAAe,MAA6B;EACzE,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;IACvB,MAAM,KAAK,KAAK,OAAO,UAAU;IACjC,OAAO;IACP,MAAM;IACN,aAAa,+BAA+B,KAAK,cAAc,GAAG,MAAM;GACzE,CAAC,CACF;EACD,SAAS,OAAO;GAEf,IAAI,EAAE,iBAAiB,yBAAyB,MAAM;EACvD;CACD;CAEA,MAAgB,WAAW,OAAe,QAAmC;EAC5E,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM;EACpC,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;IACvB;IACA,OAAO,KAAK,UAAU,MAAM;IAC5B,MAAM;IACN,aAAa,uBAAuB,KAAK,cAAc,GAAG;GAC3D,CAAC,CACF;EACD,SAAS,OAAO;GACf,IAAI,iBAAiB,wBACpB,MAAM,IAAI,YAAY,OAAO,MAAM,KAAK,SAAS,KAAK,GAAG,OAAO,MAAM;GAEvE,MAAM;EACP;EAOA,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;EACnC,MAAM,WAAW,UAAU,YAAY,QAAQ,KAAK,IAAI;EACxD,IAAI,SAAS,YAAY,KAAK,UAAU,OAAO,OAAO,IACrD,MAAM,IAAI,YAAY,OAAO,UAAU,OAAO,MAAM;CAEtD;CAEA,MAAgB,SAAS,OAA2C;EACnE,MAAM,YAAY,MAAM,KAAK,IAAI,KAAK,KAAK,OAAO,MAAM,CAAC;EACzD,OAAO,YAAY,YAAY,UAAU,KAAK,IAAI;CACnD;CAEA,MAAgB,WACf,OACA,QACgB;EAChB,IAAI,QAEC;QAAA,MADkB,KAAK,SAAS,KAAK,EAAA,EAC5B,OAAO,OAAO,IAAI;EAAA;EAEhC,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,uBAAuB,EAAE,MAAM,KAAK,KAAK,OAAO,MAAM,EAAE,CAAC,CAC9D;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,oBAAoB,MAAM;EAClD;CACD;CAEA,MAAc,IACb,MACqD;EACrD,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,KAAK,OAAO,KACvC,IAAI,oBAAoB;IAAE;IAAM,gBAAgB;GAAK,CAAC,CACvD;GACA,IAAI,WAAW,UAAU,KAAA,GAAW,OAAO;GAC3C,OAAO;IAAE,OAAO,UAAU;IAAO,SAAS,UAAU,WAAW;GAAE;EAClE,SAAS,OAAO;GACf,IAAI,iBAAiB,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;AACD;AAEA,SAAS,YAAY,OAAkC;CACtD,IAAI;EACH,OAAO,KAAK,MAAM,KAAK;CACxB,QAAQ;EACP,OAAO;CACR;AACD"}
+{"version":3,"file":"SSMStateStore-Dvl4A8Up.mjs","names":[],"sources":["../src/deploy/SSMStateStore.ts"],"sourcesContent":["/**\n * AWS SSM Parameter Store state store.\n *\n * - `/gkm/<workspace>/<stage>/state`: the state, a SecureString.\n * - `/gkm/<workspace>/<stage>/lock`: the lock, created only if absent.\n * - `/gkm/<workspace>/<stage>/state.v1`: the v1 state, kept on migration.\n *\n * SSM has no conditional put, so a write checks the parameter's version\n * before it puts, and checks the version the put returns after: a put that\n * did not land exactly one version above the one it was based on raced\n * another writer, and raises `StateVersionConflict` rather than reporting\n * success. Both writes stay in the parameter's history.\n */\n\nimport {\n\tDeleteParameterCommand,\n\tGetParameterCommand,\n\tParameterAlreadyExists,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n\ttype SSMClientConfig,\n} from '@aws-sdk/client-ssm';\nimport type { AwsRegion } from './StateProvider';\nimport {\n\tDocumentStateStore,\n\ttype LockHolder,\n\ttype RawState,\n\tStateLocked,\n\ttype StateVersion,\n\tStateVersionConflict,\n} from './StateStore';\n\nexport interface SSMStateStoreOptions {\n\tworkspaceName: string;\n\tregion?: AwsRegion;\n\t/** Uses the default credential chain when omitted. */\n\tprofile?: string;\n\tcredentials?: SSMClientConfig['credentials'];\n\t/** For the local AWS emulator. */\n\tendpoint?: string;\n}\n\nexport class SSMStateStore extends DocumentStateStore {\n\tconstructor(\n\t\treadonly workspaceName: string,\n\t\tprivate readonly client: SSMClient,\n\t) {\n\t\tsuper();\n\t}\n\n\tstatic create(options: SSMStateStoreOptions): SSMStateStore {\n\t\tconst config: SSMClientConfig = {\n\t\t\tregion: options.region,\n\t\t\tendpoint: options.endpoint,\n\t\t};\n\t\tif (options.profile) {\n\t\t\t// Required lazily: only a profile needs the credential providers.