@geekmidas/cli 10.0.0-alpha.96 → 10.0.0-alpha.98

package/dist/s3-CUKzBBae.mjs

@@ -0,0 +1,215 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { pt as s3SecretsKey } from "./workspace-BBeT6Pil.mjs";
+import { a as projectBucketName, i as findProjectBucket, n as callerAccountId, r as ensureProjectBucket } from "./projectBucket-DrkEht-j.mjs";
+import { r as withStageCredentials, t as awsClientConfig } from "./awsStore-Bx5nCFnS.mjs";
+import { GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { STSClient } from "@aws-sdk/client-sts";
+//#region src/secrets/s3.ts
+/**
+* A stage's secrets in S3: one object per stage,
+* `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the
+* deploy state (`providers/projectBucket.ts`) — or in a bucket the config
+* names, which must exist.
+*
+* Encrypted at rest with SSE-S3, asked for on every write although the
+* project bucket defaults to it, so no KMS key is another place to keep. The
+* bucket's versioning keeps every past document. Unlike an SSM parameter
+* there is no size to outgrow.
+*
+* The project bucket is created by the first write, never by a read: a stage
+* whose bucket or object does not exist yet has no secrets. Every write is
+* conditional — `If-Match` on the ETag this store last read for the stage,
+* `If-None-Match: *` when it read none — so two `secrets:set` runs at once
+* cannot each overwrite the other's key: the second is refused with
+* {@link StageSecretsChanged}.
+*/
+/**
+* Another run wrote the stage's secrets after this one read them. Nothing was
+* written: the change is to be made again, on top of theirs.
+*/
+var StageSecretsChanged = class extends GkmError {
+	stage;
+	location;
+	constructor(stage, location) {
+		super(`The secrets for stage "${stage}" at ${location} changed after this command read them — another secrets command or deploy wrote them first. Nothing was written; run the command again to make the change on top of theirs.`);
+		this.stage = stage;
+		this.location = location;
+		this.name = "StageSecretsChanged";
+	}
+};
+/** A conditional write that lost: the object is not what the write assumed. */
+function lostRace(error) {
+	const { name, $metadata } = error;
+	return name === "PreconditionFailed" || name === "ConditionalRequestConflict" || $metadata?.httpStatusCode === 412 || $metadata?.httpStatusCode === 409;
+}
+function notFound(error) {
+	const { name, $metadata } = error;
+	return name === "NoSuchKey" || name === "NotFound" || $metadata?.httpStatusCode === 404;
+}
+var S3SecretsStore = class {
+	options;
+	name = "s3";
+	clients;
+	/** The bucket's name, once known. */
+	bucketName;
+	/** Whether the bucket is known to exist. */
+	exists = false;
+	/** The ETag each stage was last read at — null: read, and not there. */
+	etags = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.options = options;
+		if (options.bucket) {
+			this.bucketName = options.bucket;
+			this.exists = true;
+		}
+	}
+	/** The bucket's name; the project bucket's is known after the first call. */
+	get bucket() {
+		return this.bucketName ?? projectBucketName(this.options.identity.scope, "<account id>");
+	}
+	/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */
+	location(stage) {
+		return `s3://${this.bucket}/${this.key(stage)}`;
+	}
+	key(stage) {
+		return s3SecretsKey(this.options.prefix, this.options.project, stage);
+	}
+	async client() {
+		if (this.clients) return this.clients;
+		const base = await awsClientConfig(this.options);
+		const endpoint = base.endpoint ?? process.env.AWS_ENDPOINT_URL_S3 ?? process.env.AWS_ENDPOINT_URL;
+		const credentials = this.options.credentials ?? base.credentials;
+		this.clients = {
+			s3: new S3Client({
+				region: base.region,
+				...endpoint ? {
+					endpoint,
+					forcePathStyle: true
+				} : {},
+				...credentials ? { credentials } : {}
+			}),
+			sts: new STSClient({
+				region: base.region,
+				...base.endpoint ? { endpoint: base.endpoint } : {},
+				...credentials ? { credentials } : {}
+			})
+		};
+		return this.clients;
+	}
+	/** One AWS call, a missing or expired credential refused by name. */
+	call(stage, access, run) {
+		return withStageCredentials({
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		}, run);
+	}
+	/**
+	* The bucket, or null for a project bucket that does not exist yet and is
+	* not to be created (a read).
+	*/
+	async use(stage, create) {
+		const { s3, sts } = await this.client();
+		if (this.exists) return {
+			s3,
+			bucket: this.bucketName
+		};
+		const access = create ? "write" : "read";
+		this.bucketName ??= projectBucketName(this.options.identity.scope, await this.call(stage, access, () => callerAccountId(sts)));
+		const bucket = this.bucketName;
+		if (create) await this.call(stage, access, () => ensureProjectBucket(s3, {
+			bucket,
+			region: this.options.region,
+			identity: this.options.identity
+		}));
+		else if (await this.call(stage, access, () => findProjectBucket(s3, bucket)) === "none") return {
+			s3,
+			bucket: null
+		};
+		this.exists = true;
+		return {
+			s3,
+			bucket
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
+	async read(stage) {
+		const { s3, bucket } = await this.use(stage, false);
+		if (!bucket) {
+			this.etags.set(stage, null);
+			return null;
+		}
+		try {
+			const response = await this.call(stage, "read", () => s3.send(new GetObjectCommand({
+				Bucket: bucket,
+				Key: this.key(stage)
+			})));
+			const body = await response.Body.transformToString("utf-8");
+			this.remember(stage, response.ETag);
+			return JSON.parse(body);
+		} catch (error) {
+			if (!notFound(error)) throw error;
+			this.etags.set(stage, null);
+			return null;
+		}
+	}
+	/**
+	* Replace the stage's secrets — on the condition that they are still what
+	* this store last read. A stage never read here is replaced as it is now.
+	*
+	* @throws {StageSecretsChanged} when another run wrote them in between
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
+	async write(stage, secrets) {
+		const { s3, bucket } = await this.use(stage, true);
+		const Bucket = bucket;
+		const Key = this.key(stage);
+		const expected = this.etags.has(stage) ? this.etags.get(stage) ?? null : await this.currentEtag(s3, stage, Bucket, Key);
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new PutObjectCommand({
+				Bucket,
+				Key,
+				Body: JSON.stringify(secrets),
+				ContentType: "application/json",
+				ServerSideEncryption: "AES256",
+				...expected === null ? { IfNoneMatch: "*" } : { IfMatch: expected }
+			})));
+			this.remember(stage, ETag);
+		} catch (error) {
+			if (lostRace(error)) {
+				this.etags.delete(stage);
+				throw new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);
+			}
+			throw error;
+		}
+	}
+	/**
+	* The ETag the stage is now at. Some S3-compatible servers answer without
+	* one: then nothing is remembered, and the next write asks for it first.
+	*/
+	remember(stage, etag) {
+		if (etag) this.etags.set(stage, etag);
+		else this.etags.delete(stage);
+	}
+	async currentEtag(s3, stage, Bucket, Key) {
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new HeadObjectCommand({
+				Bucket,
+				Key
+			})));
+			return ETag ?? null;
+		} catch (error) {
+			if (notFound(error)) return null;
+			throw error;
+		}
+	}
+};
+//#endregion
+export { S3SecretsStore };
+
+//# sourceMappingURL=s3-CUKzBBae.mjs.map

