@geekmidas/cli 10.0.0-alpha.90 → 10.0.0-alpha.92

package/dist/{aws-B-6uEhgP.mjs → aws-Dz2bYxK1.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { n as serializeWithin, t as awsClientConfig } from "./awsStore-B529csle.mjs";
+import { n as serializeWithin, r as withStageCredentials, t as awsClientConfig } from "./awsStore-BWa1KNY-.mjs";
 import { GetParameterCommand, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
 //#region src/secrets/aws.ts
 /**
@@ -40,32 +40,50 @@ var AwsSecretsStore = class {
 		this.client = new SSMClient(await awsClientConfig(this.options));
 		return this.client;
 	}
+	/** Where a call for `stage` is, for an error saying it has no credentials. */
+	context(stage, access) {
+		return {
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
 	async read(stage) {
 		const ssm = await this.ssm();
 		try {
-			const { Parameter } = await ssm.send(new GetParameterCommand({
+			const { Parameter } = await withStageCredentials(this.context(stage, "read"), () => ssm.send(new GetParameterCommand({
 				Name: secretsParameterName(this.options.project, stage),
 				WithDecryption: true
-			}));
+			})));
 			return Parameter?.Value ? JSON.parse(Parameter.Value) : null;
 		} catch (error) {
 			if (error instanceof ParameterNotFound) return null;
 			throw error;
 		}
 	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
 	async write(stage, secrets) {
 		const value = serializeWithin(stage, this.name, secrets, SSM_PARAMETER_LIMIT);
-		await (await this.ssm()).send(new PutParameterCommand({
+		const ssm = await this.ssm();
+		await withStageCredentials(this.context(stage, "write"), () => ssm.send(new PutParameterCommand({
 			Name: secretsParameterName(this.options.project, stage),
 			Value: value,
 			Type: "SecureString",
 			Tier: "Intelligent-Tiering",
 			Overwrite: true,
 			Description: `gkm secrets for ${this.options.project}/${stage}`
-		}));
+		})));
 	}
 };
 //#endregion
 export { secretsParameterName as n, aws_exports as t };
 
-//# sourceMappingURL=aws-B-6uEhgP.mjs.map
+//# sourceMappingURL=aws-Dz2bYxK1.mjs.map

package/dist/aws-Dz2bYxK1.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-Dz2bYxK1.mjs","names":[],"sources":["../src/secrets/aws.ts"],"sourcesContent":["/**\n * A stage's secrets in SSM Parameter Store, in the stage's own AWS account.\n *\n * One parameter per stage, `/gkm/<project>/<stage>/secrets`, a SecureString —\n * encrypted at rest by KMS, so nothing about it needs a key file anywhere.\n * Which account it is in is whichever credentials are active: the stage's\n * OIDC role in a deploy job, or `--profile` on a developer's machine. With\n * staging and production in different accounts, each stage's secrets sit\n * beside its infrastructure, and a staging role cannot read production's.\n *\n * Written in the Intelligent-Tiering tier: a stage under 4 KB stays a free\n * standard parameter, a larger one becomes advanced (up to 8 KB). Past 8 KB\n * the write is refused with {@link StageSecretsTooLarge} before AWS is\n * called; Secrets Manager (`secretsManager.ts`) holds up to 64 KB.\n */\n\nimport {\n\tGetParameterCommand,\n\tParameterNotFound,\n\tPutParameterCommand,\n\tSSMClient,\n} from '@aws-sdk/client-ssm';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport type AwsSecretsStoreOptions = AwsStoreOptions;\n\n/** The most an SSM parameter holds: 8 KB, in the advanced tier. */\nexport const SSM_PARAMETER_LIMIT = 8 * 1024;\n\n/** The parameter a stage's secrets are kept in. */\nexport function secretsParameterName(project: string, stage: string): string {\n\treturn `/gkm/${project}/${stage}/secrets`;\n}\n\nexport class AwsSecretsStore implements SecretsStore {\n\treadonly name = 'ssm';\n\n\tprivate client?: SSMClient;\n\n\tconstructor(private readonly options: AwsSecretsStoreOptions) {}\n\n\tprivate async ssm(): Promise<SSMClient> {\n\t\tif (this.client) return this.client;\n\n\t\tthis.client = new SSMClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst ssm = await this.ssm();\n\n\t\ttry {\n\t\t\tconst { Parameter } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tssm.send(\n\t\t\t\t\t\tnew GetParameterCommand({\n\t\t\t\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\t\t\t\tWithDecryption: true,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn Parameter?.Value\n\t\t\t\t? (JSON.parse(Parameter.Value) as StageSecrets)\n\t\t\t\t: null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ParameterNotFound) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSSM_PARAMETER_LIMIT,\n\t\t);\n\t\tconst ssm = await this.ssm();\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tssm.send(\n\t\t\t\tnew PutParameterCommand({\n\t\t\t\t\tName: secretsParameterName(this.options.project, stage),\n\t\t\t\t\tValue: value,\n\t\t\t\t\tType: 'SecureString',\n\t\t\t\t\t// Standard (free) under 4 KB, advanced past it; never the other way.\n\t\t\t\t\tTier: 'Intelligent-Tiering',\n\t\t\t\t\tOverwrite: true,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t}),\n\t\t\t),\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,MAAa,sBAAsB;;AAGnC,SAAgB,qBAAqB,SAAiB,OAAuB;CAC5E,OAAO,QAAQ,QAAQ,GAAG,MAAM;AACjC;AAEA,IAAa,kBAAb,MAAqD;CAKvB;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAkD;EAAjC,KAAA,UAAA;CAAkC;CAE/D,MAAc,MAA0B;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK;EAE7B,KAAK,SAAS,IAAI,UAAU,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC/D,OAAO,KAAK;CACb;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,MAAM,MAAM,KAAK,IAAI;EAE3B,IAAI;GACH,MAAM,EAAE,cAAc,MAAM,qBAC3B,KAAK,QAAQ,OAAO,MAAM,SAEzB,IAAI,KACH,IAAI,oBAAoB;IACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;IACtD,gBAAgB;GACjB,CAAC,CACF,CACF;GACA,OAAO,WAAW,QACd,KAAK,MAAM,UAAU,KAAK,IAC3B;EACJ,SAAS,OAAO;GACf,IAAI,iBAAiB,mBAAmB,OAAO;GAC/C,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,mBACD;EACA,MAAM,MAAM,MAAM,KAAK,IAAI;EAE3B,MAAM,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,IAAI,KACH,IAAI,oBAAoB;GACvB,MAAM,qBAAqB,KAAK,QAAQ,SAAS,KAAK;GACtD,OAAO;GACP,MAAM;GAEN,MAAM;GACN,WAAW;GACX,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;EACzD,CAAC,CACF,CACD;CACD;AACD"}

