@geekmidas/cli 10.0.0-alpha.78 → 10.0.0-alpha.80

package/dist/github-CwX9z89E.mjs

@@ -1,213 +0,0 @@
-import { k as assertDeployedStage } from "./workspace-BBdqmkch.mjs";
-import { loadWorkspaceConfig } from "./config.mjs";
-import { $t as readKey, Gt as isRemoteStore, Kt as secretsStoreFor, Xt as getKeyPath, Zt as keystoreProject } from "./stale-C5FqIVc8.mjs";
-import { execFileSync } from "node:child_process";
-import { AttachRolePolicyCommand, CreateOpenIDConnectProviderCommand, CreateRoleCommand, GetRoleCommand, IAMClient, ListOpenIDConnectProvidersCommand, UpdateAssumeRolePolicyCommand } from "@aws-sdk/client-iam";
-//#region src/deploy/github.ts
-/**
-* `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.
-*
-* A stage usually lives in its own AWS account — staging in one, production in
-* another — so this runs once per stage, with that account's profile:
-*
-*   gkm deploy:github --stage staging --profile acme-dev
-*   gkm deploy:github --stage prod    --profile acme-prod
-*
-* In the stage's account it makes sure GitHub's OIDC provider exists, and a
-* role that only this repository's `<stage>` environment can assume. On
-* GitHub it creates that environment and gives it what the generated deploy
-* workflow reads: `AWS_ROLE_ARN`, and — when the stage's secrets are kept in
-* the local file — its key as `GKM_SECRETS_KEY`. With `secrets.store` set to
-* SSM or Secrets Manager the deploy job reads them with the role instead, so
-* no key is handed to GitHub, and this checks the stage's store in the same
-* account, with the same profile. Re-running it converges rather than duplicating.
-*/
-const logger = console;
-const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
-const AUDIENCE = "sts.amazonaws.com";
-const defaultGh = (args, input) => execFileSync("gh", args, {
-	encoding: "utf-8",
-	...input === void 0 ? {} : {
-		input,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	}
-}).trim();
-/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */
-function roleName(project, stage) {
-	return `${project}-github-${stage}`.toLowerCase().replace(/[^a-z0-9+=,.@_-]/g, "-").slice(0, 64);
-}
-/**
-* Who may assume the role: a workflow job running in this repository's
-* `<stage>` environment, and nothing else — not another branch's job, not
-* another environment's. That is what keeps a staging deploy from using the
-* production role.
-*/
-function trustPolicy(providerArn, repo, stage) {
-	return JSON.stringify({
-		Version: "2012-10-17",
-		Statement: [{
-			Effect: "Allow",
-			Principal: { Federated: providerArn },
-			Action: "sts:AssumeRoleWithWebIdentity",
-			Condition: { StringEquals: {
-				[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,
-				[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`
-			} }
-		}]
-	});
-}
-/** GitHub's OIDC provider in this account, created if it is not there. */
-async function ensureOidcProvider(iam) {
-	const { OpenIDConnectProviderList = [] } = await iam.send(new ListOpenIDConnectProvidersCommand({}));
-	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
-	if (existing) return existing;
-	return (await iam.send(new CreateOpenIDConnectProviderCommand({
-		Url: `https://${GITHUB_OIDC_HOST}`,
-		ClientIDList: [AUDIENCE]
-	}))).OpenIDConnectProviderArn;
-}
-/** The deploy role, created or brought back to this trust and policy. */
-async function ensureRole(iam, name, trust, policyArn) {
-	let arn;
-	try {
-		const { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));
-		await iam.send(new UpdateAssumeRolePolicyCommand({
-			RoleName: name,
-			PolicyDocument: trust
-		}));
-		arn = Role.Arn;
-	} catch (error) {
-		if (error.name !== "NoSuchEntityException") throw error;
-		const { Role } = await iam.send(new CreateRoleCommand({
-			RoleName: name,
-			AssumeRolePolicyDocument: trust,
-			Description: "Deploys from GitHub Actions (gkm deploy:github)",
-			MaxSessionDuration: 7200
-		}));
-		arn = Role.Arn;
-	}
-	await iam.send(new AttachRolePolicyCommand({
-		RoleName: name,
-		PolicyArn: policyArn
-	}));
-	return arn;
-}
-/**
-* An IAM client for the stage's account.
-*
-* `fromIni` for a named profile, deliberately: it resolves exactly that
-* profile — keys, assume-role, `credential_process` or SSO, whichever
-* ~/.aws/config says — and never falls back to AWS_* in the environment. The
-* provider chain checks the environment first, so exported staging keys would
-* quietly win over `--profile prod` and the production role would land in the
-* staging account.
-*/
-async function iamFor(profile, endpoint) {
-	const config = { region: "us-east-1" };
-	if (profile) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		config.credentials = fromIni({ profile });
-	}
-	if (endpoint) {
-		config.endpoint = endpoint;
-		config.credentials = {
-			accessKeyId: "test",
-			secretAccessKey: "test"
-		};
-	}
-	return new IAMClient(config);
-}
-async function deployGithubCommand(options, deps = {}) {
-	const gh = deps.gh ?? defaultGh;
-	const { workspace } = await loadWorkspaceConfig(deps.cwd);
-	assertDeployedStage(workspace.stages, options.stage);
-	const repo = options.repo ?? gh([
-		"repo",
-		"view",
-		"--json",
-		"nameWithOwner",
-		"-q",
-		".nameWithOwner"
-	]);
-	const role = roleName(workspace.name, options.stage);
-	const policyArn = options.policyArn ?? "arn:aws:iam::aws:policy/AdministratorAccess";
-	const key = await readKey(options.stage, keystoreProject(workspace));
-	const keyPath = getKeyPath(options.stage, keystoreProject(workspace));
-	const hasKey = key !== null;
-	const remote = isRemoteStore(workspace, options.stage);
-	const store = await secretsStoreFor(workspace, options.stage, { ...options.profile ? { profile: options.profile } : {} });
-	const hasSecrets = remote && await store.read(options.stage) !== null;
-	const via = options.profile ? `profile "${options.profile}"` : "the default credentials";
-	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
-	logger.log(`  Repository:   ${repo}`);
-	logger.log(`  AWS profile:  ${options.profile ?? "(default credentials)"}`);
-	logger.log(`  Role:         ${role}`);
-	logger.log(`  Policy:       ${policyArn}${options.policyArn ? "" : "  (default; --policy-arn to narrow)"}`);
-	logger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);