package/dist/s3-CUKzBBae.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-CUKzBBae.mjs","names":[],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyC,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACL,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAO,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAI,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAI,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAO,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAe,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAc,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtB,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAc,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAI,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAI,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}

package/dist/s3-QQi4sNOQ.cjs

@@ -0,0 +1,215 @@
+const require_errors = require("./errors-DMC4Umsb.cjs");
+const require_workspace = require("./workspace-BJ78Bgvm.cjs");
+const require_projectBucket = require("./projectBucket-BjeDcAYy.cjs");
+const require_awsStore = require("./awsStore-u3ehhMoY.cjs");
+let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
+let _aws_sdk_client_sts = require("@aws-sdk/client-sts");
+//#region src/secrets/s3.ts
+/**
+* A stage's secrets in S3: one object per stage,
+* `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the
+* deploy state (`providers/projectBucket.ts`) — or in a bucket the config
+* names, which must exist.
+*
+* Encrypted at rest with SSE-S3, asked for on every write although the
+* project bucket defaults to it, so no KMS key is another place to keep. The
+* bucket's versioning keeps every past document. Unlike an SSM parameter
+* there is no size to outgrow.
+*
+* The project bucket is created by the first write, never by a read: a stage
+* whose bucket or object does not exist yet has no secrets. Every write is
+* conditional — `If-Match` on the ETag this store last read for the stage,
+* `If-None-Match: *` when it read none — so two `secrets:set` runs at once
+* cannot each overwrite the other's key: the second is refused with
+* {@link StageSecretsChanged}.
+*/
+/**
+* Another run wrote the stage's secrets after this one read them. Nothing was
+* written: the change is to be made again, on top of theirs.
+*/
+var StageSecretsChanged = class extends require_errors.GkmError {
+	stage;
+	location;
+	constructor(stage, location) {
+		super(`The secrets for stage "${stage}" at ${location} changed after this command read them — another secrets command or deploy wrote them first. Nothing was written; run the command again to make the change on top of theirs.`);
+		this.stage = stage;
+		this.location = location;
+		this.name = "StageSecretsChanged";
+	}
+};
+/** A conditional write that lost: the object is not what the write assumed. */
+function lostRace(error) {
+	const { name, $metadata } = error;
+	return name === "PreconditionFailed" || name === "ConditionalRequestConflict" || $metadata?.httpStatusCode === 412 || $metadata?.httpStatusCode === 409;
+}
+function notFound(error) {
+	const { name, $metadata } = error;
+	return name === "NoSuchKey" || name === "NotFound" || $metadata?.httpStatusCode === 404;
+}
+var S3SecretsStore = class {
+	options;
+	name = "s3";
+	clients;
+	/** The bucket's name, once known. */
+	bucketName;
+	/** Whether the bucket is known to exist. */
+	exists = false;
+	/** The ETag each stage was last read at — null: read, and not there. */
+	etags = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.options = options;
+		if (options.bucket) {
+			this.bucketName = options.bucket;
+			this.exists = true;
+		}
+	}
+	/** The bucket's name; the project bucket's is known after the first call. */
+	get bucket() {
+		return this.bucketName ?? require_projectBucket.projectBucketName(this.options.identity.scope, "<account id>");
+	}
+	/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */
+	location(stage) {
+		return `s3://${this.bucket}/${this.key(stage)}`;
+	}
+	key(stage) {
+		return require_workspace.s3SecretsKey(this.options.prefix, this.options.project, stage);
+	}
+	async client() {
+		if (this.clients) return this.clients;
+		const base = await require_awsStore.awsClientConfig(this.options);
