@geekmidas/cli 10.0.0-alpha.9 → 10.0.0-alpha.90

package/dist/sst-CJzvyrEz.mjs

@@ -0,0 +1,430 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { i as CommandFailed, t as MissingCredential } from "./credentials-CnVqoXMb.mjs";
+import { i as activeSandbox } from "./sandbox-Dm247NGx.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { t as defineTarget } from "./define-DR8xGYfL.mjs";
+import { t as LocalSandbox } from "./local-IuoIF3CT.mjs";
+import { n as detectPackageManager } from "./utils-D_fxUqvU.mjs";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile, rm } from "node:fs/promises";
+import { kebabCase } from "@geekmidas/manifest";
+//#region src/target/sst/health.ts
+/** Surfaces that never answered healthy. */
+var SurfacesUnhealthy = class extends Error {
+	stage;
+	surfaces;
+	constructor(stage, surfaces) {
+		const lines = surfaces.map(({ app, url, status, error }) => `  - ${app}: ${url} → ${status ?? error ?? "no answer"}`);
+		super(`The "${stage}" stage was deployed, but ${surfaces.length === 1 ? "a surface does" : "surfaces do"} not answer healthy:\n${lines.join("\n")}\nCheck its logs in CloudWatch, fix it, and deploy again.`);
+		this.stage = stage;
+		this.surfaces = surfaces;
+		this.name = "SurfacesUnhealthy";
+	}
+};
+/** `path` under `base`, keeping any path `base` already has. */
+function healthUrl(base, path) {
+	const root = base.endsWith("/") ? base : `${base}/`;
+	return new URL(path.replace(/^\//, ""), root).toString();
+}
+/**
+* Ask `url` until it answers 2xx or the attempts run out, emitting
+* `health.checked` for each. Resolves with the last answer.
+*/
+async function checkHealth(app, url, options) {
+	let last = { healthy: false };
+	for (let attempt = 1; attempt <= options.attempts; attempt++) {
+		options.signal.throwIfAborted();
+		try {
+			const response = await fetch(url, {
+				redirect: "follow",
+				signal: AbortSignal.any([options.signal, AbortSignal.timeout(options.timeoutMs)])
+			});
+			await response.arrayBuffer().catch(() => void 0);
+			last = {
+				healthy: response.ok,
+				status: response.status
+			};
+		} catch (error) {
+			options.signal.throwIfAborted();
+			last = {
+				healthy: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+		options.emit({
+			type: "health.checked",
+			app,
+			url,
+			healthy: last.healthy,
+			...last.status !== void 0 ? { status: last.status } : {},
+			attempt
+		});
+		if (last.healthy) return last;
+		if (attempt < options.attempts) await wait(options.delayMs, options.signal);
+	}
+	return last;
+}
+function wait(ms, signal) {
+	if (ms <= 0) return Promise.resolve();
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => {
+			signal.removeEventListener("abort", stop);
+			resolve();
+		}, ms);
+		const stop = () => {
+			clearTimeout(timer);
+			reject(signal.reason);
+		};
+		signal.addEventListener("abort", stop, { once: true });
+	});
+}
+//#endregion
+//#region src/target/sst/outputs.ts
+/**
+* The surface URLs an `sst deploy` reports.
+*
+* SST writes whatever `run()` in `sst.config.ts` returns to
+* `.sst/outputs.json` after every successful deploy — `{"Api": "https://…"}`.
+* What `run()` returns is the project's to write, so this reads it leniently:
+* nested objects are walked, anything that is not an http(s) URL is ignored,
+* and an output names a surface by its id in any casing, with or without a
+* `Url` suffix (`Api`, `api`, `ApiUrl`, `API_URL`, `Api.url`).
+*/
+/** Where SST leaves the last successful deploy's outputs, under the project. */
+const SST_OUTPUTS_FILE = join(".sst", "outputs.json");
+/** `.sst/outputs.json` is there, and is not JSON. */
+var SstOutputsUnreadable = class extends Error {
+	path;
+	reason;
+	constructor(path, reason) {
+		super(`Could not read SST's outputs at ${path}: ${reason}. It is rewritten by every successful \`sst deploy\`; delete it and deploy again.`);
+		this.path = path;
+		this.reason = reason;
+		this.name = "SstOutputsUnreadable";
+	}
+};
+/**
+* Remove what an earlier deploy wrote, so the outputs read after this one
+* are this one's — not another stage's, deployed from the same checkout.
+*/
+async function clearOutputs(cwd) {
+	await rm(join(cwd, SST_OUTPUTS_FILE), { force: true });
+}
+/** The deploy's outputs, or `{}` when it wrote none. */
+async function readOutputs(cwd) {
+	const path = join(cwd, SST_OUTPUTS_FILE);
+	if (!existsSync(path)) return {};
+	try {
+		return JSON.parse(await readFile(path, "utf8"));
+	} catch (error) {
+		throw new SstOutputsUnreadable(path, error instanceof Error ? error.message : String(error));
+	}
+}
+/** Every http(s) URL in `outputs`, by its key path: `['Api', 'url']`. */
+function urlsIn(value, path = [], found = []) {
+	if (typeof value === "string") {
+		if (isHttpUrl(value)) found.push({
+			path,
+			url: value
+		});
+	} else if (value && typeof value === "object" && !Array.isArray(value)) for (const [key, child] of Object.entries(value)) urlsIn(child, [...path, key], found);
+	return found;
+}
+function isHttpUrl(value) {
+	try {
+		const { protocol } = new URL(value);
+		return protocol === "http:" || protocol === "https:";
+	} catch {
+		return false;
+	}
+}
+/**
+* The app an output's key path names, kebab-cased as app keys are: its last
+* segment, without a `url` suffix — or its parent's, when the last segment
+* is only `url`. Exact names are tried first, so an app called `api-url`
+* still finds `ApiUrl`.
+*/
+function namesOf(path) {
+	const names = [];
+	for (const segment of [...path].reverse()) {
+		const name = kebabCase(segment);
+		names.push(name);
+		const bare = name.replace(/-?url$/, "");
+		if (bare) {
+			names.push(bare);
+			break;
+		}
+	}
+	return names;
+}
+/**
+* Each app's URL from the outputs, for the apps given. An app no output
+* names is left out.
+*/
+function surfaceUrls(outputs, apps) {
+	const found = urlsIn(outputs);
+	const urls = {};
+	for (const app of apps) {
+		const exact = found.find(({ path }) => namesOf(path)[0] === app);
+		const loose = found.find(({ path }) => namesOf(path).includes(app));
+		const match = exact ?? loose;
+		if (match) urls[app] = match.url;
+	}
+	return urls;
+}
+//#endregion
+//#region src/target/sst/index.ts
+/**
+* The built-in `sst` target: `gkm build` writes the manifest, `sst deploy`
+* provisions it, and the surfaces SST reports are health-checked.
+*
+* `@geekmidas/cloud` is unchanged by it: `sst.config.ts` still reads
+* `.gkm/manifest/aws.ts` and `fromManifest` still makes every resource. What
+* the target adds is the run around the two commands — the lock, the events,
+* verification, and credentials kept where they belong.
+*
+* Both commands run in the sandbox: the build executes the project's code,
+* and so does `sst deploy`, which evaluates `sst.config.ts`. Only the second
+* needs AWS, so the AWS credential goes into that one command's environment
+* and nowhere else — not the build's, not the process the deploy runs in.
+* What `sst deploy` needs beyond them, the sandbox already passes: `PATH`
+* for node and the package manager, and `HOME`, under which SST keeps its
+* toolchain (`~/.config/sst`: bun, pulumi and its plugins) and the AWS SDK
+* finds `~/.aws` for a profile. Its state — the Pulumi backend and the
+* passphrase — is in the stage's own account, reached with that credential.
+*/
+var sst_exports = /* @__PURE__ */ __exportAll({
+	SstConfigNotFound: () => SstConfigNotFound,
+	awsEnv: () => awsEnv,
+	createSstTarget: () => createSstTarget,
+	projectCommand: () => projectCommand,
+	sstTarget: () => sstTarget
+});
+/** A cold build of every handler and site. */
+const BUILD_TIMEOUT_MS = 18e5;
+/**
+* A first deploy creates CloudFront distributions and, with a database, a
+* VPC and an RDS instance — each of which alone can take a quarter of an hour.