\n\t\t\tconst { fromIni } = require('@aws-sdk/credential-providers');\n\t\t\tconfig.credentials = fromIni({ profile: options.profile });\n\t\t} else if (options.credentials) {\n\t\t\tconfig.credentials = options.credentials;\n\t\t}\n\t\treturn new SSMStateStore(options.workspaceName, new SSMClient(config));\n\t}\n\n\tprivate name(stage: string, leaf: string): string {\n\t\treturn `/gkm/${this.workspaceName}/${stage}/${leaf}`;\n\t}\n\n\tprotected location(stage: string): string {\n\t\treturn `ssm:${this.name(stage, 'state')}`;\n\t}\n\n\tprotected async readRaw(stage: string): Promise<RawState | null> {\n\t\tconst parameter = await this.get(this.name(stage, 'state'));\n\t\tif (!parameter) return null;\n\t\treturn { body: parameter.value, version: String(parameter.version) };\n\t}\n\n\tprotected async writeRaw(\n\t\tstage: string,\n\t\tbody: string,\n\t\texpectedVersion: StateVersion | null,\n\t): Promise<StateVersion> {\n\t\tconst Name = this.name(stage, 'state');\n\t\tconst Description = `GKM deployment state for ${this.workspaceName}/${stage}`;\n\n\t\tif (expectedVersion === null) {\n\t\t\ttry {\n\t\t\t\tconst { Version } = await this.client.send(\n\t\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\t\tName,\n\t\t\t\t\t\tValue: body,\n\t\t\t\t\t\tType: 'SecureString',\n\t\t\t\t\t\tDescription,\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\treturn String(Version);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof ParameterAlreadyExists) {\n\t\t\t\t\tconst current = await this.get(Name);\n\t\t\t\t\tthrow new StateVersionConflict(\n\t\t\t\t\t\tstage,\n\t\t\t\t\t\tnull,\n\t\t\t\t\t\tcurrent ? String(current.version) : null,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\tconst current = await this.get(Name);\n\t\tconst actual = current ? String(current.version) : null;\n\t\tif (actual !== expectedVersion) {\n\t\t\tthrow new StateVersionConflict(stage, expectedVersion, actual);\n\t\t}\n\n\t\tconst { Version } = await this.client.send(\n\t\t\tnew PutParameterCommand({\n\t\t\t\tName,\n\t\t\t\tValue: body,\n\t\t\t\tType: 'SecureString',\n\t\t\t\tOverwrite: true,\n\t\t\t\tDescription,\n\t\t\t}),\n\t\t);\n\t\tif (Version !== Number(expectedVersion) + 1) {\n\t\t\t// Another put landed between the check and this one. Ours is now\n\t\t\t// on top, but the caller that wrote the other believes its write\n\t\t\t// is current — its next write will conflict too, so neither is\n\t\t\t// lost silently.\n\t\t\tthrow new StateVersionConflict(\n\t\t\t\tstage,\n\t\t\t\texpectedVersion,\n\t\t\t\tString((Version ?? 1) - 1),\n\t\t\t);\n\t\t}\n\n\t\t// The version alone is not enough under an emulator, and need not be\n\t\t// on SSM either: two overwrites that raced can both be answered with\n\t\t// the same version, and both would report success. If the parameter is\n\t\t// still at the version this put returned, it has to hold this body —\n\t\t// otherwise the other put is the one that stuck.\n\t\tconst landed = await this.get(Name);\n\t\tif (landed && landed.version === Version && landed.value !== body) {\n\t\t\tthrow new StateVersionConflict(stage, expectedVersion, String(Version));\n\t\t}\n\t\treturn String(Version);\n\t}\n\n\tprotected async writeV1Backup(stage: string, body: string): Promise<void> {\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\tName: this.name(stage, 'state.v1'),\n\t\t\t\t\tValue: body,\n\t\t\t\t\tType: 'SecureString',\n\t\t\t\t\tDescription: `GKM v1 deployment state for ${this.workspaceName}/${stage}, kept on migration`,\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\t// The first migration's backup is the one worth keeping.