-	if (remote) logger.log(`  Secrets:      ${hasSecrets ? `in the store (${store.name}), read with ${via}` : `none in the store yet — gkm secrets:set <KEY> '…' --stage ${options.stage}`}`);
-	else logger.log(`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`);
-	if (options.dryRun) {
-		logger.log("\n  --dry-run: nothing changed.\n");
-		return { repo };
-	}
-	const iam = deps.iam ?? await iamFor(options.profile);
-	const roleArn = await ensureRole(iam, role, trustPolicy(await ensureOidcProvider(iam).catch((error) => {
-		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
-		throw error;
-	}), repo, options.stage), policyArn);
-	logger.log(`\n  ✓ AWS: ${roleArn}`);
-	gh([
-		"api",
-		"--method",
-		"PUT",
-		`repos/${repo}/environments/${options.stage}`
-	]);
-	gh([
-		"variable",
-		"set",
-		"AWS_ROLE_ARN",
-		"--env",
-		options.stage,
-		"--repo",
-		repo,
-		"--body",
-		roleArn
-	]);
-	logger.log(`  ✓ GitHub: environment "${options.stage}", AWS_ROLE_ARN`);
-	if (remote) {
-		if (!hasSecrets) logger.log(`  ⚠ The "${options.stage}" store holds no secrets yet; set them with gkm secrets:set <KEY> '…' --stage ${options.stage}${options.profile ? ` (AWS_PROFILE=${options.profile})` : ""}.`);
-	} else if (hasKey) {
-		gh([
-			"secret",
-			"set",
-			"GKM_SECRETS_KEY",
-			"--env",
-			options.stage,
-			"--repo",
-			repo
-		], key);
-		logger.log("  ✓ GitHub: GKM_SECRETS_KEY");
-	} else logger.log(`  ⚠ No secrets key for "${options.stage}"; run gkm secrets:init --stage ${options.stage}, then this again.`);
-	logger.log(`\n  Protect it: add required reviewers to the "${options.stage}" environment in the repository settings.\n`);
-	return {
-		roleArn,
-		repo
-	};
-}
-/** The profile's SSO login has lapsed; the fix is one command away. */
-var SsoSessionExpired = class extends Error {
-	profile;
-	constructor(profile) {
-		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
-		this.profile = profile;
-		this.name = "SsoSessionExpired";
-	}
-};
-//#endregion
-export { deployGithubCommand };
-
-//# sourceMappingURL=github-CwX9z89E.mjs.map

package/dist/github-CwX9z89E.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-CwX9z89E.mjs","names":[],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and — when the stage's secrets are kept in\n * the local file — its key as `GKM_SECRETS_KEY`. With `secrets.store` set to\n * SSM or Secrets Manager the deploy job reads them with the role instead, so\n * no key is handed to GitHub, and this checks the stage's store in the same\n * account, with the same profile. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath, keystoreProject, readKey } from '../secrets/keystore.js';\nimport { isRemoteStore, secretsStoreFor } from '../secrets/store.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\t// Read through the keystore so a key still at the place keys used to be kept\n\t// is found, and copied to where it is kept now.\n\tconst key = await readKey(options.stage, keystoreProject(workspace));\n\tconst keyPath = getKeyPath(options.stage, keystoreProject(workspace));\n\tconst hasKey = key !== null;\n\t// A stage whose secrets are in a store is read from there by the deploy job,\n\t// with the role; it needs no key on GitHub.\n\tconst remote = isRemoteStore(workspace, options.stage);\n\t// Read from the stage's own store, with the same credentials the role is\n\t// created with: what the deploy job will find there.\n\tconst store = await secretsStoreFor(workspace, options.stage, {\n\t\t...(options.profile ? { profile: options.profile } : {}),\n\t});\n\tconst hasSecrets = remote && (await store.read(options.stage)) !== null;\n\tconst via = options.profile\n\t\t? `profile \"${options.profile}\"`\n\t\t: 'the default credentials';\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tif (remote) {\n\t\tlogger.log(\n\t\t\t`  Secrets:      ${hasSecrets ? `in the store (${store.name}), read with ${via}` : `none in the store yet — gkm secrets:set <KEY> '…' --stage ${options.stage}`}`,\n\t\t);\n\t} else {\n\t\tlogger.log(\n\t\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t\t);\n\t}\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (remote) {\n\t\t// Nothing to send: the deploy job reads the stage's store itself.\n\t\tif (!hasSecrets) {\n\t\t\tlogger.log(\n\t\t\t\t`  ⚠ The \"${options.stage}\" store holds no secrets yet; set them with gkm secrets:set <KEY> '…' --stage ${options.stage}${options.profile ? ` (AWS_PROFILE=${options.profile})` : ''}.`,\n\t\t\t);\n\t\t}\n\t} else if (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\tkey!,\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;AAsBjB,MAAM,aAAiB,MAAM,UAC5B,aAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,UAAU,KAAA,IACX,CAAC,IACD;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAM;CAAW;AACtD,CAAC,CAAC,CAAC,KAAK;;AAGT,SAAgB,SAAS,SAAiB,OAAuB;CAChE,OAAO,GAAG,QAAQ,UAAU,QAC1B,YAAY,CAAC,CACb,QAAQ,qBAAqB,GAAG,CAAC,CACjC,MAAM,GAAG,EAAE;AACd;;;;;;;AAQA,SAAgB,YACf,aACA,MACA,OACS;CACT,OAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAY;GACpC,QAAQ;GACR,WAAW,EACV,cAAc;KACZ,GAAG,iBAAiB,QAAQ;KAC5B,GAAG,iBAAiB,QAAQ,QAAQ,KAAK,eAAe;GAC1D,EACD;EACD,CACD;CACD,CAAC;AACF;;AAGA,eAAsB,mBAAmB,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAC,MAAM,MAAM,IAAI,KACpD,IAAI,kCAAkC,CAAC,CAAC,CACzC;CACA,MAAM,WAAW,0BAA0B,MAAM,MAChD,EAAE,KAAK,SAAS,iBAAiB,kBAAkB,CACpD,CAAC,EAAE;CACH,IAAI,UAAU,OAAO;CAQrB,QAAO,MANe,IAAI,KACzB,IAAI,mCAAmC;EACtC,KAAK,WAAW;EAChB,cAAc,CAAC,QAAQ;CACxB,CAAC,CACF,EAAA,CACe;AAChB;;AAGA,eAAsB,WACrB,KACA,MACA,OACA,WACkB;CAClB,IAAI;CACJ,IAAI;EACH,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,IAAI,eAAe,EAAE,UAAU,KAAK,CAAC,CAAC;EACtE,MAAM,IAAI,KACT,IAAI,8BAA8B;GACjC,UAAU;GACV,gBAAgB;EACjB,CAAC,CACF;EACA,MAAM,KAAM;CACb,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,yBACzC,MAAM;EAEP,MAAM,EAAE,SAAS,MAAM,IAAI,KAC1B,IAAI,kBAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB;EACrB,CAAC,CACF;EACA,MAAM,KAAM;CACb;CAGA,MAAM,IAAI,KACT,IAAI,wBAAwB;EAAE,UAAU;EAAM,WAAW;CAAU,CAAC,CACrE;CACA,OAAO;AACR;;;;;;;;;;;AAYA,eAAsB,OACrB,SACA,UACqB;CACrB,MAAM,SAA0B,EAAE,QAAQ,YAAY;CACtD,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CACA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAO;CACrE;CACA,OAAO,IAAI,UAAU,MAAM;AAC