+*/
+const DEPLOY_TIMEOUT_MS = 54e5;
+/** The workspace has no `sst.config.ts` for `sst deploy` to run. */
+var SstConfigNotFound = class extends Error {
+	cwd;
+	constructor(cwd) {
+		super(`No sst.config.ts in ${cwd}. The sst target runs \`sst deploy\` at the workspace root: scaffold one with \`gkm init --deploy sst\` and copy its sst.config.ts, or deploy through another target with --target.`);
+		this.cwd = cwd;
+		this.name = "SstConfigNotFound";
+	}
+};
+/**
+* The project's own copy of `bin`, through its package manager — never one
+* `npx` would download, which would be code nobody installed.
+*/
+function projectCommand(pm, bin, args) {
+	switch (pm) {
+		case "pnpm": return ["pnpm", [
+			"exec",
+			bin,
+			...args
+		]];
+		case "yarn": return ["yarn", [bin, ...args]];
+		case "bun": return ["bunx", [bin, ...args]];
+		case "npm": return ["npx", [
+			"--no-install",
+			bin,
+			...args
+		]];
+	}
+}
+/**
+* The variables `credential` is to the AWS SDK and to SST.
+*
+* A profile is passed alone: given keys too, every SDK would take the keys.
+*/
+function awsEnv(credential) {
+	const region = credential.region ? {
+		AWS_REGION: credential.region,
+		AWS_DEFAULT_REGION: credential.region
+	} : {};
+	if ("profile" in credential) return {
+		AWS_PROFILE: credential.profile,
+		...region
+	};
+	return {
+		AWS_ACCESS_KEY_ID: credential.accessKeyId,
+		AWS_SECRET_ACCESS_KEY: credential.secretAccessKey,
+		...credential.sessionToken ? { AWS_SESSION_TOKEN: credential.sessionToken } : {},
+		...region
+	};
+}
+/**
+* `env` without any `AWS_*`, so a host sandbox that passes some cannot put
+* a second account beside the one the credential names.
+*/
+function withoutAws(env) {
+	return Object.fromEntries(Object.entries(env).filter(([name]) => !name.startsWith("AWS_")));
+}
+/** Each app's kind in the manifest, by app key: `rest-api` or `site`. */
+function kindsOf(manifest) {
+	return new Map(Object.entries(manifest).map(([id, declaration]) => [appKey(id), declaration.kind]));
+}
+async function exec(ctx, run, [command, args], options) {
+	const result = await run.sandbox.exec(command, args, {
+		cwd: ctx.cwd,
+		env: options.env,
+		timeoutMs: options.timeoutMs,
+		output: ctx.childOutput,
+		signal: ctx.signal
+	});
+	if (result.exitCode !== 0) throw new CommandFailed(command, args, result.exitCode, result.signal);
+}
+/** The `sst` target, with its health checks tuned — for tests and hosts. */
+function createSstTarget(options = {}) {
+	const health = {
+		attempts: options.health?.attempts ?? 6,
+		delayMs: options.health?.delayMs ?? 5e3,
+		timeoutMs: options.health?.timeoutMs ?? 1e4
+	};
+	return defineTarget({
+		name: "sst",
+		runtime: "aws",
+		capabilities: {
+			rollback: false,
+			migrations: "target",
+			images: false
+		},
+		credentials: ["aws"],
+		async validate(ctx) {
+			if (!existsSync(join(ctx.cwd, "sst.config.ts"))) throw new SstConfigNotFound(ctx.cwd);
+			const aws = await ctx.credentials.get({
+				kind: "aws",
+				stage: ctx.stage
+			}, { signal: ctx.signal });
+			if (!aws) throw new MissingCredential("aws", ctx.stage);
+			if (!("profile" in aws)) {
+				ctx.secrets.mask(aws.secretAccessKey);
+				if (aws.sessionToken) ctx.secrets.mask(aws.sessionToken);
+			}
+			for (const app of ctx.apps) if (ctx.workspace.apps[app]?.type === "mobile") ctx.skip(app, "mobile apps deploy through their own toolchain");
+			const skipped = new Set(ctx.skipped.map(({ app }) => app));
+			const apps = ctx.apps.filter((app) => !skipped.has(app));
+			ctx.logger.info(`\n🚀 Deploying "${ctx.workspace.name}" to the "${ctx.stage}" stage with SST`);
+			ctx.logger.info(`   AWS: ${"profile" in aws ? `profile "${aws.profile}"` : "access keys"}`);
+			const deployable = Object.values(ctx.workspace.apps).filter((app) => app.type !== "mobile").length;
+			if (apps.length < deployable) ctx.logger.warn(`   sst deploy deploys every construct of the stage, not only ${apps.join(", ")}.`);
+			return {
+				sandbox: activeSandbox() ?? new LocalSandbox({ root: ctx.cwd }),
+				pm: detectPackageManager(ctx.cwd),
+				aws,
+				apps,
+				urls: {}
+			};
+		},
+		async plan(ctx, run) {
+			const kinds = kindsOf(ctx.manifest);
+			for (const app of run.apps) ctx.emit({
+				type: "resource.planned",
+				key: `application:${app}`,
+				resourceType: kinds.get(app) ?? "application",
+				action: "ensure"
+			});
+			const [build, buildArgs] = buildCommand(ctx, run);
+			const [deploy, deployArgs] = deployCommand(ctx, run);
+			ctx.logger.info(`   Would run: ${[build, ...buildArgs].join(" ")}`);
+			ctx.logger.info(`   Would run: ${[deploy, ...deployArgs].join(" ")}`);
+		},
+		async build(ctx, run) {
+			ctx.logger.info("\n📦 Building the manifest SST deploys");
+			await exec(ctx, run, buildCommand(ctx, run), {
+				env: { ...run.sandbox.env },
+				timeoutMs: BUILD_TIMEOUT_MS
+			});
+		},
+		async release(ctx, run) {
+			ctx.logger.info(`\n☁️  sst deploy --stage ${ctx.stage}`);
+			await clearOutputs(ctx.cwd);
+			await exec(ctx, run, deployCommand(ctx, run), {
+				env: {
+					...withoutAws(run.sandbox.env),
+					...awsEnv(run.aws)
+				},
+				timeoutMs: DEPLOY_TIMEOUT_MS
+			});
+			run.urls = surfaceUrls(await readOutputs(ctx.cwd), run.apps);
+			for (const app of run.apps) ctx.emit({
+				type: "app.deployed",
+				app,
+				applicationId: ctx.name(app),
+				imageRef: "",
+				url: run.urls[app] ?? ""
+			});
+		},
+		async verify(ctx, run) {
+			const unhealthy = [];
+			for (const app of run.apps) {
+				const base = run.urls[app];
+				if (!base) {
+					ctx.logger.warn(`   ⚠ No URL for ${app} in SST's outputs, so it was not checked. Return it from run() in sst.config.ts — { ${app}: <its url> } — to have it checked.`);
+					continue;
+				}
+				const url = healthUrl(base, ctx.workspace.apps[app]?.type === "backend" ? "/health" : "/");
+				const answer = await checkHealth(app, url, {
+					...health,
+					signal: ctx.signal,
+					emit: ctx.emit
+				});