+		const endpoint = base.endpoint ?? process.env.AWS_ENDPOINT_URL_S3 ?? process.env.AWS_ENDPOINT_URL;
+		const credentials = this.options.credentials ?? base.credentials;
+		this.clients = {
+			s3: new _aws_sdk_client_s3.S3Client({
+				region: base.region,
+				...endpoint ? {
+					endpoint,
+					forcePathStyle: true
+				} : {},
+				...credentials ? { credentials } : {}
+			}),
+			sts: new _aws_sdk_client_sts.STSClient({
+				region: base.region,
+				...base.endpoint ? { endpoint: base.endpoint } : {},
+				...credentials ? { credentials } : {}
+			})
+		};
+		return this.clients;
+	}
+	/** One AWS call, a missing or expired credential refused by name. */
+	call(stage, access, run) {
+		return require_awsStore.withStageCredentials({
+			stage,
+			store: this.name,
+			profile: this.options.profile,
+			access
+		}, run);
+	}
+	/**
+	* The bucket, or null for a project bucket that does not exist yet and is
+	* not to be created (a read).
+	*/
+	async use(stage, create) {
+		const { s3, sts } = await this.client();
+		if (this.exists) return {
+			s3,
+			bucket: this.bucketName
+		};
+		const access = create ? "write" : "read";
+		this.bucketName ??= require_projectBucket.projectBucketName(this.options.identity.scope, await this.call(stage, access, () => require_projectBucket.callerAccountId(sts)));
+		const bucket = this.bucketName;
+		if (create) await this.call(stage, access, () => require_projectBucket.ensureProjectBucket(s3, {
+			bucket,
+			region: this.options.region,
+			identity: this.options.identity
+		}));
+		else if (await this.call(stage, access, () => require_projectBucket.findProjectBucket(s3, bucket)) === "none") return {
+			s3,
+			bucket: null
+		};
+		this.exists = true;
+		return {
+			s3,
+			bucket
+		};
+	}
+	/**
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* read it with, or they have expired
+	*/
+	async read(stage) {
+		const { s3, bucket } = await this.use(stage, false);
+		if (!bucket) {
+			this.etags.set(stage, null);
+			return null;
+		}
+		try {
+			const response = await this.call(stage, "read", () => s3.send(new _aws_sdk_client_s3.GetObjectCommand({
+				Bucket: bucket,
+				Key: this.key(stage)
+			})));
+			const body = await response.Body.transformToString("utf-8");
+			this.remember(stage, response.ETag);
+			return JSON.parse(body);
+		} catch (error) {
+			if (!notFound(error)) throw error;
+			this.etags.set(stage, null);
+			return null;
+		}
+	}
+	/**
+	* Replace the stage's secrets — on the condition that they are still what
+	* this store last read. A stage never read here is replaced as it is now.
+	*
+	* @throws {StageSecretsChanged} when another run wrote them in between
+	* @throws {StageSecretsUnreadable} when there are no AWS credentials to
+	* write it with, or they have expired
+	*/
+	async write(stage, secrets) {
+		const { s3, bucket } = await this.use(stage, true);
+		const Bucket = bucket;
+		const Key = this.key(stage);
+		const expected = this.etags.has(stage) ? this.etags.get(stage) ?? null : await this.currentEtag(s3, stage, Bucket, Key);
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new _aws_sdk_client_s3.PutObjectCommand({
+				Bucket,
+				Key,
+				Body: JSON.stringify(secrets),
+				ContentType: "application/json",
+				ServerSideEncryption: "AES256",
+				...expected === null ? { IfNoneMatch: "*" } : { IfMatch: expected }
+			})));
+			this.remember(stage, ETag);
+		} catch (error) {
+			if (lostRace(error)) {
+				this.etags.delete(stage);
+				throw new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);
+			}
+			throw error;
+		}
+	}
+	/**
+	* The ETag the stage is now at. Some S3-compatible servers answer without
+	* one: then nothing is remembered, and the next write asks for it first.
+	*/
+	remember(stage, etag) {
+		if (etag) this.etags.set(stage, etag);
+		else this.etags.delete(stage);
+	}
+	async currentEtag(s3, stage, Bucket, Key) {
+		try {
+			const { ETag } = await this.call(stage, "write", () => s3.send(new _aws_sdk_client_s3.HeadObjectCommand({
+				Bucket,
+				Key
+			})));
+			return ETag ?? null;
+		} catch (error) {
+			if (notFound(error)) return null;
+			throw error;
+		}
+	}
+};
+//#endregion
+exports.S3SecretsStore = S3SecretsStore;
+
+//# sourceMappingURL=s3-QQi4sNOQ.cjs.map

