@catladder/cli 0.0.0-main-2355fd7c → 0.0.0-main-018e2dee

package/dist/apps/cli/src/gcloud/localAccess.js

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncLocalAccessServiceAccount = exports.listUserManagedKeyIds = exports.parseServiceAccountKey = exports.getConditionalRolesOfMemberInBindings = exports.getRolesOfMemberInBindings = exports.getLocalAccessServiceAccountNames = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const child_process_promise_1 = require("child-process-promise");
+const promises_1 = require("fs/promises");
+const os_1 = require("os");
+const path_1 = require("path");
+const serviceAccountNames_1 = require("./serviceAccountNames");
+const serviceAccounts_1 = require("./serviceAccounts");
+/**
+ * the dedicated read-only service account of a component/env that
+ * `project setup` provisions from the `localAccess` declaration.
+ * Shared with `project doctor` and catenv.
+ */
+const getLocalAccessServiceAccountNames = (context, projectId) => (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, {
+    name: pipeline_1.LOCAL_ACCESS_GCP_SA_NAME,
+    projectId,
+});
+exports.getLocalAccessServiceAccountNames = getLocalAccessServiceAccountNames;
+/**
+ * all unconditional roles bound to `member` in the given iam policy
+ * bindings. Conditional bindings are reported separately, see
+ * {@link getConditionalRolesOfMemberInBindings}.
+ */
+const getRolesOfMemberInBindings = (bindings, member) => bindings
+    .filter((binding) => !binding.condition)
+    .filter((binding) => { var _a; return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member); })
+    .map((binding) => binding.role)
+    .sort();
+exports.getRolesOfMemberInBindings = getRolesOfMemberInBindings;
+/**
+ * roles bound to `member` under an iam condition. These cannot be
+ * removed by role name alone, so they are never touched by `project
+ * setup` — only reported.
+ */
+const getConditionalRolesOfMemberInBindings = (bindings, member) => bindings
+    .filter((binding) => binding.condition)
+    .filter((binding) => { var _a; return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member); })
+    .map((binding) => binding.role)
+    .sort();
+exports.getConditionalRolesOfMemberInBindings = getConditionalRolesOfMemberInBindings;
+/**
+ * parses the output of `gcloud iam service-accounts keys create` and
+ * makes sure it is a usable service account key
+ */
+const parseServiceAccountKey = (raw) => {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (_a) {
+        throw new Error("gcloud did not return a valid service account key");
+    }
+    if (typeof parsed.private_key_id !== "string" ||
+        typeof parsed.private_key !== "string") {
+        throw new Error("gcloud did not return a valid service account key");
+    }
+    return { key: raw, privateKeyId: parsed.private_key_id };
+};
+exports.parseServiceAccountKey = parseServiceAccountKey;
+const getProjectBindings = async (projectId) => {
+    var _a;
+    return (_a = JSON.parse((await (0, child_process_promise_1.exec)(`gcloud projects get-iam-policy ${projectId} --format=json`))
+        .stdout).bindings) !== null && _a !== void 0 ? _a : [];
+};
+const listUserManagedKeyIds = async (fullIdentifier) => {
+    const keys = JSON.parse((await (0, child_process_promise_1.exec)(`gcloud iam service-accounts keys list --iam-account=${fullIdentifier} --managed-by=user --format=json`)).stdout);
+    return keys.map((key) => key.name.split("/").pop());
+};
+exports.listUserManagedKeyIds = listUserManagedKeyIds;
+/**
+ * makes the account's bindings equal to `roles`: adds missing, removes
+ * everything else (the account is dedicated, every other binding is
+ * drift). Idempotent — a no-op when nothing differs.
+ */
+const syncBindings = async (io, projectId, fullIdentifier, roles) => {
+    const member = `serviceAccount:${fullIdentifier}`;
+    const bindings = await getProjectBindings(projectId);
+    const conditional = (0, exports.getConditionalRolesOfMemberInBindings)(bindings, member);
+    if (conditional.length > 0) {
+        io.log(`⚠️ ${fullIdentifier} has conditional bindings (${conditional.join(", ")}) — setup does not touch them, remove them by hand`);
+    }
+    const { missing, extra } = (0, pipeline_1.diffRoleBindings)(roles, (0, exports.getRolesOfMemberInBindings)(bindings, member));
+    for (const role of missing) {
+        io.log(`  + ${role}`);
+        await (0, child_process_promise_1.exec)(`gcloud projects add-iam-policy-binding ${projectId} --member=${member} --role=${role} --condition=None`);
+    }
+    for (const role of extra) {
+        io.log(`  - ${role}`);
+        await (0, child_process_promise_1.exec)(`gcloud projects remove-iam-policy-binding ${projectId} --member=${member} --role=${role} --condition=None`);
+    }
+};
+/**
+ * brings the local access service account of a component/env in line
+ * with the declared `roles`:
+ *
+ * - roles declared: account exists, carries exactly these bindings,
+ *   and a key for it is in the secret store (under the `local` env, so
+ *   it is never mirrored to ci). The key is only created when the
+ *   stored one is missing or no longer valid — re-running is a no-op.
+ * - no roles declared: bindings are removed and the account (with its
+ *   keys) deleted if it exists.
+ */
+const syncLocalAccessServiceAccount = async (io, context, projectId, roles) => {
+    const { fullName, fullIdentifier } = (0, exports.getLocalAccessServiceAccountNames)(context, projectId);
+    const exists = await (0, serviceAccounts_1.accountExists)(fullIdentifier);
+    if (roles.length === 0) {
+        if (exists) {
+            io.log(`local access no longer declared, removing ${fullIdentifier}...`);
+            await syncBindings(io, projectId, fullIdentifier, []);
+            await (0, child_process_promise_1.exec)(`gcloud iam service-accounts delete ${fullIdentifier} --quiet --project="${projectId}"`);
+        }
+        return;
+    }
+    if (!exists) {
+        io.log(`creating local access service account ${fullIdentifier}...`);
+        await (0, child_process_promise_1.exec)(`gcloud iam service-accounts create ${fullName} --display-name="${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.env}:${context.name} | Catladder local access (read-only)" --project="${projectId}" --description="Read-only access for local use (agents, scripts)"`);
+    }
+    await syncBindings(io, projectId, fullIdentifier, roles);
+    const secretName = (0, pipeline_1.getLocalAccessGcpSecretName)(context.env);
+    const vaultManager = await io.getVaultManager();
+    const rawName = (0, pipeline_1.getSecretVarName)("local", context.name, secretName);
+    // straight from the vault, NOT through the local cache: a stale cache
+    // (older than the first setup, or holding an older key) would make us
+    // believe the key is gone, delete the valid one and lock out every
+    // other machine.
+    const stored = (await vaultManager.vault.readAllSecrets(io))[rawName];
+    const validKeyIds = await (0, exports.listUserManagedKeyIds)(fullIdentifier);
+    let storedKeyId;
+    try {
+        storedKeyId = JSON.parse(stored).private_key_id;
+    }
+    catch (_a) {
+        // no (or unparsable) stored key
+    }
+    if (storedKeyId && validKeyIds.includes(storedKeyId)) {
+        // keep the cache in line with the vault
+        await vaultManager.cacheSecrets("local", context.name, {
+            [secretName]: stored,
+        });
+        // at most one key per account: also drop leftovers of a failed run
+        // or keys added by hand
+        await deleteKeys(fullIdentifier, validKeyIds.filter((id) => id !== storedKeyId));
+        return;
+    }
+    io.log("creating local access key...");
+    // create first: a failed create must not leave the vault empty
+    const { key, privateKeyId } = await createServiceAccountKey(fullIdentifier);
+    // straight into the vault, NOT through writeSecretsAndMirror: this
+    // key is for local use only and must never reach ci variables.
+    // A fresh key replaces the old one, a backup would be dead.
+    await vaultManager.writeSecrets("local", context.name, { [secretName]: key }, io, { backup: false });
+    // only now drop the keys that are not the new one
+    await deleteKeys(fullIdentifier, validKeyIds.filter((id) => id !== privateKeyId));
+};
+exports.syncLocalAccessServiceAccount = syncLocalAccessServiceAccount;
+const deleteKeys = async (fullIdentifier, keyIds) => {
+    for (const keyId of keyIds) {
+        await (0, child_process_promise_1.exec)(`gcloud iam service-accounts keys delete ${keyId} --quiet --iam-account=${fullIdentifier}`);
+    }
+};
+const createServiceAccountKey = async (fullIdentifier) => {
+    // a private temp file (0700 folder) instead of /dev/stdout | cat:
+    // the pipe hid gcloud's exit code
+    const folder = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), "catladder-local-access-"));
+    try {
+        const file = (0, path_1.join)(folder, "key.json");
+        await (0, child_process_promise_1.exec)(`gcloud iam service-accounts keys create "${file}" --iam-account=${fullIdentifier}`);
+        return (0, exports.parseServiceAccountKey)(await (0, promises_1.readFile)(file, "utf-8"));
+    }
+    finally {
+        await (0, promises_1.rm)(folder, { recursive: true, force: true });
+    }
+};
+//# sourceMappingURL=localAccess.js.map

