@geekmidas/cli 10.0.0-alpha.9 → 10.0.0-alpha.91

package/dist/secretsManager-Chs9VV2r.mjs

@@ -0,0 +1,76 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { n as serializeWithin, t as awsClientConfig } from "./awsStore-B529csle.mjs";
+import { CreateSecretCommand, GetSecretValueCommand, PutSecretValueCommand, ResourceNotFoundException, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+//#region src/secrets/secretsManager.ts
+/**
+* A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.
+*
+* One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's
+* parameter name without its leading `/` — holding the same JSON. It is
+* encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`
+* names another. Which account it is in is whichever credentials are active,
+* exactly as for the SSM store.
+*
+* Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's
+* own versioning, at a monthly price per secret.
+*/
+var secretsManager_exports = /* @__PURE__ */ __exportAll({
+	SECRETS_MANAGER_SECRET_LIMIT: () => SECRETS_MANAGER_SECRET_LIMIT,
+	SecretsManagerSecretsStore: () => SecretsManagerSecretsStore,
+	secretsManagerSecretName: () => secretsManagerSecretName
+});
+/** The most a Secrets Manager secret holds: 64 KB. */
+const SECRETS_MANAGER_SECRET_LIMIT = 65536;
+/** The secret a stage's secrets are kept in. */
+function secretsManagerSecretName(project, stage) {
+	return `gkm/${project}/${stage}/secrets`;
+}
+var SecretsManagerSecretsStore = class {
+	options;
+	name = "secrets-manager";
+	client;
+	constructor(options) {
+		this.options = options;
+	}
+	async secretsManager() {
+		if (this.client) return this.client;
+		this.client = new SecretsManagerClient(await awsClientConfig(this.options));
+		return this.client;
+	}
+	secretName(stage) {
+		return secretsManagerSecretName(this.options.project, stage);
+	}
+	async read(stage) {
+		const client = await this.secretsManager();
+		try {
+			const { SecretString } = await client.send(new GetSecretValueCommand({ SecretId: this.secretName(stage) }));
+			return SecretString ? JSON.parse(SecretString) : null;
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException) return null;
+			throw error;
+		}
+	}
+	async write(stage, secrets) {
+		const value = serializeWithin(stage, this.name, secrets, SECRETS_MANAGER_SECRET_LIMIT);
+		const client = await this.secretsManager();
+		const name = this.secretName(stage);
+		try {
+			await client.send(new PutSecretValueCommand({
+				SecretId: name,
+				SecretString: value
+			}));
+		} catch (error) {
+			if (!(error instanceof ResourceNotFoundException)) throw error;
+			await client.send(new CreateSecretCommand({
+				Name: name,
+				SecretString: value,
+				Description: `gkm secrets for ${this.options.project}/${stage}`,
+				...this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}
+			}));
+		}
+	}
+};
+//#endregion
+export { secretsManager_exports as n, secretsManagerSecretName as t };
+
+//# sourceMappingURL=secretsManager-Chs9VV2r.mjs.map

package/dist/secretsManager-Chs9VV2r.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsManager-Chs9VV2r.mjs","names":[],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await client.send(\n\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAI,qBAAqB,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,OAAO,KACrC,IAAI,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiB,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,IAAI;GACH,MAAM,OAAO,KACZ,IAAI,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAI,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}

package/dist/secretsManager-DcMlHnRC.cjs

@@ -0,0 +1,87 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_awsStore = require("./awsStore-7VmS_cZR.cjs");
+let _aws_sdk_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+//#region src/secrets/secretsManager.ts
+/**
+* A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.
+*
+* One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's
+* parameter name without its leading `/` — holding the same JSON. It is
+* encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`
+* names another. Which account it is in is whichever credentials are active,
+* exactly as for the SSM store.
+*
+* Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's
+* own versioning, at a monthly price per secret.
+*/
+var secretsManager_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
+	SECRETS_MANAGER_SECRET_LIMIT: () => SECRETS_MANAGER_SECRET_LIMIT,
+	SecretsManagerSecretsStore: () => SecretsManagerSecretsStore,
+	secretsManagerSecretName: () => secretsManagerSecretName
+});
+/** The most a Secrets Manager secret holds: 64 KB. */
+const SECRETS_MANAGER_SECRET_LIMIT = 65536;
+/** The secret a stage's secrets are kept in. */
+function secretsManagerSecretName(project, stage) {
+	return `gkm/${project}/${stage}/secrets`;
+}
+var SecretsManagerSecretsStore = class {
+	options;
+	name = "secrets-manager";
+	client;
+	constructor(options) {
+		this.options = options;
+	}
+	async secretsManager() {
+		if (this.client) return this.client;
+		this.client = new _aws_sdk_client_secrets_manager.SecretsManagerClient(await require_awsStore.awsClientConfig(this.options));
+		return this.client;
+	}
+	secretName(stage) {
+		return secretsManagerSecretName(this.options.project, stage);
+	}
+	async read(stage) {
+		const client = await this.secretsManager();
+		try {
+			const { SecretString } = await client.send(new _aws_sdk_client_secrets_manager.GetSecretValueCommand({ SecretId: this.secretName(stage) }));
+			return SecretString ? JSON.parse(SecretString) : null;
+		} catch (error) {
+			if (error instanceof _aws_sdk_client_secrets_manager.ResourceNotFoundException) return null;
+			throw error;
+		}
+	}
+	async write(stage, secrets) {
+		const value = require_awsStore.serializeWithin(stage, this.name, secrets, SECRETS_MANAGER_SECRET_LIMIT);
+		const client = await this.secretsManager();
+		const name = this.secretName(stage);
+		try {
+			await client.send(new _aws_sdk_client_secrets_manager.PutSecretValueCommand({
+				SecretId: name,
+				SecretString: value
+			}));
+		} catch (error) {
+			if (!(error instanceof _aws_sdk_client_secrets_manager.ResourceNotFoundException)) throw error;
+			await client.send(new _aws_sdk_client_secrets_manager.CreateSecretCommand({
+				Name: name,
+				SecretString: value,
+				Description: `gkm secrets for ${this.options.project}/${stage}`,
+				...this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}
+			}));
+		}
+	}
+};
+//#endregion
+Object.defineProperty(exports, "secretsManagerSecretName", {
+	enumerable: true,
+	get: function() {
+		return secretsManagerSecretName;
+	}
+});
+Object.defineProperty(exports, "secretsManager_exports", {
+	enumerable: true,
+	get: function() {
+		return secretsManager_exports;
+	}
+});
+
+//# sourceMappingURL=secretsManager-DcMlHnRC.cjs.map

package/dist/secretsManager-DcMlHnRC.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsManager-DcMlHnRC.cjs","names":["SecretsManagerClient","awsClientConfig","GetSecretValueCommand","ResourceNotFoundException","serializeWithin","PutSecretValueCommand","CreateSecretCommand"],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await client.send(\n\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAIA,gCAAAA,qBAAqB,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;CAEA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,OAAO,KACrC,IAAIC,gCAAAA,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiBC,gCAAAA,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;CAEA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQC,iBAAAA,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,IAAI;GACH,MAAM,OAAO,KACZ,IAAIC,gCAAAA,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiBF,gCAAAA,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAIG,gCAAAA,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}