@b00dea/cockpit 0.0.0-stage → 0.1.0

package/dist/environment/sensitive.d.ts

@@ -0,0 +1,3 @@
+export declare function isSensitiveField(name: string): boolean;
+export declare function redactSensitiveText(value: string): string;
+export declare function redactSensitiveMessage(message: string): string | undefined;

package/dist/environment/sensitive.js

@@ -0,0 +1,48 @@
+import { RefusalError } from './contract.js';
+const SENSITIVE_FIELD = /(?:authorization|password|passwd|token|secret|credential|private[_-]?key|api[_-]?key)/i;
+const SENSITIVE_ASSIGNMENT = /((?:authorization|password|passwd|token|secret|credential|private[_-]?key|api[_-]?key)[a-z0-9_-]*[\\"']*\s*[=:]\s*(?:bearer\s+)?)[^\r\n]*/ig;
+export function isSensitiveField(name) {
+    return SENSITIVE_FIELD.test(name);
+}
+export function redactSensitiveText(value) {
+    return value.replace(SENSITIVE_ASSIGNMENT, '$1[redacted]');
+}
+function redactStructured(value, key = '', depth = 0) {
+    if (depth > 64)
+        throw new RefusalError('structured diagnostic exceeds the nesting limit');
+    if (isSensitiveField(key))
+        return '[redacted]';
+    if (Array.isArray(value))
+        return value.map(item => redactStructured(item, '', depth + 1));
+    if (value !== null && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value)
+            .map(([name, child]) => [name, redactStructured(child, name, depth + 1)]));
+    return typeof value === 'string' ? redactSensitiveText(value) : value;
+}
+export function redactSensitiveMessage(message) {
+    let parsed;
+    try {
+        parsed = JSON.parse(message);
+    }
+    catch { // A message that is not JSON is plain text, redacted below.
+        if (/[\r\n]/.test(message)) {
+            const lines = message.split(/(\r?\n|\r)/).map((line, index) => index % 2 ? line : redactSensitiveMessage(line));
+            return lines.some(line => line === undefined) ? undefined : lines.join('');
+        }
+        // A partial sensitive object cannot be redacted safely one header at a time.
+        for (const match of message.matchAll(SENSITIVE_ASSIGNMENT)) {
+            const value = match[0].slice(match[1].length).trimStart();
+            if (!value || value.startsWith('{') || value.startsWith('['))
+                return undefined;
+        }
+        return redactSensitiveText(message);
+    }
+    if (typeof parsed === 'string')
+        return redactSensitiveText(parsed);
+    try {
+        return JSON.stringify(redactStructured(parsed));
+    }
+    catch {
+        return undefined;
+    } // Fails closed: a structure that cannot be redacted is withheld, and its error text could quote the secret.
+}

package/dist/environment/setup-observation.d.ts

@@ -0,0 +1,62 @@
+import { ENVIRONMENT_CODES, type CheckoutId, type CockpitId, type SourceProvenance } from './contract.js';
+import type { SetupObservation } from './setup.js';
+import { type ResolvedExecutable } from './executable.js';
+declare const OWNER = "setup-observation";
+type SynchronousResult<T> = T extends PromiseLike<unknown> ? never : T;
+export type EnvironmentIgnoreRefusal = Readonly<{
+    kind: 'refusal';
+    code: typeof ENVIRONMENT_CODES.INSTANCE_NOT_IGNORED | typeof ENVIRONMENT_CODES.TEMPLATE_NOT_TRACKED | typeof ENVIRONMENT_CODES.TEMPLATE_IGNORED;
+    path: string;
+}>;
+export declare function observeEnvironmentIgnore<T>(value: unknown, use: () => SynchronousResult<T>): Promise<SynchronousResult<T> | EnvironmentIgnoreRefusal | undefined>;
+export type SetupCheckoutObservation = Readonly<{
+    state: 'available';
+    producer: typeof OWNER;
+    observedAt: string;
+    validThrough: string;
+}> | Readonly<{
+    state: 'failed';
+    producer: typeof OWNER;
+    code: typeof ENVIRONMENT_CODES.SETUP_PATH_TYPE_INVALID;
+    reason: string;
+}>;
+export interface ConsumedSetupCheckoutObservation {
+    readonly source: SourceProvenance;
+    readonly cockpitName: string;
+    readonly currentCheckoutPath: string;
+    readonly mainCheckoutPath: string;
+    readonly cockpitId: CockpitId;
+    readonly checkoutId: CheckoutId;
+    readonly observedAt: string;
+    readonly validThrough: string;
+}
+declare const setupCheckoutProjectionBrand: unique symbol;
+export interface SetupCheckoutProjection {
+    readonly [setupCheckoutProjectionBrand]: true;
+}
+export interface SetupCheckoutObservationContext {
+    readonly source: SourceProvenance;
+    readonly cockpitName: string;
+    readonly evaluatedAt: number;
+}
+export declare function observeSetupCheckout(input: unknown): Promise<SetupCheckoutObservation>;
+export declare function withSetupCheckoutProjection<T>(observation: unknown, expected: SetupCheckoutObservationContext, use: (projection: SetupCheckoutProjection) => SynchronousResult<T>): Promise<SynchronousResult<T> | undefined>;
+export declare function consumeSetupCheckoutProjection(projection: SetupCheckoutProjection): ConsumedSetupCheckoutObservation | undefined;
+export interface GeneratedCheckoutIdentity {
+    readonly state: 'available';
+    readonly kind: 'checkout' | 'standalone';
+    readonly cockpitId: CockpitId;
+    readonly checkoutId: CheckoutId;
+    readonly currentCheckoutPath: string;
+    readonly mainCheckoutPath: string;
+}
+export declare function observeGeneratedCheckoutIdentity(input: {
+    readonly source: SourceProvenance;
+    readonly cockpitName: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+}): Promise<GeneratedCheckoutIdentity | Extract<SetupCheckoutObservation, {
+    state: 'failed';
+}>>;
+export declare function revalidateGeneratedCheckoutIdentity(identity: GeneratedCheckoutIdentity): Promise<boolean>;
+export declare function observeSetupPath(target: string, siblingsRoot: string, env: Readonly<Record<string, string>>, gitExecutable: ResolvedExecutable): Promise<SetupObservation>;
+export {};