package/dist/awsStore-B5We7bMg.cjs

@@ -0,0 +1,136 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+//#region src/secrets/awsStore.ts
+/**
+* What the two AWS secrets stores share: how a client finds its credentials,
+* what it says when it has none, and how big a stage may be before AWS would
+* refuse it.
+*/
+/** The client config both stores build their SDK client from. */
+async function awsClientConfig(options) {
+	const config = { region: options.region };
+	if (options.profile) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		config.credentials = fromIni({ profile: options.profile });
+	}
+	if (options.endpoint) config.endpoint = options.endpoint;
+	return config;
+}
+/**
+* A stage's secrets, serialized, are larger than the store can hold: 8 KB for
+* an SSM parameter (advanced tier), 64 KB for a Secrets Manager secret.
+*
+* Refused before AWS is called, so nothing half-written is left behind and
+* the answer is not a bare `ValidationException`.
+*/
+var StageSecretsTooLarge = class extends require_errors.GkmError {
+	stage;
+	store;
+	bytes;
+	limit;
+	constructor(stage, store, bytes, limit) {
+		super(`The secrets for stage "${stage}" are ${bytes} bytes, more than the ${limit} bytes ${store} holds in one ${store === "ssm" ? "parameter" : "secret"}. ` + (store === "ssm" ? `Keep them in Secrets Manager instead, which holds up to 64 KB: set secrets.store to { provider: 'secrets-manager', region } in gkm.config.ts, then move the stage with gkm secrets:migrate --stage ${stage} --from ssm.` : "Remove credentials the stage no longer uses, or keep the largest ones somewhere they are fetched from at runtime."));
+		this.stage = stage;
+		this.store = store;
+		this.bytes = bytes;
+		this.limit = limit;
+		this.name = "StageSecretsTooLarge";
+	}
+};
+/** The stage serialized, refused if it is larger than `limit` bytes. */
+function serializeWithin(stage, store, value, limit) {
+	const serialized = JSON.stringify(value);
+	const bytes = Buffer.byteLength(serialized, "utf8");
+	if (bytes > limit) throw new StageSecretsTooLarge(stage, store, bytes, limit);
+	return serialized;
+}
+/** Where each AWS store keeps a stage's secrets, as a person reads it. */
+const AWS_STORES = {
+	ssm: "SSM Parameter Store",
+	"secrets-manager": "Secrets Manager"
+};
+/**
+* A deployed stage's secrets are kept in its AWS account, and no AWS
+* credentials were found to reach them with — or the ones found have expired.
+*
+* Raised by the AWS stores themselves, on a read or a write, so every command
+* that touches a stage's secrets says it the same way.
+*/
+var StageSecretsUnreadable = class extends require_errors.GkmError {
+	stage;
+	store;
+	profile;
+	access;
+	reason;
+	constructor(input, cause) {
+		const { stage, store, profile } = input;
+		const access = input.access ?? "read";
+		const reason = input.reason ?? "no-credentials";
+		const where = AWS_STORES[store] ?? `the '${store}' store`;
+		const named = "--profile <profile> where the command takes it, or AWS_PROFILE=<profile>";
+		const lacking = reason === "expired" ? profile ? `the AWS profile '${profile}' signed in, but its session has expired. ` : "the AWS credentials found have expired. " : profile ? `the AWS profile '${profile}' has no credentials to ${access} them with. ` : `no AWS credentials were found to ${access} them with. `;
+		const fix = profile ? `Sign in to it (aws sso login --profile ${profile}) or name another: ${named}.` : reason === "expired" ? `Export fresh ones, or name the account's profile: ${named}.` : `Name the account's profile: ${named}.`;
+		super(`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` + lacking + fix, cause === void 0 ? void 0 : { cause });
+		this.name = "StageSecretsUnreadable";
+		this.stage = stage;
+		this.store = store;
+		this.profile = profile;
+		this.access = access;
+		this.reason = reason;
+	}
+};
+/**
+* Why an AWS call failed for want of credentials, by the SDK's error name —
+* its message being free to change — or undefined when it failed for any
+* other reason.
+*
+* - `CredentialsProviderError`: the credential chain found nothing, or a
+*   profile's SSO session is missing or expired (the SSO provider wraps its
+*   token errors in this one).
+* - `TokenProviderError`: an SSO token, should one reach here unwrapped.
+* - `ExpiredTokenException`/`ExpiredToken`: credentials were found, and AWS
+*   refused them as expired.
+*/
+function credentialsFailure(error) {
+	const name = error?.name;
+	if (name === "CredentialsProviderError" || name === "TokenProviderError") return "no-credentials";
+	if (name === "ExpiredTokenException" || name === "ExpiredToken") return "expired";
+}
+/**
+* Run one AWS call of a store, refusing a failure for want of credentials
+* with {@link StageSecretsUnreadable}. Any other failure is the store's own,
+* and passes through.
+*/
+async function withStageCredentials(context, call) {
+	try {
+		return await call();
+	} catch (error) {
+		const reason = credentialsFailure(error);
+		if (reason === void 0) throw error;
+		throw new StageSecretsUnreadable({
+			...context,
+			profile: context.profile ?? (process.env.AWS_PROFILE || void 0),
+			reason
+		}, error);
+	}
+}
+//#endregion
+Object.defineProperty(exports, "awsClientConfig", {
+	enumerable: true,
+	get: function() {
+		return awsClientConfig;
+	}
+});
+Object.defineProperty(exports, "serializeWithin", {
+	enumerable: true,
+	get: function() {
+		return serializeWithin;
+	}
+});
+Object.defineProperty(exports, "withStageCredentials", {
+	enumerable: true,
+	get: function() {
+		return withStageCredentials;
+	}
+});
+
+//# sourceMappingURL=awsStore-B5We7bMg.cjs.map

package/dist/awsStore-B5We7bMg.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsStore-B5We7bMg.cjs","names":["GkmError"],"sources":["../src/secrets/awsStore.ts"],"sourcesContent":["/**\n * What the two AWS secrets stores share: how a client finds its credentials,\n * what it says when it has none, and how big a stage may be before AWS would\n * refuse it.\n */\n\nimport { GkmError } from '../errors';\n\nexport interface AwsStoreOptions {\n\t/** The workspace name, which scopes where the stage is kept. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The client config both stores build their SDK client from. */\nexport async function awsClientConfig(options: AwsStoreOptions): Promise<{\n\tregion: string;\n\tendpoint?: string;\n\tcredentials?: ReturnType<\n\t\ttypeof import('@aws-sdk/credential-providers').fromIni\n\t>;\n}> {\n\tconst config: Awaited<ReturnType<typeof awsClientConfig>> = {\n\t\tregion: options.region,\n\t};\n\tif (options.profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile: options.profile });\n\t}\n\tif (options.endpoint) {\n\t\tconfig.endpoint = options.endpoint;\n\t}\n\treturn config;\n}\n\n/**\n * A stage's secrets, serialized, are larger than the store can hold: 8 KB for\n * an SSM parameter (advanced tier), 64 KB for a Secrets Manager secret.\n *\n * Refused before AWS is called, so nothing half-written is left behind and\n * the answer is not a bare `ValidationException`.\n */\nexport class StageSecretsTooLarge extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly store: string,\n\t\treadonly bytes: number,\n\t\treadonly limit: number,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" are ${bytes} bytes, more than the ${limit} bytes ${store} holds in one ${store === 'ssm' ? 'parameter' : 'secret'}. ` +\n\t\t\t\t(store === 'ssm'\n\t\t\t\t\t? `Keep them in Secrets Manager instead, which holds up to 64 KB: set secrets.store to { provider: 'secrets-manager', region } in gkm.config.ts, then move the stage with gkm secrets:migrate --stage ${stage} --from ssm.`\n\t\t\t\t\t: 'Remove credentials the stage no longer uses, or keep the largest ones somewhere they are fetched from at runtime.'),\n\t\t);\n\t\tthis.name = 'StageSecretsTooLarge';\n\t}\n}\n\n/** The stage serialized, refused if it is larger than `limit` bytes. */\nexport function serializeWithin(\n\tstage: string,\n\tstore: string,\n\tvalue: unknown,\n\tlimit: number,\n): string {\n\tconst serialized = JSON.stringify(value);\n\tconst bytes = Buffer.byteLength(serialized, 'utf8');\n\tif (bytes > limit) {\n\t\tthrow new StageSecretsTooLarge(stage, store, bytes, limit);\n\t}\n\treturn serialized;\n}\n\n/** Where each AWS store keeps a stage's secrets, as a person reads it. */\nconst AWS_STORES: Record<string, string> = {\n\tssm: 'SSM Parameter Store',\n\t'secrets-manager': 'Secrets Manager',\n};\n\n/** Why the stage's account could not be reached. */\nexport type StageSecretsUnreadableReason = 'no-credentials' | 'expired';\n\nexport interface StageSecretsUnreadableInput {\n\tstage: string;\n\t/** The store's name: `ssm`, `secrets-manager`. */\n\tstore: string;\n\t/** The AWS profile the credentials were looked up with, where one was. */\n\tprofile?: string;\n\t/** Whether the stage was being read or written. */\n\taccess?: 'read' | 'write';\n\treason?: StageSecretsUnreadableReason;\n}\n\n/**\n * A deployed stage's secrets are kept in its AWS account, and no AWS\n * credentials were found to reach them with — or the ones found have expired.\n *\n * Raised by the AWS stores themselves, on a read or a write, so every command\n * that touches a stage's secrets says it the same way.\n */\nexport class StageSecretsUnreadable extends GkmError {\n\treadonly stage: string;\n\treadonly store: string;\n\treadonly profile: string | undefined;\n\treadonly access: 'read' | 'write';\n\treadonly reason: StageSecretsUnreadableReason;\n\n\tconstructor(input: StageSecretsUnreadableInput, cause?: unknown) {\n\t\tconst { stage, store, profile } = input;\n\t\tconst access = input.access ?? 'read';\n\t\tconst reason = input.reason ?? 'no-credentials';\n\t\tconst where = AWS_STORES[store] ?? `the '${store}' store`;\n\t\t// How to name the account: the command's --profile, where it takes\n\t\t// one, or the SDK's own variable.\n\t\tconst named =\n\t\t\t'--profile <profile> where the command takes it, or AWS_PROFILE=<profile>';\n\t\tconst lacking =\n\t\t\treason === 'expired'\n\t\t\t\t? profile\n\t\t\t\t\t? `the AWS profile '${profile}' signed in, but its session has expired. `\n\t\t\t\t\t: 'the AWS credentials found have expired. '\n\t\t\t\t: profile\n\t\t\t\t\t? `the AWS profile '${profile}' has no credentials to ${access} them with. `\n\t\t\t\t\t: `no AWS credentials were found to ${access} them with. `;\n\t\tconst fix = profile\n\t\t\t? `Sign in to it (aws sso login --profile ${profile}) or name another: ${named}.`\n\t\t\t: reason === 'expired'\n\t\t\t\t? `Export fresh ones, or name the account's profile: ${named}.`\n\t\t\t\t: `Name the account's profile: ${named}.`;\n\t\tsuper(\n\t\t\t`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` +\n\t\t\t\tlacking +\n\t\t\t\tfix,\n\t\t\tcause === undefined ? undefined : { cause },\n\t\t);\n\t\tthis.name = 'StageSecretsUnreadable';\n\t\tthis.stage = stage;\n\t\tthis.store = store;\n\t\tthis.profile = profile;\n\t\tthis.access = access;\n\t\tthis.reason = reason;\n\t}\n}\n\n/**\n * Why an AWS call failed for want of credentials, by the SDK's error name —\n * its message being free to change — or undefined when it failed for any\n * other reason.\n *\n * - `CredentialsProviderError`: the credential chain found nothing, or a\n *   profile's SSO session is missing or expired (the SSO provider wraps its\n *   token errors in this one).\n * - `TokenProviderError`: an SSO token, should one reach here unwrapped.\n * - `ExpiredTokenException`/`ExpiredToken`: credentials were found, and AWS\n *   refused them as expired.\n */\nexport function credentialsFailure(\n\terror: unknown,\n): StageSecretsUnreadableReason | undefined {\n\tconst name = (error as Error | undefined)?.name;\n\tif (name === 'CredentialsProviderError' || name === 'TokenProviderError') {\n\t\treturn 'no-credentials';\n\t}\n\tif (name === 'ExpiredTokenException' || name === 'ExpiredToken') {\n\t\treturn 'expired';\n\t}\n\treturn undefined;\n}\n\n/**\n * Run one AWS call of a store, refusing a failure for want of credentials\n * with {@link StageSecretsUnreadable}. Any other failure is the store's own,\n * and passes through.\n */\nexport async function withStageCredentials<T>(\n\tcontext: {\n\t\tstage: string;\n\t\tstore: string;\n\t\tprofile: string | undefined;\n\t\taccess: 'read' | 'write';\n\t},\n\tcall: () => Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await call();\n\t} catch (error) {\n\t\tconst reason = credentialsFailure(error);\n\t\tif (reason === undefined) throw error;\n\t\tthrow new StageSecretsUnreadable(\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t// The profile the SDK's default chain read, when none was named.\n\t\t\t\tprofile: context.profile ?? (process.env.AWS_PROFILE || undefined),\n\t\t\t\treason,\n\t\t\t},\n\t\t\terror,\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;AAuBA,eAAsB,gBAAgB,SAMnC;CACF,MAAM,SAAsD,EAC3D,QAAQ,QAAQ,OACjB;CACA,IAAI,QAAQ,SAAS;EACpB,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;CAC1D;CACA,IAAI,QAAQ,UACX,OAAO,WAAW,QAAQ;CAE3B,OAAO;AACR;;;;;;;;AASA,IAAa,uBAAb,cAA0CA,eAAAA,SAAS;CAExC;CACA;CACA;CACA;CAJV,YACC,OACA,OACA,OACA,OACC;EACD,MACC,0BAA0B,MAAM,QAAQ,MAAM,wBAAwB,MAAM,SAAS,MAAM,gBAAgB,UAAU,QAAQ,cAAc,SAAS,OAClJ,UAAU,QACR,sMAAsM,MAAM,gBAC5M,oHACL;EAVS,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,gBACf,OACA,OACA,OACA,OACS;CACT,MAAM,aAAa,KAAK,UAAU,KAAK;CACvC,MAAM,QAAQ,OAAO,WAAW,YAAY,MAAM;CAClD,IAAI,QAAQ,OACX,MAAM,IAAI,qBAAqB,OAAO,OAAO,OAAO,KAAK;CAE1D,OAAO;AACR;;AAGA,MAAM,aAAqC;CAC1C,KAAK;CACL,mBAAmB;AACpB;;;;;;;;AAuBA,IAAa,yBAAb,cAA4CA,eAAAA,SAAS;CACpD;CACA;CACA;CACA;CACA;CAEA,YAAY,OAAoC,OAAiB;EAChE,MAAM,EAAE,OAAO,OAAO,YAAY;EAClC,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,QAAQ,WAAW,UAAU,QAAQ,MAAM;EAGjD,MAAM,QACL;EACD,MAAM,UACL,WAAW,YACR,UACC,oBAAoB,QAAQ,8CAC5B,6CACD,UACC,oBAAoB,QAAQ,0BAA0B,OAAO,gBAC7D,oCAAoC,OAAO;EAChD,MAAM,MAAM,UACT,0CAA0C,QAAQ,qBAAqB,MAAM,KAC7E,WAAW,YACV,qDAAqD,MAAM,KAC3D,+BAA+B,MAAM;EACzC,MACC,QAAQ,MAAM,gCAAgC,MAAM,sCACnD,UACA,KACD,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC3C;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,QAAQ;EACb,KAAK,UAAU;EACf,KAAK,SAAS;EACd,KAAK,SAAS;CACf;AACD;;;;;;;;;;;;;AAcA,SAAgB,mBACf,OAC2C;CAC3C,MAAM,OAAQ,OAA6B;CAC3C,IAAI,SAAS,8BAA8B,SAAS,sBACnD,OAAO;CAER,IAAI,SAAS,2BAA2B,SAAS,gBAChD,OAAO;AAGT;;;;;;AAOA,eAAsB,qBACrB,SAMA,MACa;CACb,IAAI;EACH,OAAO,MAAM,KAAK;CACnB,SAAS,OAAO;EACf,MAAM,SAAS,mBAAmB,KAAK;EACvC,IAAI,WAAW,KAAA,GAAW,MAAM;EAChC,MAAM,IAAI,uBACT;GACC,GAAG;GAEH,SAAS,QAAQ,YAAY,QAAQ,IAAI,eAAe,KAAA;GACxD;EACD,GACA,KACD;CACD;AACD"}

