import { __require } from "./chunk-Duj1WY3L.mjs";
import { GetParameterCommand, ParameterNotFound, PutParameterCommand, SSMClient } from "@aws-sdk/client-ssm";

//#region src/secrets/sync.ts
/**
* Get the SSM parameter name for secrets.
*/
function getSecretsParameterName(workspaceName, stage) {
	return `/gkm/${workspaceName}/${stage}/secrets`;
}
/**
* Create an SSM client from workspace state config.
*/
function createSSMClient(config) {
	const clientConfig = { region: config.region };
	if (config.profile) {
		const { fromIni } = __require("@aws-sdk/credential-providers");
		clientConfig.credentials = fromIni({ profile: config.profile });
	}
	return new SSMClient(clientConfig);
}
/**
* Push secrets to SSM Parameter Store.
*
* Stores the full StageSecrets object as a SecureString parameter.
*/
async function pushSecrets(stage, workspace) {
	const config = workspace.state;
	if (!config || config.provider !== "ssm") throw new Error("SSM state provider not configured. Add state: { provider: \"ssm\", region: \"...\" } to gkm.config.ts.");
	if (!workspace.name) throw new Error("Workspace name is required for SSM secrets sync. Set \"name\" in gkm.config.ts.");
	const client = createSSMClient(config);
	const parameterName = getSecretsParameterName(workspace.name, stage);
	const { readStageSecrets } = await import("./storage-mwbL7PhP.mjs");
	const secrets = await readStageSecrets(stage, workspace.root);
	if (!secrets) throw new Error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
	await client.send(new PutParameterCommand({
		Name: parameterName,
		Value: JSON.stringify(secrets),
		Type: "SecureString",
		Overwrite: true,
		Description: `GKM secrets for ${workspace.name}/${stage}`
	}));
}
/**
* Pull secrets from SSM Parameter Store.
*
* @returns StageSecrets or null if no secrets are stored remotely
*/
async function pullSecrets(stage, workspace) {
	const config = workspace.state;
	if (!config || config.provider !== "ssm") return null;
	if (!workspace.name) return null;
	const client = createSSMClient(config);
	const parameterName = getSecretsParameterName(workspace.name, stage);
	try {
		const response = await client.send(new GetParameterCommand({
			Name: parameterName,
			WithDecryption: true
		}));
		if (!response.Parameter?.Value) return null;
		return JSON.parse(response.Parameter.Value);
	} catch (error) {
		if (error instanceof ParameterNotFound) return null;
		throw error;
	}
}
/**
* Check if SSM is configured for the workspace.
*/
function isSSMConfigured(workspace) {
	return !!workspace.state && workspace.state.provider === "ssm";
}

//#endregion
export { isSSMConfigured, pullSecrets, pushSecrets };
//# sourceMappingURL=sync-lExOTa9t.mjs.map