@geekmidas/cli 10.0.0-alpha.98 → 10.0.0-alpha.99

package/dist/{s3-CUKzBBae.mjs.map → s3-BwhQk3QM.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"s3-CUKzBBae.mjs","names":[],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyC,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACL,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAO,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAI,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAI,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAO,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAe,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAc,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtB,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAc,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAI,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAI,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}
+{"version":3,"file":"s3-BwhQk3QM.mjs","names":[],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyC,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACL,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAO,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAM,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAI,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAI,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAO,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAe,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAc,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtB,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAc,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAI,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAI,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAI,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}

package/dist/{s3-QQi4sNOQ.cjs → s3-DLp0V-Ox.cjs}

@@ -1,6 +1,6 @@
 const require_errors = require("./errors-DMC4Umsb.cjs");
-const require_workspace = require("./workspace-BJ78Bgvm.cjs");
-const require_projectBucket = require("./projectBucket-BjeDcAYy.cjs");
+const require_workspace = require("./workspace-DRjdu1OY.cjs");
+const require_projectBucket = require("./projectBucket-CDu5rXjp.cjs");
 const require_awsStore = require("./awsStore-u3ehhMoY.cjs");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_client_sts = require("@aws-sdk/client-sts");
@@ -212,4 +212,4 @@ var S3SecretsStore = class {
 //#endregion
 exports.S3SecretsStore = S3SecretsStore;
 
-//# sourceMappingURL=s3-QQi4sNOQ.cjs.map
+//# sourceMappingURL=s3-DLp0V-Ox.cjs.map

package/dist/{s3-QQi4sNOQ.cjs.map → s3-DLp0V-Ox.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"s3-QQi4sNOQ.cjs","names":["GkmError","projectBucketName","s3SecretsKey","awsClientConfig","S3Client","STSClient","withStageCredentials","callerAccountId","ensureProjectBucket","findProjectBucket","GetObjectCommand","PutObjectCommand","HeadObjectCommand"],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyCA,eAAAA,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACLC,sBAAAA,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAOC,kBAAAA,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAIC,mBAAAA,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAIC,oBAAAA,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAOC,iBAAAA,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAeL,sBAAAA,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAcM,sBAAAA,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtBC,sBAAAA,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAcC,sBAAAA,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAIC,mBAAAA,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAIC,mBAAAA,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}