package/dist/awsStore-BWa1KNY-.mjs

@@ -0,0 +1,119 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+//#region src/secrets/awsStore.ts
+/**
+* What the two AWS secrets stores share: how a client finds its credentials,
+* what it says when it has none, and how big a stage may be before AWS would
+* refuse it.
+*/
+/** The client config both stores build their SDK client from. */
+async function awsClientConfig(options) {
+	const config = { region: options.region };
+	if (options.profile) {
+		const { fromIni } = await import("@aws-sdk/credential-providers");
+		config.credentials = fromIni({ profile: options.profile });
+	}
+	if (options.endpoint) config.endpoint = options.endpoint;
+	return config;
+}
+/**
+* A stage's secrets, serialized, are larger than the store can hold: 8 KB for
+* an SSM parameter (advanced tier), 64 KB for a Secrets Manager secret.
+*
+* Refused before AWS is called, so nothing half-written is left behind and
+* the answer is not a bare `ValidationException`.
+*/
+var StageSecretsTooLarge = class extends GkmError {
+	stage;
+	store;
+	bytes;
+	limit;
+	constructor(stage, store, bytes, limit) {
+		super(`The secrets for stage "${stage}" are ${bytes} bytes, more than the ${limit} bytes ${store} holds in one ${store === "ssm" ? "parameter" : "secret"}. ` + (store === "ssm" ? `Keep them in Secrets Manager instead, which holds up to 64 KB: set secrets.store to { provider: 'secrets-manager', region } in gkm.config.ts, then move the stage with gkm secrets:migrate --stage ${stage} --from ssm.` : "Remove credentials the stage no longer uses, or keep the largest ones somewhere they are fetched from at runtime."));
+		this.stage = stage;
+		this.store = store;
+		this.bytes = bytes;
+		this.limit = limit;
+		this.name = "StageSecretsTooLarge";
+	}
+};
+/** The stage serialized, refused if it is larger than `limit` bytes. */
+function serializeWithin(stage, store, value, limit) {
+	const serialized = JSON.stringify(value);
+	const bytes = Buffer.byteLength(serialized, "utf8");
+	if (bytes > limit) throw new StageSecretsTooLarge(stage, store, bytes, limit);
+	return serialized;
+}
+/** Where each AWS store keeps a stage's secrets, as a person reads it. */
+const AWS_STORES = {
+	ssm: "SSM Parameter Store",
+	"secrets-manager": "Secrets Manager"
+};
+/**
+* A deployed stage's secrets are kept in its AWS account, and no AWS
+* credentials were found to reach them with — or the ones found have expired.
+*
+* Raised by the AWS stores themselves, on a read or a write, so every command
+* that touches a stage's secrets says it the same way.
+*/
+var StageSecretsUnreadable = class extends GkmError {
+	stage;
+	store;
+	profile;
+	access;
+	reason;
+	constructor(input, cause) {
+		const { stage, store, profile } = input;
+		const access = input.access ?? "read";
+		const reason = input.reason ?? "no-credentials";
+		const where = AWS_STORES[store] ?? `the '${store}' store`;
+		const named = "--profile <profile> where the command takes it, or AWS_PROFILE=<profile>";
+		const lacking = reason === "expired" ? profile ? `the AWS profile '${profile}' signed in, but its session has expired. ` : "the AWS credentials found have expired. " : profile ? `the AWS profile '${profile}' has no credentials to ${access} them with. ` : `no AWS credentials were found to ${access} them with. `;
+		const fix = profile ? `Sign in to it (aws sso login --profile ${profile}) or name another: ${named}.` : reason === "expired" ? `Export fresh ones, or name the account's profile: ${named}.` : `Name the account's profile: ${named}.`;
+		super(`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` + lacking + fix, cause === void 0 ? void 0 : { cause });
+		this.name = "StageSecretsUnreadable";
+		this.stage = stage;
+		this.store = store;
+		this.profile = profile;
+		this.access = access;
+		this.reason = reason;
+	}
+};
+/**
+* Why an AWS call failed for want of credentials, by the SDK's error name —
+* its message being free to change — or undefined when it failed for any
+* other reason.
+*
+* - `CredentialsProviderError`: the credential chain found nothing, or a
+*   profile's SSO session is missing or expired (the SSO provider wraps its
+*   token errors in this one).
+* - `TokenProviderError`: an SSO token, should one reach here unwrapped.
+* - `ExpiredTokenException`/`ExpiredToken`: credentials were found, and AWS
+*   refused them as expired.
+*/
+function credentialsFailure(error) {
+	const name = error?.name;
+	if (name === "CredentialsProviderError" || name === "TokenProviderError") return "no-credentials";
+	if (name === "ExpiredTokenException" || name === "ExpiredToken") return "expired";
+}
+/**
+* Run one AWS call of a store, refusing a failure for want of credentials
+* with {@link StageSecretsUnreadable}. Any other failure is the store's own,
+* and passes through.
+*/
+async function withStageCredentials(context, call) {
+	try {
+		return await call();
+	} catch (error) {
+		const reason = credentialsFailure(error);
+		if (reason === void 0) throw error;
+		throw new StageSecretsUnreadable({
+			...context,
+			profile: context.profile ?? (process.env.AWS_PROFILE || void 0),
+			reason
+		}, error);
+	}
+}
+//#endregion
+export { serializeWithin as n, withStageCredentials as r, awsClientConfig as t };
+
+//# sourceMappingURL=awsStore-BWa1KNY-.mjs.map