\n\t\t\tif (!(error instanceof ParameterAlreadyExists)) throw error;\n\t\t}\n\t}\n\n\tprotected async createLock(stage: string, holder: LockHolder): Promise<void> {\n\t\tconst Name = this.name(stage, 'lock');\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\tName,\n\t\t\t\t\tValue: JSON.stringify(holder),\n\t\t\t\t\tType: 'String',\n\t\t\t\t\tDescription: `GKM deploy lock for ${this.workspaceName}/${stage}`,\n\t\t\t\t}),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterAlreadyExists) {\n\t\t\t\tthrow new StateLocked(stage, await this.readLock(stage), `ssm:${Name}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\n\t\t// A create-only put is atomic on SSM, so the lock is ours. Read it back\n\t\t// anyway: on a store where two racing creates can both succeed (the\n\t\t// local emulator does, a few times in a hundred) the later one has\n\t\t// overwritten the earlier — version 2, someone else's holder — and\n\t\t// taking the lock regardless would give the stage two deploys.\n\t\tconst created = await this.get(Name);\n\t\tconst recorded = created ? parseHolder(created.value) : null;\n\t\tif (created?.version !== 1 || recorded?.id !== holder.id) {\n\t\t\tthrow new StateLocked(stage, recorded, `ssm:${Name}`);\n\t\t}\n\t}\n\n\tprotected async readLock(stage: string): Promise<LockHolder | null> {\n\t\tconst parameter = await this.get(this.name(stage, 'lock'));\n\t\treturn parameter ? parseHolder(parameter.value) : null;\n\t}\n\n\tprotected async removeLock(\n\t\tstage: string,\n\t\tholder: LockHolder | null,\n\t): Promise<void> {\n\t\tif (holder) {\n\t\t\tconst current = await this.readLock(stage);\n\t\t\tif (current?.id !== holder.id) return;\n\t\t}\n\t\ttry {\n\t\t\tawait this.client.send(\n\t\t\t\tnew DeleteParameterCommand({ Name: this.name(stage, 'lock') }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ParameterNotFound)) throw error;\n\t\t}\n\t}\n\n\tprivate async get(\n\t\tName: string,\n\t): Promise<{ value: string; version: number } | null> {\n\t\ttry {\n\t\t\tconst { Parameter } = await this.client.send(\n\t\t\t\tnew GetParameterCommand({ Name, WithDecryption: true }),\n\t\t\t);\n\t\t\tif (Parameter?.Value === undefined) return null;\n\t\t\treturn { value: Parameter.Value, version: Parameter.Version ?? 1 };\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n\nfunction parseHolder(value: string): LockHolder | null {\n\ttry {\n\t\treturn JSON.parse(value) as LockHolder;\n\t} catch {\n\t\treturn null;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2CA,IAAa,gBAAb,MAAa,sBAAsB,mBAAmB;CAE3C;CACQ;CAFlB,YACC,eACA,QACC;EACD,MAAM;EAHG,KAAA,gBAAA;EACQ,KAAA,SAAA;CAGlB;CAEA,OAAO,OAAO,SAA8C;EAC3D,MAAM,SAA0B;GAC/B,QAAQ,QAAQ;GAChB,UAAU,QAAQ;EACnB;EACA,IAAI,QAAQ,SAAS;GAEpB,MAAM,EAAE,YAAA,UAAoB,+BAA+B;GAC3D,OAAO,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;EAC1D,OAAO,IAAI,QAAQ,aAClB,OAAO,cAAc,QAAQ;EAE9B,OAAO,IAAI,cAAc,QAAQ,eAAe,IAAI,UAAU,MAAM,CAAC;CACtE;CAEA,KAAa,OAAe,MAAsB;EACjD,OAAO,QAAQ,KAAK,cAAc,GAAG,MAAM,GAAG;CAC/C;CAEA,SAAmB,OAAuB;EACzC,OAAO,OAAO,KAAK,KAAK,OAAO,OAAO;CACvC;CAEA,MAAgB,QAAQ,OAAyC;EAChE,MAAM,YAAY,MAAM,KAAK,IAAI,KAAK,KAAK,OAAO,OAAO,CAAC;EAC1D,IAAI,CAAC,WAAW,OAAO;EACvB,OAAO;GAAE,MAAM,UAAU;GAAO,SAAS,OAAO,UAAU,OAAO;EAAE;CACpE;CAEA,MAAgB,