+{"version":3,"file":"s3-DLp0V-Ox.cjs","names":["GkmError","projectBucketName","s3SecretsKey","awsClientConfig","S3Client","STSClient","withStageCredentials","callerAccountId","ensureProjectBucket","findProjectBucket","GetObjectCommand","PutObjectCommand","HeadObjectCommand"],"sources":["../src/secrets/s3.ts"],"sourcesContent":["/**\n * A stage's secrets in S3: one object per stage,\n * `<prefix>/<project>/<stage>/secrets.json`, in the project bucket beside the\n * deploy state (`providers/projectBucket.ts`) — or in a bucket the config\n * names, which must exist.\n *\n * Encrypted at rest with SSE-S3, asked for on every write although the\n * project bucket defaults to it, so no KMS key is another place to keep. The\n * bucket's versioning keeps every past document. Unlike an SSM parameter\n * there is no size to outgrow.\n *\n * The project bucket is created by the first write, never by a read: a stage\n * whose bucket or object does not exist yet has no secrets. Every write is\n * conditional — `If-Match` on the ETag this store last read for the stage,\n * `If-None-Match: *` when it read none — so two `secrets:set` runs at once\n * cannot each overwrite the other's key: the second is refused with\n * {@link StageSecretsChanged}.\n */\n\nimport {\n\tGetObjectCommand,\n\tHeadObjectCommand,\n\tPutObjectCommand,\n\tS3Client,\n\ttype S3ClientConfig,\n} from '@aws-sdk/client-s3';\nimport { STSClient } from '@aws-sdk/client-sts';\nimport type { DeployIdentity } from '../deploy/identity.js';\nimport { GkmError } from '../errors';\nimport {\n\tcallerAccountId,\n\tensureProjectBucket,\n\tfindProjectBucket,\n\tprojectBucketName,\n} from '../providers/projectBucket.js';\nimport {\n\ttype AwsStoreOptions,\n\tawsClientConfig,\n\twithStageCredentials,\n} from './awsStore.js';\nimport { s3SecretsKey } from './providers.js';\nimport type { SecretsStore } from './store.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface S3SecretsStoreOptions extends AwsStoreOptions {\n\t/** The deploy identity: the project bucket's name and its tag. */\n\tidentity: Pick<DeployIdentity, 'scope' | 'key'>;\n\t/** A bucket that exists; omitted, the project bucket. */\n\tbucket?: string;\n\t/** Key prefix inside the bucket, without a trailing slash. */\n\tprefix: string;\n\t/** For tests: credentials to use instead of the default chain. */\n\tcredentials?: S3ClientConfig['credentials'];\n}\n\n/**\n * Another run wrote the stage's secrets after this one read them. Nothing was\n * written: the change is to be made again, on top of theirs.\n */\nexport class StageSecretsChanged extends GkmError {\n\tconstructor(\n\t\treadonly stage: string,\n\t\t/** `s3://<bucket>/<key>` */\n\t\treadonly location: string,\n\t) {\n\t\tsuper(\n\t\t\t`The secrets for stage \"${stage}\" at ${location} changed after this command read them — ` +\n\t\t\t\t'another secrets command or deploy wrote them first. Nothing was written; run the command ' +\n\t\t\t\t'again to make the change on top of theirs.',\n\t\t);\n\t\tthis.name = 'StageSecretsChanged';\n\t}\n}\n\ninterface S3Failure {\n\tname?: string;\n\t$metadata?: { httpStatusCode?: number };\n}\n\n/** A conditional write that lost: the object is not what the write assumed. */\nfunction lostRace(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'PreconditionFailed' ||\n\t\tname === 'ConditionalRequestConflict' ||\n\t\t$metadata?.httpStatusCode === 412 ||\n\t\t$metadata?.httpStatusCode === 409\n\t);\n}\n\nfunction notFound(error: unknown): boolean {\n\tconst { name, $metadata } = error as S3Failure;\n\treturn (\n\t\tname === 'NoSuchKey' ||\n\t\tname === 'NotFound' ||\n\t\t$metadata?.httpStatusCode === 404\n\t);\n}\n\nexport class S3SecretsStore implements SecretsStore {\n\treadonly name = 's3';\n\n\tprivate clients?: { s3: S3Client; sts: STSClient };\n\t/** The bucket's name, once known. */\n\tprivate bucketName?: string;\n\t/** Whether the bucket is known to exist. */\n\tprivate exists = false;\n\t/** The ETag each stage was last read at — null: read, and not there. */\n\tprivate readonly etags = new Map<string, string | null>();\n\n\tconstructor(private readonly options: S3SecretsStoreOptions) {\n\t\tif (options.bucket) {\n\t\t\tthis.bucketName = options.bucket;\n\t\t\tthis.exists = true;\n\t\t}\n\t}\n\n\t/** The bucket's name; the project bucket's is known after the first call. */\n\tget bucket(): string {\n\t\treturn (\n\t\t\tthis.bucketName ??\n\t\t\tprojectBucketName(this.options.identity.scope, '<account id>')\n\t\t);\n\t}\n\n\t/** Where a stage's secrets are kept: `s3://<bucket>/<key>`. */\n\tlocation(stage: string): string {\n\t\treturn `s3://${this.bucket}/${this.key(stage)}`;\n\t}\n\n\tprivate key(stage: string): string {\n\t\treturn s3SecretsKey(this.options.prefix, this.options.project, stage);\n\t}\n\n\tprivate async client(): Promise<{ s3: S3Client; sts: STSClient }> {\n\t\tif (this.clients) return this.clients;\n\t\tconst base = await awsClientConfig(this.options);\n\t\tconst endpoint =\n\t\t\tbase.endpoint ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL_S3 ??\n\t\t\tprocess.env.AWS_ENDPOINT_URL;\n\t\tconst credentials = this.options.credentials ?? base.credentials;\n\t\tthis.clients = {\n\t\t\ts3: new S3Client({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(endpoint ? { endpoint, forcePathStyle: true } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t\tsts: new STSClient({\n\t\t\t\tregion: base.region,\n\t\t\t\t...(base.endpoint ? { endpoint: base.endpoint } : {}),\n\t\t\t\t...(credentials ? { credentials } : {}),\n\t\t\t}),\n\t\t};\n\t\treturn this.clients;\n\t}\n\n\t/** One AWS call, a missing or expired credential refused by name. */\n\tprivate call<T>(\n\t\tstage: string,\n\t\taccess: 'read' | 'write',\n\t\trun: () => Promise<T>,\n\t): Promise<T> {\n\t\treturn withStageCredentials(\n\t\t\t{ stage, store: this.name, profile: this.options.profile, access },\n\t\t\trun,\n\t\t);\n\t}\n\n\t/**\n\t * The bucket, or null for a project bucket that does not exist yet and is\n\t * not to be created (a read).\n\t */\n\tprivate async use(\n\t\tstage: string,\n\t\tcreate: boolean,\n\t): Promise<{ s3: S3Client; bucket: string | null }> {\n\t\tconst { s3, sts } = await this.client();\n\t\tif (this.exists) return { s3, bucket: this.bucketName! };\n\t\tconst access = create ? 'write' : 'read';\n\t\tthis.bucketName ??= projectBucketName(\n\t\t\tthis.options.identity.scope,\n\t\t\tawait this.call(stage, access, () => callerAccountId(sts)),\n\t\t);\n\t\tconst bucket = this.bucketName;\n\t\tif (create) {\n\t\t\tawait this.call(stage, access, () =>\n\t\t\t\tensureProjectBucket(s3, {\n\t\t\t\t\tbucket,\n\t\t\t\t\tregion: this.options.region,\n\t\t\t\t\tidentity: this.options.identity,\n\t\t\t\t}),\n\t\t\t);\n\t\t} else if (\n\t\t\t(await this.call(stage, access, () => findProjectBucket(s3, bucket))) ===\n\t\t\t'none'\n\t\t) {\n\t\t\treturn { s3, bucket: null };\n\t\t}\n\t\tthis.exists = true;\n\t\treturn { s3, bucket };\n\t}\n\n\t/**\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * read it with, or they have expired\n\t */\n\tasync read(stage: string): Promise<StageSecrets | null> {\n\t\tconst { s3, bucket } = await this.use(stage, false);\n\t\tif (!bucket) {\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t\ttry {\n\t\t\tconst response = await this.call(stage, 'read', () =>\n\t\t\t\ts3.send(new GetObjectCommand({ Bucket: bucket, Key: this.key(stage) })),\n\t\t\t);\n\t\t\tconst body = await (\n\t\t\t\tresponse.Body as {\n\t\t\t\t\ttransformToString(encoding: string): Promise<string>;\n\t\t\t\t}\n\t\t\t).transformToString('utf-8');\n\t\t\tthis.remember(stage, response.ETag);\n\t\t\treturn JSON.parse(body) as StageSecrets;\n\t\t} catch (error) {\n\t\t\tif (!notFound(error)) throw error;\n\t\t\tthis.etags.set(stage, null);\n\t\t\treturn null;\n\t\t}\n\t}\n\n\t/**\n\t * Replace the stage's secrets — on the condition that they are still what\n\t * this store last read. A stage never read here is replaced as it is now.\n\t *\n\t * @throws {StageSecretsChanged} when another run wrote them in between\n\t * @throws {StageSecretsUnreadable} when there are no AWS credentials to\n\t * write it with, or they have expired\n\t */\n\tasync write(stage: string, secrets: StageSecrets): Promise<void> {\n\t\tconst { s3, bucket } = await this.use(stage, true);\n\t\tconst Bucket = bucket!;\n\t\tconst Key = this.key(stage);\n\t\tconst expected = this.etags.has(stage)\n\t\t\t? (this.etags.get(stage) ?? null)\n\t\t\t: await this.currentEtag(s3, stage, Bucket, Key);\n\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(\n\t\t\t\t\tnew PutObjectCommand({\n\t\t\t\t\t\tBucket,\n\t\t\t\t\t\tKey,\n\t\t\t\t\t\tBody: JSON.stringify(secrets),\n\t\t\t\t\t\tContentType: 'application/json',\n\t\t\t\t\t\tServerSideEncryption: 'AES256',\n\t\t\t\t\t\t...(expected === null\n\t\t\t\t\t\t\t? { IfNoneMatch: '*' }\n\t\t\t\t\t\t\t: { IfMatch: expected }),\n\t\t\t\t\t}),\n\t\t\t\t),\n\t\t\t);\n\t\t\tthis.remember(stage, ETag);\n\t\t} catch (error) {\n\t\t\tif (lostRace(error)) {\n\t\t\t\tthis.etags.delete(stage);\n\t\t\t\tthrow new StageSecretsChanged(stage, `s3://${Bucket}/${Key}`);\n\t\t\t}\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\t/**\n\t * The ETag the stage is now at. Some S3-compatible servers answer without\n\t * one: then nothing is remembered, and the next write asks for it first.\n\t */\n\tprivate remember(stage: string, etag: string | undefined): void {\n\t\tif (etag) this.etags.set(stage, etag);\n\t\telse this.etags.delete(stage);\n\t}\n\n\tprivate async currentEtag(\n\t\ts3: S3Client,\n\t\tstage: string,\n\t\tBucket: string,\n\t\tKey: string,\n\t): Promise<string | null> {\n\t\ttry {\n\t\t\tconst { ETag } = await this.call(stage, 'write', () =>\n\t\t\t\ts3.send(new HeadObjectCommand({ Bucket, Key })),\n\t\t\t);\n\t\t\treturn ETag ?? null;\n\t\t} catch (error) {\n\t\t\tif (notFound(error)) return null;\n\t\t\tthrow error;\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,IAAa,sBAAb,cAAyCA,eAAAA,SAAS;CAEvC;CAEA;CAHV,YACC,OAEA,UACC;EACD,MACC,0BAA0B,MAAM,OAAO,SAAS,4KAGjD;EARS,KAAA,QAAA;EAEA,KAAA,WAAA;EAOT,KAAK,OAAO;CACb;AACD;;AAQA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,wBACT,SAAS,gCACT,WAAW,mBAAmB,OAC9B,WAAW,mBAAmB;AAEhC;AAEA,SAAS,SAAS,OAAyB;CAC1C,MAAM,EAAE,MAAM,cAAc;CAC5B,OACC,SAAS,eACT,SAAS,cACT,WAAW,mBAAmB;AAEhC;AAEA,IAAa,iBAAb,MAAoD;CAWtB;CAV7B,OAAgB;CAEhB;;CAEA;;CAEA,SAAiB;;CAEjB,wBAAyB,IAAI,IAA2B;CAExD,YAAY,SAAiD;EAAhC,KAAA,UAAA;EAC5B,IAAI,QAAQ,QAAQ;GACnB,KAAK,aAAa,QAAQ;GAC1B,KAAK,SAAS;EACf;CACD;;CAGA,IAAI,SAAiB;EACpB,OACC,KAAK,cACLC,sBAAAA,kBAAkB,KAAK,QAAQ,SAAS,OAAO,cAAc;CAE/D;;CAGA,SAAS,OAAuB;EAC/B,OAAO,QAAQ,KAAK,OAAO,GAAG,KAAK,IAAI,KAAK;CAC7C;CAEA,IAAY,OAAuB;EAClC,OAAOC,kBAAAA