@geekmidas/cli 10.0.0-alpha.97 → 10.0.0-alpha.99

package/dist/{stages-DEmn7qI8.mjs → stages-CcS9vnNu.mjs}

@@ -1,8 +1,6 @@
 import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
-import { M as UndeclaredStage, U as stageProvider } from "./workspace-Bv4xROeu.mjs";
+import { M as UndeclaredStage, mt as s3SecretsLocation } from "./workspace-D5CpOp1y.mjs";
 import { loadWorkspaceSettings } from "./config.mjs";
-import { P as PROVIDER_KINDS } from "./seeds-BsJRUL1K.mjs";
-import { c as stageDnsDomains } from "./dns-BbTOzmVp.mjs";
 import { appendFile } from "node:fs/promises";
 //#region src/stages/plan.ts
 /**
@@ -87,28 +85,18 @@ function stagesJson(stages) {
 	};
 }
 /**
-* The region of the workspace's AWS secrets store — `ssm` or
+* The region of the workspace's AWS secrets store — `s3`, `ssm` or
 * `secrets-manager` — or `''` when its deployed stages keep their secrets
 * anywhere else. A job assumes the stage's AWS role only when this is set.
 */
 function awsSecretsRegion(workspace) {
 	const store = workspace.secrets?.store;
 	if (typeof store !== "object" || store === null) return "";
+	if (store.provider === "s3") return s3SecretsLocation(store, workspace.state).region;
 	if (store.provider === "ssm" || store.provider === "secrets-manager") return store.region;
 	return "";
 }
 /**
-* The deployed stages with resources the deploy creates — a provider under
-* `deploy.<kind>.<stage>`, or a domain under a `dns` entry whose provider
-* writes records — and secrets a CI runner can reach (an AWS store): a
-* compose deploy workflow creates their resources on the runner, with the
-* stage's role and DNS token, rather than on the server.
-*/
-function resourceStages(workspace) {
-	if (!awsSecretsRegion(workspace)) return [];
-	return workspace.stages.deployed.filter((stage) => PROVIDER_KINDS.some((kind) => stageProvider(workspace, kind, stage).mode === "provider") || stageDnsDomains(stage, workspace.domains, workspace.dns).some(({ config }) => config.provider !== "manual"));
-}
-/**
 * Every output the stages action sets, each a string `fromJSON()` reads, for
 * one workflow run.
 */
@@ -123,8 +111,7 @@ function githubOutputs(workspace, input) {
 		deploy: JSON.stringify(plan.deploy),
 		"has-build": String(plan.build.length > 0),
 		"has-deploy": String(plan.deploy.length > 0),
-		"aws-region": awsSecretsRegion(workspace),
-		resources: JSON.stringify(resourceStages(workspace))
+		"aws-region": awsSecretsRegion(workspace)
 	};
 }
 /** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */
@@ -186,4 +173,4 @@ var GithubEventNotSet = class extends GkmError {
 //#endregion
 export { stagesCommand };
 
-//# sourceMappingURL=stages-DEmn7qI8.mjs.map
+//# sourceMappingURL=stages-CcS9vnNu.mjs.map