5B;AAEA,eAAsB,oBACrB,SACA,OAAmD,CAAC,GACN;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,cAAc,MAAM,oBAAoB,KAAK,GAAG;CACxD,oBAAoB,UAAU,QAAQ,QAAQ,KAAK;CAEnD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAgB,CAAC;CACvE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,KAAK;CACnD,MAAM,YAAY,QAAQ,aAAA;CAG1B,MAAM,MAAM,MAAM,QAAQ,QAAQ,OAAO,gBAAgB,SAAS,CAAC;CACnE,MAAM,UAAU,WAAW,QAAQ,OAAO,gBAAgB,SAAS,CAAC;CACpE,MAAM,SAAS,QAAQ;CAGvB,MAAM,SAAS,cAAc,WAAW,QAAQ,KAAK;CAGrD,MAAM,QAAQ,MAAM,gBAAgB,WAAW,QAAQ,OAAO,EAC7D,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC,EACvD,CAAC;CACD,MAAM,aAAa,UAAW,MAAM,MAAM,KAAK,QAAQ,KAAK,MAAO;CACnE,MAAM,MAAM,QAAQ,UACjB,YAAY,QAAQ,QAAQ,KAC5B;CAEH,OAAO,IAAI,gCAAgC,QAAQ,MAAM,IAAI;CAC7D,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IAAI,mBAAmB,QAAQ,WAAW,yBAAyB;CAC1E,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IACN,mBAAmB,YAAY,QAAQ,YAAY,KAAK,uCACzD;CACA,OAAO,IAAI,wBAAwB,KAAK,eAAe,QAAQ,MAAM,MAAM;CAC3E,IAAI,QACH,OAAO,IACN,mBAAmB,aAAa,iBAAiB,MAAM,KAAK,eAAe,QAAQ,6DAA6D,QAAQ,SACzJ;MAEA,OAAO,IACN,mBAAmB,SAAS,UAAU,WAAW,QAAQ,kCAAkC,QAAQ,MAAM,SAC1G;CAGD,IAAI,QAAQ,QAAQ;EACnB,OAAO,IAAI,mCAAmC;EAC9C,OAAO,EAAE,KAAK;CACf;CAEA,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,OAAO;CASrD,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,MAXa,mBAAmB,GAAG,CAAC,CAAC,OAAO,UAAU;EAGlE,IAAI,eAAe,KAAK,OAAO,OAAO,OAAO,CAAC,KAAK,QAAQ,SAC1D,MAAM,IAAI,kBAAkB,QAAQ,OAAO;EAE5C,MAAM;CACP,CAAC,GAIyB,MAAM,QAAQ,KAAK,GAC5C,SACD;CACA,OAAO,IAAI,cAAc,SAAS;CAGlC,GAAG;EAAC;EAAO;EAAY;EAAO,SAAS,KAAK,gBAAgB,QAAQ;CAAO,CAAC;CAC5E,GAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACD,CAAC;CACD,OAAO,IAAI,4BAA4B,QAAQ,MAAM,gBAAgB;CAErE,IAAI,QAEC;MAAA,CAAC,YACJ,OAAO,IACN,YAAY,QAAQ,MAAM,gFAAgF,QAAQ,QAAQ,QAAQ,UAAU,iBAAiB,QAAQ,QAAQ,KAAK,GAAG,EACtL;CAAA,OAEK,IAAI,QAAQ;EAElB,GACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACD,GACA,GACD;EACA,OAAO,IAAI,6BAA6B;CACzC,OACC,OAAO,IACN,2BAA2B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,mBAC1F;CAGD,OAAO,IACN,kDAAkD,QAAQ,MAAM,4CACjE;CACA,OAAO;EAAE;EAAS;CAAK;AACxB;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CACvB;CAArB,YAAY,SAA0B;EACrC,MACC,gCAAgC,QAAQ,4DAA4D,SACrG;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD"}

package/dist/github-D9vGqdLk.cjs

@@ -1,213 +0,0 @@
-const require_workspace = require("./workspace-Bp8FEkF-.cjs");
-const require_config = require("./config.cjs");
-const require_stale = require("./stale-BsiPJI7Y.cjs");
-let node_child_process = require("node:child_process");
-let _aws_sdk_client_iam = require("@aws-sdk/client-iam");
-//#region src/deploy/github.ts
-/**
-* `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.
-*
-* A stage usually lives in its own AWS account — staging in one, production in
-* another — so this runs once per stage, with that account's profile:
-*
-*   gkm deploy:github --stage staging --profile acme-dev
-*   gkm deploy:github --stage prod    --profile acme-prod
-*
-* In the stage's account it makes sure GitHub's OIDC provider exists, and a
-* role that only this repository's `<stage>` environment can assume. On
-* GitHub it creates that environment and gives it what the generated deploy
-* workflow reads: `AWS_ROLE_ARN`, and — when the stage's secrets are kept in
-* the local file — its key as `GKM_SECRETS_KEY`. With `secrets.store` set to
-* SSM or Secrets Manager the deploy job reads them with the role instead, so
-* no key is handed to GitHub, and this checks the stage's store in the same
-* account, with the same profile. Re-running it converges rather than duplicating.
-*/
-const logger = console;
-const GITHUB_OIDC_HOST = "token.actions.githubusercontent.com";
-const AUDIENCE = "sts.amazonaws.com";
-const defaultGh = (args, input) => (0, node_child_process.execFileSync)("gh", args, {
-	encoding: "utf-8",
-	...input === void 0 ? {} : {
-		input,
-		stdio: [
-			"pipe",
-			"pipe",
-			"pipe"
-		]
-	}
-}).trim();
-/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */
-function roleName(project, stage) {
-	return `${project}-github-${stage}`.toLowerCase().replace(/[^a-z0-9+=,.@_-]/g, "-").slice(0, 64);
-}
-/**
-* Who may assume the role: a workflow job running in this repository's
-* `<stage>` environment, and nothing else — not another branch's job, not
-* another environment's. That is what keeps a staging deploy from using the
-* production role.
-*/
-function trustPolicy(providerArn, repo, stage) {
-	return JSON.stringify({
-		Version: "2012-10-17",
-		Statement: [{
-			Effect: "Allow",
-			Principal: { Federated: providerArn },
-			Action: "sts:AssumeRoleWithWebIdentity",
-			Condition: { StringEquals: {
-				[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,
-				[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`
-			} }
-		}]
-	});
-}
-/** GitHub's OIDC provider in this account, created if it is not there. */
-async function ensureOidcProvider(iam) {
-	const { OpenIDConnectProviderList = [] } = await iam.send(new _aws_sdk_client_iam.ListOpenIDConnectProvidersCommand({}));
-	const existing = OpenIDConnectProviderList.find((p) => p.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`))?.Arn;
-	if (existing) return existing;
-	return (await iam.send(new _aws_sdk_client_iam.CreateOpenIDConnectProviderCommand({
-		Url: `https://${GITHUB_OIDC_HOST}`,
-		ClientIDList: [AUDIENCE]
-	}))).OpenIDConnectProviderArn;
-}
-/** The deploy role, created or brought back to this trust and policy. */
-async function ensureRole(iam, name, trust, policyArn) {
-	let arn;
-	try {
-		const { Role } = await iam.send(new _aws_sdk_client_iam.GetRoleCommand({ RoleName: name }));
-		await iam.send(new _aws_sdk_client_iam.UpdateAssumeRolePolicyCommand({
-			RoleName: name,
-			PolicyDocument: trust
-		}));
-		arn = Role.Arn;
-	} catch (error) {
-		if (error.name !== "NoSuchEntityException") throw error;
-		const { Role } = await iam.send(new _aws_sdk_client_iam.CreateRoleCommand({
-			RoleName: name,
-			AssumeRolePolicyDocument: trust,
-			Description: "Deploys from GitHub Actions (gkm deploy:github)",
-			MaxSessionDuration: 7200
-		}));
-		arn = Role.Arn;
-	}
-	await iam.send(new _aws_sdk_client_iam.AttachRolePolicyCommand({
-		RoleName: name,
-		PolicyArn: policyArn
-	}));
-	return arn;
-}
-/**
-* An IAM client for the stage's account.