SACf,OACA,MACA,iBACwB;EACxB,MAAM,OAAO,KAAK,KAAK,OAAO,OAAO;EACrC,MAAM,cAAc,4BAA4B,KAAK,cAAc,GAAG;EAEtE,IAAI,oBAAoB,MACvB,IAAI;GACH,MAAM,EAAE,YAAY,MAAM,KAAK,OAAO,KACrC,IAAI,oBAAoB;IACvB;IACA,OAAO;IACP,MAAM;IACN;GACD,CAAC,CACF;GACA,OAAO,OAAO,OAAO;EACtB,SAAS,OAAO;GACf,IAAI,iBAAiB,wBAAwB;IAC5C,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;IACnC,MAAM,IAAI,qBACT,OACA,MACA,UAAU,OAAO,QAAQ,OAAO,IAAI,IACrC;GACD;GACA,MAAM;EACP;EAGD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;EACnC,MAAM,SAAS,UAAU,OAAO,QAAQ,OAAO,IAAI;EACnD,IAAI,WAAW,iBACd,MAAM,IAAI,qBAAqB,OAAO,iBAAiB,MAAM;EAG9D,MAAM,EAAE,YAAY,MAAM,KAAK,OAAO,KACrC,IAAI,oBAAoB;GACvB;GACA,OAAO;GACP,MAAM;GACN,WAAW;GACX;EACD,CAAC,CACF;EACA,IAAI,YAAY,OAAO,eAAe,IAAI,GAKzC,MAAM,IAAI,qBACT,OACA,iBACA,QAAQ,WAAW,KAAK,CAAC,CAC1B;EAQD,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI;EAClC,IAAI,UAAU,OAAO,YAAY,WAAW,OAAO,UAAU,MAC5D,MAAM,IAAI,qBAAqB,OAAO,iBAAiB,OAAO,OAAO,CAAC;EAEvE,OAAO,OAAO,OAAO;CACtB;CAEA,MAAgB,cAAc,OAAe,MAA6B;EACzE,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;IACvB,MAAM,KAAK,KAAK,OAAO,UAAU;IACjC,OAAO;IACP,MAAM;IACN,aAAa,+BAA+B,KAAK,cAAc,GAAG,MAAM;GACzE,CAAC,CACF;EACD,SAAS,OAAO;GAEf,IAAI,EAAE,iBAAiB,yBAAyB,MAAM;EACvD;CACD;CAEA,MAAgB,WAAW,OAAe,QAAmC;EAC5E,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM;EACpC,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,oBAAoB;IACvB;IACA,OAAO,KAAK,UAAU,MAAM;IAC5B,MAAM;IACN,aAAa,uBAAuB,KAAK,cAAc,GAAG;GAC3D,CAAC,CACF;EACD,SAAS,OAAO;GACf,IAAI,iBAAiB,wBACpB,MAAM,IAAI,YAAY,OAAO,MAAM,KAAK,SAAS,KAAK,GAAG,OAAO,MAAM;GAEvE,MAAM;EACP;EAOA,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI;EACnC,MAAM,WAAW,UAAU,YAAY,QAAQ,KAAK,IAAI;EACxD,IAAI,SAAS,YAAY,KAAK,UAAU,OAAO,OAAO,IACrD,MAAM,IAAI,YAAY,OAAO,UAAU,OAAO,MAAM;CAEtD;CAEA,MAAgB,SAAS,OAA2C;EACnE,MAAM,YAAY,MAAM,KAAK,IAAI,KAAK,KAAK,OAAO,MAAM,CAAC;EACzD,OAAO,YAAY,YAAY,UAAU,KAAK,IAAI;CACnD;CAEA,MAAgB,WACf,OACA,QACgB;EAChB,IAAI,QAEC;QAAA,MADkB,KAAK,SAAS,KAAK,EAAA,EAC5B,OAAO,OAAO,IAAI;EAAA;EAEhC,IAAI;GACH,MAAM,KAAK,OAAO,KACjB,IAAI,uBAAuB,EAAE,MAAM,KAAK,KAAK,OAAO,MAAM,EAAE,CAAC,CAC9D;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,oBAAoB,MAAM;EAClD;CACD;CAEA,MAAc,IACb,MACqD;EACrD,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,KAAK,OAAO,KACvC,IAAI,oBAAoB;IAAE;IAAM,gBAAgB;GAAK,CAAC,CACvD;GACA,IAAI,WAAW,UAAU,KAAA,GAAW,OAAO;GAC3C,OAAO;IAAE,OAAO,UAAU;IAAO,SAAS,UAAU,WAAW;GAAE;EAClE,SAAS,OAAO;GACf,IAAI,iBAAiB,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;AACD;AAEA,SAAS,YAAY,OAAkC;CACtD,IAAI;EACH,OAAO,KAAK,MAAM,KAAK;CACxB,QAAQ;EACP,OAAO;CACR;AACD"}

package/dist/add-BuviRszv.mjs

@@ -0,0 +1,566 @@
+import { g as url, o as email } from "./schemas-D-xeKJDD.mjs";
+import { r as discover } from "./discover-Buwf1z4P.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { k as assertDeployedStage } from "./workspace-C7NqCsQF.mjs";
+import { loadWorkspaceSettings } from "./config.mjs";
+import { G as constructGlobs, It as secretsStoreFor, R as requiredStageKeys, Zt as initStageSecrets, st as appEnvKeys } from "./state-527OmqvN.mjs";
+import { i as issueLine, o as loadCredentialSchemas } from "./credentialSchemas-BmYxnEz_.mjs";
+import { provideKey } from "@geekmidas/manifest";
+import prompts from "prompts";
+import { build, parse } from "@geekmidas/storage/s3-url";
+//#region src/secrets/stageKeys.ts
+/**
+* The keys a workspace's stage must be given — across every app, each once,
+* with who reads it and whether the stage holds it.