package/dist/stages-CcS9vnNu.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages-CcS9vnNu.mjs","names":[],"sources":["../src/stages/plan.ts","../src/stages/index.ts"],"sourcesContent":["/**\n * Which stages a workflow run builds and deploys, from the event that started\n * it and the project's `stages`.\n *\n * The rules live here, in tested code, rather than in a workflow's YAML or in\n * the action that runs `gkm stages --github-output`: a project's deploy\n * workflow names no stage, and what it does for each event is decided by the\n * CLI the project installed.\n *\n * | event               | build              | deploy                          |\n * | ------------------- | ------------------ | ------------------------------- |\n * | `push`              | every deployed     | deployed, less the protected    |\n * | `release`           | none               | the protected                   |\n * | `workflow_dispatch` | none               | the one stage named             |\n * | anything else       | none               | none                            |\n *\n * A push builds every deployed stage, protected ones included, so a release\n * deploys images built from the very commit its tag names; a release and a\n * manual run deploy what a push already built.\n */\n\nimport { GkmError } from '../errors';\nimport { UndeclaredStage } from '../workspace/stages.js';\nimport type { StagesConfig } from '../workspace/types.js';\n\nexport interface StagePlan {\n\t/** The stages whose images this run builds and pushes. */\n\tbuild: string[];\n\t/** The stages this run deploys. */\n\tdeploy: string[];\n}\n\nexport interface PlanInput {\n\t/** The GitHub event name: `push`, `release`, `workflow_dispatch`, … */\n\tevent: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport function planStages(stages: StagesConfig, input: PlanInput): StagePlan {\n\tconst kept = stages.protected ?? [];\n\n\tswitch (input.event) {\n\t\tcase 'push':\n\t\t\treturn {\n\t\t\t\tbuild: [...stages.deployed],\n\t\t\t\tdeploy: stages.deployed.filter((stage) => !kept.includes(stage)),\n\t\t\t};\n\t\tcase 'release':\n\t\t\treturn { build: [], deploy: [...kept] };\n\t\tcase 'workflow_dispatch': {\n\t\t\tconst stage = input.stage?.trim();\n\t\t\tif (!stage) throw new DispatchNamesNoStage(stages.deployed);\n\t\t\tif (!stages.deployed.includes(stage)) {\n\t\t\t\tthrow new UndeclaredStage(stage, stages.deployed);\n\t\t\t}\n\t\t\treturn { build: [], deploy: [stage] };\n\t\t}\n\t\tdefault:\n\t\t\treturn { build: [], deploy: [] };\n\t}\n}\n\n/**\n * A manual run with no stage. Refused rather than read as \"nothing to do\", so\n * a run started with the field left empty fails where it can be seen.\n */\nexport class DispatchNamesNoStage extends GkmError {\n\tconstructor(readonly deployed: readonly string[]) {\n\t\tsuper(\n\t\t\t`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(', ') || 'nothing yet — gkm.config.ts deploys to no stage'}.`,\n\t\t);\n\t\tthis.name = 'DispatchNamesNoStage';\n\t}\n}\n","/**\n * `gkm stages` — the workspace's stages, as gkm.config.ts declares them.\n *\n * ```bash\n * gkm stages                    # a table\n * gkm stages --json             # {\"local\":\"dev\",\"deployed\":[\"prod\"],\"protected\":[\"prod\"]}\n * gkm stages --github-output    # a workflow run's build and deploy matrices\n * ```\n *\n * The config is read by the normal loader (and sandbox), so a workflow never\n * parses TypeScript to learn which stages exist. `--github-output` is what the\n * `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and\n * which of them this run builds and deploys, to `$GITHUB_OUTPUT`.\n */\n\nimport { appendFile } from 'node:fs/promises';\nimport { loadWorkspaceSettings } from '../config.js';\nimport { GkmError } from '../errors';\nimport { s3SecretsLocation } from '../secrets/providers.js';\nimport type { NormalizedWorkspace, StagesConfig } from '../workspace/types.js';\nimport { planStages } from './plan.js';\n\nexport { DispatchNamesNoStage, type PlanInput, planStages } from './plan.js';\n\nexport interface StagesOptions {\n\t/** Print the stages as JSON. */\n\tjson?: boolean;\n\t/** Write the outputs a deploy workflow reads to `$GITHUB_OUTPUT`. */\n\tgithubOutput?: boolean;\n\t/** The event to plan for; defaults to `GITHUB_EVENT_NAME`. */\n\tevent?: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport interface StagesDeps {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\t/** Where lines go; stdout by default. */\n\tlog?: (line: string) => void;\n}\n\n/** The stages, as `gkm stages --json` prints them. */\nexport interface StagesJson {\n\tlocal: string;\n\tdeployed: string[];\n\tprotected: string[];\n}\n\nexport function stagesJson(stages: StagesConfig): StagesJson {\n\treturn {\n\t\tlocal: stages.local,\n\t\tdeployed: [...stages.deployed],\n\t\tprotected: [...(stages.protected ?? [])],\n\t};\n}\n\n/**\n * The region of the workspace's AWS secrets store — `s3`, `ssm` or\n * `secrets-manager` — or `''` when its deployed stages keep their secrets\n * anywhere else. A job assumes the stage's AWS role only when this is set.\n */\nexport function awsSecretsRegion(workspace: NormalizedWorkspace): string {\n\tconst store = workspace.secrets?.store;\n\tif (typeof store !== 'object' || store === null) return '';\n\tif (store.provider === 's3') {\n\t\treturn s3SecretsLocation(store, workspace.state).region;\n\t}\n\tif (store.provider === 'ssm' || store.provider === 'secrets-manager') {\n\t\treturn store.region;\n\t}\n\treturn '';\n}\n\n/**\n * Every output the stages action sets, each a string `fromJSON()` reads, for\n * one workflow run.\n */\nexport function githubOutputs(\n\tworkspace: NormalizedWorkspace,\n\tinput: { event: string; stage?: string },\n): Record<string, string> {\n\tconst stages = stagesJson(workspace.stages);\n\tconst plan = planStages(workspace.stages, input);\n\n\treturn {\n\t\tlocal: JSON.stringify(stages.local),\n\t\tdeployed: JSON.stringify(stages.deployed),\n\t\tprotected: JSON.stringify(stages.protected),\n\t\tbuild: JSON.stringify(plan.build),\n\t\tdeploy: JSON.stringify(plan.deploy),\n\t\t// A matrix over an empty list is an error on GitHub, so a job over one\n\t\t// is skipped on these instead.