@geekmidas/cli 10.0.0-alpha.79 → 10.0.0-alpha.81

package/dist/{rollback-Cq5s3WnD.mjs.map → rollback-B7uQKHEk.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"rollback-Cq5s3WnD.mjs","names":[],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport { createStateStore } from '../../deploy/StateStore';\nimport {\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(store, input.stage, () =>\n\t\t\t\tcreateEmptyState(input.stage, '', ''),\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAe,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAI,aAAa,EAAE,MAAM,kBAAkB,QAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAO,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAM,oBAAoB,QAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EAEjD,MAAM,QAAQ,MAAM,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAM,cAAc,KAAK,OAAO,MAAM,aACrD,iBAAiB,MAAM,OAAO,IAAI,EAAE,CACrC;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAM,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAAS,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAM,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}
+{"version":3,"file":"rollback-B7uQKHEk.mjs","names":[],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport { createStateStore } from '../../deploy/StateStore';\nimport {\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(store, input.stage, () =>\n\t\t\t\tcreateEmptyState(input.stage, '', ''),\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAe,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAI,aAAa,EAAE,MAAM,kBAAkB,QAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAO,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAM,oBAAoB,QAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EAEjD,MAAM,QAAQ,MAAM,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAM,cAAc,KAAK,OAAO,MAAM,aACrD,iBAAiB,MAAM,OAAO,IAAI,EAAE,CACrC;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAM,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAAS,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAM,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}

package/dist/{rollback-DUoOaws3.cjs → rollback-P09wRaW4.cjs}

@@ -3,9 +3,9 @@ const require_credentials = require("./credentials-BVs7mrtw.cjs");
 const require_sandbox = require("./sandbox-CL--ZDui.cjs");
 const require_workspace = require("./workspace-Bp8FEkF-.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-qX13ubmO.cjs");
+const require_seeds = require("./seeds-BjHiy9tW.cjs");
 const require_sniffer = require("./sniffer-BjG-1mlD.cjs");
-const require_engine = require("./engine-C3T39eTO.cjs");
+const require_engine = require("./engine-U0xzB5i4.cjs");
 let node_path = require("node:path");
 //#region src/target/dokploy/rollback.ts
 /**
@@ -158,4 +158,4 @@ Object.defineProperty(exports, "rollback_exports", {
 	}
 });
 
-//# sourceMappingURL=rollback-DUoOaws3.cjs.map
+//# sourceMappingURL=rollback-P09wRaW4.cjs.map