-*
-* `fromIni` for a named profile, deliberately: it resolves exactly that
-* profile — keys, assume-role, `credential_process` or SSO, whichever
-* ~/.aws/config says — and never falls back to AWS_* in the environment. The
-* provider chain checks the environment first, so exported staging keys would
-* quietly win over `--profile prod` and the production role would land in the
-* staging account.
-*/
-async function iamFor(profile, endpoint) {
-	const config = { region: "us-east-1" };
-	if (profile) {
-		const { fromIni } = await import("@aws-sdk/credential-providers");
-		config.credentials = fromIni({ profile });
-	}
-	if (endpoint) {
-		config.endpoint = endpoint;
-		config.credentials = {
-			accessKeyId: "test",
-			secretAccessKey: "test"
-		};
-	}
-	return new _aws_sdk_client_iam.IAMClient(config);
-}
-async function deployGithubCommand(options, deps = {}) {
-	const gh = deps.gh ?? defaultGh;
-	const { workspace } = await require_config.loadWorkspaceConfig(deps.cwd);
-	require_workspace.assertDeployedStage(workspace.stages, options.stage);
-	const repo = options.repo ?? gh([
-		"repo",
-		"view",
-		"--json",
-		"nameWithOwner",
-		"-q",
-		".nameWithOwner"
-	]);
-	const role = roleName(workspace.name, options.stage);
-	const policyArn = options.policyArn ?? "arn:aws:iam::aws:policy/AdministratorAccess";
-	const key = await require_stale.readKey(options.stage, require_stale.keystoreProject(workspace));
-	const keyPath = require_stale.getKeyPath(options.stage, require_stale.keystoreProject(workspace));
-	const hasKey = key !== null;
-	const remote = require_stale.isRemoteStore(workspace, options.stage);
-	const store = await require_stale.secretsStoreFor(workspace, options.stage, { ...options.profile ? { profile: options.profile } : {} });
-	const hasSecrets = remote && await store.read(options.stage) !== null;
-	const via = options.profile ? `profile "${options.profile}"` : "the default credentials";
-	logger.log(`\n🔐 GitHub → AWS for stage "${options.stage}"\n`);
-	logger.log(`  Repository:   ${repo}`);
-	logger.log(`  AWS profile:  ${options.profile ?? "(default credentials)"}`);
-	logger.log(`  Role:         ${role}`);
-	logger.log(`  Policy:       ${policyArn}${options.policyArn ? "" : "  (default; --policy-arn to narrow)"}`);
-	logger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);
-	if (remote) logger.log(`  Secrets:      ${hasSecrets ? `in the store (${store.name}), read with ${via}` : `none in the store yet — gkm secrets:set <KEY> '…' --stage ${options.stage}`}`);
-	else logger.log(`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`);
-	if (options.dryRun) {
-		logger.log("\n  --dry-run: nothing changed.\n");
-		return { repo };
-	}
-	const iam = deps.iam ?? await iamFor(options.profile);
-	const roleArn = await ensureRole(iam, role, trustPolicy(await ensureOidcProvider(iam).catch((error) => {
-		if (/SSO session/i.test(String(error?.message)) && options.profile) throw new SsoSessionExpired(options.profile);
-		throw error;
-	}), repo, options.stage), policyArn);
-	logger.log(`\n  ✓ AWS: ${roleArn}`);
-	gh([
-		"api",
-		"--method",
-		"PUT",
-		`repos/${repo}/environments/${options.stage}`
-	]);
-	gh([
-		"variable",
-		"set",
-		"AWS_ROLE_ARN",
-		"--env",
-		options.stage,
-		"--repo",
-		repo,
-		"--body",
-		roleArn
-	]);
-	logger.log(`  ✓ GitHub: environment "${options.stage}", AWS_ROLE_ARN`);
-	if (remote) {
-		if (!hasSecrets) logger.log(`  ⚠ The "${options.stage}" store holds no secrets yet; set them with gkm secrets:set <KEY> '…' --stage ${options.stage}${options.profile ? ` (AWS_PROFILE=${options.profile})` : ""}.`);
-	} else if (hasKey) {
-		gh([
-			"secret",
-			"set",
-			"GKM_SECRETS_KEY",
-			"--env",
-			options.stage,
-			"--repo",
-			repo
-		], key);
-		logger.log("  ✓ GitHub: GKM_SECRETS_KEY");
-	} else logger.log(`  ⚠ No secrets key for "${options.stage}"; run gkm secrets:init --stage ${options.stage}, then this again.`);
-	logger.log(`\n  Protect it: add required reviewers to the "${options.stage}" environment in the repository settings.\n`);
-	return {
-		roleArn,
-		repo
-	};
-}
-/** The profile's SSO login has lapsed; the fix is one command away. */
-var SsoSessionExpired = class extends Error {
-	profile;
-	constructor(profile) {
-		super(`The SSO session for profile "${profile}" has expired or is invalid. Run: aws sso login --profile ${profile}`);
-		this.profile = profile;
-		this.name = "SsoSessionExpired";
-	}
-};
-//#endregion
-exports.deployGithubCommand = deployGithubCommand;
-
-//# sourceMappingURL=github-D9vGqdLk.cjs.map