\n\t\t'has-build': String(plan.build.length > 0),\n\t\t'has-deploy': String(plan.deploy.length > 0),\n\t\t'aws-region': awsSecretsRegion(workspace),\n\t};\n}\n\n/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */\nexport function formatGithubOutputs(outputs: Record<string, string>): string {\n\treturn Object.entries(outputs)\n\t\t.map(([name, value]) => `${name}=${value}\\n`)\n\t\t.join('');\n}\n\n/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */\nfunction workflowCommandData(message: string): string {\n\treturn message\n\t\t.replaceAll('%', '%25')\n\t\t.replaceAll('\\r', '%0D')\n\t\t.replaceAll('\\n', '%0A');\n}\n\nfunction table(stages: StagesJson): string {\n\tconst rows: [string, string][] = [\n\t\t['STAGE', 'KIND'],\n\t\t[stages.local, 'local'],\n\t\t...stages.deployed.map((name): [string, string] => [\n\t\t\tname,\n\t\t\tstages.protected.includes(name) ? 'deployed, protected' : 'deployed',\n\t\t]),\n\t];\n\tconst width = Math.max(...rows.map(([name]) => name.length));\n\treturn rows\n\t\t.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`)\n\t\t.join('\\n');\n}\n\nexport async function stagesCommand(\n\toptions: StagesOptions,\n\tdeps: StagesDeps = {},\n): Promise<void> {\n\tconst env = deps.env ?? process.env;\n\tconst log = deps.log ?? ((line: string) => console.log(line));\n\n\tif (!options.githubOutput) {\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst stages = stagesJson(workspace.stages);\n\t\tlog(options.json ? JSON.stringify(stages) : table(stages));\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst file = env.GITHUB_OUTPUT;\n\t\tif (!file) throw new GithubOutputNotSet();\n\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst event = options.event || env.GITHUB_EVENT_NAME;\n\t\tif (!event) throw new GithubEventNotSet();\n\n\t\tconst outputs = githubOutputs(workspace, {\n\t\t\tevent,\n\t\t\t...(options.stage ? { stage: options.stage } : {}),\n\t\t});\n\t\tawait appendFile(file, formatGithubOutputs(outputs));\n\n\t\tlog(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);\n\t} catch (error) {\n\t\t// Annotated on the run, where whoever started it looks first.\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tlog(`::error title=gkm stages::${workflowCommandData(message)}`);\n\t\tthrow error;\n\t}\n}\n\n/** `--github-output` outside a GitHub Actions step, which sets the file. */\nexport class GithubOutputNotSet extends GkmError {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.',\n\t\t);\n\t\tthis.name = 'GithubOutputNotSet';\n\t}\n}\n\n/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */\nexport class GithubEventNotSet extends GkmError {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.',\n\t\t);\n\t\tthis.name = 'GithubEventNotSet';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,WAAW,QAAsB,OAA6B;CAC7E,MAAM,OAAO,OAAO,aAAa,CAAC;CAElC,QAAQ,MAAM,OAAd;EACC,KAAK,QACJ,OAAO;GACN,OAAO,CAAC,GAAG,OAAO,QAAQ;GAC1B,QAAQ,OAAO,SAAS,QAAQ,UAAU,CAAC,KAAK,SAAS,KAAK,CAAC;EAChE;EACD,KAAK,WACJ,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC,GAAG,IAAI;EAAE;EACvC,KAAK,qBAAqB;GACzB,MAAM,QAAQ,MAAM,OAAO,KAAK;GAChC,IAAI,CAAC,OAAO,MAAM,IAAI,qBAAqB,OAAO,QAAQ;GAC1D,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,GAClC,MAAM,IAAI,gBAAgB,OAAO,OAAO,QAAQ;GAEjD,OAAO;IAAE,OAAO,CAAC;IAAG,QAAQ,CAAC,KAAK;GAAE;EACrC;EACA,SACC,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC;EAAE;CACjC;AACD;;;;;AAMA,IAAa,uBAAb,cAA0C,SAAS;CAC7B;CAArB,YAAY,UAAsC;EACjD,MACC,wGAAwG,SAAS,KAAK,IAAI,KAAK,kDAAkD,EAClL;EAHoB,KAAA,WAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;ACzBA,SAAgB,WAAW,QAAkC;CAC5D,OAAO;EACN,OAAO,OAAO;EACd,UAAU,CAAC,GAAG,OAAO,QAAQ;EAC7B,WAAW,CAAC,GAAI,OAAO,aAAa,CAAC,CAAE;CACxC;AACD;;;;;;AAOA,SAAgB,iBAAiB,WAAwC;CACxE,MAAM,QAAQ,UAAU,SAAS;CACjC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,IAAI,MAAM,aAAa,MACtB,OAAO,kBAAkB,OAAO,UAAU,KAAK,CAAC,CAAC;CAElD,IAAI,MAAM,aAAa,SAAS,MAAM,aAAa,mBAClD,OAAO,MAAM;CAEd,OAAO;AACR;;;;;AAMA,SAAgB,cACf,WACA,OACyB;CACzB,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,OAAO,WAAW,UAAU,QAAQ,KAAK;CAE/C,OAAO;EACN,OAAO,KAAK,UAAU,OAAO,KAAK;EAClC,UAAU,KAAK,UAAU,OAAO,QAAQ;EACxC,WAAW,KAAK,UAAU,OAAO,SAAS;EAC1C,OAAO,KAAK,UAAU,KAAK,KAAK;EAChC,QAAQ,KAAK,UAAU,KAAK,MAAM;EAGlC,aAAa,OAAO,KAAK,MAAM,SAAS,CAAC;EACzC,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC;EAC3C,cAAc,iBAAiB,SAAS;CACzC;AACD;;AAGA,SAAgB,oBAAoB,SAAyC;CAC5E,OAAO,OAAO,QAAQ,OAAO,CAAC,CAC5B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,CAAC,CAC5C,KAAK,EAAE;AACV;;AAGA,SAAS,oBAAoB,SAAyB;CACrD,OAAO,QACL,WAAW,KAAK,KAAK,CAAC,CACtB,WAAW,MAAM,KAAK,CAAC,CACvB,WAAW,MAAM,KAAK;AACzB;AAEA,SAAS,MAAM,QAA4B;CAC1C,MAAM,OAA2B;EAChC,CAAC,SAAS,MAAM;EAChB,CAAC,OAAO,OAAO,OAAO;EACtB,GAAG,OAAO,SAAS,KAAK,SAA2B,CAClD,MACA,OAAO,UAAU,SAAS,IAAI,IAAI,wBAAwB,UAC3D,CAAC;CACF;CACA,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;CAC3D,OAAO,KACL,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,CACvD,KAAK,IAAI;AACZ;AAEA,eAAsB,cACrB,SACA,OAAmB,CAAC,GACJ;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,SAAS,SAAiB,QAAQ,IAAI,IAAI;CAE3D,IAAI,CAAC,QAAQ,cAAc;EAE1B,MAAM,SAAS,YAAW,MADF,sBAAsB,KAAK,GAAG,EAAA,CAClB,MAAM;EAC1C,IAAI,QAAQ,OAAO,KAAK,UAAU,MAAM,IAAI,MAAM,MAAM,CAAC;EACzD;CACD;CAEA,IAAI;EACH,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB;EAExC,MAAM,YAAY,MAAM,sBAAsB,KAAK,GAAG;EACtD,MAAM,QAAQ,QAAQ,SAAS,IAAI;EACnC,IAAI,CAAC,OAAO,MAAM,IAAI,kBAAkB;EAExC,MAAM,UAAU,cAAc,WAAW;GACxC;GACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;EACD,MAAM,WAAW,MAAM,oBAAoB,OAAO,CAAC;EAEnD,IAAI,GAAG,MAAM,UAAU,QAAQ,MAAM,WAAW,QAAQ,QAAQ;CACjE,SAAS,OAAO;EAGf,IAAI,6BAA6B,oBADjB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACT,GAAG;EAC/D,MAAM;CACP;AACD;;AAGA,IAAa,qBAAb,cAAwC,SAAS;CAChD,cAAc;EACb,MACC,oKACD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuC,SAAS;CAC/C,cAAc;EACb,MACC,uLACD;EACA,KAAK,OAAO;CACb;AACD"}