,aAAa,KAAK,QAAQ,QAAQ,KAAK,QAAQ,SAAS,KAAK;CACrE;CAEA,MAAc,SAAoD;EACjE,IAAI,KAAK,SAAS,OAAO,KAAK;EAC9B,MAAM,OAAO,MAAMC,iBAAAA,gBAAgB,KAAK,OAAO;EAC/C,MAAM,WACL,KAAK,YACL,QAAQ,IAAI,uBACZ,QAAQ,IAAI;EACb,MAAM,cAAc,KAAK,QAAQ,eAAe,KAAK;EACrD,KAAK,UAAU;GACd,IAAI,IAAIC,mBAAAA,SAAS;IAChB,QAAQ,KAAK;IACb,GAAI,WAAW;KAAE;KAAU,gBAAgB;IAAK,IAAI,CAAC;IACrD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;GACD,KAAK,IAAIC,oBAAAA,UAAU;IAClB,QAAQ,KAAK;IACb,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;IACnD,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;GACtC,CAAC;EACF;EACA,OAAO,KAAK;CACb;;CAGA,KACC,OACA,QACA,KACa;EACb,OAAOC,iBAAAA,qBACN;GAAE;GAAO,OAAO,KAAK;GAAM,SAAS,KAAK,QAAQ;GAAS;EAAO,GACjE,GACD;CACD;;;;;CAMA,MAAc,IACb,OACA,QACmD;EACnD,MAAM,EAAE,IAAI,QAAQ,MAAM,KAAK,OAAO;EACtC,IAAI,KAAK,QAAQ,OAAO;GAAE;GAAI,QAAQ,KAAK;EAAY;EACvD,MAAM,SAAS,SAAS,UAAU;EAClC,KAAK,eAAeL,sBAAAA,kBACnB,KAAK,QAAQ,SAAS,OACtB,MAAM,KAAK,KAAK,OAAO,cAAcM,sBAAAA,gBAAgB,GAAG,CAAC,CAC1D;EACA,MAAM,SAAS,KAAK;EACpB,IAAI,QACH,MAAM,KAAK,KAAK,OAAO,cACtBC,sBAAAA,oBAAoB,IAAI;GACvB;GACA,QAAQ,KAAK,QAAQ;GACrB,UAAU,KAAK,QAAQ;EACxB,CAAC,CACF;OACM,IACL,MAAM,KAAK,KAAK,OAAO,cAAcC,sBAAAA,kBAAkB,IAAI,MAAM,CAAC,MACnE,QAEA,OAAO;GAAE;GAAI,QAAQ;EAAK;EAE3B,KAAK,SAAS;EACd,OAAO;GAAE;GAAI;EAAO;CACrB;;;;;CAMA,MAAM,KAAK,OAA6C;EACvD,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,KAAK;EAClD,IAAI,CAAC,QAAQ;GACZ,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;EACA,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,KAAK,OAAO,cACvC,GAAG,KAAK,IAAIC,mBAAAA,iBAAiB;IAAE,QAAQ;IAAQ,KAAK,KAAK,IAAI,KAAK;GAAE,CAAC,CAAC,CACvE;GACA,MAAM,OAAO,MACZ,SAAS,KAGR,kBAAkB,OAAO;GAC3B,KAAK,SAAS,OAAO,SAAS,IAAI;GAClC,OAAO,KAAK,MAAM,IAAI;EACvB,SAAS,OAAO;GACf,IAAI,CAAC,SAAS,KAAK,GAAG,MAAM;GAC5B,KAAK,MAAM,IAAI,OAAO,IAAI;GAC1B,OAAO;EACR;CACD;;;;;;;;;CAUA,MAAM,MAAM,OAAe,SAAsC;EAChE,MAAM,EAAE,IAAI,WAAW,MAAM,KAAK,IAAI,OAAO,IAAI;EACjD,MAAM,SAAS;EACf,MAAM,MAAM,KAAK,IAAI,KAAK;EAC1B,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,IACjC,KAAK,MAAM,IAAI,KAAK,KAAK,OAC1B,MAAM,KAAK,YAAY,IAAI,OAAO,QAAQ,GAAG;EAEhD,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KACF,IAAIC,mBAAAA,iBAAiB;IACpB;IACA;IACA,MAAM,KAAK,UAAU,OAAO;IAC5B,aAAa;IACb,sBAAsB;IACtB,GAAI,aAAa,OACd,EAAE,aAAa,IAAI,IACnB,EAAE,SAAS,SAAS;GACxB,CAAC,CACF,CACD;GACA,KAAK,SAAS,OAAO,IAAI;EAC1B,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG;IACpB,KAAK,MAAM,OAAO,KAAK;IACvB,MAAM,IAAI,oBAAoB,OAAO,QAAQ,OAAO,GAAG,KAAK;GAC7D;GACA,MAAM;EACP;CACD;;;;;CAMA,SAAiB,OAAe,MAAgC;EAC/D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO,IAAI;OAC/B,KAAK,MAAM,OAAO,KAAK;CAC7B;CAEA,MAAc,YACb,IACA,OACA,QACA,KACyB;EACzB,IAAI;GACH,MAAM,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,eACvC,GAAG,KAAK,IAAIC,mBAAAA,kBAAkB;IAAE;IAAQ;GAAI,CAAC,CAAC,CAC/C;GACA,OAAO,QAAQ;EAChB,SAAS,OAAO;GACf,IAAI,SAAS,KAAK,GAAG,OAAO;GAC5B,MAAM;EACP;CACD;AACD"}

package/dist/{sandbox-Cm4X6HRh.d.mts → sandbox-CfpLWTPP.d.mts}

@@ -1,4 +1,4 @@
-import { jt as GkmError } from "./types-Drpl9HX9.mjs";
+import { jt as GkmError } from "./types-BhThob0H.mjs";
 //#region src/sandbox/sandbox.d.ts
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
@@ -101,4 +101,4 @@ declare class SecretNameInvalid extends GkmError {
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-Cm4X6HRh.d.mts.map
+//# sourceMappingURL=sandbox-CfpLWTPP.d.mts.map

package/dist/{sandbox-ArJ_hEKk.d.cts.map → sandbox-CfpLWTPP.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"sandbox-ArJ_hEKk.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}
+{"version":3,"file":"sandbox-CfpLWTPP.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/{sandbox-ArJ_hEKk.d.cts → sandbox-D1XeNEJ9.d.cts}