package/dist/apps/cli/src/gcloud/localAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localAccess.js","sourceRoot":"","sources":["../../../../../src/gcloud/localAccess.ts"],"names":[],"mappings":";;;AACA,kDAK6B;AAC7B,iEAA6C;AAC7C,0CAAoD;AACpD,2BAA4B;AAC5B,+BAA4B;AAE5B,+DAAqE;AACrE,uDAAkD;AAElD;;;;GAIG;AACI,MAAM,iCAAiC,GAAG,CAC/C,OAAyB,EACzB,SAAiB,EACjB,EAAE,CACF,IAAA,kDAA4B,EAAC,OAAO,EAAE;IACpC,IAAI,EAAE,mCAAwB;IAC9B,SAAS;CACV,CAAC,CAAC;AAPQ,QAAA,iCAAiC,qCAOzC;AAQL;;;;GAIG;AACI,MAAM,0BAA0B,GAAG,CACxC,QAAsB,EACtB,MAAc,EACJ,EAAE,CACZ,QAAQ;KACL,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WAAC,OAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,EAAA,CAAC;KACtD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9B,IAAI,EAAE,CAAC;AARC,QAAA,0BAA0B,8BAQ3B;AAEZ;;;;GAIG;AACI,MAAM,qCAAqC,GAAG,CACnD,QAAsB,EACtB,MAAc,EACJ,EAAE,CACZ,QAAQ;KACL,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;KACtC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WAAC,OAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,QAAQ,CAAC,MAAM,CAAC,CAAA,EAAA,CAAC;KACtD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC9B,IAAI,EAAE,CAAC;AARC,QAAA,qCAAqC,yCAQtC;AAEZ;;;GAGG;AACI,MAAM,sBAAsB,GAAG,CACpC,GAAW,EAC4B,EAAE;IACzC,IAAI,MAA2D,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IACE,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ;QACzC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;AAC3D,CAAC,CAAC;AAhBW,QAAA,sBAAsB,0BAgBjC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,SAAiB,EAAyB,EAAE;;IAC5E,OAAA,MAAA,IAAI,CAAC,KAAK,CACR,CAAC,MAAM,IAAA,4BAAI,EAAC,kCAAkC,SAAS,gBAAgB,CAAC,CAAC;SACtE,MAAM,CACV,CAAC,QAAQ,mCAAI,EAAE,CAAA;CAAA,CAAC;AAEZ,MAAM,qBAAqB,GAAG,KAAK,EACxC,cAAsB,EACH,EAAE;IACrB,MAAM,IAAI,GAAuB,IAAI,CAAC,KAAK,CACzC,CACE,MAAM,IAAA,4BAAI,EACR,uDAAuD,cAAc,kCAAkC,CACxG,CACF,CAAC,MAAM,CACT,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC,CAAC;AACvD,CAAC,CAAC;AAXW,QAAA,qBAAqB,yBAWhC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,EAAM,EACN,SAAiB,EACjB,cAAsB,EACtB,KAAe,EACf,EAAE;IACF,MAAM,MAAM,GAAG,kBAAkB,cAAc,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,IAAA,6CAAqC,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,GAAG,CACJ,MAAM,cAAc,8BAA8B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAC7H,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAA,2BAAgB,EACzC,KAAK,EACL,IAAA,kCAA0B,EAAC,QAAQ,EAAE,MAAM,CAAC,CAC7C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACtB,MAAM,IAAA,4BAAI,EACR,0CAA0C,SAAS,aAAa,MAAM,WAAW,IAAI,mBAAmB,CACzG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACtB,MAAM,IAAA,4BAAI,EACR,6CAA6C,SAAS,aAAa,MAAM,WAAW,IAAI,mBAAmB,CAC5G,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACI,MAAM,6BAA6B,GAAG,KAAK,EAChD,EAAM,EACN,OAAyB,EACzB,SAAiB,EACjB,KAAe,EACA,EAAE;IACjB,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,yCAAiC,EACpE,OAAO,EACP,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAa,EAAC,cAAc,CAAC,CAAC;IAEnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,MAAM,EAAE,CAAC;YACX,EAAE,CAAC,GAAG,CAAC,6CAA6C,cAAc,KAAK,CAAC,CAAC;YACzE,MAAM,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YACtD,MAAM,IAAA,4BAAI,EACR,sCAAsC,cAAc,uBAAuB,SAAS,GAAG,CACxF,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,EAAE,CAAC,GAAG,CAAC,yCAAyC,cAAc,KAAK,CAAC,CAAC;QACrE,MAAM,IAAA,4BAAI,EACR,sCAAsC,QAAQ,oBAAoB,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,qDAAqD,SAAS,oEAAoE,CACjS,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;IAEzD,MAAM,UAAU,GAAG,IAAA,sCAA2B,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,IAAA,2BAAgB,EAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,iBAAiB;IACjB,MAAM,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAEtE,MAAM,WAAW,GAAG,MAAM,IAAA,6BAAqB,EAAC,cAAc,CAAC,CAAC;IAChE,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC;IAClD,CAAC;IAAC,WAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,IAAI,WAAW,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,wCAAwC;QACxC,MAAM,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YACrD,CAAC,UAAU,CAAC,EAAE,MAAM;SACrB,CAAC,CAAC;QACH,mEAAmE;QACnE,wBAAwB;QACxB,MAAM,UAAU,CACd,cAAc,EACd,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC,CAC/C,CAAC;QACF,OAAO;IACT,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACvC,+DAA+D;IAC/D,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,MAAM,uBAAuB,CAAC,cAAc,CAAC,CAAC;IAC5E,mEAAmE;IACnE,+DAA+D;IAC/D,4DAA4D;IAC5D,MAAM,YAAY,CAAC,YAAY,CAC7B,OAAO,EACP,OAAO,CAAC,IAAI,EACZ,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,EACrB,EAAE,EACF,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACF,kDAAkD;IAClD,MAAM,UAAU,CACd,cAAc,EACd,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,YAAY,CAAC,CAChD,CAAC;AACJ,CAAC,CAAC;AA/EW,QAAA,6BAA6B,iCA+ExC;AAEF,MAAM,UAAU,GAAG,KAAK,EAAE,cAAsB,EAAE,MAAgB,EAAE,EAAE;IACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAA,4BAAI,EACR,2CAA2C,KAAK,0BAA0B,cAAc,EAAE,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,KAAK,EAAE,cAAsB,EAAE,EAAE;IAC/D,kEAAkE;IAClE,kCAAkC;IAClC,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACtC,MAAM,IAAA,4BAAI,EACR,4CAA4C,IAAI,mBAAmB,cAAc,EAAE,CACpF,CAAC;QACF,OAAO,IAAA,8BAAsB,EAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,aAAE,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACH,CAAC,CAAC"}