package/dist/{stages-BpDXFPGg.cjs → stages-DdBV7msu.cjs}

@@ -1,8 +1,6 @@
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_workspace = require("./workspace-C1M-S4al.cjs");
+const require_workspace = require("./workspace-DRjdu1OY.cjs");
 const require_config = require("./config.cjs");
-const require_seeds = require("./seeds-BQlj9Fsg.cjs");
-const require_dns = require("./dns-BFnoawgh.cjs");
 let node_fs_promises = require("node:fs/promises");
 //#region src/stages/plan.ts
 /**
@@ -87,28 +85,18 @@ function stagesJson(stages) {
 	};
 }
 /**
-* The region of the workspace's AWS secrets store — `ssm` or
+* The region of the workspace's AWS secrets store — `s3`, `ssm` or
 * `secrets-manager` — or `''` when its deployed stages keep their secrets
 * anywhere else. A job assumes the stage's AWS role only when this is set.
 */
 function awsSecretsRegion(workspace) {
 	const store = workspace.secrets?.store;
 	if (typeof store !== "object" || store === null) return "";
+	if (store.provider === "s3") return require_workspace.s3SecretsLocation(store, workspace.state).region;
 	if (store.provider === "ssm" || store.provider === "secrets-manager") return store.region;
 	return "";
 }
 /**
-* The deployed stages with resources the deploy creates — a provider under
-* `deploy.<kind>.<stage>`, or a domain under a `dns` entry whose provider
-* writes records — and secrets a CI runner can reach (an AWS store): a
-* compose deploy workflow creates their resources on the runner, with the
-* stage's role and DNS token, rather than on the server.
-*/
-function resourceStages(workspace) {
-	if (!awsSecretsRegion(workspace)) return [];
-	return workspace.stages.deployed.filter((stage) => require_seeds.PROVIDER_KINDS.some((kind) => require_workspace.stageProvider(workspace, kind, stage).mode === "provider") || require_dns.stageDnsDomains(stage, workspace.domains, workspace.dns).some(({ config }) => config.provider !== "manual"));
-}
-/**
 * Every output the stages action sets, each a string `fromJSON()` reads, for
 * one workflow run.
 */
@@ -123,8 +111,7 @@ function githubOutputs(workspace, input) {
 		deploy: JSON.stringify(plan.deploy),
 		"has-build": String(plan.build.length > 0),
 		"has-deploy": String(plan.deploy.length > 0),
-		"aws-region": awsSecretsRegion(workspace),
-		resources: JSON.stringify(resourceStages(workspace))
+		"aws-region": awsSecretsRegion(workspace)
 	};
 }
 /** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */
@@ -186,4 +173,4 @@ var GithubEventNotSet = class extends require_errors.GkmError {
 //#endregion
 exports.stagesCommand = stagesCommand;
 