@@ -1,4 +1,4 @@
-import { jt as GkmError } from "./types-DipUP9zp.cjs";
+import { jt as GkmError } from "./types-DwoLHelT.cjs";
 //#region src/sandbox/sandbox.d.ts
 /** Where a command's output goes. */
 type SandboxOutput = 'capture' | 'inherit' | 'stderr' | 'ignore';
@@ -101,4 +101,4 @@ declare class SecretNameInvalid extends GkmError {
 }
 //#endregion
 export { SandboxOutput as a, confineCwd as c, SandboxExecOptions as i, Sandbox as n, SandboxResult as o, SandboxCwdEscape as r, SecretNameInvalid as s, SECRETS_DIR_ENV as t };
-//# sourceMappingURL=sandbox-ArJ_hEKk.d.cts.map
+//# sourceMappingURL=sandbox-D1XeNEJ9.d.cts.map

package/dist/{sandbox-Cm4X6HRh.d.mts.map → sandbox-D1XeNEJ9.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"sandbox-Cm4X6HRh.d.mts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}
+{"version":3,"file":"sandbox-D1XeNEJ9.d.cts","names":[],"sources":["../src/sandbox/sandbox.ts"],"mappings":";;;KA8BY;UAEK;;;;;;EAMhB;;;;;EAKA,KAAK,SAAS;;;;;;EAMd;;;;;;;EAOA,UAAU,SAAS;;;;;;EAMnB,SAAS;;EAET,SAAS;;;UAIO;EAChB;EACA;;EAEA;;EAEA;;;;;;;;;;;UAYgB;;WAEP;;;;;;;;;;;;;WAaA;;;;;WAKA,KAAK,SAAS;EACvB,KACC,iBACA,yBACA,SAAS,qBACP,QAAQ;;;cAIC;;cAGA,yBAAyB;WAE3B;WACA;EAFV,YACU,aACA;;;;;;;;;;iBAwBK,WAAW,cAAc;;cAU5B,0BAA0B;WACjB;EAArB,YAAqB"}

package/dist/{seeds-Df4BI-T3.cjs → seeds-BNHSpjNP.cjs}

@@ -3,11 +3,12 @@ const require_errors = require("./errors-DMC4Umsb.cjs");
 const require_run = require("./run-fVZ-rLnc.cjs");
 const require_discover = require("./discover-DPgu-ScS.cjs");
 const require_derive = require("./derive-DAbo49sm.cjs");
-const require_workspace = require("./workspace-BJ78Bgvm.cjs");
+const require_workspace = require("./workspace-DRjdu1OY.cjs");
 const require_config = require("./config.cjs");
+const require_identity = require("./identity-CbLfgQNT.cjs");
 const require_EndpointGenerator = require("./EndpointGenerator-De03t1hd.cjs");
 const require_SubscriberGenerator = require("./SubscriberGenerator-Dvz7EzqK.cjs");
-const require_resolve = require("./resolve-CScrqgdC.cjs");
+const require_resolve = require("./resolve-DC98Rl1t.cjs");
 let node_path = require("node:path");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
@@ -296,7 +297,7 @@ function logsAccess(logs, ctx) {
 	return [
 		`📜 Logs (OpenObserve) on 127.0.0.1:${logs.port} — from your computer:`,
 		...ctx.local ? [`     on this machine, open http://localhost:${logs.port} directly; from another:`] : [],
-		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}   (user and host are guesses: this machine's)`,
+		`     ssh -N -L ${logs.port}:localhost:${logs.port} ${ctx.user}@${ctx.hostname}${ctx.known ? "" : "   (user and host are guesses: this machine's)"}`,
 		`     then open http://localhost:${logs.port}  (${login})`,
 		`⚠️  Docker-published ports bypass ufw, so OpenObserve is bound to 127.0.0.1 only — reach it through the tunnel, not by opening the port.`
 	];
@@ -423,129 +424,6 @@ function validateEnvironmentVariables(requiredVars, secrets) {
 	};
 }
 //#endregion
-//#region src/deploy/identity.ts
-/**
-* Who a deploy is, on a target it shares with other workspaces.
-*
-* A Dokploy server is one flat namespace of projects, images and Docker
-* service names. Deploys used to identify everything they made by the
-* workspace name alone, so two workspaces called `shop` — or `Shop` and
-* `shop` — deploying to one server landed in the same project, pushed over
-* each other's images and redeployed each other's applications. A
-* `DeployIdentity` is what a deploy names and claims its resources by instead.