package/dist/{rollback-DUoOaws3.cjs.map → rollback-P09wRaW4.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"rollback-DUoOaws3.cjs","names":["storedCredentials","LocalSandbox","findWorkspaceRoot","resolve","withSandbox","loadWorkspaceConfig","createStateStore","DeployJournal","createEmptyState","dokployApi","verifySettings","restoreImage"],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport { createStateStore } from '../../deploy/StateStore';\nimport {\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(store, input.stage, () =>\n\t\t\t\tcreateEmptyState(input.stage, '', ''),\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAeA,oBAAAA,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAIC,oBAAAA,aAAa,EAAE,MAAMC,eAAAA,mBAAAA,GAAkBC,UAAAA,QAAAA,CAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAOC,gBAAAA,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAMC,eAAAA,qBAAAA,GAAoBF,UAAAA,QAAAA,CAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,kBAAA,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EAEjD,MAAM,QAAQ,MAAMG,gBAAAA,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAMC,cAAAA,cAAc,KAAK,OAAO,MAAM,aACrDC,cAAAA,iBAAiB,MAAM,OAAO,IAAI,EAAE,CACrC;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAMC,eAAAA,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAASC,eAAAA,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAMC,eAAAA,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,cAAA,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}
+{"version":3,"file":"rollback-P09wRaW4.cjs","names":["storedCredentials","LocalSandbox","findWorkspaceRoot","resolve","withSandbox","loadWorkspaceConfig","createStateStore","DeployJournal","createEmptyState","dokployApi","verifySettings","restoreImage"],"sources":["../src/target/dokploy/rollback.ts"],"sourcesContent":["/**\n * `gkm deploy:rollback`: a stage's apps put back on the release before the\n * one they run, by hand — for a release that passed its checks and turned out\n * wrong anyway.\n *\n * One app by default, because an app is what usually broke: rolling the API\n * back over a site fix that shipped beside it undoes the fix too. `atomic`\n * rolls back every app that has a release to go back to, for apps that only\n * work together — an API and the site built against its newer contract.\n *\n * It restores images and nothing else. The environment an app runs with is\n * the stage's, resolved on every deploy, and migrations are forward-only: a\n * migration that the older code cannot run against is undone by a new\n * migration, never by a rollback.\n */\n\nimport { resolve } from 'node:path';\nimport { findWorkspaceRoot, loadWorkspaceConfig } from '../../config';\nimport {\n\ttype CredentialProvider,\n\tstoredCredentials,\n} from '../../deploy/credentials';\nimport { DeployJournal } from '../../deploy/journal';\nimport { createStateStore } from '../../deploy/StateStore';\nimport {\n\tcreateEmptyState,\n\ttype ReleasedImage,\n\trecordRollback,\n} from '../../deploy/state';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { type Sandbox, withSandbox } from '../../sandbox/sandbox';\nimport { assertDeployedStage } from '../../workspace/stages';\nimport { dokployApi, restoreImage, verifySettings } from './engine';\n\nexport interface RollbackInput {\n\t/** The project: the directory holding `gkm.config.ts`, or one inside it. */\n\tcwd: string;\n\tstage: string;\n\t/** The app to roll back. */\n\tapp?: string;\n\t/** Every app with an earlier release, instead of one. */\n\tatomic?: boolean;\n\t/** Defaults to the environment, then the logins `gkm login` stored. */\n\tcredentials?: CredentialProvider;\n\tsignal?: AbortSignal;\n\t/** Each progress line. Defaults to none. */\n\tlog?: (line: string) => void;\n\t/** Where the config is loaded. Defaults to a `LocalSandbox` on the project. */\n\tsandbox?: Sandbox;\n}\n\n/** One app rolled back. */\nexport interface RolledBack {\n\tapp: string;\n\tfrom: ReleasedImage;\n\tto: ReleasedImage;\n}\n\n/** Neither an app nor every app was asked for. */\nexport class RollbackNeedsApp extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** The apps that have a release to go back to. */\n\t\treadonly apps: readonly string[],\n\t) {\n\t\tsuper(\n\t\t\t`Say what to roll back: --app <name> for one app (${apps.join(', ') || 'none has an earlier release'}), ` +\n\t\t\t\t`or --atomic for every app of \"${stage}\" together.`,\n\t\t);\n\t\tthis.name = 'RollbackNeedsApp';\n\t}\n}\n\n/** An app has no release before the one it runs. */\nexport class NothingToRollBack extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly app: string,\n\t) {\n\t\tsuper(\n\t\t\t`\"${app}\" has no earlier release on \"${stage}\" to roll back to: it has been released once, ` +\n\t\t\t\t'or every earlier release was itself rolled back. Deploy the version you want instead.',\n\t\t);\n\t\tthis.name = 'NothingToRollBack';\n\t}\n}\n\n/** The stage was never deployed through Dokploy from this state. */\nexport class StageNeverDeployed extends Error {\n\tconstructor(readonly stage: string) {\n\t\tsuper(\n\t\t\t`\"${stage}\" has no deploy state, so there is nothing to roll back. ` +\n\t\t\t\t'Check the stage name, and that `state` in gkm.config.ts points at the store the deploys write to.',\n\t\t);\n\t\tthis.name = 'StageNeverDeployed';\n\t}\n}\n\n/**\n * Roll a stage's app — or, `atomic`, all of them — back to its previous\n * release, holding the stage's lock as a deploy does.