-//# sourceMappingURL=stages-BpDXFPGg.cjs.map
+//# sourceMappingURL=stages-DdBV7msu.cjs.map

package/dist/stages-DdBV7msu.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stages-DdBV7msu.cjs","names":["UndeclaredStage","GkmError","s3SecretsLocation","loadWorkspaceSettings","appendFile","GkmError"],"sources":["../src/stages/plan.ts","../src/stages/index.ts"],"sourcesContent":["/**\n * Which stages a workflow run builds and deploys, from the event that started\n * it and the project's `stages`.\n *\n * The rules live here, in tested code, rather than in a workflow's YAML or in\n * the action that runs `gkm stages --github-output`: a project's deploy\n * workflow names no stage, and what it does for each event is decided by the\n * CLI the project installed.\n *\n * | event               | build              | deploy                          |\n * | ------------------- | ------------------ | ------------------------------- |\n * | `push`              | every deployed     | deployed, less the protected    |\n * | `release`           | none               | the protected                   |\n * | `workflow_dispatch` | none               | the one stage named             |\n * | anything else       | none               | none                            |\n *\n * A push builds every deployed stage, protected ones included, so a release\n * deploys images built from the very commit its tag names; a release and a\n * manual run deploy what a push already built.\n */\n\nimport { GkmError } from '../errors';\nimport { UndeclaredStage } from '../workspace/stages.js';\nimport type { StagesConfig } from '../workspace/types.js';\n\nexport interface StagePlan {\n\t/** The stages whose images this run builds and pushes. */\n\tbuild: string[];\n\t/** The stages this run deploys. */\n\tdeploy: string[];\n}\n\nexport interface PlanInput {\n\t/** The GitHub event name: `push`, `release`, `workflow_dispatch`, … */\n\tevent: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport function planStages(stages: StagesConfig, input: PlanInput): StagePlan {\n\tconst kept = stages.protected ?? [];\n\n\tswitch (input.event) {\n\t\tcase 'push':\n\t\t\treturn {\n\t\t\t\tbuild: [...stages.deployed],\n\t\t\t\tdeploy: stages.deployed.filter((stage) => !kept.includes(stage)),\n\t\t\t};\n\t\tcase 'release':\n\t\t\treturn { build: [], deploy: [...kept] };\n\t\tcase 'workflow_dispatch': {\n\t\t\tconst stage = input.stage?.trim();\n\t\t\tif (!stage) throw new DispatchNamesNoStage(stages.deployed);\n\t\t\tif (!stages.deployed.includes(stage)) {\n\t\t\t\tthrow new UndeclaredStage(stage, stages.deployed);\n\t\t\t}\n\t\t\treturn { build: [], deploy: [stage] };\n\t\t}\n\t\tdefault:\n\t\t\treturn { build: [], deploy: [] };\n\t}\n}\n\n/**\n * A manual run with no stage. Refused rather than read as \"nothing to do\", so\n * a run started with the field left empty fails where it can be seen.\n */\nexport class DispatchNamesNoStage extends GkmError {\n\tconstructor(readonly deployed: readonly string[]) {\n\t\tsuper(\n\t\t\t`A manual run deploys one stage, and none was given. Run the workflow again with stage set to one of: ${deployed.join(', ') || 'nothing yet — gkm.config.ts deploys to no stage'}.`,\n\t\t);\n\t\tthis.name = 'DispatchNamesNoStage';\n\t}\n}\n","/**\n * `gkm stages` — the workspace's stages, as gkm.config.ts declares them.\n *\n * ```bash\n * gkm stages                    # a table\n * gkm stages --json             # {\"local\":\"dev\",\"deployed\":[\"prod\"],\"protected\":[\"prod\"]}\n * gkm stages --github-output    # a workflow run's build and deploy matrices\n * ```\n *\n * The config is read by the normal loader (and sandbox), so a workflow never\n * parses TypeScript to learn which stages exist. `--github-output` is what the\n * `geekmidas/toolbox/actions/stages` action runs: it writes the stages, and\n * which of them this run builds and deploys, to `$GITHUB_OUTPUT`.\n */\n\nimport { appendFile } from 'node:fs/promises';\nimport { loadWorkspaceSettings } from '../config.js';\nimport { GkmError } from '../errors';\nimport { s3SecretsLocation } from '../secrets/providers.js';\nimport type { NormalizedWorkspace, StagesConfig } from '../workspace/types.js';\nimport { planStages } from './plan.js';\n\nexport { DispatchNamesNoStage, type PlanInput, planStages } from './plan.js';\n\nexport interface StagesOptions {\n\t/** Print the stages as JSON. */\n\tjson?: boolean;\n\t/** Write the outputs a deploy workflow reads to `$GITHUB_OUTPUT`. */\n\tgithubOutput?: boolean;\n\t/** The event to plan for; defaults to `GITHUB_EVENT_NAME`. */\n\tevent?: string;\n\t/** The stage a `workflow_dispatch` names. */\n\tstage?: string;\n}\n\nexport interface StagesDeps {\n\tcwd?: string;\n\tenv?: NodeJS.ProcessEnv;\n\t/** Where lines go; stdout by default. */\n\tlog?: (line: string) => void;\n}\n\n/** The stages, as `gkm stages --json` prints them. */\nexport interface StagesJson {\n\tlocal: string;\n\tdeployed: string[];\n\tprotected: string[];\n}\n\nexport function stagesJson(stages: StagesConfig): StagesJson {\n\treturn {\n\t\tlocal: stages.local,\n\t\tdeployed: [...stages.deployed],\n\t\tprotected: [...(stages.protected ?? [])],\n\t};\n}\n\n/**\n * The region of the workspace's AWS secrets store — `s3`, `ssm` or\n * `secrets-manager` — or `''` when its deployed stages keep their secrets\n * anywhere else. A job assumes the stage's AWS role only when this is set.\n */\nexport function awsSecretsRegion(workspace: NormalizedWorkspace): string {\n\tconst store = workspace.secrets?.store;\n\tif (typeof store !== 'object' || store === null) return '';\n\tif (store.provider === 's3') {\n\t\treturn s3SecretsLocation(store, workspace.state).region;\n\t}\n\tif (store.provider === 'ssm' || store.provider === 'secrets-manager') {\n\t\treturn store.region;\n\t}\n\treturn '';\n}\n\n/**\n * Every output the stages action sets, each a string `fromJSON()` reads, for\n * one workflow run.\n */\nexport function githubOutputs(\n\tworkspace: NormalizedWorkspace,\n\tinput: { event: string; stage?: string },\n): Record<string, string> {\n\tconst stages = stagesJson(workspace.stages);\n\tconst plan = planStages(workspace.stages, input);\n\n\treturn {\n\t\tlocal: JSON.stringify(stages.local),\n\t\tdeployed: JSON.stringify(stages.deployed),\n\t\tprotected: JSON.stringify(stages.protected),\n\t\tbuild: JSON.stringify(plan.build),\n\t\tdeploy: JSON.stringify(plan.deploy),\n\t\t// A matrix over an empty list is an error on GitHub, so a job over one\n\t\t// is skipped on these instead.