package/dist/apps/cli/src/gcloud/serviceAccounts.js

@@ -5,12 +5,19 @@ const child_process_promise_1 = require("child-process-promise");
 const secrets_1 = require("../secrets");
 const serviceAccountNames_1 = require("./serviceAccountNames");
 const accountExists = async (fullIdentifier) => {
+    var _a, _b;
     try {
         await (0, child_process_promise_1.exec)(`gcloud iam service-accounts describe ${fullIdentifier}`);
         return true;
     }
-    catch (_a) {
-        return false;
+    catch (e) {
+        // only a missing account means "does not exist": an auth or
+        // permission error must not look like one (setup would skip the
+        // deletion, doctor would report it missing)
+        if (`${(_a = e === null || e === void 0 ? void 0 : e.stderr) !== null && _a !== void 0 ? _a : ""}${(_b = e === null || e === void 0 ? void 0 : e.message) !== null && _b !== void 0 ? _b : ""}`.includes("NOT_FOUND")) {
+            return false;
+        }
+        throw e;
     }
 };
 exports.accountExists = accountExists;

package/dist/apps/cli/src/gcloud/serviceAccounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../../../../src/gcloud/serviceAccounts.ts"],"names":[],"mappings":";;;AAEA,iEAA6C;AAE7C,wCAAmD;AACnD,+DAAqE;AAE9D,MAAM,aAAa,GAAG,KAAK,EAAE,cAAsB,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,aAAa,iBAOxB;AASF,MAAM,0BAA0B,GAAG,KAAK,EACtC,OAAyB,EACzB,OAAuB,EACN,EAAE;IACnB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAC/D,OAAO,EACP,OAAO,CACR,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC;IAE3I,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAA,4BAAI,EACR,sCAAsC,QAAQ,oBAAoB,eAAe,gBAAgB,SAAS,qBAAqB,WAAW,GAAG,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,cAAc,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAA,4BAAI,EACR,0CAA0C,SAAS,aAAa,UAAU,WAAW,IAAI,mBAAmB,CAC7G,CAAC;IACJ,CAAC;IAED,aAAa;IAEb,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAI,EACrB,uDAAuD,cAAc,kCAAkC,CACxG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,4BAAI,EACR,2CAA2C,GAAG,CAAC,IAAI,0BAA0B,cAAc,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAA,4BAAI;IACf,kEAAkE;IAClE,qEAAqE,cAAc,QAAQ,CAC5F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEK,MAAM,uCAAuC,GAAG,KAAK,EAC1D,QAAY,EACZ,OAAyB,EACzB,OAAuB,EACvB,UAAkB,EACH,EAAE;IACjB,QAAQ,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,IAAA,+BAAqB,EACzB,QAAQ,EACR;QACE;YACE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,OAAO,CAAC,IAAI;YAC3B,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE;SAC/B;KACF;IACD,mEAAmE;IACnE,8DAA8D;IAC9D,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC;AA3BW,QAAA,uCAAuC,2CA2BlD"}
+{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../../../../src/gcloud/serviceAccounts.ts"],"names":[],"mappings":";;;AAEA,iEAA6C;AAE7C,wCAAmD;AACnD,+DAAqE;AAE9D,MAAM,aAAa,GAAG,KAAK,EAAE,cAAsB,EAAE,EAAE;;IAC5D,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,4DAA4D;QAC5D,gEAAgE;QAChE,4CAA4C;QAC5C,IAAI,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,mCAAI,EAAE,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC,CAAC;AAbW,QAAA,aAAa,iBAaxB;AASF,MAAM,0BAA0B,GAAG,KAAK,EACtC,OAAyB,EACzB,OAAuB,EACN,EAAE;IACnB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAC/D,OAAO,EACP,OAAO,CACR,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC;IAE3I,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAA,4BAAI,EACR,sCAAsC,QAAQ,oBAAoB,eAAe,gBAAgB,SAAS,qBAAqB,WAAW,GAAG,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,cAAc,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAA,4BAAI,EACR,0CAA0C,SAAS,aAAa,UAAU,WAAW,IAAI,mBAAmB,CAC7G,CAAC;IACJ,CAAC;IAED,aAAa;IAEb,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAI,EACrB,uDAAuD,cAAc,kCAAkC,CACxG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,4BAAI,EACR,2CAA2C,GAAG,CAAC,IAAI,0BAA0B,cAAc,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAA,4BAAI;IACf,kEAAkE;IAClE,qEAAqE,cAAc,QAAQ,CAC5F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEK,MAAM,uCAAuC,GAAG,KAAK,EAC1D,QAAY,EACZ,OAAyB,EACzB,OAAuB,EACvB,UAAkB,EACH,EAAE;IACjB,QAAQ,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,IAAA,+BAAqB,EACzB,QAAQ,EACR;QACE;YACE,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,OAAO,CAAC,IAAI;YAC3B,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE;SAC/B;KACF;IACD,mEAAmE;IACnE,8DAA8D;IAC9D,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC;AA3BW,QAAA,uCAAuC,2CA2BlD"}

