@geekmidas/cli 10.0.0-alpha.73 → 10.0.0-alpha.75

package/dist/{sniffer-C-T7dSMN.cjs → sniffer-bMzrX4cO.cjs}

@@ -19,6 +19,58 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
+//#region src/secrets/encryption.ts
+var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	encryptSecrets: () => encryptSecrets,
+	generateDefineOptions: () => generateDefineOptions,
+	keyFingerprint: () => keyFingerprint
+});
+/** AES-256-GCM configuration */
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+/**
+* Encrypt secrets for embedding in a bundle.
+* Uses AES-256-GCM with a randomly generated ephemeral key.
+*
+* @param secrets - Key-value pairs to encrypt
+* @returns Encrypted payload with ephemeral master key
+*/
+function encryptSecrets(secrets) {
+	const masterKey = (0, node_crypto.randomBytes)(KEY_LENGTH);
+	const iv = (0, node_crypto.randomBytes)(IV_LENGTH);
+	const plaintext = JSON.stringify(secrets);
+	const cipher = (0, node_crypto.createCipheriv)(ALGORITHM, masterKey, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	return {
+		encrypted: Buffer.concat([ciphertext, authTag]).toString("base64"),
+		iv: iv.toString("hex"),
+		masterKey: masterKey.toString("hex")
+	};
+}
+/**
+* Generate the define options for tsdown/esbuild.
+* These will be injected at build time.
+*/
+function generateDefineOptions(payload) {
+	return {
+		__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),
+		__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv)
+	};
+}
+/**
+* A short, one-way name for a master key: the first 8 hex characters of its
+* SHA-256.
+*
+* Printed where the key itself used to be, so a person can tell which key a
+* build used — and match it against the one they hold — without the output
+* carrying a value that decrypts every secret of the stage.
+*/
+function keyFingerprint(masterKey) {
+	return (0, node_crypto.createHash)("sha256").update(masterKey).digest("hex").slice(0, 8);
+}
+//#endregion
 //#region src/deploy/events.ts
 /** An error as an event carries it: its name and message, nothing else. */
 function eventError(error) {
@@ -353,17 +405,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-BhrlQIXD.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-zQGZ9b4J.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-D_78eaHM.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-BFnXUFlx.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-DXp0m7XI.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-HmsH3c4v.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -373,7 +425,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-oCxRs6HM.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-CT-ZMlQY.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -1644,12 +1696,30 @@ Object.defineProperty(exports, "dokploy_api_exports", {
 		return dokploy_api_exports;
 	}
 });
+Object.defineProperty(exports, "encryptSecrets", {
+	enumerable: true,
+	get: function() {
+		return encryptSecrets;
+	}
+});
+Object.defineProperty(exports, "encryption_exports", {
+	enumerable: true,
+	get: function() {
+		return encryption_exports;
+	}
+});
 Object.defineProperty(exports, "eventError", {
 	enumerable: true,
 	get: function() {
 		return eventError;
 	}
 });
+Object.defineProperty(exports, "keyFingerprint", {
+	enumerable: true,
+	get: function() {
+		return keyFingerprint;
+	}
+});
 Object.defineProperty(exports, "newLockHolder", {
 	enumerable: true,
 	get: function() {
@@ -1669,4 +1739,4 @@ Object.defineProperty(exports, "sniffAppEnvironment", {
 	}
 });
 
-//# sourceMappingURL=sniffer-C-T7dSMN.cjs.map
+//# sourceMappingURL=sniffer-bMzrX4cO.cjs.map