\n\t\t'has-build': String(plan.build.length > 0),\n\t\t'has-deploy': String(plan.deploy.length > 0),\n\t\t'aws-region': awsSecretsRegion(workspace),\n\t};\n}\n\n/** `name=value` lines, as `$GITHUB_OUTPUT` takes single-line values. */\nexport function formatGithubOutputs(outputs: Record<string, string>): string {\n\treturn Object.entries(outputs)\n\t\t.map(([name, value]) => `${name}=${value}\\n`)\n\t\t.join('');\n}\n\n/** A message as a workflow command's data: GitHub reads `%`, CR and LF escaped. */\nfunction workflowCommandData(message: string): string {\n\treturn message\n\t\t.replaceAll('%', '%25')\n\t\t.replaceAll('\\r', '%0D')\n\t\t.replaceAll('\\n', '%0A');\n}\n\nfunction table(stages: StagesJson): string {\n\tconst rows: [string, string][] = [\n\t\t['STAGE', 'KIND'],\n\t\t[stages.local, 'local'],\n\t\t...stages.deployed.map((name): [string, string] => [\n\t\t\tname,\n\t\t\tstages.protected.includes(name) ? 'deployed, protected' : 'deployed',\n\t\t]),\n\t];\n\tconst width = Math.max(...rows.map(([name]) => name.length));\n\treturn rows\n\t\t.map(([name, kind]) => `${name.padEnd(width)}  ${kind}`)\n\t\t.join('\\n');\n}\n\nexport async function stagesCommand(\n\toptions: StagesOptions,\n\tdeps: StagesDeps = {},\n): Promise<void> {\n\tconst env = deps.env ?? process.env;\n\tconst log = deps.log ?? ((line: string) => console.log(line));\n\n\tif (!options.githubOutput) {\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst stages = stagesJson(workspace.stages);\n\t\tlog(options.json ? JSON.stringify(stages) : table(stages));\n\t\treturn;\n\t}\n\n\ttry {\n\t\tconst file = env.GITHUB_OUTPUT;\n\t\tif (!file) throw new GithubOutputNotSet();\n\n\t\tconst workspace = await loadWorkspaceSettings(deps.cwd);\n\t\tconst event = options.event || env.GITHUB_EVENT_NAME;\n\t\tif (!event) throw new GithubEventNotSet();\n\n\t\tconst outputs = githubOutputs(workspace, {\n\t\t\tevent,\n\t\t\t...(options.stage ? { stage: options.stage } : {}),\n\t\t});\n\t\tawait appendFile(file, formatGithubOutputs(outputs));\n\n\t\tlog(`${event}: build ${outputs.build}, deploy ${outputs.deploy}`);\n\t} catch (error) {\n\t\t// Annotated on the run, where whoever started it looks first.\n\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\tlog(`::error title=gkm stages::${workflowCommandData(message)}`);\n\t\tthrow error;\n\t}\n}\n\n/** `--github-output` outside a GitHub Actions step, which sets the file. */\nexport class GithubOutputNotSet extends GkmError {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output writes to the file GITHUB_OUTPUT names, and it is not set. Run it in a GitHub Actions step, or set GITHUB_OUTPUT to a file to write to.',\n\t\t);\n\t\tthis.name = 'GithubOutputNotSet';\n\t}\n}\n\n/** No `--event`, and no `GITHUB_EVENT_NAME` to take it from. */\nexport class GithubEventNotSet extends GkmError {\n\tconstructor() {\n\t\tsuper(\n\t\t\t'gkm stages --github-output plans for an event, and none was given. Pass --event (push, release, workflow_dispatch), or run it in a GitHub Actions step, which sets GITHUB_EVENT_NAME.',\n\t\t);\n\t\tthis.name = 'GithubEventNotSet';\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,WAAW,QAAsB,OAA6B;CAC7E,MAAM,OAAO,OAAO,aAAa,CAAC;CAElC,QAAQ,MAAM,OAAd;EACC,KAAK,QACJ,OAAO;GACN,OAAO,CAAC,GAAG,OAAO,QAAQ;GAC1B,QAAQ,OAAO,SAAS,QAAQ,UAAU,CAAC,KAAK,SAAS,KAAK,CAAC;EAChE;EACD,KAAK,WACJ,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC,GAAG,IAAI;EAAE;EACvC,KAAK,qBAAqB;GACzB,MAAM,QAAQ,MAAM,OAAO,KAAK;GAChC,IAAI,CAAC,OAAO,MAAM,IAAI,qBAAqB,OAAO,QAAQ;GAC1D,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,GAClC,MAAM,IAAIA,kBAAAA,gBAAgB,OAAO,OAAO,QAAQ;GAEjD,OAAO;IAAE,OAAO,CAAC;IAAG,QAAQ,CAAC,KAAK;GAAE;EACrC;EACA,SACC,OAAO;GAAE,OAAO,CAAC;GAAG,QAAQ,CAAC;EAAE;CACjC;AACD;;;;;AAMA,IAAa,uBAAb,cAA0CC,eAAAA,SAAS;CAC7B;CAArB,YAAY,UAAsC;EACjD,MACC,wGAAwG,SAAS,KAAK,IAAI,KAAK,kDAAkD,EAClL;EAHoB,KAAA,WAAA;EAIpB,KAAK,OAAO;CACb;AACD;;;;;;;;;;;;;;;;;ACzBA,SAAgB,WAAW,QAAkC;CAC5D,OAAO;EACN,OAAO,OAAO;EACd,UAAU,CAAC,GAAG,OAAO,QAAQ;EAC7B,WAAW,CAAC,GAAI,OAAO,aAAa,CAAC,CAAE;CACxC;AACD;;;;;;AAOA,SAAgB,iBAAiB,WAAwC;CACxE,MAAM,QAAQ,UAAU,SAAS;CACjC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,IAAI,MAAM,aAAa,MACtB,OAAOC,kBAAAA,kBAAkB,OAAO,UAAU,KAAK,CAAC,CAAC;CAElD,IAAI,MAAM,aAAa,SAAS,MAAM,aAAa,mBAClD,OAAO,MAAM;CAEd,OAAO;AACR;;;;;AAMA,SAAgB,cACf,WACA,OACyB;CACzB,MAAM,SAAS,WAAW,UAAU,MAAM;CAC1C,MAAM,OAAO,WAAW,UAAU,QAAQ,KAAK;CAE/C,OAAO;EACN,OAAO,KAAK,UAAU,OAAO,KAAK;EAClC,UAAU,KAAK,UAAU,OAAO,QAAQ;EACxC,WAAW,KAAK,UAAU,OAAO,SAAS;EAC1C,OAAO,KAAK,UAAU,KAAK,KAAK;EAChC,QAAQ,KAAK,UAAU,KAAK,MAAM;EAGlC,aAAa,OAAO,KAAK,MAAM,SAAS,CAAC;EACzC,cAAc,OAAO,KAAK,OAAO,SAAS,CAAC;EAC3C,cAAc,iBAAiB,SAAS;CACzC;AACD;;AAGA,SAAgB,oBAAoB,SAAyC;CAC5E,OAAO,OAAO,QAAQ,OAAO,CAAC,CAC5B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,CAAC,CAC5C,KAAK,EAAE;AACV;;AAGA,SAAS,oBAAoB,SAAyB;CACrD,OAAO,QACL,WAAW,KAAK,KAAK,CAAC,CACtB,WAAW,MAAM,KAAK,CAAC,CACvB,WAAW,MAAM,KAAK;AACzB;AAEA,SAAS,MAAM,QAA4B;CAC1C,MAAM,OAA2B;EAChC,CAAC,SAAS,MAAM;EAChB,CAAC,OAAO,OAAO,OAAO;EACtB,GAAG,OAAO,SAAS,KAAK,SAA2B,CAClD,MACA,OAAO,UAAU,SAAS,IAAI,IAAI,wBAAwB,UAC3D,CAAC;CACF;CACA,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC;CAC3D,OAAO,KACL,KAAK,CAAC,MAAM,UAAU,GAAG,KAAK,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,CACvD,KAAK,IAAI;AACZ;AAEA,eAAsB,cACrB,SACA,OAAmB,CAAC,GACJ;CAChB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,SAAS,SAAiB,QAAQ,IAAI,IAAI;CAE3D,IAAI,CAAC,QAAQ,cAAc;EAE1B,MAAM,SAAS,YAAW,MADFC,eAAAA,sBAAsB,KAAK,GAAG,EAAA,CAClB,MAAM;EAC1C,IAAI,QAAQ,OAAO,KAAK,UAAU,MAAM,IAAI,MAAM,MAAM,CAAC;EACzD;CACD;CAEA,IAAI;EACH,MAAM,OAAO,IAAI;EACjB,IAAI,CAAC,MAAM,MAAM,IAAI,mBAAmB;EAExC,MAAM,YAAY,MAAMA,eAAAA,sBAAsB,KAAK,GAAG;EACtD,MAAM,QAAQ,QAAQ,SAAS,IAAI;EACnC,IAAI,CAAC,OAAO,MAAM,IAAI,kBAAkB;EAExC,MAAM,UAAU,cAAc,WAAW;GACxC;GACA,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;EACjD,CAAC;EACD,OAAA,GAAMC,iBAAAA,WAAAA,CAAW,MAAM,oBAAoB,OAAO,CAAC;EAEnD,IAAI,GAAG,MAAM,UAAU,QAAQ,MAAM,WAAW,QAAQ,QAAQ;CACjE,SAAS,OAAO;EAGf,IAAI,6BAA6B,oBADjB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACT,GAAG;EAC/D,MAAM;CACP;AACD;;AAGA,IAAa,qBAAb,cAAwCC,eAAAA,SAAS;CAChD,cAAc;EACb,MACC,oKACD;EACA,KAAK,OAAO;CACb;AACD;;AAGA,IAAa,oBAAb,cAAuCA,eAAAA,SAAS;CAC/C,cAAc;EACb,MACC,uLACD;EACA,KAAK,OAAO;CACb;AACD"}