package/dist/apps/cli/src/localAccess/declared.d.ts

@@ -0,0 +1,14 @@
+import type { Config } from "../../../../packages/pipeline/src/index.js";
+/**
+ * the envs of a component declaring gcp local access. An invalid
+ * declaration yields none instead of throwing: catenv and the vault
+ * cache must keep working (`project doctor` and `project setup` report
+ * the invalid declaration loudly).
+ */
+export declare const getDeclaredLocalAccessEnvs: (config: Config, componentName: string) => string[];
+/**
+ * the declared `credentialsEnvVar` names of a component, mapped to their
+ * env. Empty instead of throwing on an invalid declaration, see
+ * {@link getDeclaredLocalAccessEnvs}.
+ */
+export declare const getDeclaredLocalAccessCredentialsEnvVars: (config: Config, componentName: string) => Record<string, string>;

package/dist/apps/cli/src/localAccess/declared.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getDeclaredLocalAccessCredentialsEnvVars = exports.getDeclaredLocalAccessEnvs = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+/**
+ * the envs of a component declaring gcp local access. An invalid
+ * declaration yields none instead of throwing: catenv and the vault
+ * cache must keep working (`project doctor` and `project setup` report
+ * the invalid declaration loudly).
+ */
+const getDeclaredLocalAccessEnvs = (config, componentName) => {
+    try {
+        return (0, pipeline_1.getLocalAccessGcpEnvs)(config, componentName);
+    }
+    catch (_a) {
+        return [];
+    }
+};
+exports.getDeclaredLocalAccessEnvs = getDeclaredLocalAccessEnvs;
+/**
+ * the declared `credentialsEnvVar` names of a component, mapped to their
+ * env. Empty instead of throwing on an invalid declaration, see
+ * {@link getDeclaredLocalAccessEnvs}.
+ */
+const getDeclaredLocalAccessCredentialsEnvVars = (config, componentName) => {
+    try {
+        return (0, pipeline_1.getLocalAccessGcpCredentialsEnvVars)(config, componentName);
+    }
+    catch (_a) {
+        return {};
+    }
+};
+exports.getDeclaredLocalAccessCredentialsEnvVars = getDeclaredLocalAccessCredentialsEnvVars;
+//# sourceMappingURL=declared.js.map

package/dist/apps/cli/src/localAccess/declared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared.js","sourceRoot":"","sources":["../../../../../src/localAccess/declared.ts"],"names":[],"mappings":";;;AACA,kDAG6B;AAE7B;;;;;GAKG;AACI,MAAM,0BAA0B,GAAG,CACxC,MAAc,EACd,aAAqB,EACX,EAAE;IACZ,IAAI,CAAC;QACH,OAAO,IAAA,gCAAqB,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AATW,QAAA,0BAA0B,8BASrC;AAEF;;;;GAIG;AACI,MAAM,wCAAwC,GAAG,CACtD,MAAc,EACd,aAAqB,EACG,EAAE;IAC1B,IAAI,CAAC;QACH,OAAO,IAAA,8CAAmC,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AATW,QAAA,wCAAwC,4CASnD"}

package/dist/apps/cli/src/localAccess/keyFiles.d.ts

@@ -0,0 +1,28 @@
+import type { Config } from "../../../../packages/pipeline/src/index.js";
+import type { IO } from "../core/types";
+/** file name of a component/env key, relative to the local access folder */
+export declare const getLocalAccessKeyFileName: (env: string, componentName: string) => string;
+/**
+ * env var exposing the key file path. Deliberately NOT
+ * GOOGLE_APPLICATION_CREDENTIALS: the key must only be used where a
+ * command opts in (isolated gcloud config, or a declared
+ * `credentialsEnvVar`), never by ADC implicitly.
+ */
+export declare const getLocalAccessKeyFileVarName: (env: string) => string;
+/**
+ * env vars pointing at the key files that exist for the component
+ * (only paths, no secrets): one per env, plus the declared
+ * `credentialsEnvVar` names
+ */
+export declare const getLocalAccessKeyFileVars: (config: Config, componentName: string) => Promise<Record<string, string>>;
+/**
+ * writes the stored local access service account keys to gitignored
+ * files (mode 0600) and removes files of declarations that are gone.
+ * A no-op without any declaration (nothing is created). Never throws:
+ * a vault that cannot be reached or an invalid declaration (reported by
+ * `project doctor`) must not break catenv.
+ *
+ * The key is only read through the cache; if setup rotated it on another
+ * machine, refresh with `catenv --vault-mode refresh`.
+ */
+export declare const writeLocalAccessKeyFiles: (io: IO, config: Config) => Promise<void>;