package/dist/awsStore-BWa1KNY-.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"awsStore-BWa1KNY-.mjs","names":[],"sources":["../src/secrets/awsStore.ts"],"sourcesContent":["/**\n * What the two AWS secrets stores share: how a client finds its credentials,\n * what it says when it has none, and how big a stage may be before AWS would\n * refuse it.\n */\n\nimport { GkmError } from '../errors';\n\nexport interface AwsStoreOptions {\n\t/** The workspace name, which scopes where the stage is kept. */\n\tproject: string;\n\tregion: string;\n\t/**\n\t * A named AWS profile, resolved with `fromIni` only. The default chain\n\t * reads AWS_* from the environment first, so exported staging keys would\n\t * win over `--profile prod` and put production's secrets in staging.\n\t */\n\tprofile?: string;\n\t/** For tests: an endpoint such as the AWS emulator. */\n\tendpoint?: string;\n}\n\n/** The client config both stores build their SDK client from. */\nexport async function awsClientConfig(options: AwsStoreOptions): Promise<{\n\tregion: string;\n\tendpoint?: string;\n\tcredentials?: ReturnType<\n\t\ttypeof import('@aws-sdk/credential-providers').fromIni\n\t>;\n}> {\n\tconst config: Awaited<ReturnType<typeof awsClientConfig>> = {\n\t\tregion: options.region,\n\t};\n\tif (options.profile) {\n\t\tconst { fromIni } = await import('@aws-sdk/credential-providers');\n\t\tconfig.credentials = fromIni({ profile: options.profile });\n\t}\n\tif (options.endpoint) {\n\t\tconfig.endpoint = options.endpoint;\n\t}\n\treturn config;\n}\n\n/**\n * A stage's secrets, serialized, are larger than the store can hold: 8 KB for\n * an SSM parameter (advanced tier), 64 KB for a Secrets Manager secret.\n *\n * Refused before AWS is called, so nothing half-written is left behind and\n * the answer is not a bare `ValidationException`.\n */\nexport class StageSecretsTooLarge extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\treadonly store: string,\n\t\treadonly bytes: number,\n\t\treadonly limit: number,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" are ${bytes} bytes, more than the ${limit} bytes ${store} holds in one ${store === 'ssm' ? 'parameter' : 'secret'}. ` +\n\t\t\t\t(store === 'ssm'\n\t\t\t\t\t? `Keep them in Secrets Manager instead, which holds up to 64 KB: set secrets.store to { provider: 'secrets-manager', region } in gkm.config.ts, then move the stage with gkm secrets:migrate --stage ${stage} --from ssm.`\n\t\t\t\t\t: 'Remove credentials the stage no longer uses, or keep the largest ones somewhere they are fetched from at runtime.'),\n\t\t);\n\t\tthis.name = 'StageSecretsTooLarge';\n\t}\n}\n\n/** The stage serialized, refused if it is larger than `limit` bytes. */\nexport function serializeWithin(\n\tstage: string,\n\tstore: string,\n\tvalue: unknown,\n\tlimit: number,\n): string {\n\tconst serialized = JSON.stringify(value);\n\tconst bytes = Buffer.byteLength(serialized, 'utf8');\n\tif (bytes > limit) {\n\t\tthrow new StageSecretsTooLarge(stage, store, bytes, limit);\n\t}\n\treturn serialized;\n}\n\n/** Where each AWS store keeps a stage's secrets, as a person reads it. */\nconst AWS_STORES: Record<string, string> = {\n\tssm: 'SSM Parameter Store',\n\t'secrets-manager': 'Secrets Manager',\n};\n\n/** Why the stage's account could not be reached. */\nexport type StageSecretsUnreadableReason = 'no-credentials' | 'expired';\n\nexport interface StageSecretsUnreadableInput {\n\tstage: string;\n\t/** The store's name: `ssm`, `secrets-manager`. */\n\tstore: string;\n\t/** The AWS profile the credentials were looked up with, where one was. */\n\tprofile?: string;\n\t/** Whether the stage was being read or written. */\n\taccess?: 'read' | 'write';\n\treason?: StageSecretsUnreadableReason;\n}\n\n/**\n * A deployed stage's secrets are kept in its AWS account, and no AWS\n * credentials were found to reach them with — or the ones found have expired.\n *\n * Raised by the AWS stores themselves, on a read or a write, so every command\n * that touches a stage's secrets says it the same way.\n */\nexport class StageSecretsUnreadable extends GkmError {\n\treadonly stage: string;\n\treadonly store: string;\n\treadonly profile: string | undefined;\n\treadonly access: 'read' | 'write';\n\treadonly reason: StageSecretsUnreadableReason;\n\n\tconstructor(input: StageSecretsUnreadableInput, cause?: unknown) {\n\t\tconst { stage, store, profile } = input;\n\t\tconst access = input.access ?? 'read';\n\t\tconst reason = input.reason ?? 'no-credentials';\n\t\tconst where = AWS_STORES[store] ?? `the '${store}' store`;\n\t\t// How to name the account: the command's --profile, where it takes\n\t\t// one, or the SDK's own variable.\n\t\tconst named =\n\t\t\t'--profile <profile> where the command takes it, or AWS_PROFILE=<profile>';\n\t\tconst lacking =\n\t\t\treason === 'expired'\n\t\t\t\t? profile\n\t\t\t\t\t? `the AWS profile '${profile}' signed in, but its session has expired. `\n\t\t\t\t\t: 'the AWS credentials found have expired. '\n\t\t\t\t: profile\n\t\t\t\t\t? `the AWS profile '${profile}' has no credentials to ${access} them with. `\n\t\t\t\t\t: `no AWS credentials were found to ${access} them with. `;\n\t\tconst fix = profile\n\t\t\t? `Sign in to it (aws sso login --profile ${profile}) or name another: ${named}.`\n\t\t\t: reason === 'expired'\n\t\t\t\t? `Export fresh ones, or name the account's profile: ${named}.`\n\t\t\t\t: `Name the account's profile: ${named}.`;\n\t\tsuper(\n\t\t\t`The '${stage}' stage's secrets are kept in ${where}, in the stage's AWS account, and ` +\n\t\t\t\tlacking +\n\t\t\t\tfix,\n\t\t\tcause === undefined ? undefined : { cause },\n\t\t);\n\t\tthis.name = 'StageSecretsUnreadable';\n\t\tthis.stage = stage;\n\t\tthis.store = store;\n\t\tthis.profile = profile;\n\t\tthis.access = access;\n\t\tthis.reason = reason;\n\t}\n}\n\n/**\n * Why an AWS call failed for want of credentials, by the SDK's error name —\n * its message being free to change — or undefined when it failed for any\n * other reason.\n *\n * - `CredentialsProviderError`: the credential chain found nothing, or a\n *   profile's SSO session is missing or expired (the SSO provider wraps its\n *   token errors in this one).\n * - `TokenProviderError`: an SSO token, should one reach here unwrapped.\n * - `ExpiredTokenException`/`ExpiredToken`: credentials were found, and AWS\n *   refused them as expired.\n */\nexport function credentialsFailure(\n\terror: unknown,\n): StageSecretsUnreadableReason | undefined {\n\tconst name = (error as Error | undefined)?.name;\n\tif (name === 'CredentialsProviderError' || name === 'TokenProviderError') {\n\t\treturn 'no-credentials';\n\t}\n\tif (name === 'ExpiredTokenException' || name === 'ExpiredToken') {\n\t\treturn 'expired';\n\t}\n\treturn undefined;\n}\n\n/**\n * Run one AWS call of a store, refusing a failure for want of credentials\n * with {@link StageSecretsUnreadable}. Any other failure is the store's own,\n * and passes through.\n */\nexport async function withStageCredentials<T>(\n\tcontext: {\n\t\tstage: string;\n\t\tstore: string;\n\t\tprofile: string | undefined;\n\t\taccess: 'read' | 'write';\n\t},\n\tcall: () => Promise<T>,\n): Promise<T> {\n\ttry {\n\t\treturn await call();\n\t} catch (error) {\n\t\tconst reason = credentialsFailure(error);\n\t\tif (reason === undefined) throw error;\n\t\tthrow new StageSecretsUnreadable(\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t// The profile the SDK's default chain read, when none was named.\n\t\t\t\tprofile: context.profile ?? (process.env.AWS_PROFILE || undefined),\n\t\t\t\treason,\n\t\t\t},\n\t\t\terror,\n\t\t);\n\t}\n}\n"],"mappings":";;;;;;;;AAuBA,eAAsB,gBAAgB,SAMnC;CACF,MAAM,SAAsD,EAC3D,QAAQ,QAAQ,OACjB;CACA,IAAI,QAAQ,SAAS;EACpB,MAAM,EAAE,YAAY,MAAM,OAAO;EACjC,OAAO,cAAc,QAAQ,EAAE,SAAS,QAAQ,QAAQ,CAAC;CAC1D;CACA,IAAI,QAAQ,UACX,OAAO,WAAW,QAAQ;CAE3B,OAAO;AACR;;;;;;;;AASA,IAAa,uBAAb,cAA0C,SAAS;CAExC;CACA;CACA;CACA;CAJV,YACC,OACA,OACA,OACA,OACC;EACD,MACC,0BAA0B,MAAM,QAAQ,MAAM,wBAAwB,MAAM,SAAS,MAAM,gBAAgB,UAAU,QAAQ,cAAc,SAAS,OAClJ,UAAU,QACR,sMAAsM,MAAM,gBAC5M,oHACL;EAVS,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;EAQT,KAAK,OAAO;CACb;AACD;;AAGA,SAAgB,gBACf,OACA,OACA,OACA,OACS;CACT,MAAM,aAAa,KAAK,UAAU,KAAK;CACvC,MAAM,QAAQ,OAAO,WAAW,YAAY,MAAM;CAClD,IAAI,QAAQ,OACX,MAAM,IAAI,qBAAqB,OAAO,OAAO,OAAO,KAAK;CAE1D,OAAO;AACR;;AAGA,MAAM,aAAqC;CAC1C,KAAK;CACL,mBAAmB;AACpB;;;;;;;;AAuBA,IAAa,yBAAb,cAA4C,SAAS;CACpD;CACA;CACA;CACA;CACA;CAEA,YAAY,OAAoC,OAAiB;EAChE,MAAM,EAAE,OAAO,OAAO,YAAY;EAClC,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,SAAS,MAAM,UAAU;EAC/B,MAAM,QAAQ,WAAW,UAAU,QAAQ,MAAM;EAGjD,MAAM,QACL;EACD,MAAM,UACL,WAAW,YACR,UACC,oBAAoB,QAAQ,8CAC5B,6CACD,UACC,oBAAoB,QAAQ,0BAA0B,OAAO,gBAC7D,oCAAoC,OAAO;EAChD,MAAM,MAAM,UACT,0CAA0C,QAAQ,qBAAqB,MAAM,KAC7E,WAAW,YACV,qDAAqD,MAAM,KAC3D,+BAA+B,MAAM;EACzC,MACC,QAAQ,MAAM,gCAAgC,MAAM,sCACnD,UACA,KACD,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM,CAC3C;EACA,KAAK,OAAO;EACZ,KAAK,QAAQ;EACb,KAAK,QAAQ;EACb,KAAK,UAAU;EACf,KAAK,SAAS;EACd,KAAK,SAAS;CACf;AACD;;;;;;;;;;;;;AAcA,SAAgB,mBACf,OAC2C;CAC3C,MAAM,OAAQ,OAA6B;CAC3C,IAAI,SAAS,8BAA8B,SAAS,sBACnD,OAAO;CAER,IAAI,SAAS,2BAA2B,SAAS,gBAChD,OAAO;AAGT;;;;;;AAOA,eAAsB,qBACrB,SAMA,MACa;CACb,IAAI;EACH,OAAO,MAAM,KAAK;CACnB,SAAS,OAAO;EACf,MAAM,SAAS,mBAAmB,KAAK;EACvC,IAAI,WAAW,KAAA,GAAW,MAAM;EAChC,MAAM,IAAI,uBACT;GACC,GAAG;GAEH,SAAS,QAAQ,YAAY,QAAQ,IAAI,eAAe,KAAA;GACxD;EACD,GACA,KACD;CACD;AACD"}