+*
+* The keys themselves are `requiredStageKeys`'s, the list a deploy refuses a
+* stage by. What this adds is the workspace: which constructs its apps read
+* (`appEnvKeys`, the keys each app's environment is built from) and which of
+* the keys the stage has set.
+*/
+/** The keys of each kind of construct an app reads, that the stage supplies. */
+function keysOf(id, kind) {
+	switch (kind) {
+		case "email": return [provideKey(id, "url"), provideKey(id, "from")];
+		case "objects":
+		case "file-server": return [provideKey(id, "url")];
+		case "external-api":
+		case "credential": return [provideKey(id, "credentials")];
+		default: return [];
+	}
+}
+/**
+* Every key the stage must be given for the constructs its apps read — a
+* file server's whenever its bucket is read, since its client reads both —
+* and every file server's bucket, which serves it whether or not an app
+* reads it directly.
+*/
+function workspaceStageKeys(input) {
+	const { manifest } = input;
+	const reads = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		const { kind } = declaration;
+		if (kind !== "rest-api" && kind !== "site" && kind !== "mobile-app") continue;
+		const name = appKey(id);
+		const keys = appEnvKeys(manifest, name, input.runnables);
+		if (keys) reads.set(name, keys);
+	}
+	const readers = (id, kind) => {
+		const keys = keysOf(id, kind);
+		return [...reads].filter(([, env]) => keys.some((key) => env.has(key))).map(([app]) => app).sort();
+	};
+	const services = [];
+	const credentials = [];
+	const buckets = /* @__PURE__ */ new Set();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		const { kind } = declaration;
+		const apps = declaration.kind === "file-server" && declaration.of ? [.../* @__PURE__ */ new Set([...readers(id, kind), ...readers(declaration.of, "objects")])].sort() : readers(id, kind);
+		if (kind === "external-api" || kind === "credential") {
+			if (apps.length > 0) credentials.push({
+				id,
+				kind,
+				apps
+			});
+			continue;
+		}
+		if (kind !== "email" && kind !== "objects" && kind !== "file-server") continue;
+		if (apps.length === 0) continue;
+		const of = declaration.kind === "file-server" ? declaration.of : void 0;
+		services.push({
+			id,
+			kind,
+			...of ? { of } : {},
+			apps
+		});
+		if (of) buckets.add(of);
+	}
+	for (const of of buckets) {
+		if (services.some((s) => s.id === of)) continue;
+		if (manifest[of]?.kind !== "objects") continue;
+		services.push({
+			id: of,
+			kind: "objects",
+			apps: readers(of, "objects")
+		});
+	}
+	return requiredStageKeys({
+		local: input.local,
+		services,
+		credentials,
+		...input.domain ? { domain: input.domain } : {}
+	}).map((key) => ({
+		...key,
+		set: input.supplied[key.key] !== void 0
+	}));
+}
+//#endregion
+//#region src/secrets/add.ts
+/**
+* `gkm secrets:add --stage <stage>` — the secrets a stage must be given,
+* built key by key.
+*
+* It offers exactly the keys a deploy would refuse the stage without
+* (`requiredStageKeys`), across every app in the workspace, each once: the
+* stage's buckets, mail and file servers where it is deployed, and every
+* third party's credentials. A key is built by what it is — a bucket from its
+* provider, mail from its SMTP server, credentials field by field from their
+* construct's schema — checked, and saved through the stage's own store, the
+* one `gkm secrets:set` writes. No value is ever printed.
+*
+* `--json` asks nothing: it prints the keys, for a script or an agent to set
+* with `gkm secrets:set`.