package/dist/apps/cli/src/localAccess/keyFiles.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeLocalAccessKeyFiles = exports.getLocalAccessKeyFileVars = exports.getLocalAccessKeyFileVarName = exports.getLocalAccessKeyFileName = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const promises_1 = require("fs/promises");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const writePrivateFile_1 = require("../utils/writePrivateFile");
+const declared_1 = require("./declared");
+const gitProjectInformation_1 = require("../git/gitProjectInformation");
+const sanitize = (s) => s.replace(/[^A-Za-z0-9]+/g, "_");
+/** file name of a component/env key, relative to the local access folder */
+const getLocalAccessKeyFileName = (env, componentName) => `gcp-${sanitize(env)}-${sanitize(componentName)}.json`;
+exports.getLocalAccessKeyFileName = getLocalAccessKeyFileName;
+/**
+ * env var exposing the key file path. Deliberately NOT
+ * GOOGLE_APPLICATION_CREDENTIALS: the key must only be used where a
+ * command opts in (isolated gcloud config, or a declared
+ * `credentialsEnvVar`), never by ADC implicitly.
+ */
+const getLocalAccessKeyFileVarName = (env) => `CATLADDER_LOCAL_ACCESS_GCP_${sanitize(env).toUpperCase()}_KEY_FILE`;
+exports.getLocalAccessKeyFileVarName = getLocalAccessKeyFileVarName;
+// inside .catladder/, which ignores itself (see vault/cache.ts)
+const getFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder", "local-access");
+/**
+ * env vars pointing at the key files that exist for the component
+ * (only paths, no secrets): one per env, plus the declared
+ * `credentialsEnvVar` names
+ */
+const getLocalAccessKeyFileVars = async (config, componentName) => {
+    const folder = await getFolder();
+    const getPath = (env) => (0, path_1.join)(folder, (0, exports.getLocalAccessKeyFileName)(env, componentName));
+    return Object.fromEntries([
+        ...(0, declared_1.getDeclaredLocalAccessEnvs)(config, componentName).map((env) => [
+            (0, exports.getLocalAccessKeyFileVarName)(env),
+            getPath(env),
+        ]),
+        ...Object.entries((0, declared_1.getDeclaredLocalAccessCredentialsEnvVars)(config, componentName)).map(([name, env]) => [name, getPath(env)]),
+    ].filter(([, path]) => (0, fs_1.existsSync)(path)));
+};
+exports.getLocalAccessKeyFileVars = getLocalAccessKeyFileVars;
+/**
+ * writes the stored local access service account keys to gitignored
+ * files (mode 0600) and removes files of declarations that are gone.
+ * A no-op without any declaration (nothing is created). Never throws:
+ * a vault that cannot be reached or an invalid declaration (reported by
+ * `project doctor`) must not break catenv.
+ *
+ * The key is only read through the cache; if setup rotated it on another
+ * machine, refresh with `catenv --vault-mode refresh`.
+ */
+const writeLocalAccessKeyFiles = async (io, config) => {
+    const wanted = Object.keys(config.components).flatMap((componentName) => (0, declared_1.getDeclaredLocalAccessEnvs)(config, componentName).map((env) => ({
+        env,
+        componentName,
+        secretName: (0, pipeline_1.getSecretVarName)("local", componentName, (0, pipeline_1.getLocalAccessGcpSecretName)(env)),
+        fileName: (0, exports.getLocalAccessKeyFileName)(env, componentName),
+    })));
+    const folder = await getFolder();
+    if (wanted.length === 0 && !(0, fs_1.existsSync)(folder))
+        return;
+    try {
+        const secrets = wanted.length > 0
+            ? await (await io.getVaultManager()).readSecrets(wanted.map((w) => w.secretName), io)
+            : {};
+        await (0, promises_1.mkdir)(folder, { recursive: true, mode: 0o700 });
+        // the parent folder ignores itself
+        await (0, promises_1.writeFile)((0, path_1.join)(folder, "..", ".gitignore"), "*\n");
+        const written = new Set();
+        for (const { secretName, fileName, env, componentName } of wanted) {
+            const key = secrets[secretName];
+            if (!key) {
+                io.log(`⚠️ no local access key for ${env}:${componentName} in the secret store — run \`catladder project setup\` (or \`catenv --vault-mode refresh\` if it was set up on another machine)`);
+                continue;
+            }
+            const path = (0, path_1.join)(folder, fileName);
+            await (0, writePrivateFile_1.writePrivateFile)(path, key);
+            written.add(fileName);
+        }
+        for (const file of await (0, promises_1.readdir)(folder)) {
+            if (!written.has(file)) {
+                await (0, promises_1.rm)((0, path_1.join)(folder, file), { force: true });
+            }
+        }
+    }
+    catch (e) {
+        io.log(`⚠️ could not write local access keys: ${e.message}`);
+    }
+};
+exports.writeLocalAccessKeyFiles = writeLocalAccessKeyFiles;
+//# sourceMappingURL=keyFiles.js.map