+				if (answer.healthy) ctx.logger.info(`   ✓ ${app}: ${url}`);
+				else unhealthy.push({
+					app,
+					url,
+					...answer.status !== void 0 ? { status: answer.status } : {},
+					...answer.error ? { error: answer.error } : {}
+				});
+			}
+			if (unhealthy.length > 0) throw new SurfacesUnhealthy(ctx.stage, unhealthy);
+		},
+		result(ctx, run) {
+			return {
+				apps: run.apps.map((appName) => ({
+					appName,
+					type: ctx.workspace.apps[appName]?.type ?? "backend",
+					success: true,
+					...run.urls[appName] ? { url: run.urls[appName] } : {}
+				})),
+				projectId: "",
+				environmentId: "",
+				successCount: ctx.dryRun ? 0 : run.apps.length,
+				failedCount: 0,
+				stage: ctx.stage,
+				identity: ctx.identity.key,
+				tag: ctx.tag,
+				dryRun: ctx.dryRun,
+				skipped: [...ctx.skipped],
+				urls: { ...run.urls },
+				changes: []
+			};
+		}
+	});
+}
+function buildCommand(ctx, run) {
+	return projectCommand(run.pm, "gkm", [
+		"build",
+		"--provider",
+		"aws",
+		"--stage",
+		ctx.stage
+	]);
+}
+function deployCommand(ctx, run) {
+	return projectCommand(run.pm, "sst", [
+		"deploy",
+		"--stage",
+		ctx.stage
+	]);
+}
+const sstTarget = createSstTarget();
+//#endregion
+export { SurfacesUnhealthy as i, sst_exports as n, SstOutputsUnreadable as r, SstConfigNotFound as t };
+
+//# sourceMappingURL=sst-CJzvyrEz.mjs.map

package/dist/sst-CJzvyrEz.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sst-CJzvyrEz.mjs","names":[],"sources":["../src/target/sst/health.ts","../src/target/sst/outputs.ts","../src/target/sst/index.ts"],"sourcesContent":["/**\n * Whether a released surface answers.\n *\n * The paths are the ones the local stack's healthchecks use\n * (`reconcile/apps.ts`): an API's `/health`, a site's `/`. A surface is\n * asked a few times, because a fresh deploy can take a moment to answer — a\n * Lambda's first start, a distribution still settling — and healthy means a\n * 2xx, after redirects.\n */\n\nimport type { TargetEvent } from '../types';\n\nexport interface HealthCheckOptions {\n\t/** How many times a surface is asked before it counts as down. */\n\tattempts: number;\n\t/** The wait between two attempts. */\n\tdelayMs: number;\n\t/** How long one request may take. */\n\ttimeoutMs: number;\n\tsignal: AbortSignal;\n\temit: (event: TargetEvent) => void;\n}\n\n/** Surfaces that never answered healthy. */\nexport class SurfacesUnhealthy extends Error {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** Each surface that failed, with the last thing it answered. */\n\t\treadonly surfaces: readonly {\n\t\t\tapp: string;\n\t\t\turl: string;\n\t\t\tstatus?: number;\n\t\t\terror?: string;\n\t\t}[],\n\t) {\n\t\tconst lines = surfaces.map(\n\t\t\t({ app, url, status, error }) =>\n\t\t\t\t`  - ${app}: ${url} → ${status ?? error ?? 'no answer'}`,\n\t\t);\n\t\tsuper(\n\t\t\t`The \"${stage}\" stage was deployed, but ${surfaces.length === 1 ? 'a surface does' : 'surfaces do'} not answer healthy:\\n${lines.join('\\n')}\\nCheck its logs in CloudWatch, fix it, and deploy again.`,\n\t\t);\n\t\tthis.name = 'SurfacesUnhealthy';\n\t}\n}\n\n/** `path` under `base`, keeping any path `base` already has. */\nexport function healthUrl(base: string, path: string): string {\n\tconst root = base.endsWith('/') ? base : `${base}/`;\n\treturn new URL(path.replace(/^\\//, ''), root).toString();\n}\n\n/**\n * Ask `url` until it answers 2xx or the attempts run out, emitting\n * `health.checked` for each. Resolves with the last answer.\n */\nexport async function checkHealth(\n\tapp: string,\n\turl: string,\n\toptions: HealthCheckOptions,\n): Promise<{ healthy: boolean; status?: number; error?: string }> {\n\tlet last: { healthy: boolean; status?: number; error?: string } = {\n\t\thealthy: false,\n\t};\n\tfor (let attempt = 1; attempt <= options.attempts; attempt++) {\n\t\toptions.signal.throwIfAborted();\n\t\ttry {\n\t\t\tconst response = await fetch(url, {\n\t\t\t\tredirect: 'follow',\n\t\t\t\tsignal: AbortSignal.any([\n\t\t\t\t\toptions.signal,\n\t\t\t\t\tAbortSignal.timeout(options.timeoutMs),\n\t\t\t\t]),\n\t\t\t});\n\t\t\t// Drained, so the connection is not held open by an unread body.\n\t\t\tawait response.arrayBuffer().catch(() => undefined);\n\t\t\tlast = { healthy: response.ok, status: response.status };\n\t\t} catch (error) {\n\t\t\t// The run being stopped is not the surface being down.\n\t\t\toptions.signal.throwIfAborted();\n\t\t\tlast = {\n\t\t\t\thealthy: false,\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t};\n\t\t}\n\t\toptions.emit({\n\t\t\ttype: 'health.checked',\n\t\t\tapp,\n\t\t\turl,\n\t\t\thealthy: last.healthy,\n\t\t\t...(last.status !== undefined ? { status: last.status } : {}),\n\t\t\tattempt,\n\t\t});\n\t\tif (last.healthy) return last;\n\t\tif (attempt < options.attempts) await wait(options.delayMs, options.signal);\n\t}\n\treturn last;\n}\n\nfunction wait(ms: number, signal: AbortSignal): Promise<void> {\n\tif (ms <= 0) return Promise.resolve();\n\treturn new Promise((resolve, reject) => {\n\t\tconst timer = setTimeout(() => {\n\t\t\tsignal.removeEventListener('abort', stop);\n\t\t\tresolve();\n\t\t}, ms);\n\t\tconst stop = () => {\n\t\t\tclearTimeout(timer);\n\t\t\treject(signal.reason);\n\t\t};\n\t\tsignal.addEventListener('abort', stop, { once: true });\n\t});\n}\n","/**\n * The surface URLs an `sst deploy` reports.\n *\n * SST writes whatever `run()` in `sst.config.ts` returns to\n * `.sst/outputs.json` after every successful deploy — `{\"Api\": \"https://…\"}`.\n * What `run()` returns is the project's to write, so this reads it leniently:\n * nested objects are walked, anything that is not an http(s) URL is ignored,\n * and an output names a surface by its id in any casing, with or without a\n * `Url` suffix (`Api`, `api`, `ApiUrl`, `API_URL`, `Api.url`).