-*/
-var identity_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
-	DeployNamespaceInvalid: () => DeployNamespaceInvalid,
-	DeployProjectNameInvalid: () => DeployProjectNameInvalid,
-	applicationName: () => applicationName,
-	defaultNamespace: () => defaultNamespace,
-	deployIdentity: () => deployIdentity,
-	imageName: () => imageName,
-	imageRef: () => imageRef,
-	isOwnedBy: () => isOwnedBy,
-	markerOf: () => markerOf,
-	ownershipMarker: () => ownershipMarker,
-	projectName: () => projectName
-});
-/** A namespace that cannot be part of a Dokploy name or an image path. */
-var DeployNamespaceInvalid = class extends require_errors.GkmError {
-	namespace;
-	constructor(namespace) {
-		super(`deploy.namespace '${namespace}' is not usable as a name: use lowercase letters, digits and single '-' between them (e.g. 'acme' or 'acme-platform') in gkm.config.ts.`);
-		this.namespace = namespace;
-		this.name = "DeployNamespaceInvalid";
-	}
-};
-/** A workspace name with nothing a target can name a resource by. */
-var DeployProjectNameInvalid = class extends require_errors.GkmError {
-	workspaceName;
-	constructor(workspaceName) {
-		super(`The workspace name '${workspaceName}' has no letters or digits to name deployed resources by. Set "name" in gkm.config.ts.`);
-		this.workspaceName = workspaceName;
-		this.name = "DeployProjectNameInvalid";
-	}
-};
-const NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-/**
-* Lowercase `[a-z0-9-]`, runs of anything else collapsed to one `-`: valid as
-* a Docker image path component, a Docker service name and a Dokploy name.
-*/
-function slug(value) {
-	return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
-/** The namespace a workspace is in when it does not name one. */
-function defaultNamespace(workspaceName) {
-	return slug((0, _geekmidas_manifest.kebabCase)(workspaceName));
-}
-function deployIdentity(workspace, stage) {
-	const project = slug(workspace.name);
-	if (!project) throw new DeployProjectNameInvalid(workspace.name);
-	const fallback = defaultNamespace(workspace.name);
-	const namespace = workspace.deploy?.namespace ?? fallback;
-	if (!NAME.test(namespace)) throw new DeployNamespaceInvalid(namespace);
-	return {
-		namespace,
-		project,
-		stage,
-		key: `${namespace}/${project}`,
-		scope: namespace === fallback ? project : `${namespace}-${project}`
-	};
-}
-/**
-* The token a Dokploy project's description carries to say which identity
-* created it. A project with the right name and no marker belongs to someone
-* else, and a deploy never adopts it.
-*/
-function ownershipMarker(identity) {
-	return `gkm:${identity.key}`;
-}
-/** Whether a project description carries `identity`'s marker. */
-function isOwnedBy(description, identity) {
-	const marker = ownershipMarker(identity);
-	return (description ?? "").split(/\s+/).includes(marker);
-}
-/** Any `gkm:` marker a description carries — whoever's it is. */
-function markerOf(description) {
-	return (description ?? "").split(/\s+/).find((t) => t.startsWith("gkm:"));
-}
-/** What the Dokploy project is called. */
-function projectName(identity) {
-	return identity.scope;
-}
-/**
-* The repository an app's image is pushed to, below the registry:
-* `<namespace>/<project>-<app>`.
-*
-* The namespace is a path segment of its own so that a registry that maps
-* paths to owners (an organisation's packages, a Harbor project) can grant it
-* as one; the app is joined to the project so the two read as one name.
-*/
-function imageName(identity, app) {
-	return `${identity.namespace}/${identity.project}-${slug((0, _geekmidas_manifest.kebabCase)(app))}`;
-}
-/** The full image ref an app is built, pushed and deployed as. */
-function imageRef(identity, app, registry, tag) {
-	const name = imageName(identity, app);
-	return registry ? `${registry.replace(/\/+$/, "")}/${name}:${tag}` : `${name}:${tag}`;
-}
-/**
-* What one application is called on the target.
-*
-* The same rule the constructs use, through the same `scopedName`, scoped by
-* the stage and the identity: the application beside
-* `production-kitchen-sink-database` is `production-kitchen-sink-api`. A
-* Dokploy application's name is also its Docker service name, which is unique
-* on the whole server, so the namespace has to be in it too — `acme`'s and
-* `globex`'s `shop` would otherwise both run `production-shop-api`.
-*
-* The app id is dropped when it repeats the project, so a project named for its
-* one application is `production-kitchen-sink` rather than
-* `production-kitchen-sink-kitchen-sink`.
-*/
-function applicationName(identity, app) {
-	return slug(app) === identity.project ? `${identity.stage}-${identity.scope}` : (0, _geekmidas_manifest.scopedName)([identity.stage, identity.scope], app);
-}
-//#endregion
 //#region src/secrets/keystore.ts
 /**
 * The keys that open each stage's encrypted secrets file, kept outside the
@@ -590,7 +468,7 @@ const PROJECT_KEY = /^[a-z0-9]+(?:-[a-z0-9]+)*\/[a-z0-9]+(?:-[a-z0-9]+)*$/;
 * a project's keys and its Dokploy project are named by the same thing.
