@geekmidas/cli 10.0.0-alpha.91 → 10.0.0-alpha.93

package/dist/{sandbox-M8UnLhXE.d.mts → sandbox-JwuPAl7I.d.cts}

@@ -1,27 +1,5 @@
+import { jt as GkmError } from "./types-BibpiHKB.cjs";
 //#region src/sandbox/sandbox.d.ts
-/**
- * Where a deploy runs the project's own code.
- *
- * A deploy holds credentials — Dokploy's token, a registry login, an AWS key —
- * and loading `gkm.config.ts`, sniffing an app's environment and building it
- * all execute code from the repository being deployed. On a developer's own
- * laptop that is the developer's code. On a CI job for a fork, or a shared
- * build runner, it is not, and that code should not be able to read the
- * credentials used to deploy it, hang the deploy, or reach outside the
- * checkout.
- *
- * So every step that runs project code goes through a `Sandbox`: one call,
- * with an argument array rather than a shell line, the complete environment
- * the step needs rather than the host's, a timeout it cannot outlive, secrets
- * as files rather than variables, and a working directory inside the project.
- * The steps that need credentials — provisioning, pushing, releasing — are
- * the deploy's own code and never run in one.
- *
- * `LocalSandbox` is the default: a child process on this machine with an
- * allowlisted environment. A host that builds repositories it does not trust
- * passes its own — a container per build, a VM — through `deploy()`'s
- * `sandbox`.
- */
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
 interface SandboxExecOptions {
@@ -102,7 +80,7 @@ interface Sandbox {
 /** The variable naming the directory a command's secrets are mounted in. */
 declare const SECRETS_DIR_ENV = "GKM_SECRETS_DIR";
 /** A command was asked to run outside the project. */
-declare class SandboxCwdEscape extends Error {
+declare class SandboxCwdEscape extends GkmError {
   readonly cwd: string;
   readonly root: string;
   constructor(cwd: string, root: string);
@@ -117,10 +95,10 @@ declare class SandboxCwdEscape extends Error {
  */
 declare function confineCwd(root: string, cwd: string): string;
 /** A secret's file name: one path segment, so it cannot be written elsewhere. */
-declare class SecretNameInvalid extends Error {
+declare class SecretNameInvalid extends GkmError {
   readonly secretName: string;
   constructor(secretName: string);
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-M8UnLhXE.d.mts.map
+//# sourceMappingURL=sandbox-JwuPAl7I.d.cts.map

package/dist/sandbox-JwuPAl7I.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-JwuPAl7I.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/secrets-DJteijZo.cjs

@@ -0,0 +1,47 @@
+const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
+const require_workspace = require("./workspace-CHOB2Xg3.cjs");
+const require_seeds = require("./seeds-c-ByX9je.cjs");
+//#region src/compose/secrets.ts
+var secrets_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ deployedStackSecrets: () => deployedStackSecrets });
+function deployedStackSecrets(workspace, stage, stored, manifest) {
+	const withSeed = require_seeds.withGeneratedSecrets(stored ?? require_seeds.initStageSecrets(stage), manifest);
+	const withLogs = require_workspace.resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: require_seeds.usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? require_seeds.withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const withRedis = require_seeds.runsRedis(manifest, withLogs.secrets.custom ?? {}) ? require_seeds.withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	return {
+		secrets: withRedis.secrets,
+		generated: [
+			...withSeed.generated,
+			...withLogs.generated,
+			...withRedis.generated
+		]
+	};
+}
+//#endregion
+Object.defineProperty(exports, "deployedStackSecrets", {
+	enumerable: true,
+	get: function() {
+		return deployedStackSecrets;
+	}
+});
+Object.defineProperty(exports, "secrets_exports", {
+	enumerable: true,
+	get: function() {
+		return secrets_exports;
+	}
+});
+
+//# sourceMappingURL=secrets-DJteijZo.cjs.map

package/dist/secrets-DJteijZo.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-DJteijZo.cjs","names":["withGeneratedSecrets","initStageSecrets","resolveStageTelemetry","usesTelemetry","withLogsPassword","runsRedis","withRedisPassword"],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm setup`'s DNS step composes the stack with it to read the stack's hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAWA,cAAAA,qBAChB,UAAUC,cAAAA,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXYC,kBAAAA,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAMC,cAAAA,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrBC,cAAAA,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAYC,cAAAA,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChEC,cAAAA,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}