+*/
+/** `gkm secrets:add` with nobody at a terminal to answer it. */
+var SecretsAddNeedsTerminal = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`gkm secrets:add asks for each key, and there is no terminal to ask at. List what the stage needs with gkm secrets:add --stage ${stage} --missing --json, and set each with gkm secrets:set <KEY> <value> --stage ${stage}.`);
+		this.stage = stage;
+		this.name = "SecretsAddNeedsTerminal";
+	}
+};
+/** The person stopped the builder; nothing was saved. */
+var SecretsAddCancelled = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Stopped. Nothing was saved to the stage '${stage}'.`);
+		this.stage = stage;
+		this.name = "SecretsAddCancelled";
+	}
+};
+const defaultIo = () => ({
+	log: (line) => console.log(line),
+	write: (chunk) => {
+		process.stdout.write(chunk);
+	},
+	interactive: process.stdin.isTTY === true && process.stdout.isTTY === true
+});
+/** `gkm secrets:add`. */
+async function secretsAddCommand(options, io = defaultIo()) {
+	const { stage } = options;
+	const workspace = await loadWorkspaceSettings(options.cwd ?? process.cwd());
+	const local = stage === workspace.stages.local;
+	if (!local) assertDeployedStage(workspace.stages, stage);
+	const patterns = constructGlobs(workspace);
+	const runnables = {};
+	const manifest = await discover({
+		patterns,
+		cwd: workspace.root,
+		runnables
+	});
+	const store = await secretsStoreFor(workspace, stage, { ...options.home ? { home: options.home } : {} });
+	const stored = await store.read(stage);
+	const domain = workspace.deploy?.domains?.[stage];
+	const all = workspaceStageKeys({
+		manifest,
+		runnables,
+		local,
+		supplied: stored?.custom ?? {},
+		...domain ? { domain } : {}
+	});
+	const keys = options.missing ? all.filter((k) => !k.set) : all;
+	if (options.json) {
+		const listed = keys.map((k) => ({
+			key: k.key,
+			kind: k.kind,
+			construct: k.id,
+			apps: [...k.apps ?? []],
+			set: k.set
+		}));
+		io.write(`${JSON.stringify(listed, null, 2)}\n`);
+		return {
+			keys,
+			saved: []
+		};
+	}
+	if (!io.interactive) throw new SecretsAddNeedsTerminal(stage);
+	if (keys.length === 0) {
+		io.log(all.length === 0 ? `Nothing to add: no construct on '${stage}' needs a key only the stage can supply.` : `Nothing to add: the stage '${stage}' has every key it needs.`);
+		return {
+			keys,
+			saved: []
+		};
+	}
+	const ask = asker(stage);
+	const chosen = await ask({
+		type: "multiselect",
+		message: `Which keys for '${stage}'? (${store.name} store)`,
+		choices: keys.map((k) => ({
+			title: `${k.key}  ${KIND_LABEL[k.kind]} '${k.id}'${k.apps?.length ? ` · ${k.apps.join(", ")}` : ""}${k.set ? " · set" : ""}`,
+			value: k.key,
+			selected: !k.set
+		})),
+		instructions: false,
+		hint: "space to toggle, enter to continue"
+	});
+	const selected = keys.filter((k) => (chosen ?? []).includes(k.key));
+	const values = {};
+	const has = (key) => values[key] !== void 0 || stored?.custom?.[key] !== void 0;
+	let schemas;
+	for (const entry of selected) {
+		if (entry.set) {
+			if (!await ask({
+				type: "confirm",
+				message: `${entry.key} is set. Replace it?`,
+				initial: false
+			})) continue;
+		}
+		io.log(`\n${entry.key} — ${entry.what}`);
+		switch (entry.kind) {
+			case "bucket":
+				Object.assign(values, await buildBucket(ask, io, entry, has));
+				break;
+			case "email":
+				values[entry.key] = entry.key.endsWith("_FROM") ? await askFrom(ask, io) : await buildSmtpUrl(ask, io);
+				break;
+			case "file-server":
+				values[entry.key] = await askHttpUrl(ask, io, "Its public URL");
+				break;
+			case "external-api":
+			case "credential":
+				schemas ??= await loadCredentialSchemas({
+					root: workspace.root,
+					patterns
+				});
+				values[entry.key] = await buildCredentials(ask, io, entry, schemas);
+		}
+	}
+	const saved = Object.keys(values);
+	if (saved.length === 0) {
+		io.log("\nNothing was saved.");
+		return {
+			keys,
+			saved
+		};
+	}
+	const base = stored ?? initStageSecrets(stage);
+	await store.write(stage, {
+		...base,
+		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		custom: {
+			...base.custom,
+			...values
+		}
+	});
+	io.log(`\n✓ Saved ${saved.join(", ")} to the stage '${stage}' (${store.name} store).`);
+	return {
+		keys,
+		saved
+	};
+}
+const KIND_LABEL = {
+	bucket: "bucket",
+	email: "email",
+	"file-server": "file server",
+	"external-api": "external API",
+	credential: "credential"
+};
+function asker(stage) {
+	return async (question) => {
+		return (await prompts({
+			...question,
+			name: "value"
+		}, { onCancel: () => {
+			throw new SecretsAddCancelled(stage);
+		} })).value;
+	};
+}
+/** Ask until `accept` takes the answer; `accept` returns why it did not. */
+async function askUntil(ask, io, question, accept) {
+	for (;;) {
+		const value = await ask(question);
+		const problem = accept(value);
+		if (!problem) return value;
+		io.log(`  ✗ ${problem}`);
+	}
+}
+const required = (what) => (value) => value?.trim() ? void 0 : `${what} is required.`;
+const text = (value) => String(value ?? "").trim();
+/** An `http(s)://` URL. */
+const HttpUrl = url({ protocol: /^https?$/ });
+async function askHttpUrl(ask, io, message) {
+	return text(await askUntil(ask, io, {
+		type: "text",
+		message
+	}, (value) => HttpUrl.safeParse(text(value)).success ? void 0 : "An http:// or https:// URL is required."));
+}
+async function askFrom(ask, io) {
+	return text(await askUntil(ask, io, {
+		type: "text",
+		message: "The address it sends from"
+	}, (value) => email().safeParse(text(value)).success ? void 0 : "An email address is required, e.g. noreply@example.com."));
+}
+/**
+* An SMTP server as the URL `@geekmidas/emailkit` reads: `smtp://` for
+* STARTTLS, `smtps://` for TLS from the first byte, with the user and
+* password percent-encoded.