package/dist/s3-QQi4sNOQ.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3-QQi4sNOQ.cjs","names":["GkmError","projectBucketName","s3SecretsKey","awsClientConfig","S3Client","STSClient","withStageCredentials","callerAccountId","ensureProjectBucket","findProjectBucket","GetObjectCommand","PutObjectCommand","HeadObjectCommand"],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyCA,eAAAA,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACLC,sBAAAA,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAOC,kBAAAA,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAIC,mBAAAA,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAIC,oBAAAA,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAOC,iBAAAA,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAeL,sBAAAA,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAcM,sBAAAA,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtBC,sBAAAA,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAcC,sBAAAA,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAIC,mBAAAA,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAIC,mBAAAA,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}

package/dist/{sandbox-DGOsMPMf.d.mts → sandbox-ArJ_hEKk.d.cts}

@@ -1,4 +1,4 @@
-import { jt as GkmError } from "./types-bkqVscdN.mjs";
+import { jt as GkmError } from "./types-DipUP9zp.cjs";
 //#region src/sandbox/sandbox.d.ts
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
@@ -101,4 +101,4 @@ declare class SecretNameInvalid extends GkmError {
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-DGOsMPMf.d.mts.map
+//# sourceMappingURL=sandbox-ArJ_hEKk.d.cts.map

package/dist/{sandbox-BbJmh2rI.d.cts.map → sandbox-ArJ_hEKk.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"sandbox-BbJmh2rI.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}
+{"version":3,"file":"sandbox-ArJ_hEKk.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/{sandbox-BbJmh2rI.d.cts → sandbox-Cm4X6HRh.d.mts}