package/dist/secrets-DbPmAS4k.mjs

@@ -0,0 +1,36 @@
+import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
+import { L as resolveStageTelemetry } from "./workspace-Bzw7Zs82.mjs";
+import { Ft as withGeneratedSecrets, Vt as withRedisPassword, jn as usesTelemetry, lr as initStageSecrets, yr as withLogsPassword, zt as runsRedis } from "./seeds-BSL55F6q.mjs";
+//#region src/compose/secrets.ts
+var secrets_exports = /* @__PURE__ */ __exportAll({ deployedStackSecrets: () => deployedStackSecrets });
+function deployedStackSecrets(workspace, stage, stored, manifest) {
+	const withSeed = withGeneratedSecrets(stored ?? initStageSecrets(stage), manifest);
+	const withLogs = resolveStageTelemetry({
+		...workspace.deploy?.telemetry ? { telemetry: workspace.deploy.telemetry } : {},
+		stage,
+		local: false,
+		target: "compose",
+		runtime: "server",
+		selfHosted: true,
+		used: usesTelemetry(manifest)
+	})?.provider === "self-hosted" ? withLogsPassword(withSeed.secrets) : {
+		secrets: withSeed.secrets,
+		generated: []
+	};
+	const withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {}) ? withRedisPassword(withLogs.secrets) : {
+		secrets: withLogs.secrets,
+		generated: []
+	};
+	return {
+		secrets: withRedis.secrets,
+		generated: [
+			...withSeed.generated,
+			...withLogs.generated,
+			...withRedis.generated
+		]
+	};
+}
+//#endregion
+export { secrets_exports as n, deployedStackSecrets as t };
+
+//# sourceMappingURL=secrets-DbPmAS4k.mjs.map

package/dist/secrets-DbPmAS4k.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-DbPmAS4k.mjs","names":[],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm setup`'s DNS step composes the stack with it to read the stack's hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAW,qBAChB,UAAU,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXY,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAM,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrB,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAY,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChE,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}

package/dist/{secretsManager-Chs9VV2r.mjs → secretsManager-C6wm-9uZ.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { n as serializeWithin, t as awsClientConfig } from "./awsStore-B529csle.mjs";
+import { n as serializeWithin, r as withStageCredentials, t as awsClientConfig } from "./awsStore-BWa1KNY-.mjs";
 import { CreateSecretCommand, GetSecretValueCommand, PutSecretValueCommand, ResourceNotFoundException, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 //#region src/secrets/secretsManager.ts
 /**
@@ -40,20 +40,41 @@ var SecretsManagerSecretsStore = class {
 	secretName(stage) {
 		return secretsManagerSecretName(this.options.project, stage);
 	}
+	/** Where a call for `stage` is, for an error saying it has no credentials. */
+	context(stage, access) {
+		return {
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
 	async read(stage) {
 		const client = await this.secretsManager();
 		try {
-			const { SecretString } = await client.send(new GetSecretValueCommand({ SecretId: this.secretName(stage) }));
+			const { SecretString } = await withStageCredentials(this.context(stage, "read"), () => client.send(new GetSecretValueCommand({ SecretId: this.secretName(stage) })));
 			return SecretString ? JSON.parse(SecretString) : null;
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException) return null;
 			throw error;
 		}
 	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
 	async write(stage, secrets) {
 		const value = serializeWithin(stage, this.name, secrets, SECRETS_MANAGER_SECRET_LIMIT);
 		const client = await this.secretsManager();
 		const name = this.secretName(stage);
+		await withStageCredentials(this.context(stage, "write"), () => this.put(client, stage, name, value));
+	}
+	/** Put the secret, creating it on the stage's first write. */
+	async put(client, stage, name, value) {
 		try {
 			await client.send(new PutSecretValueCommand({
 				SecretId: name,
@@ -73,4 +94,4 @@ var SecretsManagerSecretsStore = class {
 //#endregion
 export { secretsManager_exports as n, secretsManagerSecretName as t };
 