+*/
+async function buildSmtpUrl(ask, io) {
+	const host = text(await askUntil(ask, io, {
+		type: "text",
+		message: "SMTP host"
+	}, required("The host")));
+	const port = await askUntil(ask, io, {
+		type: "text",
+		message: "Port",
+		initial: "587"
+	}, (value) => {
+		const n = Number(value);
+		return Number.isInteger(n) && n > 0 && n < 65536 ? void 0 : "A port number is required.";
+	});
+	const user = text(await ask({
+		type: "text",
+		message: "User (empty for none)"
+	}));
+	const password = user ? await ask({
+		type: "password",
+		message: "Password"
+	}) : "";
+	const tls = await ask({
+		type: "select",
+		message: "TLS",
+		choices: [{
+			title: "STARTTLS (smtp://, usually port 587)",
+			value: "starttls"
+		}, {
+			title: "TLS on connect (smtps://, usually port 465)",
+			value: "tls"
+		}],
+		initial: 0
+	});
+	const url = new URL(`${tls === "tls" ? "smtps" : "smtp"}://${host}`);
+	url.port = String(Number(port));
+	if (user) {
+		url.username = encodeURIComponent(user);
+		url.password = encodeURIComponent(password ?? "");
+	}
+	return url.toString().replace(/\/$/, "");
+}
+/**
+* A bucket's URL, from its provider — and, optionally, a key for it alone in
+* the URL, or the stage's shared pair. Credentials are never required: without
+* them the SDK's own chain signs, a role included.
+*/
+async function buildBucket(ask, io, entry, has) {
+	const provider = await ask({
+		type: "select",
+		message: "Where is the bucket?",
+		choices: [
+			{
+				title: "AWS S3",
+				value: "s3"
+			},
+			{
+				title: "Cloudflare R2",
+				value: "r2"
+			},
+			{
+				title: "MinIO, or another S3-compatible store",
+				value: "compatible"
+			},
+			{
+				title: "Paste an s3:// URL",
+				value: "url"
+			}
+		],
+		initial: 0
+	});
+	const bucketName = async () => text(await askUntil(ask, io, {
+		type: "text",
+		message: "Bucket name"
+	}, required("The bucket name")));
+	let address;
+	switch (provider) {
+		case "s3":
+			address = {
+				bucket: await bucketName(),
+				region: text(await askUntil(ask, io, {
+					type: "text",
+					message: "Region",
+					initial: "eu-west-1"
+				}, required("The region")))
+			};
+			break;
+		case "r2": {
+			const account = text(await askUntil(ask, io, {
+				type: "text",
+				message: "Cloudflare account id, or the R2 endpoint URL"
+			}, required("The account id or endpoint")));
+			address = {
+				bucket: await bucketName(),
+				region: "auto",
+				endpoint: /^https?:\/\//.test(account) ? account : `https://${account}.r2.cloudflarestorage.com`
+			};
+			break;
+		}
+		case "compatible": {
+			const endpoint = await askHttpUrl(ask, io, "Endpoint URL");
+			const bucket = await bucketName();
+			const region = text(await ask({
+				type: "text",
+				message: "Region",
+				initial: "us-east-1"
+			}));
+			const forcePathStyle = await ask({
+				type: "confirm",
+				message: "Path-style addressing? (MinIO needs it)",
+				initial: true
+			});
+			address = {
+				bucket,
+				...region ? { region } : {},
+				endpoint,
+				...forcePathStyle ? { forcePathStyle } : {}
+			};
+			break;
+		}
+		case "url": {
+			const pasted = await askUntil(ask, io, {
+				type: "password",
+				message: "The s3:// URL"
+			}, (value) => {
+				try {
+					parse(text(value));
+					return;
+				} catch (error) {
+					return `Not an s3:// URL the storage client can read (${error.name}).`;
+				}
+			});
+			address = parse(text(pasted));
+			break;
+		}
+	}
+	if (!address.accessKeyId) {
+		if (await ask({
+			type: "confirm",
+			message: `A key for '${entry.id}' alone, in its URL? (optional)`,
+			initial: false
+		})) {
+			const accessKeyId = text(await askUntil(ask, io, {
+				type: "text",
+				message: "Access key id"
+			}, required("The access key id")));
+			const secretAccessKey = await askUntil(ask, io, {
+				type: "password",
+				message: "Secret access key"
+			}, required("The secret access key"));
+			address = {
+				...address,
+				accessKeyId,
+				secretAccessKey
+			};
+		}
+	}