package/dist/target/public.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_define = require("../define-crmMcXFS.cjs");
-const require_resolve = require("../resolve-C8VkR4oW.cjs");
+const require_resolve = require("../resolve-DC98Rl1t.cjs");
 const require_provider = require("../provider-BqpjG9QM.cjs");
 exports.DeployTargetNotYetSupported = require_define.DeployTargetNotYetSupported;
 exports.InvalidTargetOptions = require_resolve.InvalidTargetOptions;

package/dist/target/public.d.cts

@@ -1,5 +1,5 @@
-import { $ as TargetOptions, G as DeployPhaseContext, J as DeployTarget, K as DeployRuntime, Ot as StageSecrets, Q as TargetEvent, St as StateStore, U as AnyDeployTarget, W as DeployFailure, X as DeployTargetEntry, Y as DeployTargetCapabilities, Z as DeployTargetLogger, at as DeployPhase, ct as AppDeployResult, dt as Credential, et as TargetOptionsIssue, ft as CredentialKind, ht as CredentialRequest, it as DeployEventType, kt as DeployIdentity, lt as DeployResult, mt as CredentialProvider, nt as DeployEvent, ot as ResourceChange, pt as CredentialKinds, q as DeploySecrets, rt as DeployEventError, st as ResourceVia, tt as TargetOptionsSchema, ut as AwsCredential } from "../types-4vPS_YFX.cjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CaW4QqF2.cjs";
+import { $ as TargetOptions, G as DeployPhaseContext, J as DeployTarget, K as DeployRuntime, Ot as StageSecrets, Q as TargetEvent, St as StateStore, U as AnyDeployTarget, W as DeployFailure, X as DeployTargetEntry, Y as DeployTargetCapabilities, Z as DeployTargetLogger, at as DeployPhase, ct as AppDeployResult, dt as Credential, et as TargetOptionsIssue, ft as CredentialKind, ht as CredentialRequest, it as DeployEventType, kt as DeployIdentity, lt as DeployResult, mt as CredentialProvider, nt as DeployEvent, ot as ResourceChange, pt as CredentialKinds, q as DeploySecrets, rt as DeployEventError, st as ResourceVia, tt as TargetOptionsSchema, ut as AwsCredential } from "../types-DwoLHelT.cjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CUWf0IUk.cjs";
 //#region src/target/define.d.ts
 /**
  * A deploy target, typed from what it is written with: the options from its

package/dist/target/public.d.mts

@@ -1,5 +1,5 @@
-import { $ as TargetOptions, G as DeployPhaseContext, J as DeployTarget, K as DeployRuntime, Ot as StageSecrets, Q as TargetEvent, St as StateStore, U as AnyDeployTarget, W as DeployFailure, X as DeployTargetEntry, Y as DeployTargetCapabilities, Z as DeployTargetLogger, at as DeployPhase, ct as AppDeployResult, dt as Credential, et as TargetOptionsIssue, ft as CredentialKind, ht as CredentialRequest, it as DeployEventType, kt as DeployIdentity, lt as DeployResult, mt as CredentialProvider, nt as DeployEvent, ot as ResourceChange, pt as CredentialKinds, q as DeploySecrets, rt as DeployEventError, st as ResourceVia, tt as TargetOptionsSchema, ut as AwsCredential } from "../types-CFsEyFb1.mjs";
-import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-K5uxp6HE.mjs";
+import { $ as TargetOptions, G as DeployPhaseContext, J as DeployTarget, K as DeployRuntime, Ot as StageSecrets, Q as TargetEvent, St as StateStore, U as AnyDeployTarget, W as DeployFailure, X as DeployTargetEntry, Y as DeployTargetCapabilities, Z as DeployTargetLogger, at as DeployPhase, ct as AppDeployResult, dt as Credential, et as TargetOptionsIssue, ft as CredentialKind, ht as CredentialRequest, it as DeployEventType, kt as DeployIdentity, lt as DeployResult, mt as CredentialProvider, nt as DeployEvent, ot as ResourceChange, pt as CredentialKinds, q as DeploySecrets, rt as DeployEventError, st as ResourceVia, tt as TargetOptionsSchema, ut as AwsCredential } from "../types-BhThob0H.mjs";
+import { a as TargetRuntimeMismatch, c as DeployTargetNotYetSupported, i as TargetPackageInvalid, l as UnknownDeployTarget, n as InvalidTargetOptions, o as ProviderRemoved, r as TargetEntryInvalid, s as TargetPackageNotFound, t as TargetRuntimeUndeclared } from "../runtime-CLz3bf07.mjs";
 //#region src/target/define.d.ts
 /**
  * A deploy target, typed from what it is written with: the options from its