 */
 function projectKey(workspace) {
-	return deployIdentity(workspace, "").key;
+	return require_identity.deployIdentity(workspace, "").key;
 }
 /** The keystore project of a loaded workspace. */
 function keystoreProject(workspace, home) {
@@ -844,8 +722,8 @@ async function storeFromConfig(workspace, config, options = {}) {
 	const profile = options.profile ? { profile: options.profile } : {};
 	switch (config.provider) {
 		case "s3": {
-			const { S3SecretsStore } = await Promise.resolve().then(() => require("./s3-QQi4sNOQ.cjs"));
-			const { deployIdentity } = await Promise.resolve().then(() => identity_exports);
+			const { S3SecretsStore } = await Promise.resolve().then(() => require("./s3-DLp0V-Ox.cjs"));
+			const { deployIdentity } = await Promise.resolve().then(() => require("./identity-CbLfgQNT.cjs")).then((n) => n.identity_exports);
 			const location = require_workspace.s3SecretsLocation(config, workspace.state);
 			return new S3SecretsStore({
 				project: workspace.name,
@@ -6708,7 +6586,7 @@ async function createDnsProvider(options) {
 		});
 	}
 	if (provider === "godaddy") {
-		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-SLlyDwD1.cjs"));
+		const { GoDaddyProvider } = await Promise.resolve().then(() => require("./GoDaddyProvider-D1aQy2i1.cjs"));
 		return new GoDaddyProvider(options.godaddy ?? {});
 	}
 	if (provider === "cloudflare") throw new DnsProviderNotImplemented("cloudflare");
@@ -8476,12 +8354,6 @@ Object.defineProperty(exports, "appTelemetry", {
 		return appTelemetry;
 	}
 });
-Object.defineProperty(exports, "applicationName", {
-	enumerable: true,
-	get: function() {
-		return applicationName;
-	}
-});
 Object.defineProperty(exports, "applyBuckets", {
 	enumerable: true,
 	get: function() {
@@ -8596,12 +8468,6 @@ Object.defineProperty(exports, "currentActor", {
 		return currentActor;
 	}
 });
-Object.defineProperty(exports, "deployIdentity", {
-	enumerable: true,
-	get: function() {
-		return deployIdentity;
-	}
-});
 Object.defineProperty(exports, "derivedContainers", {
 	enumerable: true,
 	get: function() {
@@ -8758,18 +8624,6 @@ Object.defineProperty(exports, "imageLayout", {
 		return imageLayout;
 	}
 });
-Object.defineProperty(exports, "imageName", {
-	enumerable: true,
-	get: function() {
-		return imageName;
-	}
-});
-Object.defineProperty(exports, "imageRef", {
-	enumerable: true,
-	get: function() {
-		return imageRef;
-	}
-});
 Object.defineProperty(exports, "initStageSecrets", {
 	enumerable: true,
 	get: function() {
@@ -8794,12 +8648,6 @@ Object.defineProperty(exports, "isMainFrontendApp", {
 		return isMainFrontendApp;
 	}
 });
-Object.defineProperty(exports, "isOwnedBy", {
-	enumerable: true,
-	get: function() {
-		return isOwnedBy;
-	}
-});
 Object.defineProperty(exports, "isPortAvailable", {
 	enumerable: true,
 	get: function() {
@@ -8866,12 +8714,6 @@ Object.defineProperty(exports, "logsService", {
 		return logsService;
 	}
 });
-Object.defineProperty(exports, "markerOf", {
-	enumerable: true,
-	get: function() {
-		return markerOf;
-	}
-});
 Object.defineProperty(exports, "maskPassword", {
 	enumerable: true,
 	get: function() {
@@ -8896,12 +8738,6 @@ Object.defineProperty(exports, "orchestrateDns", {
 		return orchestrateDns;
 	}
 });
-Object.defineProperty(exports, "ownershipMarker", {
-	enumerable: true,
-	get: function() {
-		return ownershipMarker;
-	}
-});
 Object.defineProperty(exports, "pgClient", {
 	enumerable: true,
 	get: function() {
@@ -8962,12 +8798,6 @@ Object.defineProperty(exports, "projectKey", {
 		return projectKey;
 	}
 });
-Object.defineProperty(exports, "projectName", {
-	enumerable: true,
-	get: function() {
-		return projectName;
-	}
-});
 Object.defineProperty(exports, "providerOf", {
 	enumerable: true,
 	get: function() {
@@ -9263,4 +9093,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=seeds-Df4BI-T3.cjs.map
+//# sourceMappingURL=seeds-BNHSpjNP.cjs.map