package/dist/github-D9vGqdLk.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"github-D9vGqdLk.cjs","names":["execFileSync","ListOpenIDConnectProvidersCommand","CreateOpenIDConnectProviderCommand","GetRoleCommand","UpdateAssumeRolePolicyCommand","CreateRoleCommand","AttachRolePolicyCommand","IAMClient","loadWorkspaceConfig","readKey","keystoreProject","getKeyPath","isRemoteStore","secretsStoreFor"],"sources":["../src/deploy/github.ts"],"sourcesContent":["/**\n * `gkm deploy:github` — let GitHub Actions deploy one stage, with no keys.\n *\n * A stage usually lives in its own AWS account — staging in one, production in\n * another — so this runs once per stage, with that account's profile:\n *\n *   gkm deploy:github --stage staging --profile acme-dev\n *   gkm deploy:github --stage prod    --profile acme-prod\n *\n * In the stage's account it makes sure GitHub's OIDC provider exists, and a\n * role that only this repository's `<stage>` environment can assume. On\n * GitHub it creates that environment and gives it what the generated deploy\n * workflow reads: `AWS_ROLE_ARN`, and — when the stage's secrets are kept in\n * the local file — its key as `GKM_SECRETS_KEY`. With `secrets.store` set to\n * SSM or Secrets Manager the deploy job reads them with the role instead, so\n * no key is handed to GitHub, and this checks the stage's store in the same\n * account, with the same profile. Re-running it converges rather than duplicating.\n */\n\nimport { execFileSync } from 'node:child_process';\nimport {\n\tAttachRolePolicyCommand,\n\tCreateOpenIDConnectProviderCommand,\n\tCreateRoleCommand,\n\tGetRoleCommand,\n\tIAMClient,\n\ttype IAMClientConfig,\n\tListOpenIDConnectProvidersCommand,\n\tUpdateAssumeRolePolicyCommand,\n} from '@aws-sdk/client-iam';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { getKeyPath, keystoreProject, readKey } from '../secrets/keystore.js';\nimport { isRemoteStore, secretsStoreFor } from '../secrets/store.js';\nimport { assertDeployedStage } from '../workspace/stages.js';\n\nconst logger = console;\n\nconst GITHUB_OIDC_HOST = 'token.actions.githubusercontent.com';\nconst AUDIENCE = 'sts.amazonaws.com';\n\n/**\n * What SST needs to create a stack is most of AWS, so this is the default —\n * said out loud in the output, and replaceable with `--policy-arn`.\n */\nexport const DEFAULT_POLICY_ARN = 'arn:aws:iam::aws:policy/AdministratorAccess';\n\nexport interface DeployGithubOptions {\n\tstage: string;\n\t/** The AWS profile for the stage's account. */\n\tprofile?: string;\n\t/** `owner/name`; defaults to the repository `gh` sees here. */\n\trepo?: string;\n\t/** The policy the deploy role gets. */\n\tpolicyArn?: string;\n\tdryRun?: boolean;\n}\n\n/** Runs `gh` with the given arguments and optional stdin, returning stdout. */\nexport type Gh = (args: string[], input?: string) => string;\n\nconst defaultGh: Gh = (args, input) =>\n\texecFileSync('gh', args, {\n\t\tencoding: 'utf-8',\n\t\t...(input === undefined\n\t\t\t? {}\n\t\t\t: { input, stdio: ['pipe', 'pipe', 'pipe'] as const }),\n\t}).trim();\n\n/** The role a stage deploys as: `<project>-github-<stage>`, within IAM's 64. */\nexport function roleName(project: string, stage: string): string {\n\treturn `${project}-github-${stage}`\n\t\t.toLowerCase()\n\t\t.replace(/[^a-z0-9+=,.@_-]/g, '-')\n\t\t.slice(0, 64);\n}\n\n/**\n * Who may assume the role: a workflow job running in this repository's\n * `<stage>` environment, and nothing else — not another branch's job, not\n * another environment's. That is what keeps a staging deploy from using the\n * production role.\n */\nexport function trustPolicy(\n\tproviderArn: string,\n\trepo: string,\n\tstage: string,\n): string {\n\treturn JSON.stringify({\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tEffect: 'Allow',\n\t\t\t\tPrincipal: { Federated: providerArn },\n\t\t\t\tAction: 'sts:AssumeRoleWithWebIdentity',\n\t\t\t\tCondition: {\n\t\t\t\t\tStringEquals: {\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:aud`]: AUDIENCE,\n\t\t\t\t\t\t[`${GITHUB_OIDC_HOST}:sub`]: `repo:${repo}:environment:${stage}`,\n\t\t\t\t\t},\n\t\t\t\t},\n\t\t\t},\n\t\t],\n\t});\n}\n\n/** GitHub's OIDC provider in this account, created if it is not there. */\nexport async function ensureOidcProvider(iam: IAMClient): Promise<string> {\n\tconst { OpenIDConnectProviderList = [] } = await iam.send(\n\t\tnew ListOpenIDConnectProvidersCommand({}),\n\t);\n\tconst existing = OpenIDConnectProviderList.find((p) =>\n\t\tp.Arn?.endsWith(`oidc-provider/${GITHUB_OIDC_HOST}`),\n\t)?.Arn;\n\tif (existing) return existing;\n\n\tconst created = await iam.send(\n\t\tnew CreateOpenIDConnectProviderCommand({\n\t\t\tUrl: `https://${GITHUB_OIDC_HOST}`,\n\t\t\tClientIDList: [AUDIENCE],\n\t\t}),\n\t);\n\treturn created.OpenIDConnectProviderArn!;\n}\n\n/** The deploy role, created or brought back to this trust and policy. */\nexport async function ensureRole(\n\tiam: IAMClient,\n\tname: string,\n\ttrust: string,\n\tpolicyArn: string,\n): Promise<string> {\n\tlet arn: string;\n\ttry {\n\t\tconst { Role } = await iam.send(new GetRoleCommand({ RoleName: name }));\n\t\tawait iam.send(\n\t\t\tnew UpdateAssumeRolePolicyCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tPolicyDocument: trust,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t} catch (error) {\n\t\tif ((error as { name?: string }).name !== 'NoSuchEntityException') {\n\t\t\tthrow error;\n\t\t}\n\t\tconst { Role } = await iam.send(\n\t\t\tnew CreateRoleCommand({\n\t\t\t\tRoleName: name,\n\t\t\t\tAssumeRolePolicyDocument: trust,\n\t\t\t\tDescription: 'Deploys from GitHub Actions (gkm deploy:github)',\n\t\t\t\t// SST deploys can run long; the default hour is tight.