\n */\nexport async function rollbackStage(\n\tinput: RollbackInput,\n): Promise<RolledBack[]> {\n\tconst signal = input.signal ?? new AbortController().signal;\n\tconst log = input.log ?? (() => {});\n\tconst credentials = input.credentials ?? storedCredentials();\n\tconst sandbox =\n\t\tinput.sandbox ??\n\t\tnew LocalSandbox({ root: findWorkspaceRoot(resolve(input.cwd)) });\n\n\treturn withSandbox(sandbox, async () => {\n\t\tconst { workspace } = await loadWorkspaceConfig(resolve(input.cwd), {\n\t\t\tsandbox,\n\t\t});\n\t\tassertDeployedStage(workspace.stages, input.stage);\n\n\t\tconst store = await createStateStore({\n\t\t\tconfig: workspace.state,\n\t\t\tworkspaceRoot: workspace.root,\n\t\t\tworkspaceName: workspace.name,\n\t\t});\n\t\tif (!(await store.read(input.stage))) {\n\t\t\tthrow new StageNeverDeployed(input.stage);\n\t\t}\n\n\t\tconst lock = await store.lock(input.stage, { operation: 'rollback' });\n\t\ttry {\n\t\t\tconst journal = await DeployJournal.open(store, input.stage, () =>\n\t\t\t\tcreateEmptyState(input.stage, '', ''),\n\t\t\t);\n\t\t\tconst { state } = journal;\n\t\t\tconst releases = state.releases ?? {};\n\t\t\tconst restorable = Object.keys(releases).filter(\n\t\t\t\t(app) => releases[app]!.previous,\n\t\t\t);\n\n\t\t\tlet apps: string[];\n\t\t\tif (input.atomic) {\n\t\t\t\tapps = restorable;\n\t\t\t\tif (apps.length === 0) {\n\t\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t\t}\n\t\t\t} else if (input.app) {\n\t\t\t\tif (!releases[input.app]?.previous) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, input.app);\n\t\t\t\t}\n\t\t\t\tapps = [input.app];\n\t\t\t} else {\n\t\t\t\tthrow new RollbackNeedsApp(input.stage, restorable);\n\t\t\t}\n\n\t\t\tconst { api } = await dokployApi(workspace, { credentials, signal });\n\t\t\tconst verify = verifySettings(workspace.deploy.dokploy?.verify);\n\t\t\tconst rolled: RolledBack[] = [];\n\n\t\t\tfor (const app of apps) {\n\t\t\t\tsignal.throwIfAborted();\n\t\t\t\tconst { current, previous } = releases[app]!;\n\t\t\t\tconst applicationId = state.applications[app];\n\t\t\t\tif (!previous || !applicationId) {\n\t\t\t\t\tthrow new NothingToRollBack(input.stage, app);\n\t\t\t\t}\n\n\t\t\t\tlog(`⏪ ${app}: ${current.ref} → ${previous.ref}`);\n\t\t\t\tawait restoreImage(api, {\n\t\t\t\t\tapplicationId,\n\t\t\t\t\timage: previous,\n\t\t\t\t\tregistryId: state.registryId,\n\t\t\t\t\tverify,\n\t\t\t\t\tsignal,\n\t\t\t\t});\n\t\t\t\trecordRollback(state, app, previous);\n\t\t\t\tawait journal.save();\n\t\t\t\tlog(`   ✓ ${app} is running ${previous.ref}`);\n\t\t\t\trolled.push({ app, from: current, to: previous });\n\t\t\t}\n\n\t\t\treturn rolled;\n\t\t} finally {\n\t\t\tawait lock.release();\n\t\t}\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,mBAAb,cAAsC,MAAM;CAEjC;CAEA;CAHV,YACC,OAEA,MACC;EACD,MACC,oDAAoD,KAAK,KAAK,IAAI,KAAK,8BAA8B,mCACnE,MAAM,YACzC;EAPS,KAAA,QAAA;EAEA,KAAA,OAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CACA;CAFV,YACC,OACA,KACC;EACD,MACC,IAAI,IAAI,+BAA+B,MAAM,oIAE9C;EANS,KAAA,QAAA;EACA,KAAA,MAAA;EAMT,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,qBAAb,cAAwC,MAAM;CACxB;CAArB,YAAY,OAAwB;EACnC,MACC,IAAI,MAAM,6JAEX;EAJoB,KAAA,QAAA;EAKpB,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,cACrB,OACwB;CACxB,MAAM,SAAS,MAAM,UAAU,IAAI,gBAAgB,CAAC,CAAC;CACrD,MAAM,MAAM,MAAM,cAAc,CAAC;CACjC,MAAM,cAAc,MAAM,eAAeA,oBAAAA,kBAAkB;CAC3D,MAAM,UACL,MAAM,WACN,IAAIC,oBAAAA,aAAa,EAAE,MAAMC,eAAAA,mBAAAA,GAAkBC,UAAAA,QAAAA,CAAQ,MAAM,GAAG,CAAC,EAAE,CAAC;CAEjE,OAAOC,gBAAAA,YAAY,SAAS,YAAY;EACvC,MAAM,EAAE,cAAc,MAAMC,eAAAA,qBAAAA,GAAoBF,UAAAA,QAAAA,CAAQ,MAAM,GAAG,GAAG,EACnE,QACD,CAAC;EACD,kBAAA,oBAAoB,UAAU,QAAQ,MAAM,KAAK;EAEjD,MAAM,QAAQ,MAAMG,gBAAAA,iBAAiB;GACpC,QAAQ,UAAU;GAClB,eAAe,UAAU;GACzB,eAAe,UAAU;EAC1B,CAAC;EACD,IAAI,CAAE,MAAM,MAAM,KAAK,MAAM,KAAK,GACjC,MAAM,IAAI,mBAAmB,MAAM,KAAK;EAGzC,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,OAAO,EAAE,WAAW,WAAW,CAAC;EACpE,IAAI;GACH,MAAM,UAAU,MAAMC,cAAAA,cAAc,KAAK,OAAO,MAAM,aACrDC,cAAAA,iBAAiB,MAAM,OAAO,IAAI,EAAE,CACrC;GACA,MAAM,EAAE,UAAU;GAClB,MAAM,WAAW,MAAM,YAAY,CAAC;GACpC,MAAM,aAAa,OAAO,KAAK,QAAQ,CAAC,CAAC,QACvC,QAAQ,SAAS,IAAI,CAAE,QACzB;GAEA,IAAI;GACJ,IAAI,MAAM,QAAQ;IACjB,OAAO;IACP,IAAI,KAAK,WAAW,GACnB,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAEpD,OAAO,IAAI,MAAM,KAAK;IACrB,IAAI,CAAC,SAAS,MAAM,IAAI,EAAE,UACzB,MAAM,IAAI,kBAAkB,MAAM,OAAO,MAAM,GAAG;IAEnD,OAAO,CAAC,MAAM,GAAG;GAClB,OACC,MAAM,IAAI,iBAAiB,MAAM,OAAO,UAAU;GAGnD,MAAM,EAAE,QAAQ,MAAMC,eAAAA,WAAW,WAAW;IAAE;IAAa;GAAO,CAAC;GACnE,MAAM,SAASC,eAAAA,eAAe,UAAU,OAAO,SAAS,MAAM;GAC9D,MAAM,SAAuB,CAAC;GAE9B,KAAK,MAAM,OAAO,MAAM;IACvB,OAAO,eAAe;IACtB,MAAM,EAAE,SAAS,aAAa,SAAS;IACvC,MAAM,gBAAgB,MAAM,aAAa;IACzC,IAAI,CAAC,YAAY,CAAC,eACjB,MAAM,IAAI,kBAAkB,MAAM,OAAO,GAAG;IAG7C,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,SAAS,KAAK;IAChD,MAAMC,eAAAA,aAAa,KAAK;KACvB;KACA,OAAO;KACP,YAAY,MAAM;KAClB;KACA;IACD,CAAC;IACD,cAAA,eAAe,OAAO,KAAK,QAAQ;IACnC,MAAM,QAAQ,KAAK;IACnB,IAAI,QAAQ,IAAI,cAAc,SAAS,KAAK;IAC5C,OAAO,KAAK;KAAE;KAAK,MAAM;KAAS,IAAI;IAAS,CAAC;GACjD;GAEA,OAAO;EACR,UAAU;GACT,MAAM,KAAK,QAAQ;EACpB;CACD,CAAC;AACF"}