\n */\n\nimport { existsSync } from 'node:fs';\nimport { readFile, rm } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { kebabCase } from '@geekmidas/manifest';\n\n/** Where SST leaves the last successful deploy's outputs, under the project. */\nexport const SST_OUTPUTS_FILE = join('.sst', 'outputs.json');\n\n/** `.sst/outputs.json` is there, and is not JSON. */\nexport class SstOutputsUnreadable extends Error {\n\tconstructor(\n\t\treadonly path: string,\n\t\treadonly reason: string,\n\t) {\n\t\tsuper(\n\t\t\t`Could not read SST's outputs at ${path}: ${reason}. It is rewritten by every successful \\`sst deploy\\`; delete it and deploy again.`,\n\t\t);\n\t\tthis.name = 'SstOutputsUnreadable';\n\t}\n}\n\n/**\n * Remove what an earlier deploy wrote, so the outputs read after this one\n * are this one's — not another stage's, deployed from the same checkout.\n */\nexport async function clearOutputs(cwd: string): Promise<void> {\n\tawait rm(join(cwd, SST_OUTPUTS_FILE), { force: true });\n}\n\n/** The deploy's outputs, or `{}` when it wrote none. */\nexport async function readOutputs(cwd: string): Promise<unknown> {\n\tconst path = join(cwd, SST_OUTPUTS_FILE);\n\tif (!existsSync(path)) return {};\n\ttry {\n\t\treturn JSON.parse(await readFile(path, 'utf8'));\n\t} catch (error) {\n\t\tthrow new SstOutputsUnreadable(\n\t\t\tpath,\n\t\t\terror instanceof Error ? error.message : String(error),\n\t\t);\n\t}\n}\n\n/** Every http(s) URL in `outputs`, by its key path: `['Api', 'url']`. */\nfunction urlsIn(\n\tvalue: unknown,\n\tpath: string[] = [],\n\tfound: { path: string[]; url: string }[] = [],\n): { path: string[]; url: string }[] {\n\tif (typeof value === 'string') {\n\t\tif (isHttpUrl(value)) found.push({ path, url: value });\n\t} else if (value && typeof value === 'object' && !Array.isArray(value)) {\n\t\tfor (const [key, child] of Object.entries(value)) {\n\t\t\turlsIn(child, [...path, key], found);\n\t\t}\n\t}\n\treturn found;\n}\n\nfunction isHttpUrl(value: string): boolean {\n\ttry {\n\t\tconst { protocol } = new URL(value);\n\t\treturn protocol === 'http:' || protocol === 'https:';\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * The app an output's key path names, kebab-cased as app keys are: its last\n * segment, without a `url` suffix — or its parent's, when the last segment\n * is only `url`. Exact names are tried first, so an app called `api-url`\n * still finds `ApiUrl`.\n */\nfunction namesOf(path: string[]): string[] {\n\tconst names: string[] = [];\n\tfor (const segment of [...path].reverse()) {\n\t\tconst name = kebabCase(segment);\n\t\tnames.push(name);\n\t\tconst bare = name.replace(/-?url$/, '');\n\t\tif (bare) {\n\t\t\tnames.push(bare);\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn names;\n}\n\n/**\n * Each app's URL from the outputs, for the apps given. An app no output\n * names is left out.\n */\nexport function surfaceUrls(\n\toutputs: unknown,\n\tapps: readonly string[],\n): Record<string, string> {\n\tconst found = urlsIn(outputs);\n\tconst urls: Record<string, string> = {};\n\tfor (const app of apps) {\n\t\t// An exact name beats a stripped one, wherever each is in the file.\n\t\tconst exact = found.find(({ path }) => namesOf(path)[0] === app);\n\t\tconst loose = found.find(({ path }) => namesOf(path).includes(app));\n\t\tconst match = exact ?? loose;\n\t\tif (match) urls[app] = match.url;\n\t}\n\treturn urls;\n}\n","/**\n * The built-in `sst` target: `gkm build` writes the manifest, `sst deploy`\n * provisions it, and the surfaces SST reports are health-checked.\n *\n * `@geekmidas/cloud` is unchanged by it: `sst.config.ts` still reads\n * `.gkm/manifest/aws.ts` and `fromManifest` still makes every resource. What\n * the target adds is the run around the two commands — the lock, the events,\n * verification, and credentials kept where they belong.\n *\n * Both commands run in the sandbox: the build executes the project's code,\n * and so does `sst deploy`, which evaluates `sst.config.ts`. Only the second\n * needs AWS, so the AWS credential goes into that one command's environment\n * and nowhere else — not the build's, not the process the deploy runs in.\n * What `sst deploy` needs beyond them, the sandbox already passes: `PATH`\n * for node and the package manager, and `HOME`, under which SST keeps its\n * toolchain (`~/.config/sst`: bun, pulumi and its plugins) and the AWS SDK\n * finds `~/.aws` for a profile. Its state — the Pulumi backend and the\n * passphrase — is in the stage's own account, reached with that credential.\n */\n\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype AwsCredential,\n\tMissingCredential,\n} from '../../deploy/credentials';\nimport type { DeployResult } from '../../deploy/types';\nimport { detectPackageManager, type PackageManager } from '../../init/utils';\nimport { CommandFailed } from '../../run';\nimport { LocalSandbox } from '../../sandbox/local';\nimport { activeSandbox, type Sandbox } from '../../sandbox/sandbox';\nimport { appKey } from '../../workspace/derive';\nimport { defineTarget } from '../define';\nimport type { DeployPhaseContext, DeployTarget } from '../types';\nimport { checkHealth, healthUrl, SurfacesUnhealthy } from './health';\nimport { clearOutputs, readOutputs, surfaceUrls } from './outputs';\n\nexport { SurfacesUnhealthy } from './health';\nexport { SST_OUTPUTS_FILE, SstOutputsUnreadable } from './outputs';\n\n/** A cold build of every handler and site. */\nconst BUILD_TIMEOUT_MS = 30 * 60_000;\n/**\n * A first deploy creates CloudFront distributions and, with a database, a\n * VPC and an RDS instance — each of which alone can take a quarter of an hour.\n */\nconst DEPLOY_TIMEOUT_MS = 90 * 60_000;\n\n/** The workspace has no `sst.config.ts` for `sst deploy` to run. */\nexport class SstConfigNotFound extends Error {\n\tconstructor(readonly cwd: string) {\n\t\tsuper(\n\t\t\t`No sst.config.ts in ${cwd}. The sst target runs \\`sst deploy\\` at the workspace root: scaffold one with \\`gkm init --deploy sst\\` and copy its sst.config.ts, or deploy through another target with --target.