\n\t\t\t\tMaxSessionDuration: 3600 * 2,\n\t\t\t}),\n\t\t);\n\t\tarn = Role!.Arn!;\n\t}\n\n\t// Attaching an attached policy is a no-op, so this converges too.\n\tawait iam.send(\n\t\tnew AttachRolePolicyCommand({ RoleName: name, PolicyArn: policyArn }),\n\t);\n\treturn arn;\n}\n\n/**\n * An IAM client for the stage's account.\n *\n * `fromIni` for a named profile, deliberately: it resolves exactly that\n * profile — keys, assume-role, `credential_process` or SSO, whichever\n * ~/.aws/config says — and never falls back to AWS_* in the environment. The\n * provider chain checks the environment first, so exported staging keys would\n * quietly win over `--profile prod` and the production role would land in the\n * staging account.\n */\nexport async function iamFor(\n\tprofile?: string,\n\tendpoint?: string,\n): Promise<IAMClient> {\n\tconst config: IAMClientConfig = { region: 'us-east-1' };\n\tif (profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile });\n\t}\n\tif (endpoint) {\n\t\tconfig.endpoint = endpoint;\n\t\tconfig.credentials = { accessKeyId: 'test', secretAccessKey: 'test' };\n\t}\n\treturn new IAMClient(config);\n}\n\nexport async function deployGithubCommand(\n\toptions: DeployGithubOptions,\n\tdeps: { iam?: IAMClient; gh?: Gh; cwd?: string } = {},\n): Promise<{ roleArn?: string; repo: string }> {\n\tconst gh = deps.gh ?? defaultGh;\n\tconst { workspace } = await loadWorkspaceConfig(deps.cwd);\n\tassertDeployedStage(workspace.stages, options.stage);\n\n\tconst repo =\n\t\toptions.repo ??\n\t\tgh(['repo', 'view', '--json', 'nameWithOwner', '-q', '.nameWithOwner']);\n\tconst role = roleName(workspace.name, options.stage);\n\tconst policyArn = options.policyArn ?? DEFAULT_POLICY_ARN;\n\t// Read through the keystore so a key still at the place keys used to be kept\n\t// is found, and copied to where it is kept now.\n\tconst key = await readKey(options.stage, keystoreProject(workspace));\n\tconst keyPath = getKeyPath(options.stage, keystoreProject(workspace));\n\tconst hasKey = key !== null;\n\t// A stage whose secrets are in a store is read from there by the deploy job,\n\t// with the role; it needs no key on GitHub.\n\tconst remote = isRemoteStore(workspace, options.stage);\n\t// Read from the stage's own store, with the same credentials the role is\n\t// created with: what the deploy job will find there.\n\tconst store = await secretsStoreFor(workspace, options.stage, {\n\t\t...(options.profile ? { profile: options.profile } : {}),\n\t});\n\tconst hasSecrets = remote && (await store.read(options.stage)) !== null;\n\tconst via = options.profile\n\t\t? `profile \"${options.profile}\"`\n\t\t: 'the default credentials';\n\n\tlogger.log(`\\n🔐 GitHub → AWS for stage \"${options.stage}\"\\n`);\n\tlogger.log(`  Repository:   ${repo}`);\n\tlogger.log(`  AWS profile:  ${options.profile ?? '(default credentials)'}`);\n\tlogger.log(`  Role:         ${role}`);\n\tlogger.log(\n\t\t`  Policy:       ${policyArn}${options.policyArn ? '' : '  (default; --policy-arn to narrow)'}`,\n\t);\n\tlogger.log(`  Trusted by:   repo:${repo}:environment:${options.stage} only`);\n\tif (remote) {\n\t\tlogger.log(\n\t\t\t`  Secrets:      ${hasSecrets ? `in the store (${store.name}), read with ${via}` : `none in the store yet — gkm secrets:set <KEY> '…' --stage ${options.stage}`}`,\n\t\t);\n\t} else {\n\t\tlogger.log(\n\t\t\t`  Secrets key:  ${hasKey ? keyPath : `none at ${keyPath} — run gkm secrets:init --stage ${options.stage} first`}`,\n\t\t);\n\t}\n\n\tif (options.dryRun) {\n\t\tlogger.log('\\n  --dry-run: nothing changed.\\n');\n\t\treturn { repo };\n\t}\n\n\tconst iam = deps.iam ?? (await iamFor(options.profile));\n\tconst providerArn = await ensureOidcProvider(iam).catch((error) => {\n\t\t// The first AWS call is where an expired SSO login surfaces; the SDK's\n\t\t// message does not say which profile, and this command knows.\n\t\tif (/SSO session/i.test(String(error?.message)) && options.profile) {\n\t\t\tthrow new SsoSessionExpired(options.profile);\n\t\t}\n\t\tthrow error;\n\t});\n\tconst roleArn = await ensureRole(\n\t\tiam,\n\t\trole,\n\t\ttrustPolicy(providerArn, repo, options.stage),\n\t\tpolicyArn,\n\t);\n\tlogger.log(`\\n  ✓ AWS: ${roleArn}`);\n\n\t// The environment the generated deploy workflow runs the stage in.\n\tgh(['api', '--method', 'PUT', `repos/${repo}/environments/${options.stage}`]);\n\tgh([\n\t\t'variable',\n\t\t'set',\n\t\t'AWS_ROLE_ARN',\n\t\t'--env',\n\t\toptions.stage,\n\t\t'--repo',\n\t\trepo,\n\t\t'--body',\n\t\troleArn,\n\t]);\n\tlogger.log(`  ✓ GitHub: environment \"${options.stage}\", AWS_ROLE_ARN`);\n\n\tif (remote) {\n\t\t// Nothing to send: the deploy job reads the stage's store itself.\n\t\tif (!hasSecrets) {\n\t\t\tlogger.log(\n\t\t\t\t`  ⚠ The \"${options.stage}\" store holds no secrets yet; set them with gkm secrets:set <KEY> '…' --stage ${options.stage}${options.profile ? ` (AWS_PROFILE=${options.profile})` : ''}.`,\n\t\t\t);\n\t\t}\n\t} else if (hasKey) {\n\t\t// Through stdin, so the key is never an argument a process list shows.