+	const values = { [entry.key]: build(address) };
+	if (!address.accessKeyId && !has("AWS_ACCESS_KEY_ID")) {
+		if (await ask({
+			type: "confirm",
+			message: "Set the stage's shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY? (optional: without them a role signs)",
+			initial: false
+		})) {
+			values.AWS_ACCESS_KEY_ID = text(await askUntil(ask, io, {
+				type: "text",
+				message: "AWS_ACCESS_KEY_ID"
+			}, required("The access key id")));
+			values.AWS_SECRET_ACCESS_KEY = await askUntil(ask, io, {
+				type: "password",
+				message: "AWS_SECRET_ACCESS_KEY"
+			}, required("The secret access key"));
+		}
+	}
+	return values;
+}
+/** A field whose name says it is a secret, asked for without echo. */
+const SECRET_FIELD = /secret|key|token|password/i;
+/** The properties of an object schema, or nothing for any other shape. */
+function objectProperties(info) {
+	const schema = info?.jsonSchema;
+	if (!schema || schema.type !== "object") return void 0;
+	const properties = schema.properties;
+	if (!properties || typeof properties !== "object") return void 0;
+	return {
+		properties,
+		required: Array.isArray(schema.required) ? schema.required : []
+	};
+}
+function typesOf(property) {
+	if (Array.isArray(property.type)) return property.type;
+	return property.type ? [property.type] : [];
+}
+/**
+* Credentials, field by field where the construct's schema is an object it
+* can describe, and as JSON otherwise — checked against the schema itself
+* before anything is kept, and asked again, with each issue's path, until
+* the schema takes it.
+*/
+async function buildCredentials(ask, io, entry, schemas) {
+	const info = schemas.schemas.find((s) => s.key === entry.key);
+	const shape = objectProperties(info);
+	if (!info) io.log(`  '${entry.id}' exposes no schema to check against; the value is stored as given.`);
+	for (;;) {
+		const raw = shape ? JSON.stringify(await askFields(ask, io, shape)) : text(await ask({
+			type: "password",
+			message: "The value, as JSON (or one opaque string)"
+		}));
+		const check = await schemas.check(entry.key, raw);
+		if (check.ok) return raw;
+		io.log(`  ✗ The schema of '${entry.id}' refuses it:`);
+		for (const issue of check.issues) io.log(`      ${issueLine(entry.key, issue)}`);
+		io.log("    Again:");
+	}
+}
+async function askFields(ask, io, shape) {
+	const value = {};
+	for (const [name, property] of Object.entries(shape.properties)) {
+		const optional = !shape.required.includes(name);
+		const label = `${name}${optional ? " (optional)" : ""}${property.description ? ` — ${property.description}` : ""}`;
+		const types = typesOf(property);
+		if (property.enum?.length) {
+			const choices = property.enum.map((option) => ({
+				title: String(option),
+				value: option
+			}));
+			const picked = await ask({
+				type: "select",
+				message: label,
+				choices: optional ? [{
+					title: "(none)",
+					value: void 0
+				}, ...choices] : choices
+			});
+			if (picked !== void 0) value[name] = picked;
+			continue;
+		}
+		if (types.includes("boolean")) {
+			value[name] = await ask({
+				type: "confirm",
+				message: label,
+				initial: false
+			});
+			continue;
+		}
+		const numeric = types.includes("number") || types.includes("integer");
+		const plain = types.length === 0 || types.includes("string");
+		const answer = await askUntil(ask, io, {
+			type: SECRET_FIELD.test(name) ? "password" : "text",
+			message: label
+		}, (given) => {
+			const typed = text(given);
+			if (!typed) return optional ? void 0 : `${name} is required.`;
+			if (numeric && !plain && Number.isNaN(Number(typed))) return `${name} is a number.`;
+			if (!numeric && !plain) try {
+				JSON.parse(typed);
+			} catch {
+				return `${name} is JSON (${types.join(" or ")}).`;
+			}
+		});
+		const typed = text(answer);
+		if (!typed) continue;
+		value[name] = plain ? typed : numeric ? Number(typed) : JSON.parse(typed);
+	}
+	return value;
+}
+//#endregion
+export { secretsAddCommand };
+
+//# sourceMappingURL=add-BuviRszv.mjs.map