package/dist/{bundler-D6eBfVkl.mjs → bundler-C-AdesaG.mjs}

@@ -82,10 +82,10 @@ async function bundleServer(options) {
 	for (const ext of external) args.push(`--external:${ext}`);
 	let masterKey;
 	if (stage) {
-		const { toEmbeddableSecrets, validateEnvironmentVariables, initStageSecrets } = await import("./seeds-odfgSCmu.mjs").then((n) => n.Xn);
-		const { FileSecretsStore, secretsStoreFor } = await import("./seeds-odfgSCmu.mjs").then((n) => n.Pn);
+		const { toEmbeddableSecrets, validateEnvironmentVariables, initStageSecrets } = await import("./seeds-CvGQJnPO.mjs").then((n) => n.Xn);
+		const { FileSecretsStore, secretsStoreFor } = await import("./seeds-CvGQJnPO.mjs").then((n) => n.Pn);
 		const { ConfigNotFound, loadWorkspaceSettings } = await import("./config.mjs");
-		const { encryptSecrets, generateDefineOptions } = await import("./sniffer-BTtX3NUM.mjs").then((n) => n.d);
+		const { encryptSecrets, generateDefineOptions } = await import("./sniffer-BTtGAtm3.mjs").then((n) => n.d);
 		const store = await loadWorkspaceSettings().then((workspace) => secretsStoreFor(workspace, stage), (error) => {
 			if (error instanceof ConfigNotFound) return new FileSecretsStore(process.cwd());
 			throw error;
@@ -133,7 +133,7 @@ async function bundleServer(options) {
 		const encryptedPath = join(gkmDir, "credentials.enc");
 		const ivPath = join(gkmDir, "credentials.iv");
 		if (existsSync(encryptedPath) && existsSync(ivPath)) {
-			const { generateDefineOptions } = await import("./sniffer-BTtX3NUM.mjs").then((n) => n.d);
+			const { generateDefineOptions } = await import("./sniffer-BTtGAtm3.mjs").then((n) => n.d);
 			const defines = generateDefineOptions({
 				encrypted: readFileSync(encryptedPath, "utf-8").trim(),
 				iv: readFileSync(ivPath, "utf-8").trim(),
@@ -166,4 +166,4 @@ async function bundleServer(options) {
 //#endregion
 export { bundleServer };
 
-//# sourceMappingURL=bundler-D6eBfVkl.mjs.map
+//# sourceMappingURL=bundler-C-AdesaG.mjs.map

package/dist/{bundler-D6eBfVkl.mjs.map → bundler-C-AdesaG.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"bundler-D6eBfVkl.mjs","names":[],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/**\n * Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n */\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/** Entry point file (e.g., .gkm/server/server.ts) */\n\tentryPoint: string;\n\t/** Output directory for bundled files */\n\toutputDir: string;\n\t/** The bundle's file name in `outputDir`. Defaults to `server.mjs`. */\n\toutfile?: string;\n\t/** Minify the output (default: true) */\n\tminify: boolean;\n\t/** Generate sourcemaps (default: false) */\n\tsourcemap: boolean;\n\t/** Packages to exclude from bundling */\n\texternal: string[];\n\t/** Stage for secrets injection (optional) */\n\tstage?: string;\n\t/** Constructs to validate environment variables for */\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/** Path to the bundled output */\n\toutputPath: string;\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n/**\n * The esbuild binary, resolved from this package rather than from PATH.\n *\n * It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the *app's* directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n *\n * The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n */\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/**\n * Collect the environment variables a build cannot proceed without.\n *\n * Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n *\n * Without it, a key that is *absent by design* failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n *\n * @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n */\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/**\n * Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n *\n * @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified)\n\tfor (const ext of external) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string | undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(`  Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(`  ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log('  Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => `  ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t`  1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t`     gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t`  2. Or import from a JSON file:`,\n\t\t\t\t\t\t`     gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? `  ❌ ${v}` : `  ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`  ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(`  Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log('  Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAM,UAAU,cAAc,YAAY,GAAG;CAE7C,IAAI;EAGH,MAAM,MAAM,QAAQ,QAAQ,sBAAsB;EAClD,OAAO,KAAK,QAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,YAAY,KAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAIxB,KAAK,MAAM,OAAO,UACjB,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAM,OAAO,uBAAqB,CAAA,MAAA,MAAA,EAAA,EAAA;EACtC,MAAM,EAAE,kBAAkB,oBAAoB,MAAM,OACnD,uBACA,CAAA,MAAA,MAAA,EAAA,EAAA;EACD,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OAAO;EAC/D,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OACvD,yBACA,CAAA,MAAA,MAAA,EAAA,CAAA;EAKD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,SAAS,KAAK,WAAW,MAAM,IAAI;EACzC,MAAM,gBAAgB,KAAK,QAAQ,iBAAiB;EACpD,MAAM,SAAS,KAAK,QAAQ,gBAAgB;EAC5C,IAAI,WAAW,aAAa,KAAK,WAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAM,OAAO,yBAAwB,CAAA,MAAA,MAAA,EAAA,CAAA;GACvE,MAAM,UAAU,sBAAsB;IACrC,WAAW,aAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,IAAI,aAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,SAAS,UAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,MAAM,UAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}
+{"version":3,"file":"bundler-C-AdesaG.mjs","names":[],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/**\n * Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n */\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/** Entry point file (e.g., .gkm/server/server.ts) */\n\tentryPoint: string;\n\t/** Output directory for bundled files */\n\toutputDir: string;\n\t/** The bundle's file name in `outputDir`. Defaults to `server.mjs`. */\n\toutfile?: string;\n\t/** Minify the output (default: true) */\n\tminify: boolean;\n\t/** Generate sourcemaps (default: false) */\n\tsourcemap: boolean;\n\t/** Packages to exclude from bundling */\n\texternal: string[];\n\t/** Stage for secrets injection (optional) */\n\tstage?: string;\n\t/** Constructs to validate environment variables for */\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/** Path to the bundled output */\n\toutputPath: string;\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n/**\n * The esbuild binary, resolved from this package rather than from PATH.\n *\n * It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the *app's* directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n *\n * The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n */\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/**\n * Collect the environment variables a build cannot proceed without.\n *\n * Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n *\n * Without it, a key that is *absent by design* failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n *\n * @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n */\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/**\n * Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n *\n * @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified)\n\tfor (const ext of external) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string | undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(`  Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(`  ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log('  Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => `  ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t`  1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t`     gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t`  2. Or import from a JSON file:`,\n\t\t\t\t\t\t`     gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? `  ❌ ${v}` : `  ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`  ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(`  Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log('  Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAM,UAAU,cAAc,YAAY,GAAG;CAE7C,IAAI;EAGH,MAAM,MAAM,QAAQ,QAAQ,sBAAsB;EAClD,OAAO,KAAK,QAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,MAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,YAAY,KAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAIxB,KAAK,MAAM,OAAO,UACjB,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAM,OAAO,uBAAqB,CAAA,MAAA,MAAA,EAAA,EAAA;EACtC,MAAM,EAAE,kBAAkB,oBAAoB,MAAM,OACnD,uBACA,CAAA,MAAA,MAAA,EAAA,EAAA;EACD,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OAAO;EAC/D,MAAM,EAAE,gBAAgB,0BAA0B,MAAM,OACvD,yBACA,CAAA,MAAA,MAAA,EAAA,CAAA;EAKD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,SAAS,KAAK,WAAW,MAAM,IAAI;EACzC,MAAM,gBAAgB,KAAK,QAAQ,iBAAiB;EACpD,MAAM,SAAS,KAAK,QAAQ,gBAAgB;EAC5C,IAAI,WAAW,aAAa,KAAK,WAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAM,OAAO,yBAAwB,CAAA,MAAA,MAAA,EAAA,CAAA;GACvE,MAAM,UAAU,sBAAsB;IACrC,WAAW,aAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,IAAI,aAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,SAAS,UAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,MAAM,UAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}