\n\t\tgh(\n\t\t\t[\n\t\t\t\t'secret',\n\t\t\t\t'set',\n\t\t\t\t'GKM_SECRETS_KEY',\n\t\t\t\t'--env',\n\t\t\t\toptions.stage,\n\t\t\t\t'--repo',\n\t\t\t\trepo,\n\t\t\t],\n\t\t\tkey!,\n\t\t);\n\t\tlogger.log('  ✓ GitHub: GKM_SECRETS_KEY');\n\t} else {\n\t\tlogger.log(\n\t\t\t`  ⚠ No secrets key for \"${options.stage}\"; run gkm secrets:init --stage ${options.stage}, then this again.`,\n\t\t);\n\t}\n\n\tlogger.log(\n\t\t`\\n  Protect it: add required reviewers to the \"${options.stage}\" environment in the repository settings.\\n`,\n\t);\n\treturn { roleArn, repo };\n}\n\n/** The profile's SSO login has lapsed; the fix is one command away. */\nexport class SsoSessionExpired extends Error {\n\tconstructor(readonly profile: string) {\n\t\tsuper(\n\t\t\t`The SSO session for profile \"${profile}\" has expired or is invalid. Run: aws sso login --profile ${profile}`,\n\t\t);\n\t\tthis.name = 'SsoSessionExpired';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAM,SAAS;AAEf,MAAM,mBAAmB;AACzB,MAAM,WAAW;AAsBjB,MAAM,aAAiB,MAAM,WAAA,GAC5BA,mBAAAA,aAAAA,CAAa,MAAM,MAAM;CACxB,UAAU;CACV,GAAI,UAAU,KAAA,IACX,CAAC,IACD;EAAE;EAAO,OAAO;GAAC;GAAQ;GAAQ;EAAM;CAAW;AACtD,CAAC,CAAC,CAAC,KAAK;;AAGT,SAAgB,SAAS,SAAiB,OAAuB;CAChE,OAAO,GAAG,QAAQ,UAAU,QAC1B,YAAY,CAAC,CACb,QAAQ,qBAAqB,GAAG,CAAC,CACjC,MAAM,GAAG,EAAE;AACd;;;;;;;AAQA,SAAgB,YACf,aACA,MACA,OACS;CACT,OAAO,KAAK,UAAU;EACrB,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,WAAW,EAAE,WAAW,YAAY;GACpC,QAAQ;GACR,WAAW,EACV,cAAc;KACZ,GAAG,iBAAiB,QAAQ;KAC5B,GAAG,iBAAiB,QAAQ,QAAQ,KAAK,eAAe;GAC1D,EACD;EACD,CACD;CACD,CAAC;AACF;;AAGA,eAAsB,mBAAmB,KAAiC;CACzE,MAAM,EAAE,4BAA4B,CAAC,MAAM,MAAM,IAAI,KACpD,IAAIC,oBAAAA,kCAAkC,CAAC,CAAC,CACzC;CACA,MAAM,WAAW,0BAA0B,MAAM,MAChD,EAAE,KAAK,SAAS,iBAAiB,kBAAkB,CACpD,CAAC,EAAE;CACH,IAAI,UAAU,OAAO;CAQrB,QAAO,MANe,IAAI,KACzB,IAAIC,oBAAAA,mCAAmC;EACtC,KAAK,WAAW;EAChB,cAAc,CAAC,QAAQ;CACxB,CAAC,CACF,EAAA,CACe;AAChB;;AAGA,eAAsB,WACrB,KACA,MACA,OACA,WACkB;CAClB,IAAI;CACJ,IAAI;EACH,MAAM,EAAE,SAAS,MAAM,IAAI,KAAK,IAAIC,oBAAAA,eAAe,EAAE,UAAU,KAAK,CAAC,CAAC;EACtE,MAAM,IAAI,KACT,IAAIC,oBAAAA,8BAA8B;GACjC,UAAU;GACV,gBAAgB;EACjB,CAAC,CACF;EACA,MAAM,KAAM;CACb,SAAS,OAAO;EACf,IAAK,MAA4B,SAAS,yBACzC,MAAM;EAEP,MAAM,EAAE,SAAS,MAAM,IAAI,KAC1B,IAAIC,oBAAAA,kBAAkB;GACrB,UAAU;GACV,0BAA0B;GAC1B,aAAa;GAEb,oBAAoB;EACrB,CAAC,CACF;EACA,MAAM,KAAM;CACb;CAGA,MAAM,IAAI,KACT,IAAIC,oBAAAA,wBAAwB;EAAE,UAAU;EAAM,WAAW;CAAU,CAAC,CACrE;CACA,OAAO;AACR;;;;;;;;;;;AAYA,eAAsB,OACrB,SACA,UACqB;CACrB,MAAM,SAA0B,EAAE,QAAQ,YAAY;CACtD,IAAI,SAAS;EACZ,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,QAAQ,CAAC;CACzC;CACA,IAAI,UAAU;EACb,OAAO,WAAW;EAClB,OAAO,cAAc;GAAE,aAAa;GAAQ,iBAAiB;EAAO;CACrE;CACA,OAAO,IAAIC,oBAAAA,UAAU,MAAM;AAC5B;AAEA,eAAsB,oBACrB,SACA,OAAmD,CAAC,GACN;CAC9C,MAAM,KAAK,KAAK,MAAM;CACtB,MAAM,EAAE,cAAc,MAAMC,eAAAA,oBAAoB,KAAK,GAAG;CACxD,kBAAA,oBAAoB,UAAU,QAAQ,QAAQ,KAAK;CAEnD,MAAM,OACL,QAAQ,QACR,GAAG;EAAC;EAAQ;EAAQ;EAAU;EAAiB;EAAM;CAAgB,CAAC;CACvE,MAAM,OAAO,SAAS,UAAU,MAAM,QAAQ,KAAK;CACnD,MAAM,YAAY,QAAQ,aAAA;CAG1B,MAAM,MAAM,MAAMC,cAAAA,QAAQ,QAAQ,OAAOC,cAAAA,gBAAgB,SAAS,CAAC;CACnE,MAAM,UAAUC,cAAAA,WAAW,QAAQ,OAAOD,cAAAA,gBAAgB,SAAS,CAAC;CACpE,MAAM,SAAS,QAAQ;CAGvB,MAAM,SAASE,cAAAA,cAAc,WAAW,QAAQ,KAAK;CAGrD,MAAM,QAAQ,MAAMC,cAAAA,gBAAgB,WAAW,QAAQ,OAAO,EAC7D,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC,EACvD,CAAC;CACD,MAAM,aAAa,UAAW,MAAM,MAAM,KAAK,QAAQ,KAAK,MAAO;CACnE,MAAM,MAAM,QAAQ,UACjB,YAAY,QAAQ,QAAQ,KAC5B;CAEH,OAAO,IAAI,gCAAgC,QAAQ,MAAM,IAAI;CAC7D,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IAAI,mBAAmB,QAAQ,WAAW,yBAAyB;CAC1E,OAAO,IAAI,mBAAmB,MAAM;CACpC,OAAO,IACN,mBAAmB,YAAY,QAAQ,YAAY,KAAK,uCACzD;CACA,OAAO,IAAI,wBAAwB,KAAK,eAAe,QAAQ,MAAM,MAAM;CAC3E,IAAI,QACH,OAAO,IACN,mBAAmB,aAAa,iBAAiB,MAAM,KAAK,eAAe,QAAQ,6DAA6D,QAAQ,SACzJ;MAEA,OAAO,IACN,mBAAmB,SAAS,UAAU,WAAW,QAAQ,kCAAkC,QAAQ,MAAM,SAC1G;CAGD,IAAI,QAAQ,QAAQ;EACnB,OAAO,IAAI,mCAAmC;EAC9C,OAAO,EAAE,KAAK;CACf;CAEA,MAAM,MAAM,KAAK,OAAQ,MAAM,OAAO,QAAQ,OAAO;CASrD,MAAM,UAAU,MAAM,WACrB,KACA,MACA,YAAY,MAXa,mBAAmB,GAAG,CAAC,CAAC,OAAO,UAAU;EAGlE,IAAI,eAAe,KAAK,OAAO,OAAO,OAAO,CAAC,KAAK,QAAQ,SAC1D,MAAM,IAAI,kBAAkB,QAAQ,OAAO;EAE5C,MAAM;CACP,CAAC,GAIyB,MAAM,QAAQ,KAAK,GAC5C,SACD;CACA,OAAO,IAAI,cAAc,SAAS;CAGlC,GAAG;EAAC;EAAO;EAAY;EAAO,SAAS,KAAK,gBAAgB,QAAQ;CAAO,CAAC;CAC5E,GAAG;EACF;EACA;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;CACD,CAAC;CACD,OAAO,IAAI,4BAA4B,QAAQ,MAAM,gBAAgB;CAErE,IAAI,QAEC;MAAA,CAAC,YACJ,OAAO,IACN,YAAY,QAAQ,MAAM,gFAAgF,QAAQ,QAAQ,QAAQ,UAAU,iBAAiB,QAAQ,QAAQ,KAAK,GAAG,EACtL;CAAA,OAEK,IAAI,QAAQ;EAElB,GACC;GACC;GACA;GACA;GACA;GACA,QAAQ;GACR;GACA;EACD,GACA,GACD;EACA,OAAO,IAAI,6BAA6B;CACzC,OACC,OAAO,IACN,2BAA2B,QAAQ,MAAM,kCAAkC,QAAQ,MAAM,mBAC1F;CAGD,OAAO,IACN,kDAAkD,QAAQ,MAAM,4CACjE;CACA,OAAO;EAAE;EAAS;CAAK;AACxB;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CACvB;CAArB,YAAY,SAA0B;EACrC,MACC,gCAAgC,QAAQ,4DAA4D,SACrG;EAHoB,KAAA,UAAA;EAIpB,KAAK,OAAO;CACb;AACD"}

package/dist/provider-B3Sv_a74.cjs

@@ -1,173 +0,0 @@
-let node_path = require("node:path");
-let node_fs_promises = require("node:fs/promises");
-let node_url = require("node:url");
-//#region src/migrate/provider.ts
-/**
-* One construct's migrations and seeds, read from its folders.