package/dist/{secretsManager-Ti0oZwsS.mjs → secretsManager-Chs9VV2r.mjs}

@@ -1,3 +1,4 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { n as serializeWithin, t as awsClientConfig } from "./awsStore-B529csle.mjs";
 import { CreateSecretCommand, GetSecretValueCommand, PutSecretValueCommand, ResourceNotFoundException, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 //#region src/secrets/secretsManager.ts
@@ -13,6 +14,11 @@ import { CreateSecretCommand, GetSecretValueCommand, PutSecretValueCommand, Reso
 * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's
 * own versioning, at a monthly price per secret.
 */
+var secretsManager_exports = /* @__PURE__ */ __exportAll({
+	SECRETS_MANAGER_SECRET_LIMIT: () => SECRETS_MANAGER_SECRET_LIMIT,
+	SecretsManagerSecretsStore: () => SecretsManagerSecretsStore,
+	secretsManagerSecretName: () => secretsManagerSecretName
+});
 /** The most a Secrets Manager secret holds: 64 KB. */
 const SECRETS_MANAGER_SECRET_LIMIT = 65536;
 /** The secret a stage's secrets are kept in. */
@@ -65,6 +71,6 @@ var SecretsManagerSecretsStore = class {
 	}
 };
 //#endregion
-export { SecretsManagerSecretsStore };
+export { secretsManager_exports as n, secretsManagerSecretName as t };
 