package/dist/{bundler-BQJiB7Ub.cjs → bundler-CXQDrhzN.cjs}

@@ -82,10 +82,10 @@ async function bundleServer(options) {
 	for (const ext of external) args.push(`--external:${ext}`);
 	let masterKey;
 	if (stage) {
-		const { toEmbeddableSecrets, validateEnvironmentVariables, initStageSecrets } = await Promise.resolve().then(() => require("./seeds-CkIPFGNO.cjs")).then((n) => n.storage_exports);
-		const { FileSecretsStore, secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-CkIPFGNO.cjs")).then((n) => n.store_exports);
+		const { toEmbeddableSecrets, validateEnvironmentVariables, initStageSecrets } = await Promise.resolve().then(() => require("./seeds-BKoJYsE7.cjs")).then((n) => n.storage_exports);
+		const { FileSecretsStore, secretsStoreFor } = await Promise.resolve().then(() => require("./seeds-BKoJYsE7.cjs")).then((n) => n.store_exports);
 		const { ConfigNotFound, loadWorkspaceSettings } = await Promise.resolve().then(() => require("./config.cjs"));
-		const { encryptSecrets, generateDefineOptions } = await Promise.resolve().then(() => require("./sniffer-IAQEpsQb.cjs")).then((n) => n.encryption_exports);
+		const { encryptSecrets, generateDefineOptions } = await Promise.resolve().then(() => require("./sniffer-Dq5BS98f.cjs")).then((n) => n.encryption_exports);
 		const store = await loadWorkspaceSettings().then((workspace) => secretsStoreFor(workspace, stage), (error) => {
 			if (error instanceof ConfigNotFound) return new FileSecretsStore(process.cwd());
 			throw error;
@@ -133,7 +133,7 @@ async function bundleServer(options) {
 		const encryptedPath = (0, node_path.join)(gkmDir, "credentials.enc");
 		const ivPath = (0, node_path.join)(gkmDir, "credentials.iv");
 		if ((0, node_fs.existsSync)(encryptedPath) && (0, node_fs.existsSync)(ivPath)) {
-			const { generateDefineOptions } = await Promise.resolve().then(() => require("./sniffer-IAQEpsQb.cjs")).then((n) => n.encryption_exports);
+			const { generateDefineOptions } = await Promise.resolve().then(() => require("./sniffer-Dq5BS98f.cjs")).then((n) => n.encryption_exports);
 			const defines = generateDefineOptions({
 				encrypted: (0, node_fs.readFileSync)(encryptedPath, "utf-8").trim(),
 				iv: (0, node_fs.readFileSync)(ivPath, "utf-8").trim(),
@@ -166,4 +166,4 @@ async function bundleServer(options) {
 //#endregion
 exports.bundleServer = bundleServer;
 
-//# sourceMappingURL=bundler-BQJiB7Ub.cjs.map
+//# sourceMappingURL=bundler-CXQDrhzN.cjs.map