-*
-* Two kinds of file, told apart by extension rather than by configuration: a
-* script exports `up` (and may export `down`) — or `seed(db, { stage })`, in
-* `seeds/` — and a
-* `.sql` file is run whole. The second is what makes a folder independent of
-* the client the app uses — Better Auth's schema is SQL whatever the
-* application queries with.
-*/
-const SCRIPTS = /* @__PURE__ */ new Set([
-	".ts",
-	".mts",
-	".js",
-	".mjs"
-]);
-/** Two files in one folder that would be one migration. */
-var DuplicateMigration = class extends Error {
-	folder;
-	migration;
-	constructor(folder, migration) {
-		super(`${folder} has two migrations named '${migration}' — a script and a .sql file with the same name. A migration is recorded by name, so only one of them could ever run; rename or remove the other.`);
-		this.folder = folder;
-		this.migration = migration;
-		this.name = "DuplicateMigration";
-	}
-};
-/** A script in a migrations folder that exports no `up`. */
-var MigrationHasNoUp = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a migrations folder but exports no \`up\` function. Export \`async function up(db: Kysely<unknown>)\`, or move the file out of the folder if it is not a migration.`);
-		this.file = file;
-		this.name = "MigrationHasNoUp";
-	}
-};
-/** A script in a seeds folder that exports no `seed`. */
-var SeedHasNoSeed = class extends Error {
-	file;
-	constructor(file) {
-		super(`${file} is in a seeds folder but exports no \`seed\` function. Export \`async function seed(db, { stage })\`, or move the file out of the folder if it is not a seed.`);
-		this.file = file;
-		this.name = "SeedHasNoSeed";
-	}
-};
-/**
-* The migration files in a folder, by name, without reading them.
-*
-* Also what `gkm dev` compares against a construct's history to report what
-* is pending, which is why it is separate from loading them.
-*/
-async function migrationFiles(folder) {
-	const entries = await (0, node_fs_promises.readdir)(folder, { withFileTypes: true }).catch((error) => {
-		if (error.code === "ENOENT") return [];
-		throw error;
-	});
-	const files = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		if (!entry.isFile() || !isMigration(entry.name)) continue;
-		const name = entry.name.slice(0, -(0, node_path.extname)(entry.name).length);
-		if (files.has(name)) throw new DuplicateMigration(folder, name);
-		files.set(name, (0, node_path.join)(folder, entry.name));
-	}
-	return files;
-}
-/** A Kysely provider over one construct's folder. */
-function folderProvider(folder, raw) {
-	return { async getMigrations() {
-		const migrations = {};
-		for (const [name, file] of await migrationFiles(folder)) migrations[name] = (0, node_path.extname)(file) === ".sql" ? await sqlMigration(file, raw) : await scriptMigration(file);
-		return migrations;
-	} };
-}
-/**
-* The seeds in a folder, loaded, in name order.
-*
-* Every one runs on every pass — there is no history to consult — so the order
-* is the only thing between two seeds where one reads what another writes.
-* Name them to sort that way.
-*/
-async function loadSeeds(folder, raw) {
-	const files = [...await migrationFiles(folder)].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	const seeds = [];
-	for (const [name, file] of files) seeds.push({
-		name,
-		run: (0, node_path.extname)(file) === ".sql" ? (await sqlMigration(file, raw)).up : await scriptSeed(file)
-	});
-	return seeds;
-}
-/**
-* A seed script, imported as it is on disk now.
-*
-* Keyed by its modification time: a seed is run again after it is edited, and
-* a process that has imported it once would otherwise run the old one.
-*/
-async function scriptSeed(file) {
-	const url = (0, node_url.pathToFileURL)(file);
-	url.searchParams.set("mtime", String((await (0, node_fs_promises.stat)(file)).mtimeMs));
-	const module = await import(url.href);
-	if (typeof module.seed !== "function") throw new SeedHasNoSeed(file);
-	return module.seed;
-}
-function isMigration(file) {
-	if (file.endsWith(".d.ts")) return false;
-	if (/\.(spec|test)\.[cm]?[jt]s$/.test(file)) return false;
-	const extension = (0, node_path.extname)(file);
-	return extension === ".sql" || SCRIPTS.has(extension);
-}
-async function scriptMigration(file) {
-	const module = await import((0, node_url.pathToFileURL)(file).href);
-	if (typeof module.up !== "function") throw new MigrationHasNoUp(file);
-	return {
-		up: module.up,
-		...typeof module.down === "function" ? { down: module.down } : {}
-	};
-}
-/**
-* A `.sql` file, run whole.
-*
-* One query rather than split on `;`: with no parameters, Postgres takes
-* several statements in one message, and splitting by hand breaks on the first
-* `;` inside a string or a function body. There is no `down` — a generated
-* schema is rolled back by a migration that says how, not by guessing.
-*/
-async function sqlMigration(file, raw) {
-	const statements = await (0, node_fs_promises.readFile)(file, "utf-8");
-	return { up: async (db) => {
-		await raw.raw(statements).execute(db);
-	} };
-}
-//#endregion
-Object.defineProperty(exports, "DuplicateMigration", {
-	enumerable: true,
-	get: function() {
-		return DuplicateMigration;
-	}
-});
-Object.defineProperty(exports, "MigrationHasNoUp", {
-	enumerable: true,
-	get: function() {
-		return MigrationHasNoUp;
-	}
-});
-Object.defineProperty(exports, "SeedHasNoSeed", {
-	enumerable: true,
-	get: function() {
-		return SeedHasNoSeed;
-	}
-});
-Object.defineProperty(exports, "folderProvider", {
-	enumerable: true,
-	get: function() {
-		return folderProvider;
-	}
-});
-Object.defineProperty(exports, "loadSeeds", {
-	enumerable: true,
-	get: function() {
-		return loadSeeds;
-	}
-});
-Object.defineProperty(exports, "migrationFiles", {
-	enumerable: true,
-	get: function() {
-		return migrationFiles;
-	}
-});
-
-//# sourceMappingURL=provider-B3Sv_a74.cjs.map