@@ -1,4 +1,4 @@
-import { jt as GkmError } from "./types-dipJRmKV.cjs";
+import { jt as GkmError } from "./types-Drpl9HX9.mjs";
 //#region src/sandbox/sandbox.d.ts
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
@@ -101,4 +101,4 @@ declare class SecretNameInvalid extends GkmError {
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-BbJmh2rI.d.cts.map
+//# sourceMappingURL=sandbox-Cm4X6HRh.d.mts.map

package/dist/{sandbox-DGOsMPMf.d.mts.map → sandbox-Cm4X6HRh.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"sandbox-DGOsMPMf.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}
+{"version":3,"file":"sandbox-Cm4X6HRh.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/{secrets-ZikTIxEm.mjs → secrets-AA_tQUl-.mjs}

@@ -1,6 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { L as resolveStageTelemetry } from "./workspace-CqFUjObk.mjs";
-import { St as withRedisPassword, Wn as initStageSecrets, bt as runsRedis, er as withLogsPassword, fn as usesTelemetry, gt as withGeneratedSecrets } from "./seeds-CbJSne1A.mjs";
+import { L as resolveStageTelemetry } from "./workspace-BBeT6Pil.mjs";
+import { St as withRedisPassword, Wn as initStageSecrets, bt as runsRedis, er as withLogsPassword, fn as usesTelemetry, gt as withGeneratedSecrets } from "./seeds-BvxWUGKJ.mjs";
 //#region src/compose/secrets.ts
 var secrets_exports = /* @__PURE__ */ __exportAll({ deployedStackSecrets: () => deployedStackSecrets });
 function deployedStackSecrets(workspace, stage, stored, manifest) {
@@ -33,4 +33,4 @@ function deployedStackSecrets(workspace, stage, stored, manifest) {
 //#endregion
 export { secrets_exports as n, deployedStackSecrets as t };
 
-//# sourceMappingURL=secrets-ZikTIxEm.mjs.map
+//# sourceMappingURL=secrets-AA_tQUl-.mjs.map

package/dist/{secrets-ZikTIxEm.mjs.map → secrets-AA_tQUl-.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"secrets-ZikTIxEm.mjs","names":[],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm deploy --resources-only` composes the stack with it to read its hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAW,qBAChB,UAAU,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXY,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAM,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrB,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAY,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChE,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}
+{"version":3,"file":"secrets-AA_tQUl-.mjs","names":[],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm deploy --resources-only` composes the stack with it to read its hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAW,qBAChB,UAAU,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXY,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAM,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrB,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAY,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChE,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}

package/dist/{secrets-C5qROlbp.cjs → secrets-B_biKsKx.cjs}

@@ -1,6 +1,6 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
-const require_workspace = require("./workspace-DDkm4y6D.cjs");
-const require_seeds = require("./seeds-BjXW-Krf.cjs");
+const require_workspace = require("./workspace-BJ78Bgvm.cjs");
+const require_seeds = require("./seeds-Df4BI-T3.cjs");
 //#region src/compose/secrets.ts
 var secrets_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({ deployedStackSecrets: () => deployedStackSecrets });
 function deployedStackSecrets(workspace, stage, stored, manifest) {
@@ -44,4 +44,4 @@ Object.defineProperty(exports, "secrets_exports", {
 	}
 });
 
-//# sourceMappingURL=secrets-C5qROlbp.cjs.map
+//# sourceMappingURL=secrets-B_biKsKx.cjs.map