package/dist/{bundler-BQJiB7Ub.cjs.map → bundler-CXQDrhzN.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"bundler-BQJiB7Ub.cjs","names":["require","createRequire","join","dirname","mkdir","existsSync","readFileSync","spawnSync","writeFile"],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/**\n * Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n */\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/** Entry point file (e.g., .gkm/server/server.ts) */\n\tentryPoint: string;\n\t/** Output directory for bundled files */\n\toutputDir: string;\n\t/** The bundle's file name in `outputDir`. Defaults to `server.mjs`. */\n\toutfile?: string;\n\t/** Minify the output (default: true) */\n\tminify: boolean;\n\t/** Generate sourcemaps (default: false) */\n\tsourcemap: boolean;\n\t/** Packages to exclude from bundling */\n\texternal: string[];\n\t/** Stage for secrets injection (optional) */\n\tstage?: string;\n\t/** Constructs to validate environment variables for */\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/** Path to the bundled output */\n\toutputPath: string;\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n/**\n * The esbuild binary, resolved from this package rather than from PATH.\n *\n * It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the *app's* directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n *\n * The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n */\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/**\n * Collect the environment variables a build cannot proceed without.\n *\n * Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n *\n * Without it, a key that is *absent by design* failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n *\n * @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n */\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/**\n * Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n *\n * @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified)\n\tfor (const ext of external) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string | undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(`  Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(`  ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log('  Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => `  ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t`  1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t`     gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t`  2. Or import from a JSON file:`,\n\t\t\t\t\t\t`     gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? `  ❌ ${v}` : `  ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`  ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(`  Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log('  Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAMA,aAAAA,GAAUC,YAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B;CAE7C,IAAI;EAGH,MAAM,MAAMD,UAAQ,QAAQ,sBAAsB;EAClD,QAAA,GAAOE,UAAAA,KAAAA,EAAAA,GAAKC,UAAAA,QAAAA,CAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,OAAA,GAAMC,iBAAAA,MAAAA,CAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,aAAA,GAAYF,UAAAA,KAAAA,CAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAIxB,KAAK,MAAM,OAAO,UACjB,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,sBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,eAAA;EACV,MAAM,EAAE,kBAAkB,oBAAoB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,sBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,aAAA;EAGpD,MAAM,EAAE,gBAAgB,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,cAAA,CAAA;EACxD,MAAM,EAAE,gBAAgB,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,kBAAA;EAOxD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,UAAA,GAASA,UAAAA,KAAAA,CAAK,WAAW,MAAM,IAAI;EACzC,MAAM,iBAAA,GAAgBA,UAAAA,KAAAA,CAAK,QAAQ,iBAAiB;EACpD,MAAM,UAAA,GAASA,UAAAA,KAAAA,CAAK,QAAQ,gBAAgB;EAC5C,KAAA,GAAIG,QAAAA,WAAAA,CAAW,aAAa,MAAA,GAAKA,QAAAA,WAAAA,CAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,kBAAA;GACxC,MAAM,UAAU,sBAAsB;IACrC,YAAA,GAAWC,QAAAA,aAAAA,CAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,KAAA,GAAIA,QAAAA,aAAAA,CAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,UAAA,GAASC,mBAAAA,UAAAA,CAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,OAAA,GAAMC,iBAAAA,UAAAA,CAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}
+{"version":3,"file":"bundler-CXQDrhzN.cjs","names":["require","createRequire","join","dirname","mkdir","existsSync","readFileSync","spawnSync","writeFile"],"sources":["../src/build/bundler.ts"],"sourcesContent":["import { spawnSync } from 'node:child_process';\nimport { existsSync, readFileSync } from 'node:fs';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { createRequire } from 'node:module';\nimport { dirname, join } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\n\n/**\n * Banner to inject into ESM bundle for CJS compatibility.\n * Creates a `require` function using Node's createRequire for packages\n * that internally use CommonJS require() for Node builtins.\n */\nconst ESM_CJS_COMPAT_BANNER =\n\t'import { createRequire } from \"module\"; const require = createRequire(import.meta.url);';\n\nexport interface BundleOptions {\n\t/** Entry point file (e.g., .gkm/server/server.ts) */\n\tentryPoint: string;\n\t/** Output directory for bundled files */\n\toutputDir: string;\n\t/** The bundle's file name in `outputDir`. Defaults to `server.mjs`. */\n\toutfile?: string;\n\t/** Minify the output (default: true) */\n\tminify: boolean;\n\t/** Generate sourcemaps (default: false) */\n\tsourcemap: boolean;\n\t/** Packages to exclude from bundling */\n\texternal: string[];\n\t/** Stage for secrets injection (optional) */\n\tstage?: string;\n\t/** Constructs to validate environment variables for */\n\tconstructs?: Construct[];\n}\n\nexport interface BundleResult {\n\t/** Path to the bundled output */\n\toutputPath: string;\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n/**\n * The esbuild binary, resolved from this package rather than from PATH.\n *\n * It used to be `npx esbuild`, which is two assumptions: that esbuild is\n * installed somewhere npx can find, and that the *app's* directory is where to\n * look. Neither holds — the CLI did not depend on esbuild at all, so a deploy\n * run from an app that had not installed it failed at the bundle step with\n * `sh: esbuild: command not found`, after provisioning had already happened.\n *\n * The same fix `bin/gkm.mjs` makes for tsx: resolve from this package's own\n * `node_modules`, so the tool the CLI shells out to is the one it depends on.\n */\nfunction esbuildBinary(): string {\n\tconst require = createRequire(import.meta.url);\n\n\ttry {\n\t\t// The package root, then its bin — `require.resolve('esbuild')` gives the\n\t\t// JS entry point, which is a library rather than the CLI.\n\t\tconst pkg = require.resolve('esbuild/package.json');\n\t\treturn join(dirname(pkg), 'bin', 'esbuild');\n\t} catch {\n\t\t// Better a PATH lookup than a hard failure: a project that installed\n\t\t// esbuild itself still works.\n\t\treturn 'esbuild';\n\t}\n}\n\n/**\n * Collect the environment variables a build cannot proceed without.\n *\n * Uses the SnifferEnvironmentParser to detect which env vars each service\n * reads, and keeps only the ones it cannot do without. `markOptional` is what\n * separates them: the sniffer already knows which reads went through\n * `.optional()` or `.default()`, and asking for that distinction is the\n * difference between a build that stops and one that proceeds correctly.\n *\n * Without it, a key that is *absent by design* failed the build. A surface\n * publishes `AUTH_COOKIE_DOMAIN` only when there is a domain to widen a cookie\n * to — one host has nothing to share it with, so the derivation correctly\n * yields nothing, and Better Auth reads it as optional for exactly that\n * reason. Treating every sniffed read as required made the honest answer\n * indistinguishable from a missing secret.\n *\n * @param constructs - Array of constructs to analyze\n * @returns Deduplicated, sorted names of the required variables\n */\nasync function collectRequiredEnvVars(\n\tconstructs: Construct[],\n): Promise<string[]> {\n\t// A key read optionally by one construct and required by another stays\n\t// required: the strictest read is the one that fails at runtime, and taking\n\t// the union of the required reads is what says so.\n\tconst required = new Set<string>();\n\n\tfor (const construct of constructs) {\n\t\tfor (const name of await construct.getEnvironment({ markOptional: true })) {\n\t\t\tif (!name.endsWith('?')) required.add(name);\n\t\t}\n\t}\n\n\treturn Array.from(required).sort();\n}\n\n/**\n * Bundle the server application using esbuild.\n * Creates a fully standalone bundle with all dependencies included.\n *\n * @param options - Bundle configuration options\n * @returns Bundle result with output path and optional master key\n */\n\nexport async function bundleServer(\n\toptions: BundleOptions,\n): Promise<BundleResult> {\n\tconst {\n\t\tentryPoint,\n\t\toutputDir,\n\t\tminify,\n\t\tsourcemap,\n\t\texternal,\n\t\tstage,\n\t\tconstructs,\n\t} = options;\n\n\t// Ensure output directory exists\n\tawait mkdir(outputDir, { recursive: true });\n\n\tconst mjsOutput = join(outputDir, options.outfile ?? 'server.mjs');\n\n\t// Build command-line arguments for esbuild\n\tconst args = [\n\t\tesbuildBinary(),\n\t\tentryPoint,\n\t\t'--bundle',\n\t\t'--platform=node',\n\t\t'--target=node22',\n\t\t'--format=esm',\n\t\t`--outfile=${mjsOutput}`,\n\t\t'--packages=bundle', // Bundle all dependencies for standalone output\n\t\t`--banner:js=${ESM_CJS_COMPAT_BANNER}`, // CJS compatibility for packages like pino\n\t];\n\n\tif (minify) {\n\t\t// Names kept: an error's class name is what a log line's `err.type` and\n\t\t// a response's `name` say, and minified they read `_6`.