package/dist/target/public.mjs

@@ -1,4 +1,4 @@
 import { a as UnknownDeployTarget, i as DeployTargetNotYetSupported, n as isDeployTarget, t as defineTarget } from "../define-6poNqm5O.mjs";
-import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-6EYNqYdr.mjs";
+import { i as TargetRuntimeMismatch, l as TargetPackageNotFound, n as TargetEntryInvalid, r as TargetPackageInvalid, s as TargetRuntimeUndeclared, t as InvalidTargetOptions } from "../resolve-CNYbGH8g.mjs";
 import { t as ProviderRemoved } from "../provider-CEOKk8NS.mjs";
 export { DeployTargetNotYetSupported, InvalidTargetOptions, ProviderRemoved, TargetEntryInvalid, TargetPackageInvalid, TargetPackageNotFound, TargetRuntimeMismatch, TargetRuntimeUndeclared, UnknownDeployTarget, defineTarget, isDeployTarget };

package/dist/{types-4vPS_YFX.d.cts → types-BhThob0H.d.mts}

@@ -1,5 +1,4 @@
 import { ConstructManifest } from "@geekmidas/manifest";
-//#endregion
 //#region src/errors.d.ts
 /**
  * The errors gkm raises on purpose.
@@ -111,8 +110,8 @@ interface StageSecrets {
 //#region src/secrets/store.d.ts
 interface SecretsStore {
   /**
-   * Which kind of store this is — `'file'`, `'ssm'`, `'secrets-manager'`, or
-   * a custom one's.
+   * Which kind of store this is — `'file'`, `'s3'`, `'ssm'`,
+   * `'secrets-manager'`, or a custom one's.
    */
   readonly name: string;
   /** The stage's secrets, or null when it has none here. */
@@ -139,6 +138,24 @@ interface SecretsManagerSecretsStoreConfig {
    */
   kmsKeyId?: string;
 }
+/**
+ * Secrets in S3, one object per stage —
+ * `<prefix>/<project>/<stage>/secrets.json` — in the project bucket beside the
+ * deploy state and backups, or in a bucket that exists. Encrypted with SSE-S3,
+ * every past document kept by the bucket's versioning, and no size limit.
+ */
+interface S3SecretsStoreConfig {
+  provider: 's3';
+  /**
+   * A bucket that already exists. Omitted, the project bucket —
+   * `gkm-<project>-<account id>`, created by the first write.
+   */
+  bucket?: string;
+  /** The bucket's region. Omitted, the deploy state's, when it is in S3. */
+  region?: string;
+  /** Key prefix inside the bucket. Omitted, the S3 state's, else `gkm`. */
+  prefix?: string;
+}
 /** Any other backend: an object implementing {@link SecretsStore}. */
 interface CustomSecretsStoreConfig {
   provider: SecretsStore;
@@ -149,10 +166,10 @@ interface CustomSecretsStoreConfig {
  * `'file'` — the default — keeps each stage's secrets in the encrypted
  * `.gkm/secrets/<stage>.json`, its key in the CLI's home (`GKM_HOME`, else
  * `~/.gkm`). It cannot serve a
- * deploy from CI while `.gkm/` is gitignored; `ssm`, `secrets-manager` or a
- * custom store can.
+ * deploy from CI while `.gkm/` is gitignored; `s3`, `ssm`, `secrets-manager`
+ * or a custom store can.
  */
-type SecretsStoreConfig = 'file' | SsmSecretsStoreConfig | SecretsManagerSecretsStoreConfig | CustomSecretsStoreConfig;
+type SecretsStoreConfig = 'file' | S3SecretsStoreConfig | SsmSecretsStoreConfig | SecretsManagerSecretsStoreConfig | CustomSecretsStoreConfig;
 //#endregion
 //#region src/deploy/actor.d.ts
 /**
@@ -1006,7 +1023,7 @@ interface TargetOptionsSchema<Output = unknown> {
  * would print one prints `***` instead, in the terminal and in the events.
  */
 interface DeploySecrets {
-  /** Which kind of store holds them — `'file'`, `'ssm'`, `'secrets-manager'`, or
+  /** Which kind of store holds them — `'file'`, `'s3'`, `'ssm'`, `'secrets-manager'`, or
    * a custom one's. */
   readonly store: string;
   /** The stage's secrets, or null when it has none yet. */
@@ -1103,12 +1120,6 @@ interface DeployPhaseContext<Options = undefined> {
    * proxy in front of it, or records written by another step.
    */
   readonly skipDns?: boolean;
-  /**
-   * `--skip-resources`: an earlier `--resources-only` run created the
-   * stage's resources — its providers' and its DNS records — so this run
-   * creates, writes and checks none of them; it only verifies what it reads.
-   */
-  readonly skipResources?: boolean;
   /** Where every credential comes from. Nothing prompts. */
   readonly credentials: CredentialProvider;
   /**
@@ -1212,12 +1223,6 @@ interface DeployTarget<Options = undefined, Run = unknown> {
   ready?(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
   /** A dry run: emit `resource.planned` for what a real run would do. */
   plan(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
-  /**
-   * What the stage needs outside the target that only the target knows how
-   * to create — compose's DNS records. Run by `--resources-only`, after the
-   * stage's providers, in place of every other phase.
-   */
-  resources?(ctx: DeployPhaseContext<Options>): Promise<void>;
   /** Create or find what the apps run on, and what they declare. */
   provision?(ctx: DeployPhaseContext<Options>, run: Run): Promise<void>;
   /** Build each app's artifact (`artifact.built`), changing nothing live. */
@@ -5976,6 +5981,11 @@ declare const WorkspaceConfigSchema: ZodObject<{
         certFile: ZodString;
         keyFile: ZodString;
       }, $strict>>>;
+      server: ZodOptional<ZodRecord<ZodString, ZodObject<{
+        user: ZodString;
+        host: ZodOptional<ZodString>;
+        port: ZodOptional<ZodNumber>;
+      }, $strict>>>;
     }, $strict>>;
     telemetry: ZodOptional<ZodRecord<ZodString, ZodUnion<readonly [ZodLiteral<false>, ZodLiteral<"self-hosted">, ZodObject<{
       provider: ZodLiteral<"self-hosted">;
@@ -6036,6 +6046,39 @@ declare const WorkspaceConfigSchema: ZodObject<{
   secrets: ZodOptional<ZodObject<{
     enabled: ZodOptional<ZodBoolean>;
     store: ZodOptional<ZodUnion<readonly [ZodLiteral<"file">, ZodObject<{
+      provider: ZodLiteral<"s3">;
+      bucket: ZodOptional<ZodString>;
+      region: ZodOptional<ZodEnum<{
+        "af-south-1": "af-south-1";
+        "ap-east-1": "ap-east-1";
+        "ap-northeast-1": "ap-northeast-1";
+        "ap-northeast-2": "ap-northeast-2";
+        "ap-northeast-3": "ap-northeast-3";
+        "ap-south-1": "ap-south-1";
+        "ap-south-2": "ap-south-2";
+        "ap-southeast-1": "ap-southeast-1";
+        "ap-southeast-2": "ap-southeast-2";
+        "ap-southeast-3": "ap-southeast-3";
+        "ap-southeast-4": "ap-southeast-4";
+        "ca-central-1": "ca-central-1";
+        "eu-central-1": "eu-central-1";
+        "eu-central-2": "eu-central-2";
+        "eu-north-1": "eu-north-1";
+        "eu-south-1": "eu-south-1";
+        "eu-south-2": "eu-south-2";
+        "eu-west-1": "eu-west-1";
+        "eu-west-2": "eu-west-2";
+        "eu-west-3": "eu-west-3";
+        "me-central-1": "me-central-1";
+        "me-south-1": "me-south-1";
+        "sa-east-1": "sa-east-1";
+        "us-east-1": "us-east-1";
+        "us-east-2": "us-east-2";
+        "us-west-1": "us-west-1";
+        "us-west-2": "us-west-2";
+      }>>;
+      prefix: ZodOptional<ZodString>;
+    }, $strict>, ZodObject<{
       provider: ZodLiteral<"ssm">;
       region: ZodEnum<{
         "af-south-1": "af-south-1";
@@ -6392,6 +6435,29 @@ interface ComposeWorkspaceConfig<S extends string = string> {
    * ```
    */
   tls?: StageMap<S, ComposeTlsConfig>;
+  /**
+   * Each deployed stage's server: the SSH login gkm drives its Docker
+   * engine with (`DOCKER_HOST=ssh://user@host`). gkm runs where the deploy
+   * starts — a CI runner, a laptop — and never on the server, which holds
+   * Docker and this login and no cloud credentials. The host defaults to
+   * the stage's `GKM_SERVER_IPV4` secret. Every deployed stage needs one;
+   * the local stage runs on this machine's Docker.
+   *
+   * ```ts
+   * server: { production: { user: 'deploy' } }
+   * server: { staging: { user: 'deploy', host: 'staging.example.com', port: 2222 } }
+   * ```
+   */
+  server?: StageMap<S, ComposeServerConfig>;
+}
+/** A deployed stage's server — `deploy.compose.server.<stage>`. */
+interface ComposeServerConfig {
+  /** The SSH user, in the server's `docker` group. */
+  user: string;
+  /** The host to SSH to. Default: the stage's `GKM_SERVER_IPV4` secret. */
+  host?: string;
+  /** The SSH port. Default 22. */
+  port?: number;
 }
 /** The proxies a compose stack can be served by — `deploy.compose.proxy`. */
 type ComposeProxy = 'caddy' | 'traefik';
@@ -6675,7 +6741,10 @@ interface SecretsConfig {
   /**
    * Where deployed stages' secrets live, so a deploy can reach them from
    * anywhere: `'file'` (default — the encrypted `.gkm/secrets/<stage>.json`,
-   * which cannot serve CI while `.gkm/` is gitignored), `{ provider: 'ssm',
+   * which cannot serve CI while `.gkm/` is gitignored), `{ provider: 's3',
+   * region?, bucket?, prefix? }` (each stage's secrets in one object in the
+   * project bucket beside the deploy state, SSE-S3 and versioned, no size
+   * limit; region and prefix default to an S3 `state`'s), `{ provider: 'ssm',
    * region }` (each stage's secrets in an SSM parameter in its own AWS
    * account, up to 8 KB), `{ provider: 'secrets-manager', region, kmsKeyId? }`
    * (a Secrets Manager secret in its own account, up to 64 KB), or any object
@@ -7549,4 +7618,4 @@ interface GkmConfig {
 }
 //#endregion
 export { TargetOptions as $, BackendFramework as A, deployIdentity as At, isPhase2DeployTarget as B, SecretsConfig as C, StateVersionConflict as Ct, WorkspaceConfig as D, LocalActor as Dt, StageTelemetryConfig as E, GithubActor as Et, SUPPORTED_DEPLOY_TARGETS as F, DeployPhaseContext as G, validateWorkspaceConfig as H, WorkspaceConfigSchema as I, DeployTarget as J, DeployRuntime as K, formatValidationErrors as L, FrontendFramework as M, MobileFramework as N, WorkspaceInput as O, StageSecrets as Ot, PHASE_2_DEPLOY_TARGETS as P, TargetEvent as Q, getDeployTargetError as R, OtlpTelemetryConfig as S, StateStore as St, SharedConfig as T, Actor as Tt, AnyDeployTarget as U, safeValidateWorkspaceConfig as V, DeployFailure as W, DeployTargetEntry as X, DeployTargetCapabilities as Y, DeployTargetLogger as Z, InferredWorkspaceConfig as _, StoredCredentialsOptions as _t, Routes as a, DeployPhase as at, NormalizedAppConfig as b, LocalStateInCi as bt, AppInput as c, AppDeployResult as ct, ConstrainedApps as d, Credential as dt, TargetOptionsIssue as et, DeployConfig as f, CredentialKind as ft, InferAppNames as g, MissingCredential as gt, DokployWorkspaceConfig as h, CredentialRequest as ht, OpenApiConfig as i, DeployEventType as it, Framework as j, GkmError as jt, isWorkspaceConfig as k, DeployIdentity as kt, AppsRecord as l, DeployResult as lt, DevConfig as m, CredentialProvider as mt, EmailBackend as n, DeployEvent as nt, AppConfig as o, ResourceChange as ot, DeployTargetName as p, CredentialKinds as pt, DeploySecrets as q, GkmConfig as r, DeployEventError as rt, AppConfigInput as s, ResourceVia as st, CacheBackend as t, TargetOptionsSchema as tt, ComposeWorkspaceConfig as u, AwsCredential as ut, LoadedConfig as v, chainCredentials as vt, SelfHostedTelemetryConfig as w, ReleasedImage as wt, NormalizedWorkspace as x, StateLocked as xt, ModelsConfig as y, storedCredentials as yt, isDeployTargetSupported as z };
-//# sourceMappingURL=types-4vPS_YFX.d.cts.map
+//# sourceMappingURL=types-BhThob0H.d.mts.map