package/dist/apps/cli/src/localAccess/keyFiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyFiles.js","sourceRoot":"","sources":["../../../../../src/localAccess/keyFiles.ts"],"names":[],"mappings":";;;AACA,kDAG6B;AAC7B,0CAA4D;AAC5D,2BAAgC;AAChC,+BAA4B;AAE5B,gEAA6D;AAC7D,yCAGoB;AACpB,wEAAkE;AAElE,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;AAEjE,4EAA4E;AACrE,MAAM,yBAAyB,GAAG,CAAC,GAAW,EAAE,aAAqB,EAAE,EAAE,CAC9E,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC;AAD5C,QAAA,yBAAyB,6BACmB;AAEzD;;;;;GAKG;AACI,MAAM,4BAA4B,GAAG,CAAC,GAAW,EAAE,EAAE,CAC1D,8BAA8B,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC;AAD1D,QAAA,4BAA4B,gCAC8B;AAEvE,gEAAgE;AAChE,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE,CAC3B,IAAA,WAAI,EAAC,MAAM,IAAA,0CAAkB,GAAE,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAEjE;;;;GAIG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,MAAc,EACd,aAAqB,EACY,EAAE;IACnC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAC9B,IAAA,WAAI,EAAC,MAAM,EAAE,IAAA,iCAAyB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,WAAW,CACvB;QACE,GAAG,IAAA,qCAA0B,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CACtD,CAAC,GAAG,EAAoB,EAAE,CAAC;YACzB,IAAA,oCAA4B,EAAC,GAAG,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC;SACb,CACF;QACD,GAAG,MAAM,CAAC,OAAO,CACf,IAAA,mDAAwC,EAAC,MAAM,EAAE,aAAa,CAAC,CAChE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAoB,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/D,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,CAAC,CACzC,CAAC;AACJ,CAAC,CAAC;AApBW,QAAA,yBAAyB,6BAoBpC;AAEF;;;;;;;;;GASG;AACI,MAAM,wBAAwB,GAAG,KAAK,EAAE,EAAM,EAAE,MAAc,EAAE,EAAE;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CACtE,IAAA,qCAA0B,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9D,GAAG;QACH,aAAa;QACb,UAAU,EAAE,IAAA,2BAAgB,EAC1B,OAAO,EACP,aAAa,EACb,IAAA,sCAA2B,EAAC,GAAG,CAAC,CACjC;QACD,QAAQ,EAAE,IAAA,iCAAyB,EAAC,GAAG,EAAE,aAAa,CAAC;KACxD,CAAC,CAAC,CACJ,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAA,eAAU,EAAC,MAAM,CAAC;QAAE,OAAO;IAEvD,IAAI,CAAC;QACH,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,GAAG,CAAC;YACf,CAAC,CAAC,MAAM,CACJ,MAAM,EAAE,CAAC,eAAe,EAAE,CAC3B,CAAC,WAAW,CACX,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAC/B,EAAE,CACH;YACH,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAA,gBAAK,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,mCAAmC;QACnC,MAAM,IAAA,oBAAS,EAAC,IAAA,WAAI,EAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QAEzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,MAAM,EAAE,CAAC;YAClE,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,EAAE,CAAC,GAAG,CACJ,8BAA8B,GAAG,IAAI,aAAa,iIAAiI,CACpL,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpC,MAAM,IAAA,mCAAgB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,MAAM,IAAA,kBAAO,EAAC,MAAM,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAA,aAAE,EAAC,IAAA,WAAI,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC;AArDW,QAAA,wBAAwB,4BAqDnC"}

package/dist/apps/cli/src/utils/writePrivateFile.d.ts

@@ -0,0 +1,7 @@
+/**
+ * writes a file readable by the owner only. Goes through a 0600 temp
+ * file and a rename, so the content is never visible with looser
+ * permissions (writing first and chmod-ing afterwards would leave an
+ * existing 0644 file readable until the chmod).
+ */
+export declare const writePrivateFile: (path: string, content: string) => Promise<void>;

package/dist/apps/cli/src/utils/writePrivateFile.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writePrivateFile = void 0;
+const promises_1 = require("fs/promises");
+/**
+ * writes a file readable by the owner only. Goes through a 0600 temp
+ * file and a rename, so the content is never visible with looser
+ * permissions (writing first and chmod-ing afterwards would leave an
+ * existing 0644 file readable until the chmod).
+ */
+const writePrivateFile = async (path, content) => {
+    const tmp = `${path}.${process.pid}.tmp`;
+    try {
+        await (0, promises_1.writeFile)(tmp, content, { mode: 0o600 });
+        // the mode is only applied when the file is created
+        await (0, promises_1.chmod)(tmp, 0o600);
+        await (0, promises_1.rename)(tmp, path);
+    }
+    catch (e) {
+        await (0, promises_1.rm)(tmp, { force: true });
+        throw e;
+    }
+};
+exports.writePrivateFile = writePrivateFile;
+//# sourceMappingURL=writePrivateFile.js.map

package/dist/apps/cli/src/utils/writePrivateFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writePrivateFile.js","sourceRoot":"","sources":["../../../../../src/utils/writePrivateFile.ts"],"names":[],"mappings":";;;AAAA,0CAA2D;AAE3D;;;;;GAKG;AACI,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAAY,EAAE,OAAe,EAAE,EAAE;IACtE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAA,oBAAS,EAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,oDAAoD;QACpD,MAAM,IAAA,gBAAK,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,MAAM,IAAA,iBAAM,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAA,aAAE,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC,CAAC;AAXW,QAAA,gBAAgB,oBAW3B"}

package/dist/apps/cli/src/vault/BitwardenVault.js

@@ -100,30 +100,21 @@ class BitwardenVault {
             : {};
         const notes = (0, yaml_1.stringify)({ ...previous, ...secrets });
         if (existing) {
-            await (0, bw_1.runBw)(bwSession, [
-                "edit",
-                "item",
-                existing.id,
-                encodePayload({ ...existing, notes }),
-            ]);
+            await (0, bw_1.runBw)(bwSession, ["edit", "item", existing.id], encodePayload({ ...existing, notes }));
         }
         else {
-            await (0, bw_1.runBw)(bwSession, [
-                "create",
-                "item",
-                encodePayload({
-                    type: SECURE_NOTE_TYPE,
-                    secureNote: { type: 0 },
-                    name,
-                    notes,
-                    ...(collection.organizationId
-                        ? {
-                            organizationId: collection.organizationId,
-                            collectionIds: [collection.id],
-                        }
-                        : {}),
-                }),
-            ]);
+            await (0, bw_1.runBw)(bwSession, ["create", "item"], encodePayload({
+                type: SECURE_NOTE_TYPE,
+                secureNote: { type: 0 },
+                name,
+                notes,
+                ...(collection.organizationId
+                    ? {
+                        organizationId: collection.organizationId,
+                        collectionIds: [collection.id],
+                    }
+                    : {}),
+            }));
         }
     }
 }