\n\t\targs.push('--minify', '--keep-names');\n\t}\n\n\tif (sourcemap) {\n\t\targs.push('--sourcemap');\n\t}\n\n\t// Add external packages (user-specified)\n\tfor (const ext of external) {\n\t\targs.push(`--external:${ext}`);\n\t}\n\n\t// Handle secrets injection if stage is provided\n\tlet masterKey: string | undefined;\n\n\tif (stage) {\n\t\tconst {\n\t\t\ttoEmbeddableSecrets,\n\t\t\tvalidateEnvironmentVariables,\n\t\t\tinitStageSecrets,\n\t\t} = await import('../secrets/storage');\n\t\tconst { FileSecretsStore, secretsStoreFor } = await import(\n\t\t\t'../secrets/store'\n\t\t);\n\t\tconst { ConfigNotFound, loadWorkspaceSettings } = await import('../config');\n\t\tconst { encryptSecrets, generateDefineOptions } = await import(\n\t\t\t'../secrets/encryption'\n\t\t);\n\n\t\t// The stage's own store — SSM or Secrets Manager for a deployed stage\n\t\t// kept there. Outside\n\t\t// any workspace nothing names one, so it is the file.\n\t\tconst store = await loadWorkspaceSettings().then(\n\t\t\t(workspace) => secretsStoreFor(workspace, stage),\n\t\t\t(error) => {\n\t\t\t\tif (error instanceof ConfigNotFound) {\n\t\t\t\t\treturn new FileSecretsStore(process.cwd());\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t},\n\t\t);\n\t\tlet secrets = await store.read(stage);\n\n\t\tif (!secrets) {\n\t\t\t// Auto-initialize secrets for the stage\n\t\t\tconsole.log(`  Initializing secrets for stage \"${stage}\"...`);\n\t\t\tsecrets = initStageSecrets(stage);\n\t\t\tawait store.write(stage, secrets);\n\t\t\tconsole.log(`  ✓ Created the \"${stage}\" secrets (${store.name})`);\n\t\t}\n\n\t\t// Validate environment variables if constructs are provided\n\t\tif (constructs && constructs.length > 0) {\n\t\t\tconsole.log('  Analyzing environment variable requirements...');\n\t\t\tconst requiredVars = await collectRequiredEnvVars(constructs);\n\n\t\t\tif (requiredVars.length > 0) {\n\t\t\t\tconst validation = validateEnvironmentVariables(requiredVars, secrets);\n\n\t\t\t\tif (!validation.valid) {\n\t\t\t\t\tconst errorMessage = [\n\t\t\t\t\t\t`Missing environment variables for stage \"${stage}\":`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t...validation.missing.map((v) => `  ❌ ${v}`),\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'To fix this, either:',\n\t\t\t\t\t\t`  1. Add the missing variables to the \"${stage}\" secrets using:`,\n\t\t\t\t\t\t`     gkm secrets:set <KEY> <VALUE> --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t`  2. Or import from a JSON file:`,\n\t\t\t\t\t\t`     gkm secrets:import secrets.json --stage ${stage}`,\n\t\t\t\t\t\t'',\n\t\t\t\t\t\t'Required variables:',\n\t\t\t\t\t\t...validation.required.map((v) =>\n\t\t\t\t\t\t\tvalidation.missing.includes(v) ? `  ❌ ${v}` : `  ✓ ${v}`,\n\t\t\t\t\t\t),\n\t\t\t\t\t].join('\\n');\n\n\t\t\t\t\tthrow new Error(errorMessage);\n\t\t\t\t}\n\n\t\t\t\tconsole.log(\n\t\t\t\t\t`  ✓ All ${requiredVars.length} required environment variables found`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\t// Convert to embeddable format and encrypt\n\t\tconst embeddable = toEmbeddableSecrets(secrets);\n\t\tconst encrypted = encryptSecrets(embeddable);\n\t\tmasterKey = encrypted.masterKey;\n\n\t\t// Add define options for build-time injection using esbuild's --define:KEY=VALUE format\n\t\tconst defines = generateDefineOptions(encrypted);\n\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t// `value` is already a JS string literal; quoting it again would\n\t\t\t// embed the quotes, and the IV would not parse as hex.\n\t\t\targs.push(`--define:${key}=${value}`);\n\t\t}\n\n\t\tconsole.log(`  Secrets encrypted for stage \"${stage}\"`);\n\t} else {\n\t\t// Credentials encrypted elsewhere — an image build hands them in as a\n\t\t// BuildKit secret and writes them beside the app's `.gkm/server` — are\n\t\t// embedded as they are; whoever encrypted them holds the key.\n\t\tconst gkmDir = join(outputDir, '..', '..');\n\t\tconst encryptedPath = join(gkmDir, 'credentials.enc');\n\t\tconst ivPath = join(gkmDir, 'credentials.iv');\n\t\tif (existsSync(encryptedPath) && existsSync(ivPath)) {\n\t\t\tconst { generateDefineOptions } = await import('../secrets/encryption');\n\t\t\tconst defines = generateDefineOptions({\n\t\t\t\tencrypted: readFileSync(encryptedPath, 'utf-8').trim(),\n\t\t\t\tiv: readFileSync(ivPath, 'utf-8').trim(),\n\t\t\t\tmasterKey: '',\n\t\t\t});\n\t\t\tfor (const [key, value] of Object.entries(defines)) {\n\t\t\t\targs.push(`--define:${key}=${value}`);\n\t\t\t}\n\t\t\tconsole.log('  Embedded the encrypted credentials the build was given');\n\t\t}\n\t}\n\n\ttry {\n\t\t// Run esbuild with command-line arguments\n\t\tconst [cmd, ...cmdArgs] = args as [string, ...string[]];\n\t\tconst result = spawnSync(cmd, cmdArgs, {\n\t\t\tcwd: process.cwd(),\n\t\t\tstdio: 'inherit',\n\t\t\tshell: process.platform === 'win32', // Only use shell on Windows for npx resolution\n\t\t});\n\n\t\tif (result.error) {\n\t\t\tthrow result.error;\n\t\t}\n\t\tif (result.status !== 0) {\n\t\t\tthrow new Error(`esbuild exited with code ${result.status}`);\n\t\t}\n\n\t\t// Add shebang to the bundled file\n\t\tconst { readFile } = await import('node:fs/promises');\n\t\tconst content = await readFile(mjsOutput, 'utf-8');\n\t\tif (!content.startsWith('#!')) {\n\t\t\tawait writeFile(mjsOutput, `#!/usr/bin/env node\\n${content}`);\n\t\t}\n\t} catch (error) {\n\t\tthrow new Error(\n\t\t\t`Failed to bundle server: ${error instanceof Error ? error.message : 'Unknown error'}`,\n\t\t);\n\t}\n\n\treturn {\n\t\toutputPath: mjsOutput,\n\t\tmasterKey,\n\t};\n}\n"],"mappings":";;;;;;;;;;;AAYA,MAAM,wBACL;;;;;;;;;;;;;AAwCD,SAAS,gBAAwB;CAChC,MAAMA,aAAAA,GAAUC,YAAAA,cAAAA,CAAAA,QAAAA,KAAAA,CAAAA,CAAAA,cAAAA,UAAAA,CAAAA,CAAAA,IAA6B;CAE7C,IAAI;EAGH,MAAM,MAAMD,UAAQ,QAAQ,sBAAsB;EAClD,QAAA,GAAOE,UAAAA,KAAAA,EAAAA,GAAKC,UAAAA,QAAAA,CAAQ,GAAG,GAAG,OAAO,SAAS;CAC3C,QAAQ;EAGP,OAAO;CACR;AACD;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,uBACd,YACoB;CAIpB,MAAM,2BAAW,IAAI,IAAY;CAEjC,KAAK,MAAM,aAAa,YACvB,KAAK,MAAM,QAAQ,MAAM,UAAU,eAAe,EAAE,cAAc,KAAK,CAAC,GACvE,IAAI,CAAC,KAAK,SAAS,GAAG,GAAG,SAAS,IAAI,IAAI;CAI5C,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;AAClC;;;;;;;;AAUA,eAAsB,aACrB,SACwB;CACxB,MAAM,EACL,YACA,WACA,QACA,WACA,UACA,OACA,eACG;CAGJ,OAAA,GAAMC,iBAAAA,MAAAA,CAAM,WAAW,EAAE,WAAW,KAAK,CAAC;CAE1C,MAAM,aAAA,GAAYF,UAAAA,KAAAA,CAAK,WAAW,QAAQ,WAAW,YAAY;CAGjE,MAAM,OAAO;EACZ,cAAc;EACd;EACA;EACA;EACA;EACA;EACA,aAAa;EACb;EACA,eAAe;CAChB;CAEA,IAAI,QAGH,KAAK,KAAK,YAAY,cAAc;CAGrC,IAAI,WACH,KAAK,KAAK,aAAa;CAIxB,KAAK,MAAM,OAAO,UACjB,KAAK,KAAK,cAAc,KAAK;CAI9B,IAAI;CAEJ,IAAI,OAAO;EACV,MAAM,EACL,qBACA,8BACA,qBACG,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,sBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,eAAA;EACV,MAAM,EAAE,kBAAkB,oBAAoB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,sBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,aAAA;EAGpD,MAAM,EAAE,gBAAgB,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,cAAA,CAAA;EACxD,MAAM,EAAE,gBAAgB,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,kBAAA;EAOxD,MAAM,QAAQ,MAAM,sBAAsB,CAAC,CAAC,MAC1C,cAAc,gBAAgB,WAAW,KAAK,IAC9C,UAAU;GACV,IAAI,iBAAiB,gBACpB,OAAO,IAAI,iBAAiB,QAAQ,IAAI,CAAC;GAE1C,MAAM;EACP,CACD;EACA,IAAI,UAAU,MAAM,MAAM,KAAK,KAAK;EAEpC,IAAI,CAAC,SAAS;GAEb,QAAQ,IAAI,qCAAqC,MAAM,KAAK;GAC5D,UAAU,iBAAiB,KAAK;GAChC,MAAM,MAAM,MAAM,OAAO,OAAO;GAChC,QAAQ,IAAI,oBAAoB,MAAM,aAAa,MAAM,KAAK,EAAE;EACjE;EAGA,IAAI,cAAc,WAAW,SAAS,GAAG;GACxC,QAAQ,IAAI,kDAAkD;GAC9D,MAAM,eAAe,MAAM,uBAAuB,UAAU;GAE5D,IAAI,aAAa,SAAS,GAAG;IAC5B,MAAM,aAAa,6BAA6B,cAAc,OAAO;IAErE,IAAI,CAAC,WAAW,OAAO;KACtB,MAAM,eAAe;MACpB,4CAA4C,MAAM;MAClD;MACA,GAAG,WAAW,QAAQ,KAAK,MAAM,OAAO,GAAG;MAC3C;MACA;MACA,0CAA0C,MAAM;MAChD,8CAA8C;MAC9C;MACA;MACA,gDAAgD;MAChD;MACA;MACA,GAAG,WAAW,SAAS,KAAK,MAC3B,WAAW,QAAQ,SAAS,CAAC,IAAI,OAAO,MAAM,OAAO,GACtD;KACD,CAAC,CAAC,KAAK,IAAI;KAEX,MAAM,IAAI,MAAM,YAAY;IAC7B;IAEA,QAAQ,IACP,WAAW,aAAa,OAAO,sCAChC;GACD;EACD;EAIA,MAAM,YAAY,eADC,oBAAoB,OACG,CAAC;EAC3C,YAAY,UAAU;EAGtB,MAAM,UAAU,sBAAsB,SAAS;EAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAGhD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;EAGrC,QAAQ,IAAI,kCAAkC,MAAM,EAAE;CACvD,OAAO;EAIN,MAAM,UAAA,GAASA,UAAAA,KAAAA,CAAK,WAAW,MAAM,IAAI;EACzC,MAAM,iBAAA,GAAgBA,UAAAA,KAAAA,CAAK,QAAQ,iBAAiB;EACpD,MAAM,UAAA,GAASA,UAAAA,KAAAA,CAAK,QAAQ,gBAAgB;EAC5C,KAAA,GAAIG,QAAAA,WAAAA,CAAW,aAAa,MAAA,GAAKA,QAAAA,WAAAA,CAAW,MAAM,GAAG;GACpD,MAAM,EAAE,0BAA0B,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,QAAM,wBAAA,CAAA,CAAA,CAAA,MAAA,MAAA,EAAA,kBAAA;GACxC,MAAM,UAAU,sBAAsB;IACrC,YAAA,GAAWC,QAAAA,aAAAA,CAAa,eAAe,OAAO,CAAC,CAAC,KAAK;IACrD,KAAA,GAAIA,QAAAA,aAAAA,CAAa,QAAQ,OAAO,CAAC,CAAC,KAAK;IACvC,WAAW;GACZ,CAAC;GACD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,GAChD,KAAK,KAAK,YAAY,IAAI,GAAG,OAAO;GAErC,QAAQ,IAAI,0DAA0D;EACvE;CACD;CAEA,IAAI;EAEH,MAAM,CAAC,KAAK,GAAG,WAAW;EAC1B,MAAM,UAAA,GAASC,mBAAAA,UAAAA,CAAU,KAAK,SAAS;GACtC,KAAK,QAAQ,IAAI;GACjB,OAAO;GACP,OAAO,QAAQ,aAAa;EAC7B,CAAC;EAED,IAAI,OAAO,OACV,MAAM,OAAO;EAEd,IAAI,OAAO,WAAW,GACrB,MAAM,IAAI,MAAM,4BAA4B,OAAO,QAAQ;EAI5D,MAAM,EAAE,aAAa,MAAM,OAAO;EAClC,MAAM,UAAU,MAAM,SAAS,WAAW,OAAO;EACjD,IAAI,CAAC,QAAQ,WAAW,IAAI,GAC3B,OAAA,GAAMC,iBAAAA,UAAAA,CAAU,WAAW,wBAAwB,SAAS;CAE9D,SAAS,OAAO;EACf,MAAM,IAAI,MACT,4BAA4B,iBAAiB,QAAQ,MAAM,UAAU,iBACtE;CACD;CAEA,OAAO;EACN,YAAY;EACZ;CACD;AACD"}

package/dist/{cli-BE9mqeX8.cjs → cli-BRZFYvdb.cjs}

@@ -1,8 +1,8 @@
-const require_credentials = require("./credentials-BKfIugu2.cjs");
-const require_deploy = require("./deploy-CuHasEA4.cjs");
+const require_credentials = require("./credentials-QBu7VgaQ.cjs");
+const require_deploy = require("./deploy-6ToUHJmM.cjs");
 const require_index = require("./index.cjs");
-const require_provider = require("./provider-C9_-45d5.cjs");
-const require_terminal = require("./terminal-DuapRxh6.cjs");
+const require_provider = require("./provider-BqpjG9QM.cjs");
+const require_terminal = require("./terminal-8XngdSTo.cjs");
 //#region src/deploy/cli.ts
 /**
 * `gkm deploy`: the terminal around `deploy()`. CLI layer only.
@@ -66,4 +66,4 @@ async function deployCli(options, streams = { stdout: process.stdout }) {
 //#endregion
 exports.deployCli = deployCli;
 
-//# sourceMappingURL=cli-BE9mqeX8.cjs.map
+//# sourceMappingURL=cli-BRZFYvdb.cjs.map