-//# sourceMappingURL=secretsManager-Chs9VV2r.mjs.map
+//# sourceMappingURL=secretsManager-C6wm-9uZ.mjs.map

package/dist/secretsManager-C6wm-9uZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsManager-C6wm-9uZ.mjs","names":[],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tclient.send(\n\t\t\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tthis.put(client, stage, name, value),\n\t\t);\n\t}\n\n\t/** Put the secret, creating it on the stage's first write. */\n\tprivate async put(\n\t\tclient: SecretsManagerClient,\n\t\tstage: string,\n\t\tname: string,\n\t\tvalue: string,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAI,qBAAqB,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,qBAC9B,KAAK,QAAQ,OAAO,MAAM,SAEzB,OAAO,KACN,IAAI,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D,CACF;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiB,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,MAAM,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,KAAK,IAAI,QAAQ,OAAO,MAAM,KAAK,CACpC;CACD;;CAGA,MAAc,IACb,QACA,OACA,MACA,OACgB;EAChB,IAAI;GACH,MAAM,OAAO,KACZ,IAAI,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAI,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}

package/dist/{secretsManager-DcMlHnRC.cjs → secretsManager-Cwwgs81g.cjs}

@@ -1,5 +1,5 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_awsStore = require("./awsStore-7VmS_cZR.cjs");
+const require_awsStore = require("./awsStore-B5We7bMg.cjs");
 let _aws_sdk_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
 //#region src/secrets/secretsManager.ts
 /**
@@ -40,20 +40,41 @@ var SecretsManagerSecretsStore = class {
 	secretName(stage) {
 		return secretsManagerSecretName(this.options.project, stage);
 	}
+	/** Where a call for `stage` is, for an error saying it has no credentials. */
+	context(stage, access) {
+		return {
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
 	async read(stage) {
 		const client = await this.secretsManager();
 		try {
-			const { SecretString } = await client.send(new _aws_sdk_client_secrets_manager.GetSecretValueCommand({ SecretId: this.secretName(stage) }));
+			const { SecretString } = await require_awsStore.withStageCredentials(this.context(stage, "read"), () => client.send(new _aws_sdk_client_secrets_manager.GetSecretValueCommand({ SecretId: this.secretName(stage) })));
 			return SecretString ? JSON.parse(SecretString) : null;
 		} catch (error) {
 			if (error instanceof _aws_sdk_client_secrets_manager.ResourceNotFoundException) return null;
 			throw error;
 		}
 	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
 	async write(stage, secrets) {
 		const value = require_awsStore.serializeWithin(stage, this.name, secrets, SECRETS_MANAGER_SECRET_LIMIT);
 		const client = await this.secretsManager();
 		const name = this.secretName(stage);
+		await require_awsStore.withStageCredentials(this.context(stage, "write"), () => this.put(client, stage, name, value));
+	}
+	/** Put the secret, creating it on the stage's first write. */
+	async put(client, stage, name, value) {
 		try {
 			await client.send(new _aws_sdk_client_secrets_manager.PutSecretValueCommand({
 				SecretId: name,
@@ -84,4 +105,4 @@ Object.defineProperty(exports, "secretsManager_exports", {
 	}
 });
 
-//# sourceMappingURL=secretsManager-DcMlHnRC.cjs.map
+//# sourceMappingURL=secretsManager-Cwwgs81g.cjs.map

package/dist/secretsManager-Cwwgs81g.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsManager-Cwwgs81g.cjs","names":["SecretsManagerClient","awsClientConfig","withStageCredentials","GetSecretValueCommand","ResourceNotFoundException","serializeWithin","PutSecretValueCommand","CreateSecretCommand"],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tclient.send(\n\t\t\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tthis.put(client, stage, name, value),\n\t\t);\n\t}\n\n\t/** Put the secret, creating it on the stage's first write. */\n\tprivate async put(\n\t\tclient: SecretsManagerClient,\n\t\tstage: string,\n\t\tname: string,\n\t\tvalue: string,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAIA,gCAAAA,qBAAqB,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAMC,iBAAAA,qBAC9B,KAAK,QAAQ,OAAO,MAAM,SAEzB,OAAO,KACN,IAAIC,gCAAAA,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D,CACF;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiBC,gCAAAA,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQC,iBAAAA,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,MAAMH,iBAAAA,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,KAAK,IAAI,QAAQ,OAAO,MAAM,KAAK,CACpC;CACD;;CAGA,MAAc,IACb,QACA,OACA,MACA,OACgB;EAChB,IAAI;GACH,MAAM,OAAO,KACZ,IAAII,gCAAAA,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiBF,gCAAAA,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAIG,gCAAAA,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}