`,\n\t\t);\n\t\tthis.name = 'SstConfigNotFound';\n\t}\n}\n\n/** What the phases hand on. */\nexport interface SstRun {\n\tsandbox: Sandbox;\n\tpm: PackageManager;\n\taws: AwsCredential;\n\t/** The apps SST deploys this run: `ctx.apps` without the skipped. */\n\tapps: string[];\n\t/** Each app's URL, from the deploy's outputs. */\n\turls: Record<string, string>;\n}\n\nexport interface SstTargetOptions {\n\t/** How often, and how patiently, `verify` asks each surface. */\n\thealth?: { attempts?: number; delayMs?: number; timeoutMs?: number };\n}\n\n/**\n * The project's own copy of `bin`, through its package manager — never one\n * `npx` would download, which would be code nobody installed.\n */\nexport function projectCommand(\n\tpm: PackageManager,\n\tbin: string,\n\targs: readonly string[],\n): [command: string, args: string[]] {\n\tswitch (pm) {\n\t\tcase 'pnpm':\n\t\t\treturn ['pnpm', ['exec', bin, ...args]];\n\t\tcase 'yarn':\n\t\t\treturn ['yarn', [bin, ...args]];\n\t\tcase 'bun':\n\t\t\treturn ['bunx', [bin, ...args]];\n\t\tcase 'npm':\n\t\t\treturn ['npx', ['--no-install', bin, ...args]];\n\t}\n}\n\n/**\n * The variables `credential` is to the AWS SDK and to SST.\n *\n * A profile is passed alone: given keys too, every SDK would take the keys.\n */\nexport function awsEnv(credential: AwsCredential): Record<string, string> {\n\tconst region: Record<string, string> = credential.region\n\t\t? { AWS_REGION: credential.region, AWS_DEFAULT_REGION: credential.region }\n\t\t: {};\n\tif ('profile' in credential) {\n\t\treturn { AWS_PROFILE: credential.profile, ...region };\n\t}\n\treturn {\n\t\tAWS_ACCESS_KEY_ID: credential.accessKeyId,\n\t\tAWS_SECRET_ACCESS_KEY: credential.secretAccessKey,\n\t\t...(credential.sessionToken\n\t\t\t? { AWS_SESSION_TOKEN: credential.sessionToken }\n\t\t\t: {}),\n\t\t...region,\n\t};\n}\n\n/**\n * `env` without any `AWS_*`, so a host sandbox that passes some cannot put\n * a second account beside the one the credential names.\n */\nfunction withoutAws(\n\tenv: Readonly<Record<string, string>>,\n): Record<string, string> {\n\treturn Object.fromEntries(\n\t\tObject.entries(env).filter(([name]) => !name.startsWith('AWS_')),\n\t);\n}\n\n/** Each app's kind in the manifest, by app key: `rest-api` or `site`. */\nfunction kindsOf(manifest: ConstructManifest): Map<string, string> {\n\treturn new Map(\n\t\tObject.entries(manifest).map(([id, declaration]) => [\n\t\t\tappKey(id),\n\t\t\tdeclaration.kind,\n\t\t]),\n\t);\n}\n\nasync function exec(\n\tctx: DeployPhaseContext<unknown>,\n\trun: SstRun,\n\t[command, args]: [string, string[]],\n\toptions: { env: Record<string, string>; timeoutMs: number },\n): Promise<void> {\n\tconst result = await run.sandbox.exec(command, args, {\n\t\tcwd: ctx.cwd,\n\t\tenv: options.env,\n\t\ttimeoutMs: options.timeoutMs,\n\t\toutput: ctx.childOutput,\n\t\tsignal: ctx.signal,\n\t});\n\tif (result.exitCode !== 0) {\n\t\tthrow new CommandFailed(\n\t\t\tcommand,\n\t\t\targs,\n\t\t\tresult.exitCode,\n\t\t\tresult.signal as NodeJS.Signals | null,\n\t\t);\n\t}\n}\n\n/** The `sst` target, with its health checks tuned — for tests and hosts. */\nexport function createSstTarget(\n\toptions: SstTargetOptions = {},\n): DeployTarget<undefined, SstRun> {\n\tconst health = {\n\t\tattempts: options.health?.attempts ?? 6,\n\t\tdelayMs: options.health?.delayMs ?? 5_000,\n\t\ttimeoutMs: options.health?.timeoutMs ?? 10_000,\n\t};\n\n\treturn defineTarget<undefined, SstRun>({\n\t\tname: 'sst',\n\t\truntime: 'aws',\n\t\t// SST keeps no previous release to return to; migrations run in the\n\t\t// stack, as `fromManifest` provisions the database; and nothing here\n\t\t// builds an image.\n\t\tcapabilities: { rollback: false, migrations: 'target', images: false },\n\t\tcredentials: ['aws'],\n\n\t\tasync validate(ctx) {\n\t\t\tif (!existsSync(join(ctx.cwd, 'sst.config.ts'))) {\n\t\t\t\tthrow new SstConfigNotFound(ctx.cwd);\n\t\t\t}\n\n\t\t\tconst aws = await ctx.credentials.get(\n\t\t\t\t{ kind: 'aws', stage: ctx.stage },\n\t\t\t\t{ signal: ctx.signal },\n\t\t\t);\n\t\t\tif (!aws) throw new MissingCredential('aws', ctx.stage);\n\t\t\tif (!('profile' in aws)) {\n\t\t\t\tctx.secrets.mask(aws.secretAccessKey);\n\t\t\t\tif (aws.sessionToken) ctx.secrets.mask(aws.sessionToken);\n\t\t\t}\n\n\t\t\t// A mobile app ships through its own store's toolchain.\n\t\t\tfor (const app of ctx.apps) {\n\t\t\t\tif (ctx.workspace.apps[app]?.type === 'mobile') {\n\t\t\t\t\tctx.skip(app, 'mobile apps deploy through their own toolchain');\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst skipped = new Set(ctx.skipped.map(({ app }) => app));\n\t\t\tconst apps = ctx.apps.filter((app) => !skipped.has(app));\n\n\t\t\tctx.logger.info(\n\t\t\t\t`\\n🚀 Deploying \"${ctx.workspace.name}\" to the \"${ctx.stage}\" stage with SST`,\n\t\t\t);\n\t\t\tctx.logger.info(\n\t\t\t\t`   AWS: ${'profile' in aws ? `profile \"${aws.profile}\"` : 'access keys'}`,\n\t\t\t);\n\t\t\t// `sst deploy` takes the whole stack: there is no deploying one app.\n\t\t\tconst deployable = Object.values(ctx.workspace.apps).filter(\n\t\t\t\t(app) => app.type !== 'mobile',\n\t\t\t).length;\n\t\t\tif (apps.length < deployable) {\n\t\t\t\tctx.logger.warn(\n\t\t\t\t\t`   sst deploy deploys every construct of the stage, not only ${apps.join(', ')}.`,\n\t\t\t\t);\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tsandbox: activeSandbox() ?? new LocalSandbox({ root: ctx.cwd }),\n\t\t\t\tpm: detectPackageManager(ctx.cwd),\n\t\t\t\taws,\n\t\t\t\tapps,\n\t\t\t\turls: {},\n\t\t\t};\n\t\t},\n\n\t\tasync plan(ctx, run) {\n\t\t\tconst kinds = kindsOf(ctx.manifest);\n\t\t\tfor (const app of run.apps) {\n\t\t\t\tctx.emit({\n\t\t\t\t\ttype: 'resource.planned',\n\t\t\t\t\tkey: `application:${app}`,\n\t\t\t\t\tresourceType: kinds.get(app) ?? 'application',\n\t\t\t\t\taction: 'ensure',\n\t\t\t\t});\n\t\t\t}\n\t\t\tconst [build, buildArgs] = buildCommand(ctx, run);\n\t\t\tconst [deploy, deployArgs] = deployCommand(ctx, run);\n\t\t\tctx.logger.info(`   Would run: ${[build, ...buildArgs].join(' ')}`);\n\t\t\tctx.logger.info(`   Would run: ${[deploy, ...deployArgs].join(' ')}`);\n\t\t},\n\n\t\tasync build(ctx, run) {\n\t\t\tctx.logger.info('\\n📦 Building the manifest SST deploys');\n\t\t\t// No credential: the build runs the project's code and needs none.