package/dist/{secrets-C5qROlbp.cjs.map → secrets-B_biKsKx.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"secrets-C5qROlbp.cjs","names":["withGeneratedSecrets","initStageSecrets","resolveStageTelemetry","usesTelemetry","withLogsPassword","runsRedis","withRedisPassword"],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm deploy --resources-only` composes the stack with it to read its hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAWA,cAAAA,qBAChB,UAAUC,cAAAA,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXYC,kBAAAA,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAMC,cAAAA,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrBC,cAAAA,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAYC,cAAAA,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChEC,cAAAA,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}
+{"version":3,"file":"secrets-B_biKsKx.cjs","names":["withGeneratedSecrets","initStageSecrets","resolveStageTelemetry","usesTelemetry","withLogsPassword","runsRedis","withRedisPassword"],"sources":["../src/compose/secrets.ts"],"sourcesContent":["/**\n * What a deployed stage's stack generates once and keeps: its seed, each\n * `secret` construct's value, the log UI's root password where its telemetry\n * is self-hosted, and the stack's Redis password where a cache lives in it.\n *\n * Pure: the compose target writes the result back to the stage's store, and\n * `gkm deploy --resources-only` composes the stack with it to read its hosts,\n * writing nothing.\n */\n\nimport type { ConstructManifest } from '@geekmidas/manifest';\nimport {\n\ttype GeneratedSecrets,\n\twithGeneratedSecrets,\n} from '../deploy/generated.js';\nimport { initStageSecrets } from '../secrets/storage.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { resolveStageTelemetry } from '../telemetry/config';\nimport { usesTelemetry } from '../telemetry/edges';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport { withLogsPassword } from './logs';\nimport { runsRedis, withRedisPassword } from './redis';\n\nexport function deployedStackSecrets(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\tstored: StageSecrets | null,\n\tmanifest: ConstructManifest,\n): GeneratedSecrets {\n\tconst withSeed = withGeneratedSecrets(\n\t\tstored ?? initStageSecrets(stage),\n\t\tmanifest,\n\t);\n\t// The log UI's root password, generated once like the seed, where the\n\t// stage's telemetry is self-hosted and the stage set none.\n\tconst telemetry = resolveStageTelemetry({\n\t\t...(workspace.deploy?.telemetry\n\t\t\t? { telemetry: workspace.deploy.telemetry }\n\t\t\t: {}),\n\t\tstage,\n\t\tlocal: false,\n\t\ttarget: 'compose',\n\t\truntime: 'server',\n\t\tselfHosted: true,\n\t\tused: usesTelemetry(manifest),\n\t});\n\tconst withLogs =\n\t\ttelemetry?.provider === 'self-hosted'\n\t\t\t? withLogsPassword(withSeed.secrets)\n\t\t\t: { secrets: withSeed.secrets, generated: [] };\n\t// The stack's Redis password, the same way, where a cache lives in it.\n\tconst withRedis = runsRedis(manifest, withLogs.secrets.custom ?? {})\n\t\t? withRedisPassword(withLogs.secrets)\n\t\t: { secrets: withLogs.secrets, generated: [] };\n\treturn {\n\t\tsecrets: withRedis.secrets,\n\t\tgenerated: [\n\t\t\t...withSeed.generated,\n\t\t\t...withLogs.generated,\n\t\t\t...withRedis.generated,\n\t\t],\n\t};\n}\n"],"mappings":";;;;;AAuBA,SAAgB,qBACf,WACA,OACA,QACA,UACmB;CACnB,MAAM,WAAWA,cAAAA,qBAChB,UAAUC,cAAAA,iBAAiB,KAAK,GAChC,QACD;CAcA,MAAM,WAXYC,kBAAAA,sBAAsB;EACvC,GAAI,UAAU,QAAQ,YACnB,EAAE,WAAW,UAAU,OAAO,UAAU,IACxC,CAAC;EACJ;EACA,OAAO;EACP,QAAQ;EACR,SAAS;EACT,YAAY;EACZ,MAAMC,cAAAA,cAAc,QAAQ;CAC7B,CAES,CAAC,EAAE,aAAa,gBACrBC,cAAAA,iBAAiB,SAAS,OAAO,IACjC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAE/C,MAAM,YAAYC,cAAAA,UAAU,UAAU,SAAS,QAAQ,UAAU,CAAC,CAAC,IAChEC,cAAAA,kBAAkB,SAAS,OAAO,IAClC;EAAE,SAAS,SAAS;EAAS,WAAW,CAAC;CAAE;CAC9C,OAAO;EACN,SAAS,UAAU;EACnB,WAAW;GACV,GAAG,SAAS;GACZ,GAAG,SAAS;GACZ,GAAG,UAAU;EACd;CACD;AACD"}

package/dist/{secretsManager-C6wm-9uZ.mjs → secretsManager-CQORubp9.mjs}

@@ -1,5 +1,5 @@
 import { t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
-import { n as serializeWithin, r as withStageCredentials, t as awsClientConfig } from "./awsStore-BWa1KNY-.mjs";
+import { n as serializeWithin, r as withStageCredentials, t as awsClientConfig } from "./awsStore-Bx5nCFnS.mjs";
 import { CreateSecretCommand, GetSecretValueCommand, PutSecretValueCommand, ResourceNotFoundException, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
 //#region src/secrets/secretsManager.ts
 /**
@@ -94,4 +94,4 @@ var SecretsManagerSecretsStore = class {
 //#endregion
 export { secretsManager_exports as n, secretsManagerSecretName as t };
 