-//# sourceMappingURL=secretsManager-Ti0oZwsS.mjs.map
+//# sourceMappingURL=secretsManager-Chs9VV2r.mjs.map

package/dist/{secretsManager-Ti0oZwsS.mjs.map → secretsManager-Chs9VV2r.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"secretsManager-Ti0oZwsS.mjs","names":[],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await client.send(\n\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAI,qBAAqB,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,OAAO,KACrC,IAAI,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiB,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,IAAI;GACH,MAAM,OAAO,KACZ,IAAI,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAI,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}
+{"version":3,"file":"secretsManager-Chs9VV2r.mjs","names":[],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await client.send(\n\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAI,qBAAqB,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,OAAO,KACrC,IAAI,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiB,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,IAAI;GACH,MAAM,OAAO,KACZ,IAAI,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAI,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}

package/dist/{secretsManager-DUXW3fQt.cjs → secretsManager-DcMlHnRC.cjs}

@@ -1,3 +1,4 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_awsStore = require("./awsStore-7VmS_cZR.cjs");
 let _aws_sdk_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 //#region src/secrets/secretsManager.ts
@@ -13,6 +14,11 @@ let _aws_sdk_client_secrets_manager = require("@aws-sdk/client-secrets-manager")
 * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's
 * own versioning, at a monthly price per secret.
 */
+var secretsManager_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	SECRETS_MANAGER_SECRET_LIMIT: () => SECRETS_MANAGER_SECRET_LIMIT,
+	SecretsManagerSecretsStore: () => SecretsManagerSecretsStore,
+	secretsManagerSecretName: () => secretsManagerSecretName
+});
 /** The most a Secrets Manager secret holds: 64 KB. */
 const SECRETS_MANAGER_SECRET_LIMIT = 65536;
 /** The secret a stage's secrets are kept in. */
@@ -65,6 +71,17 @@ var SecretsManagerSecretsStore = class {
 	}
 };
 //#endregion
-exports.SecretsManagerSecretsStore = SecretsManagerSecretsStore;
+Object.defineProperty(exports, "secretsManagerSecretName", {
+	enumerable: true,
+	get: function() {
+		return secretsManagerSecretName;
+	}
+});
+Object.defineProperty(exports, "secretsManager_exports", {
+	enumerable: true,
+	get: function() {
+		return secretsManager_exports;
+	}
+});
 
-//# sourceMappingURL=secretsManager-DUXW3fQt.cjs.map
+//# sourceMappingURL=secretsManager-DcMlHnRC.cjs.map

package/dist/{secretsManager-DUXW3fQt.cjs.map → secretsManager-DcMlHnRC.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"secretsManager-DUXW3fQt.cjs","names":["SecretsManagerClient","awsClientConfig","GetSecretValueCommand","ResourceNotFoundException","serializeWithin","PutSecretValueCommand","CreateSecretCommand"],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await client.send(\n\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAkCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAIA,gCAAAA,qBAAqB,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,OAAO,KACrC,IAAIC,gCAAAA,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiBC,gCAAAA,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQC,iBAAAA,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,IAAI;GACH,MAAM,OAAO,KACZ,IAAIC,gCAAAA,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiBF,gCAAAA,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAIG,gCAAAA,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}
+{"version":3,"file":"secretsManager-DcMlHnRC.cjs","names":["SecretsManagerClient","awsClientConfig","GetSecretValueCommand","ResourceNotFoundException","serializeWithin","PutSecretValueCommand","CreateSecretCommand"],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await client.send(\n\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAIA,gCAAAA,qBAAqB,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,OAAO,KACrC,IAAIC,gCAAAA,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiBC,gCAAAA,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQC,iBAAAA,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,IAAI;GACH,MAAM,OAAO,KACZ,IAAIC,gCAAAA,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiBF,gCAAAA,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAIG,gCAAAA,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}