package/dist/apps/cli/src/vault/BitwardenVault.js.map

@@ -1 +1 @@
-{"version":3,"file":"BitwardenVault.js","sourceRoot":"","sources":["../../../../../src/vault/BitwardenVault.ts"],"names":[],"mappings":";;;AAAA,kDAAuD;AAEvD,+BAAwC;AAExC,6BAAsD;AAGtD,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAW3B;;;GAGG;AACH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,aAAqB,EAAU,EAAE,CAC9E,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,aAAa,cAAc,CAAC;AAEjF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CACpC,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;AAE9C;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;SAChC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAe,EACf,cAAsB,EACC,EAAE;IACzB,MAAM,WAAW,GAAG,MAAM,IAAA,cAAS,EAAiB,OAAO,EAAE;QAC3D,MAAM;QACN,aAAa;QACb,UAAU;QACV,cAAc;KACf,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yBAAyB,cAAc,uDAAuD,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE,CACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEnE,MAAa,cAAc;IAKzB,YACmB,MAAc,EAC/B,OAAgC;IAChC;;;OAGG;IACc,WAAoB;;QANpB,WAAM,GAAN,MAAM,CAAQ;QAMd,gBAAW,GAAX,WAAW,CAAS;QAErC,IAAI,CAAC,cAAc,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,kBAAkB,CAAC;QAC/D,IAAI,CAAC,EAAE,GAAG,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/C,CAAC;IAEO,OAAO,CAAC,EAAa;QAC3B,OAAO,IAAA,iBAAY,EAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAa;QAChC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACjD,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,KAAK,CAAmC,CAAC;YACnE,MAAM,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACpD,OAAO,CAAC,IAAA,2BAAgB,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,OAAgC;;QAEhC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,CACf,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACnC,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;YACb,UAAU;YACV,IAAI;SACL,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAErC,MAAM,QAAQ,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK;YAC9B,CAAC,CAAC,CAAC,MAAC,IAAA,YAAK,EAAC,QAAQ,CAAC,KAAK,CAAoC,mCAAI,EAAE,CAAC;YACnE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAA,UAAK,EAAC,SAAS,EAAE;gBACrB,MAAM;gBACN,MAAM;gBACN,QAAQ,CAAC,EAAE;gBACX,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,UAAK,EAAC,SAAS,EAAE;gBACrB,QAAQ;gBACR,MAAM;gBACN,aAAa,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;oBACvB,IAAI;oBACJ,KAAK;oBACL,GAAG,CAAC,UAAU,CAAC,cAAc;wBAC3B,CAAC,CAAC;4BACE,cAAc,EAAE,UAAU,CAAC,cAAc;4BACzC,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;yBAC/B;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA3GD,wCA2GC"}
+{"version":3,"file":"BitwardenVault.js","sourceRoot":"","sources":["../../../../../src/vault/BitwardenVault.ts"],"names":[],"mappings":";;;AAAA,kDAAuD;AAEvD,+BAAwC;AAExC,6BAAsD;AAGtD,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAW3B;;;GAGG;AACH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,aAAqB,EAAU,EAAE,CAC9E,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,aAAa,cAAc,CAAC;AAEjF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CACpC,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;AAE9C;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;SAChC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAe,EACf,cAAsB,EACC,EAAE;IACzB,MAAM,WAAW,GAAG,MAAM,IAAA,cAAS,EAAiB,OAAO,EAAE;QAC3D,MAAM;QACN,aAAa;QACb,UAAU;QACV,cAAc;KACf,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yBAAyB,cAAc,uDAAuD,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE,CACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEnE,MAAa,cAAc;IAKzB,YACmB,MAAc,EAC/B,OAAgC;IAChC;;;OAGG;IACc,WAAoB;;QANpB,WAAM,GAAN,MAAM,CAAQ;QAMd,gBAAW,GAAX,WAAW,CAAS;QAErC,IAAI,CAAC,cAAc,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,kBAAkB,CAAC;QAC/D,IAAI,CAAC,EAAE,GAAG,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/C,CAAC;IAEO,OAAO,CAAC,EAAa;QAC3B,OAAO,IAAA,iBAAY,EAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAa;QAChC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACjD,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,KAAK,CAAmC,CAAC;YACnE,MAAM,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACpD,OAAO,CAAC,IAAA,2BAAgB,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,OAAgC;;QAEhC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,CACf,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACnC,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;YACb,UAAU;YACV,IAAI;SACL,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAErC,MAAM,QAAQ,GAAG,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK;YAC9B,CAAC,CAAC,CAAC,MAAC,IAAA,YAAK,EAAC,QAAQ,CAAC,KAAK,CAAoC,mCAAI,EAAE,CAAC;YACnE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAErD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAA,UAAK,EACT,SAAS,EACT,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,EAC7B,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,CACtC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,UAAK,EACT,SAAS,EACT,CAAC,QAAQ,EAAE,MAAM,CAAC,EAClB,aAAa,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;gBACvB,IAAI;gBACJ,KAAK;gBACL,GAAG,CAAC,UAAU,CAAC,cAAc;oBAC3B,CAAC,CAAC;wBACE,cAAc,EAAE,UAAU,CAAC,cAAc;wBACzC,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;qBAC/B;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA1GD,wCA0GC"}

package/dist/apps/cli/src/vault/VaultManager.d.ts

@@ -34,10 +34,16 @@ export declare class VaultManager {
      * local cache (write-through, "local" env only)
      */
     writeSecrets(env: string, componentName: string, secrets: Record<string, unknown>, io?: IO | null, options?: WriteSecretsOptions): Promise<void>;
+    /**
+     * updates the local cache only (the vault already holds the values),
+     * "local" env only
+     */
+    cacheSecrets(env: string, componentName: string, secrets: Record<string, string>): Promise<void>;
     /**
      * the subset of the vault secrets that may be cached: the declared
      * secrets of the "local" env, per component, as a hierarchy
      */
     private cacheableSubset;
     private declaredSecretKeys;
+    private declaredEnvSecretKeys;
 }

package/dist/apps/cli/src/vault/VaultManager.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VaultManager = void 0;
 const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const declared_1 = require("../localAccess/declared");
 const BitwardenVault_1 = require("./BitwardenVault");
 const cache_1 = require("./cache");
 const GitlabVault_1 = require("./GitlabVault");
@@ -84,6 +85,15 @@ class VaultManager {
             ])));
         }
     }
+    /**
+     * updates the local cache only (the vault already holds the values),
+     * "local" env only
+     */
+    async cacheSecrets(env, componentName, secrets) {
+        if (env !== CACHED_ENV)
+            return;
+        await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, secrets);
+    }
     /**
      * the subset of the vault secrets that may be cached: the declared
      * secrets of the "local" env, per component, as a hierarchy
@@ -107,6 +117,14 @@ class VaultManager {
         return Object.keys(local).length > 0 ? { [CACHED_ENV]: local } : {};
     }
     async declaredSecretKeys(componentName) {
+        return [
+            ...(await this.declaredEnvSecretKeys(componentName)),
+            // the local access keys `project setup` provisions are not part
+            // of any env's vars, but belong to the cached local secrets
+            ...(0, declared_1.getDeclaredLocalAccessEnvs)(this.config, componentName).map(pipeline_1.getLocalAccessGcpSecretName),
+        ];
+    }
+    async declaredEnvSecretKeys(componentName) {
         try {
             const { secretEnvVarKeys, jobOnlyVars } = await (0, pipeline_1.getEnvironment)({
                 config: this.config,