-//# sourceMappingURL=secretsManager-C6wm-9uZ.mjs.map
+//# sourceMappingURL=secretsManager-CQORubp9.mjs.map

package/dist/{secretsManager-C6wm-9uZ.mjs.map → secretsManager-CQORubp9.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"secretsManager-C6wm-9uZ.mjs","names":[],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tclient.send(\n\t\t\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tthis.put(client, stage, name, value),\n\t\t);\n\t}\n\n\t/** Put the secret, creating it on the stage's first write. */\n\tprivate async put(\n\t\tclient: SecretsManagerClient,\n\t\tstage: string,\n\t\tname: string,\n\t\tvalue: string,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAI,qBAAqB,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,qBAC9B,KAAK,QAAQ,OAAO,MAAM,SAEzB,OAAO,KACN,IAAI,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D,CACF;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiB,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,MAAM,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,KAAK,IAAI,QAAQ,OAAO,MAAM,KAAK,CACpC;CACD;;CAGA,MAAc,IACb,QACA,OACA,MACA,OACgB;EAChB,IAAI;GACH,MAAM,OAAO,KACZ,IAAI,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAI,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}
+{"version":3,"file":"secretsManager-CQORubp9.mjs","names":[],"sources":["../src/secrets/secretsManager.ts"],"sourcesContent":["/**\n * A stage's secrets in AWS Secrets Manager, in the stage's own AWS account.\n *\n * One secret per stage, `gkm/<project>/<stage>/secrets` — the SSM store's\n * parameter name without its leading `/` — holding the same JSON. It is\n * encrypted with the account's `aws/secretsmanager` key unless `kmsKeyId`\n * names another. Which account it is in is whichever credentials are active,\n * exactly as for the SSM store.\n *\n * Chosen over SSM for size (64 KB rather than 8 KB) and for Secrets Manager's\n * own versioning, at a monthly price per secret.\n */\n\nimport {\n\tCreateSecretCommand,\n\tGetSecretValueCommand,\n\tPutSecretValueCommand,\n\tResourceNotFoundException,\n\tSecretsManagerClient,\n} from '@aws-sdk/client-secrets-manager';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\tserializeWithin,\n\twithStageCredentials,\n} from './awsStore.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface SecretsManagerStoreOptions extends AwsStoreOptions {\n\t/** The KMS key a new secret is encrypted with; `aws/secretsmanager` if unset. */\n\tkmsKeyId?: string;\n}\n\n/** The most a Secrets Manager secret holds: 64 KB. */\nexport const SECRETS_MANAGER_SECRET_LIMIT = 64 * 1024;\n\n/** The secret a stage's secrets are kept in. */\nexport function secretsManagerSecretName(\n\tproject: string,\n\tstage: string,\n): string {\n\treturn `gkm/${project}/${stage}/secrets`;\n}\n\nexport class SecretsManagerSecretsStore implements SecretsStore {\n\treadonly name = 'secrets-manager';\n\n\tprivate client?: SecretsManagerClient;\n\n\tconstructor(private readonly options: SecretsManagerStoreOptions) {}\n\n\tprivate async secretsManager(): Promise<SecretsManagerClient> {\n\t\tif (this.client) return this.client;\n\t\tthis.client = new SecretsManagerClient(await awsClientConfig(this.options));\n\t\treturn this.client;\n\t}\n\n\tprivate secretName(stage: string): string {\n\t\treturn secretsManagerSecretName(this.options.project, stage);\n\t}\n\n\t/** Where