\n\t\t\tawait exec(ctx, run, buildCommand(ctx, run), {\n\t\t\t\tenv: { ...run.sandbox.env },\n\t\t\t\ttimeoutMs: BUILD_TIMEOUT_MS,\n\t\t\t});\n\t\t},\n\n\t\tasync release(ctx, run) {\n\t\t\tctx.logger.info(`\\n☁️  sst deploy --stage ${ctx.stage}`);\n\t\t\tawait clearOutputs(ctx.cwd);\n\t\t\tawait exec(ctx, run, deployCommand(ctx, run), {\n\t\t\t\tenv: { ...withoutAws(run.sandbox.env), ...awsEnv(run.aws) },\n\t\t\t\ttimeoutMs: DEPLOY_TIMEOUT_MS,\n\t\t\t});\n\n\t\t\trun.urls = surfaceUrls(await readOutputs(ctx.cwd), run.apps);\n\t\t\tfor (const app of run.apps) {\n\t\t\t\tctx.emit({\n\t\t\t\t\ttype: 'app.deployed',\n\t\t\t\t\tapp,\n\t\t\t\t\tapplicationId: ctx.name(app),\n\t\t\t\t\t// SST builds no image a registry holds.\n\t\t\t\t\timageRef: '',\n\t\t\t\t\turl: run.urls[app] ?? '',\n\t\t\t\t});\n\t\t\t}\n\t\t},\n\n\t\tasync verify(ctx, run) {\n\t\t\tconst unhealthy: SurfacesUnhealthy['surfaces'][number][] = [];\n\n\t\t\tfor (const app of run.apps) {\n\t\t\t\tconst base = run.urls[app];\n\t\t\t\tif (!base) {\n\t\t\t\t\tctx.logger.warn(\n\t\t\t\t\t\t`   ⚠ No URL for ${app} in SST's outputs, so it was not checked. Return it from run() in sst.config.ts — { ${app}: <its url> } — to have it checked.`,\n\t\t\t\t\t);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\t// A surface — a `rest-api` — is the backend app it derives.\n\t\t\t\tconst backend = ctx.workspace.apps[app]?.type === 'backend';\n\t\t\t\tconst url = healthUrl(base, backend ? '/health' : '/');\n\t\t\t\tconst answer = await checkHealth(app, url, {\n\t\t\t\t\t...health,\n\t\t\t\t\tsignal: ctx.signal,\n\t\t\t\t\temit: ctx.emit,\n\t\t\t\t});\n\t\t\t\tif (answer.healthy) {\n\t\t\t\t\tctx.logger.info(`   ✓ ${app}: ${url}`);\n\t\t\t\t} else {\n\t\t\t\t\tunhealthy.push({\n\t\t\t\t\t\tapp,\n\t\t\t\t\t\turl,\n\t\t\t\t\t\t...(answer.status !== undefined ? { status: answer.status } : {}),\n\t\t\t\t\t\t...(answer.error ? { error: answer.error } : {}),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (unhealthy.length > 0) {\n\t\t\t\tthrow new SurfacesUnhealthy(ctx.stage, unhealthy);\n\t\t\t}\n\t\t},\n\n\t\tresult(ctx, run): DeployResult {\n\t\t\treturn {\n\t\t\t\tapps: run.apps.map((appName) => ({\n\t\t\t\t\tappName,\n\t\t\t\t\ttype: ctx.workspace.apps[appName]?.type ?? 'backend',\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\t...(run.urls[appName] ? { url: run.urls[appName] } : {}),\n\t\t\t\t})),\n\t\t\t\tprojectId: '',\n\t\t\t\tenvironmentId: '',\n\t\t\t\tsuccessCount: ctx.dryRun ? 0 : run.apps.length,\n\t\t\t\tfailedCount: 0,\n\t\t\t\tstage: ctx.stage,\n\t\t\t\tidentity: ctx.identity.key,\n\t\t\t\ttag: ctx.tag,\n\t\t\t\tdryRun: ctx.dryRun,\n\t\t\t\tskipped: [...ctx.skipped],\n\t\t\t\turls: { ...run.urls },\n\t\t\t\tchanges: [],\n\t\t\t};\n\t\t},\n\t});\n}\n\nfunction buildCommand(\n\tctx: DeployPhaseContext<unknown>,\n\trun: SstRun,\n): [string, string[]] {\n\treturn projectCommand(run.pm, 'gkm', [\n\t\t'build',\n\t\t'--provider',\n\t\t'aws',\n\t\t'--stage',\n\t\tctx.stage,\n\t]);\n}\n\nfunction deployCommand(\n\tctx: DeployPhaseContext<unknown>,\n\trun: SstRun,\n): [string, string[]] {\n\treturn projectCommand(run.pm, 'sst', ['deploy', '--stage', ctx.stage]);\n}\n\nexport const sstTarget = createSstTarget();\n"],"mappings":";;;;;;;;;;;;;AAwBA,IAAa,oBAAb,cAAuC,MAAM;CAElC;CAEA;CAHV,YACC,OAEA,UAMC;EACD,MAAM,QAAQ,SAAS,KACrB,EAAE,KAAK,KAAK,QAAQ,YACpB,OAAO,IAAI,IAAI,IAAI,KAAK,UAAU,SAAS,aAC7C;EACA,MACC,QAAQ,MAAM,4BAA4B,SAAS,WAAW,IAAI,mBAAmB,cAAc,wBAAwB,MAAM,KAAK,IAAI,EAAE,0DAC7I;EAfS,KAAA,QAAA;EAEA,KAAA,WAAA;EAcT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,UAAU,MAAc,MAAsB;CAC7D,MAAM,OAAO,KAAK,SAAS,GAAG,IAAI,OAAO,GAAG,KAAK;CACjD,OAAO,IAAI,IAAI,KAAK,QAAQ,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AACxD;;;;;AAMA,eAAsB,YACrB,KACA,KACA,SACiE;CACjE,IAAI,OAA8D,EACjE,SAAS,MACV;CACA,KAAK,IAAI,UAAU,GAAG,WAAW,QAAQ,UAAU,WAAW;EAC7D,QAAQ,OAAO,eAAe;EAC9B,IAAI;GACH,MAAM,WAAW,MAAM,MAAM,KAAK;IACjC,UAAU;IACV,QAAQ,YAAY,IAAI,CACvB,QAAQ,QACR,YAAY,QAAQ,QAAQ,SAAS,CACtC,CAAC;GACF,CAAC;GAED,MAAM,SAAS,YAAY,CAAC,CAAC,YAAY,KAAA,CAAS;GAClD,OAAO;IAAE,SAAS,SAAS;IAAI,QAAQ,SAAS;GAAO;EACxD,SAAS,OAAO;GAEf,QAAQ,OAAO,eAAe;GAC9B,OAAO;IACN,SAAS;IACT,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC7D;EACD;EACA,QAAQ,KAAK;GACZ,MAAM;GACN;GACA;GACA,SAAS,KAAK;GACd,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;GAC3D;EACD,CAAC;EACD,IAAI,KAAK,SAAS,OAAO;EACzB,IAAI,UAAU,QAAQ,UAAU,MAAM,KAAK,QAAQ,SAAS,QAAQ,MAAM;CAC3E;CACA,OAAO;AACR;AAEA,SAAS,KAAK,IAAY,QAAoC;CAC7D,IAAI,MAAM,GAAG,OAAO,QAAQ,QAAQ;CACpC,OAAO,IAAI,SAAS,SAAS,WAAW;EACvC,MAAM,QAAQ,iBAAiB;GAC9B,OAAO,oBAAoB,SAAS,IAAI;GACxC,QAAQ;EACT,GAAG,EAAE;EACL,MAAM,aAAa;GAClB,aAAa,KAAK;GAClB,OAAO,OAAO,MAAM;EACrB;EACA,OAAO,iBAAiB,SAAS,MAAM,EAAE,MAAM,KAAK,CAAC;CACtD,CAAC;AACF;;;;;;;;;;;;;;AC/FA,MAAa,mBAAmB,KAAK,QAAQ,cAAc;;AAG3D,IAAa,uBAAb,cAA0C,MAAM;CAErC;CACA;CAFV,YACC,MACA,QACC;EACD,MACC,mCAAmC,KAAK,IAAI,OAAO,kFACpD;EALS,KAAA,OAAA;EACA,KAAA,SAAA;EAKT,KAAK,OAAO;CACb;AACD;;;;;AAMA,eAAsB,aAAa,KAA4B;CAC9D,MAAM,GAAG,KAAK,KAAK,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AACtD;;AAGA,eAAsB,YAAY,KAA+B;CAChE,MAAM,OAAO,KAAK,KAAK,gBAAgB;CACvC,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,CAAC;CAC/B,IAAI;EACH,OAAO,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;CAC/C,SAAS,OAAO;EACf,MAAM,IAAI,qBACT,MACA,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACtD;CACD;AACD;;AAGA,SAAS,OACR,OACA,OAAiB,CAAC,GAClB,QAA2C,CAAC,GACR;CACpC,IAAI,OAAO,UAAU,UAChB;MAAA,UAAU,KAAK,GAAG,MAAM,KAAK;GAAE;GAAM,KAAK;EAAM,CAAC;CAAA,OAC/C,IAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GACpE,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC9C,OAAO,OAAO,CAAC,GAAG,MAAM,GAAG,GAAG,KAAK;CAGrC,OAAO;AACR;AAEA,SAAS,UAAU,OAAwB;CAC1C,IAAI;EACH,MAAM,EAAE,aAAa,IAAI,IAAI,KAAK;EAClC,OAAO,aAAa,WAAW,aAAa;CAC7C,QAAQ;EACP,OAAO;CACR;AACD;;;;;;;AAQA,SAAS,QAAQ,MAA0B;CAC1C,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,GAAG;EAC1C,MAAM,OAAO,UAAU,OAAO;EAC9B,MAAM,KAAK,IAAI;EACf,MAAM,OAAO,KAAK,QAAQ,UAAU,EAAE;EACtC,IAAI,MAAM;GACT,MAAM,KAAK,IAAI;GACf;EACD;CACD;CACA,OAAO;AACR;;;;;AAMA,SAAgB,YACf,SACA,MACyB;CACzB,MAAM,QAAQ,OAAO,OAAO;CAC5B,MAAM,OAA+B,CAAC;CACtC,KAAK,MAAM,OAAO,MAAM;EAEvB,MAAM,QAAQ,MAAM,MAAM,EAAE,WAAW,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG;EAC/D,MAAM,QAAQ,MAAM,MAAM,EAAE,WAAW,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC;EAClE,MAAM,QAAQ,SAAS;EACvB,IAAI,OAAO,KAAK,OAAO,MAAM;CAC9B;CACA,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC3EA,MAAM,mBAAmB;;;;;AAKzB,MAAM,oBAAoB;;AAG1B,IAAa,oBAAb,cAAuC,MAAM;CACvB;CAArB,YAAY,KAAsB;EACjC,MACC,uBAAuB,IAAI,oLAC5B;EAHoB,KAAA,MAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;AAsBA,SAAgB,eACf,IACA,KACA,MACoC;CACpC,QAAQ,IAAR;EACC,KAAK,QACJ,OAAO,CAAC,QAAQ;GAAC;GAAQ;GAAK,GAAG;EAAI,CAAC;EACvC,KAAK,QACJ,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;EAC/B,KAAK,OACJ,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC;EAC/B,KAAK,OACJ,OAAO,CAAC,OAAO;GAAC;GAAgB;GAAK,GAAG;EAAI,CAAC;CAC/C;AACD;;;;;;AAOA,SAAgB,OAAO,YAAmD;CACzE,MAAM,SAAiC,WAAW,SAC/C;EAAE,YAAY,WAAW;EAAQ,oBAAoB,WAAW;CAAO,IACvE,CAAC;CACJ,IAAI,aAAa,YAChB,OAAO;EAAE,aAAa,WAAW;EAAS,GAAG;CAAO;CAErD,OAAO;EACN,mBAAmB,WAAW;EAC9B,uBAAuB,WAAW;EAClC,GAAI,WAAW,eACZ,EAAE,mBAAmB,WAAW,aAAa,IAC7C,CAAC;EACJ,GAAG;CACJ;AACD;;;;;AAMA,SAAS,WACR,KACyB;CACzB,OAAO,OAAO,YACb,OAAO,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,WAAW,MAAM,CAAC,CAChE;AACD;;AAGA,SAAS,QAAQ,UAAkD;CAClE,OAAO,IAAI,IACV,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,iBAAiB,CACnD,OAAO,EAAE,GACT,YAAY,IACb,CAAC,CACF;AACD;AAEA,eAAe,KACd,KACA,KACA,CAAC,SAAS,OACV,SACgB;CAChB,MAAM,SAAS,MAAM,IAAI,QAAQ,KAAK,SAAS,MAAM;EACpD,KAAK,IAAI;EACT,KAAK,QAAQ;EACb,WAAW,QAAQ;EACnB,QAAQ,IAAI;EACZ,QAAQ,IAAI;CACb,CAAC;CACD,IAAI,OAAO,aAAa,GACvB,MAAM,IAAI,cACT,SACA,MACA,OAAO,UACP,OAAO,MACR;AAEF;;AAGA,SAAgB,gBACf,UAA4B,CAAC,GACK;CAClC,MAAM,SAAS;EACd,UAAU,QAAQ,QAAQ,YAAY;EACtC,SAAS,QAAQ,QAAQ,WAAW;EACpC,WAAW,QAAQ,QAAQ,aAAa;CACzC;CAEA,OAAO,aAAgC;EACtC,MAAM;EACN,SAAS;EAIT,cAAc;GAAE,UAAU;GAAO,YAAY;GAAU,QAAQ;EAAM;EACrE,aAAa,CAAC,KAAK;EAEnB,MAAM,SAAS,KAAK;GACnB,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,eAAe,CAAC,GAC7C,MAAM,IAAI,kBAAkB,IAAI,GAAG;GAGpC,MAAM,MAAM,MAAM,IAAI,YAAY,IACjC;IAAE,MAAM;IAAO,OAAO,IAAI;GAAM,GAChC,EAAE,QAAQ,IAAI,OAAO,CACtB;GACA,IAAI,CAAC,KAAK,MAAM,IAAI,kBAAkB,OAAO,IAAI,KAAK;GACtD,IAAI,EAAE,aAAa,MAAM;IACxB,IAAI,QAAQ,KAAK,IAAI,eAAe;IACpC,IAAI,IAAI,cAAc,IAAI,QAAQ,KAAK,IAAI,YAAY;GACxD;GAGA,KAAK,MAAM,OAAO,IAAI,MACrB,IAAI,IAAI,UAAU,KAAK,IAAI,EAAE,SAAS,UACrC,IAAI,KAAK,KAAK,gDAAgD;GAGhE,MAAM,UAAU,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE,UAAU,GAAG,CAAC;GACzD,MAAM,OAAO,IAAI,KAAK,QAAQ,QAAQ,CAAC,QAAQ,IAAI,GAAG,CAAC;GAEvD,IAAI,OAAO,KACV,mBAAmB,IAAI,UAAU,KAAK,YAAY,IAAI,MAAM,iBAC7D;GACA,IAAI,OAAO,KACV,WAAW,aAAa,MAAM,YAAY,IAAI,QAAQ,KAAK,eAC5D;GAEA,MAAM,aAAa,OAAO,OAAO,IAAI,UAAU,IAAI,CAAC,CAAC,QACnD,QAAQ,IAAI,SAAS,QACvB,CAAC,CAAC;GACF,IAAI,KAAK,SAAS,YACjB,IAAI,OAAO,KACV,gEAAgE,KAAK,KAAK,IAAI,EAAE,EACjF;GAGD,OAAO;IACN,SAAS,cAAc,KAAK,IAAI,aAAa,EAAE,MAAM,IAAI,IAAI,CAAC;IAC9D,IAAI,qBAAqB,IAAI,GAAG;IAChC;IACA;IACA,MAAM,CAAC;GACR;EACD;EAEA,MAAM,KAAK,KAAK,KAAK;GACpB,MAAM,QAAQ,QAAQ,IAAI,QAAQ;GAClC,KAAK,MAAM,OAAO,IAAI,MACrB,IAAI,KAAK;IACR,MAAM;IACN,KAAK,eAAe;IACpB,cAAc,MAAM,IAAI,GAAG,KAAK;IAChC,QAAQ;GACT,CAAC;GAEF,MAAM,CAAC,OAAO,aAAa,aAAa,KAAK,GAAG;GAChD,MAAM,CAAC,QAAQ,cAAc,cAAc,KAAK,GAAG;GACnD,IAAI,OAAO,KAAK,iBAAiB,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,KAAK,GAAG,GAAG;GAClE,IAAI,OAAO,KAAK,iBAAiB,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC,KAAK,GAAG,GAAG;EACrE;EAEA,MAAM,MAAM,KAAK,KAAK;GACrB,IAAI,OAAO,KAAK,wCAAwC;GAExD,MAAM,KAAK,KAAK,KAAK,aAAa,KAAK,GAAG,GAAG;IAC5C,KAAK,EAAE,GAAG,IAAI,QAAQ,IAAI;IAC1B,WAAW;GACZ,CAAC;EACF;EAEA,MAAM,QAAQ,KAAK,KAAK;GACvB,IAAI,OAAO,KAAK,4BAA4B,IAAI,OAAO;GACvD,MAAM,aAAa,IAAI,GAAG;GAC1B,MAAM,KAAK,KAAK,KAAK,cAAc,KAAK,GAAG,GAAG;IAC7C,KAAK;KAAE,GAAG,WAAW,IAAI,QAAQ,GAAG;KAAG,GAAG,OAAO,IAAI,GAAG;IAAE;IAC1D,WAAW;GACZ,CAAC;GAED,IAAI,OAAO,YAAY,MAAM,YAAY,IAAI,GAAG,GAAG,IAAI,IAAI;GAC3D,KAAK,MAAM,OAAO,IAAI,MACrB,IAAI,KAAK;IACR,MAAM;IACN;IACA,eAAe,IAAI,KAAK,GAAG;IAE3B,UAAU;IACV,KAAK,IAAI,KAAK,QAAQ;GACvB,CAAC;EAEH;EAEA,MAAM,OAAO,KAAK,KAAK;GACtB,MAAM,YAAqD,CAAC;GAE5D,KAAK,MAAM,OAAO,IAAI,MAAM;IAC3B,MAAM,OAAO,IAAI,KAAK;IACtB,IAAI,CAAC,MAAM;KACV,IAAI,OAAO,KACV,mBAAmB,IAAI,sFAAsF,IAAI,oCAClH;KACA;IACD;IAGA,MAAM,MAAM,UAAU,MADN,IAAI,UAAU,KAAK,IAAI,EAAE,SAAS,YACZ,YAAY,GAAG;IACrD,MAAM,SAAS,MAAM,YAAY,KAAK,KAAK;KAC1C,GAAG;KACH,QAAQ,IAAI;KACZ,MAAM,IAAI;IACX,CAAC;IACD,IAAI,OAAO,SACV,IAAI,OAAO,KAAK,QAAQ,IAAI,IAAI,KAAK;SAErC,UAAU,KAAK;KACd;KACA;KACA,GAAI,OAAO,WAAW,KAAA,IAAY,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;KAC/D,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;IAC/C,CAAC;GAEH;GAEA,IAAI,UAAU,SAAS,GACtB,MAAM,IAAI,kBAAkB,IAAI,OAAO,SAAS;EAElD;EAEA,OAAO,KAAK,KAAmB;GAC9B,OAAO;IACN,MAAM,IAAI,KAAK,KAAK,aAAa;KAChC;KACA,MAAM,IAAI,UAAU,KAAK,QAAQ,EAAE,QAAQ;KAC3C,SAAS;KACT,GAAI,IAAI,KAAK,WAAW,EAAE,KAAK,IAAI,KAAK,SAAS,IAAI,CAAC;IACvD,EAAE;IACF,WAAW;IACX,eAAe;IACf,cAAc,IAAI,SAAS,IAAI,IAAI,KAAK;IACxC,aAAa;IACb,OAAO,IAAI;IACX,UAAU,IAAI,SAAS;IACvB,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ,SAAS,CAAC,GAAG,IAAI,OAAO;IACxB,MAAM,EAAE,GAAG,IAAI,KAAK;IACpB,SAAS,CAAC;GACX;EACD;CACD,CAAC;AACF;AAEA,SAAS,aACR,KACA,KACqB;CACrB,OAAO,eAAe,IAAI,IAAI,OAAO;EACpC;EACA;EACA;EACA;EACA,IAAI;CACL,CAAC;AACF;AAEA,SAAS,cACR,KACA,KACqB;CACrB,OAAO,eAAe,IAAI,IAAI,OAAO;EAAC;EAAU;EAAW,IAAI;CAAK,CAAC;AACtE;AAEA,MAAa,YAAY,gBAAgB"}

package/dist/stages-CUn6gvXL.cjs

@@ -0,0 +1,174 @@
+const require_workspace = require("./workspace-CwW3Gkru.cjs");
+const require_config = require("./config.cjs");
+let node_fs_promises = require("node:fs/promises");
+//#region src/stages/plan.ts
+/**
+* Which stages a workflow run builds and deploys, from the event that started
+* it and the project's `stages`.