package/dist/apps/cli/src/vault/VaultManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"VaultManager.js","sourceRoot":"","sources":["../../../../../src/vault/VaultManager.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAE7B,qDAAkD;AAElD,mCAIiB;AACjB,+CAA4C;AAG5C;;;GAGG;AACH,MAAM,UAAU,GAAG,OAAO,CAAC;AAW3B;;;;GAIG;AACH,MAAa,YAAY;IAUvB,YACmB,MAAc,EAC/B,UAA+B,EAAE;;QADhB,WAAM,GAAN,MAAM,CAAQ;QAJjC,4DAA4D;QACpD,cAAS,GAAG,KAAK,CAAC;QAMxB,IAAI,CAAC,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC;QACnC,IAAI,CAAC,EAAE,GAAG,MAAA,OAAO,CAAC,EAAE,mCAAI,IAAI,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW;;QACjB,MAAM,WAAW,GAAG,IAAA,yBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,IAAI,yBAAW,EAAE,CAAC;YAC3B,KAAK,WAAW;gBACd,OAAO,IAAI,+BAAc,CACvB,IAAI,CAAC,MAAM,EACX,WAAW;gBACX,6DAA6D;gBAC7D,4DAA4D;gBAC5D,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;oBAC/C,CAAC,MAAA,MAAA,IAAI,CAAC,EAAE,0CAAE,WAAW,mCAAI,IAAI,CAAC,CACjC,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,aAAuB,EACvB,KAAgB,IAAI,CAAC,EAAE;QAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAA,wBAAgB,GAAE,CAAC;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,KAAK,GACT,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,MAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,sEAAsE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,kDAAkD,OAAO,CAAC,MAAM,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,IAAA,yBAAiB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,aAAqB,EACrB,OAAgC,EAChC,KAAgB,IAAI,CAAC,EAAE,EACvB,UAA+B,EAAE;QAEjC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAA,0BAAkB,EACtB,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,GAAG,EACH,aAAa,EACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5C,GAAG;gBACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC1D,CAAC,CACH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmC;QAEnC,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAA2B,EAAE;;gBAAC,OAAA;oBACzC,GAAG;oBACH,oDAAoD;oBACpD,MAAA,WAAW,CAAC,IAAA,2BAAgB,EAAC,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,mCAAI,IAAI;iBACtE,CAAA;aAAA,CAAC,CACH,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC;gBAC7D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa;gBACb,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,WAAM,CAAC;YACP,8DAA8D;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAlJD,oCAkJC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAG,CACrB,OAAsB,EACS,EAAE,CACjC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3C,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC;IACzC,KAAK;CACN,CAAC,CACH,CACF,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,KAAoC,EACZ,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CACxD,CACF,CAAC"}
+{"version":3,"file":"VaultManager.js","sourceRoot":"","sources":["../../../../../src/vault/VaultManager.ts"],"names":[],"mappings":";;;AACA,kDAK6B;AAE7B,sDAAqE;AACrE,qDAAkD;AAElD,mCAIiB;AACjB,+CAA4C;AAG5C;;;GAGG;AACH,MAAM,UAAU,GAAG,OAAO,CAAC;AAW3B;;;;GAIG;AACH,MAAa,YAAY;IAUvB,YACmB,MAAc,EAC/B,UAA+B,EAAE;;QADhB,WAAM,GAAN,MAAM,CAAQ;QAJjC,4DAA4D;QACpD,cAAS,GAAG,KAAK,CAAC;QAMxB,IAAI,CAAC,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC;QACnC,IAAI,CAAC,EAAE,GAAG,MAAA,OAAO,CAAC,EAAE,mCAAI,IAAI,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW;;QACjB,MAAM,WAAW,GAAG,IAAA,yBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,IAAI,yBAAW,EAAE,CAAC;YAC3B,KAAK,WAAW;gBACd,OAAO,IAAI,+BAAc,CACvB,IAAI,CAAC,MAAM,EACX,WAAW;gBACX,6DAA6D;gBAC7D,4DAA4D;gBAC5D,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;oBAC/C,CAAC,MAAA,MAAA,IAAI,CAAC,EAAE,0CAAE,WAAW,mCAAI,IAAI,CAAC,CACjC,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,aAAuB,EACvB,KAAgB,IAAI,CAAC,EAAE;QAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAA,wBAAgB,GAAE,CAAC;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,KAAK,GACT,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,MAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,sEAAsE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,kDAAkD,OAAO,CAAC,MAAM,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,IAAA,yBAAiB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,aAAqB,EACrB,OAAgC,EAChC,KAAgB,IAAI,CAAC,EAAE,EACvB,UAA+B,EAAE;QAEjC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACxE,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAA,0BAAkB,EACtB,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,GAAG,EACH,aAAa,EACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5C,GAAG;gBACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC1D,CAAC,CACH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,aAAqB,EACrB,OAA+B;QAE/B,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO;QAC/B,MAAM,IAAA,0BAAkB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmC;QAEnC,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAA2B,EAAE;;gBAAC,OAAA;oBACzC,GAAG;oBACH,oDAAoD;oBACpD,MAAA,WAAW,CAAC,IAAA,2BAAgB,EAAC,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,mCAAI,IAAI;iBACtE,CAAA;aAAA,CAAC,CACH,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QACpD,OAAO;YACL,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACpD,gEAAgE;YAChE,4DAA4D;YAC5D,GAAG,IAAA,qCAA0B,EAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAC3D,sCAA2B,CAC5B;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,aAAqB;QAErB,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC;gBAC7D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa;gBACb,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,WAAM,CAAC;YACP,8DAA8D;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AA5KD,oCA4KC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAG,CACrB,OAAsB,EACS,EAAE,CACjC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3C,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC;IACzC,KAAK;CACN,CAAC,CACH,CACF,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,KAAoC,EACZ,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CACxD,CACF,CAAC"}

package/dist/apps/cli/src/vault/bw.d.ts

@@ -7,7 +7,11 @@ export declare const getBwSession: (io: IO | null, { allowPrompt }: {
     allowPrompt: boolean;
 }) => Promise<string>;
 /**
- * runs a bw command with the given session and returns stdout
+ * runs a bw command with the given session and returns stdout.
+ *
+ * `input` is written to stdin: use it for payloads (e.g. the secrets of
+ * `bw create item`), which would otherwise be visible in `ps` and be
+ * echoed by node's "Command failed" error.
  */
-export declare const runBw: (session: string, args: string[]) => Promise<string>;
+export declare const runBw: (session: string, args: string[], input?: string) => Promise<string>;
 export declare const runBwJson: <T>(session: string, args: string[]) => Promise<T>;