a call for `stage` is, for an error saying it has no credentials. */\n\tprivate context(stage: string, access: 'read' | 'write') {\n\t\treturn { stage, store: this.name, profile: this.options.profile, access };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst client = await this.secretsManager();\n\n\t\ttry {\n\t\t\tconst { SecretString } = await withStageCredentials(\n\t\t\t\tthis.context(stage, 'read'),\n\t\t\t\t() =>\n\t\t\t\t\tclient.send(\n\t\t\t\t\t\tnew GetSecretValueCommand({ SecretId: this.secretName(stage) }),\n\t\t\t\t\t),\n\t\t\t);\n\t\t\treturn SecretString ? (JSON.parse(SecretString) as StageSecrets) : null;\n\t\t} catch (error) {\n\t\t\tif (error instanceof ResourceNotFoundException) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst value = serializeWithin(\n\t\t\tstage,\n\t\t\tthis.name,\n\t\t\tsecrets,\n\t\t\tSECRETS_MANAGER_SECRET_LIMIT,\n\t\t);\n\t\tconst client = await this.secretsManager();\n\t\tconst name = this.secretName(stage);\n\n\t\tawait withStageCredentials(this.context(stage, 'write'), () =>\n\t\t\tthis.put(client, stage, name, value),\n\t\t);\n\t}\n\n\t/** Put the secret, creating it on the stage's first write. */\n\tprivate async put(\n\t\tclient: SecretsManagerClient,\n\t\tstage: string,\n\t\tname: string,\n\t\tvalue: string,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait client.send(\n\t\t\t\tnew PutSecretValueCommand({ SecretId: name, SecretString: value }),\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (!(error instanceof ResourceNotFoundException)) throw error;\n\t\t\t// The stage's first write: the secret does not exist yet.\n\t\t\tawait client.send(\n\t\t\t\tnew CreateSecretCommand({\n\t\t\t\t\tName: name,\n\t\t\t\t\tSecretString: value,\n\t\t\t\t\tDescription: `gkm secrets for ${this.options.project}/${stage}`,\n\t\t\t\t\t...(this.options.kmsKeyId ? { KmsKeyId: this.options.kmsKeyId } : {}),\n\t\t\t\t}),\n\t\t\t);\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,+BAA+B;;AAG5C,SAAgB,yBACf,SACA,OACS;CACT,OAAO,OAAO,QAAQ,GAAG,MAAM;AAChC;AAEA,IAAa,6BAAb,MAAgE;CAKlC;CAJ7B,OAAgB;CAEhB;CAEA,YAAY,SAAsD;EAArC,KAAA,UAAA;CAAsC;CAEnE,MAAc,iBAAgD;EAC7D,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,KAAK,SAAS,IAAI,qBAAqB,MAAM,gBAAgB,KAAK,OAAO,CAAC;EAC1E,OAAO,KAAK;CACb;CAEA,WAAmB,OAAuB;EACzC,OAAO,yBAAyB,KAAK,QAAQ,SAAS,KAAK;CAC5D;;CAGA,QAAgB,OAAe,QAA0B;EACxD,OAAO;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO;CACzE;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,SAAS,MAAM,KAAK,eAAe;EAEzC,IAAI;GACH,MAAM,EAAE,iBAAiB,MAAM,qBAC9B,KAAK,QAAQ,OAAO,MAAM,SAEzB,OAAO,KACN,IAAI,sBAAsB,EAAE,UAAU,KAAK,WAAW,KAAK,EAAE,CAAC,CAC/D,CACF;GACA,OAAO,eAAgB,KAAK,MAAM,YAAY,IAAqB;EACpE,SAAS,OAAO;GACf,IAAI,iBAAiB,2BAA2B,OAAO;GACvD,MAAM;EACP;CACD;;;;;CAMA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,QAAQ,gBACb,OACA,KAAK,MACL,SACA,4BACD;EACA,MAAM,SAAS,MAAM,KAAK,eAAe;EACzC,MAAM,OAAO,KAAK,WAAW,KAAK;EAElC,MAAM,qBAAqB,KAAK,QAAQ,OAAO,OAAO,SACrD,KAAK,IAAI,QAAQ,OAAO,MAAM,KAAK,CACpC;CACD;;CAGA,MAAc,IACb,QACA,OACA,MACA,OACgB;EAChB,IAAI;GACH,MAAM,OAAO,KACZ,IAAI,sBAAsB;IAAE,UAAU;IAAM,cAAc;GAAM,CAAC,CAClE;EACD,SAAS,OAAO;GACf,IAAI,EAAE,iBAAiB,4BAA4B,MAAM;GAEzD,MAAM,OAAO,KACZ,IAAI,oBAAoB;IACvB,MAAM;IACN,cAAc;IACd,aAAa,mBAAmB,KAAK,QAAQ,QAAQ,GAAG;IACxD,GAAI,KAAK,QAAQ,WAAW,EAAE,UAAU,KAAK,QAAQ,SAAS,IAAI,CAAC;GACpE,CAAC,CACF;EACD;CACD;AACD"}