+*
+* The rules live here, in tested code, rather than in a workflow's YAML or in
+* the action that runs `gkm stages --github-output`: a project's deploy
+* workflow names no stage, and what it does for each event is decided by the
+* CLI the project installed.
+*
+* | event               | build              | deploy                          |
+* | ------------------- | ------------------ | ------------------------------- |
+* | `push`              | every deployed     | deployed, less the protected    |
+* | `release`           | none               | the protected                   |
+* | `workflow_dispatch` | none               | the one stage named             |
+* | anything else       | none               | none                            |
+*
+* A push builds every deployed stage, protected ones included, so a release
+* deploys images built from the very commit its tag names; a release and a
+* manual run deploy what a push already built.
+*/
+function planStages(stages, input) {
+	const kept = stages.protected ?? [];
+	switch (input.event) {
+		case "push": return {
+			build: [...stages.deployed],
+			deploy: stages.deployed.filter((stage) => !kept.includes(stage))
+		};
+		case "release": return {
+			build: [],
+			deploy: [...kept]
+		};
+		case "workflow_dispatch": {
+			const stage = input.stage?.trim();
+			if (!stage) throw new DispatchNamesNoStage(stages.deployed);
+			if (!stages.deployed.includes(stage)) throw new require_workspace.UndeclaredStage(stage, stages.deployed);
+			return {
+				build: [],
+				deploy: [stage]
+			};
+		}
+		default: return {
+			build: [],
+			deploy: []
+		};
+	}
+}
+/**
+* A manual run with no stage. Refused rather than read as "nothing to do", so
+* a run started with the field left empty fails where it can be seen.
+*/
+var DispatchNamesNoStage = class extends Error {
+	deployed;
+	constructor(deployed) {
+		super(`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(", ") || "nothing yet — gkm.config.ts deploys to no stage"}.`);
+		this.deployed = deployed;
+		this.name = "DispatchNamesNoStage";
+	}
+};
+//#endregion
+//#region src/stages/index.ts
+/**
+* `gkm stages` — the workspace's stages, as gkm.config.ts declares them.
+*
+* ```bash
+* gkm stages                    # a table
+* gkm stages --json             # {"local":"dev","deployed":["prod"],"protected":["prod"]}
+* gkm stages --github-output    # a workflow run's build and deploy matrices
+* ```
+*
+* The config is read by the normal loader (and sandbox), so a workflow never
+* parses TypeScript to learn which stages exist. `--github-output` is what the
+* `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and
+* which of them this run builds and deploys, to `$GITHUB_OUTPUT`.
+*/
+function stagesJson(stages) {
+	return {
+		local: stages.local,
+		deployed: [...stages.deployed],
+		protected: [...stages.protected ?? []]
+	};
+}
+/**
+* The region of the workspace's AWS secrets store — `ssm` or
+* `secrets-manager` — or `''` when its deployed stages keep their secrets
+* anywhere else. A job assumes the stage's AWS role only when this is set.
+*/
+function awsSecretsRegion(workspace) {
+	const store = workspace.secrets?.store;
+	if (typeof store !== "object" || store === null) return "";
+	if (store.provider === "ssm" || store.provider === "secrets-manager") return store.region;
+	return "";
+}
+/**
+* Every output the stages action sets, each a string `fromJSON()` reads, for
+* one workflow run.
+*/
+function githubOutputs(workspace, input) {
+	const stages = stagesJson(workspace.stages);
+	const plan = planStages(workspace.stages, input);
+	return {
+		local: JSON.stringify(stages.local),
+		deployed: JSON.stringify(stages.deployed),
+		protected: JSON.stringify(stages.protected),
+		build: JSON.stringify(plan.build),
+		deploy: JSON.stringify(plan.deploy),
+		"has-build": String(plan.build.length > 0),
+		"has-deploy": String(plan.deploy.length > 0),
+		"aws-region": awsSecretsRegion(workspace)
+	};
+}
+/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */
+function formatGithubOutputs(outputs) {
+	return Object.entries(outputs).map(([name, value]) => `${name}=${value}\n`).join("");
+}
+/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */
+function workflowCommandData(message) {
+	return message.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function table(stages) {
+	const rows = [
+		["STAGE", "KIND"],
+		[stages.local, "local"],
+		...stages.deployed.map((name) => [name, stages.protected.includes(name) ? "deployed, protected" : "deployed"])
+	];
+	const width = Math.max(...rows.map(([name]) => name.length));
+	return rows.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`).join("\n");
+}
+async function stagesCommand(options, deps = {}) {
+	const env = deps.env ?? process.env;
+	const log = deps.log ?? ((line) => console.log(line));
+	if (!options.githubOutput) {
+		const stages = stagesJson((await require_config.loadWorkspaceSettings(deps.cwd)).stages);
+		log(options.json ? JSON.stringify(stages) : table(stages));
+		return;
+	}
+	try {
+		const file = env.GITHUB_OUTPUT;
+		if (!file) throw new GithubOutputNotSet();
+		const workspace = await require_config.loadWorkspaceSettings(deps.cwd);
+		const event = options.event || env.GITHUB_EVENT_NAME;
+		if (!event) throw new GithubEventNotSet();
+		const outputs = githubOutputs(workspace, {
+			event,
+			...options.stage ? { stage: options.stage } : {}
+		});
+		await (0, node_fs_promises.appendFile)(file, formatGithubOutputs(outputs));
+		log(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);
+	} catch (error) {
+		log(`::error title=gkm stages::${workflowCommandData(error instanceof Error ? error.message : String(error))}`);
+		throw error;
+	}
+}
+/** `--github-output` outside a GitHub Actions step, which sets the file. */
+var GithubOutputNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.");
+		this.name = "GithubOutputNotSet";
+	}
+};
+/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */
+var GithubEventNotSet = class extends Error {
+	constructor() {
+		super("gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.");
+		this.name = "GithubEventNotSet";
+	}
+};
+//#endregion
+exports.stagesCommand = stagesCommand;
+
+//# sourceMappingURL=stages-CUn6gvXL.cjs.map