@catladder/cli 0.0.0-main-8dbb6c76 → 0.0.0-main-a6b45abe

package/dist/apps/cli/src/vault/VaultManager.d.ts

@@ -0,0 +1,43 @@
+import type { Config } from "../../../../packages/pipeline/src/index.js";
+import type { IO } from "../core/types";
+import type { SecretsMode, SecretsVault } from "./types";
+export type VaultManagerOptions = {
+    mode?: SecretsMode;
+    /**
+     * default IO for vault interactions (logging, unlock prompts).
+     * Method-level io takes precedence.
+     */
+    io?: IO | null;
+};
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+export declare class VaultManager {
+    private readonly config;
+    readonly mode: SecretsMode;
+    readonly vault: SecretsVault;
+    private readonly io;
+    /** refresh mode bypasses the cache only once per manager */
+    private refreshed;
+    constructor(config: Config, options?: VaultManagerOptions);
+    private createVault;
+    /**
+     * the vault secrets, served from the local cache when it contains
+     * all required names; otherwise (depending on the mode) refreshed
+     * from the vault. Only the "local" env is (re-)cached.
+     */
+    readSecrets(requiredNames: string[], io?: IO | null): Promise<Record<string, string>>;
+    /**
+     * writes secrets of one env/component to the vault and updates the
+     * local cache (write-through, "local" env only)
+     */
+    writeSecrets(env: string, componentName: string, secrets: Record<string, unknown>, io?: IO | null): Promise<void>;
+    /**
+     * the subset of the vault secrets that may be cached: the declared
+     * secrets of the "local" env, per component, as a hierarchy
+     */
+    private cacheableSubset;
+    private declaredSecretKeys;
+}

package/dist/apps/cli/src/vault/VaultManager.js

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultManager = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const BitwardenVault_1 = require("./BitwardenVault");
+const cache_1 = require("./cache");
+const GitlabVault_1 = require("./GitlabVault");
+/**
+ * only secrets of this env are cached locally — the other envs'
+ * secrets have no business sitting on developer machines
+ */
+const CACHED_ENV = "local";
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+class VaultManager {
+    constructor(config, options = {}) {
+        var _a, _b;
+        this.config = config;
+        /** refresh mode bypasses the cache only once per manager */
+        this.refreshed = false;
+        this.mode = (_a = options.mode) !== null && _a !== void 0 ? _a : "auto";
+        this.io = (_b = options.io) !== null && _b !== void 0 ? _b : null;
+        this.vault = this.createVault();
+    }
+    createVault() {
+        var _a, _b;
+        const vaultConfig = (0, pipeline_1.getVaultConfig)(this.config);
+        switch (vaultConfig.type) {
+            case "gitlab":
+                return new GitlabVault_1.GitlabVault();
+            case "bitwarden":
+                return new BitwardenVault_1.BitwardenVault(this.config, vaultConfig, 
+                // unlock prompts need a mode that allows them AND an IO that
+                // can actually prompt (catenv under direnv/turbo/CI cannot)
+                (this.mode === "auto" || this.mode === "refresh") &&
+                    ((_b = (_a = this.io) === null || _a === void 0 ? void 0 : _a.interactive) !== null && _b !== void 0 ? _b : true));
+        }
+    }
+    /**
+     * the vault secrets, served from the local cache when it contains
+     * all required names; otherwise (depending on the mode) refreshed
+     * from the vault. Only the "local" env is (re-)cached.
+     */
+    async readSecrets(requiredNames, io = this.io) {
+        const bypassCache = this.mode === "refresh" && !this.refreshed;
+        const cache = bypassCache ? null : await (0, cache_1.readSecretsCache)();
+        // known entries include recorded misses (null values), so declared
+        // but intentionally unset secrets don't force a vault refresh
+        const known = (cache === null || cache === void 0 ? void 0 : cache.vaultId) === this.vault.id
+            ? flattenSecrets(cache.secrets)
+            : undefined;
+        const missing = requiredNames.filter((name) => !(name in (known !== null && known !== void 0 ? known : {})));
+        // nothing missing (or nothing required at all): don't touch the vault
+        if (missing.length === 0 && (known || requiredNames.length === 0)) {
+            return withoutMisses(known !== null && known !== void 0 ? known : {});
+        }
+        if (this.mode === "offline") {
+            if (missing.length > 0) {
+                io === null || io === void 0 ? void 0 : io.log(`⚠️ vault is offline (--vault-mode offline) and ${missing.length} secrets are not in the local cache: ${missing.join(", ")}`);
+            }
+            return withoutMisses(known !== null && known !== void 0 ? known : {});
+        }
+        const secrets = await this.vault.readAllSecrets(io);
+        this.refreshed = true;
+        await (0, cache_1.writeSecretsCache)(this.vault.id, await this.cacheableSubset(secrets));
+        return secrets;
+    }
+    /**
+     * writes secrets of one env/component to the vault and updates the
+     * local cache (write-through, "local" env only)
+     */
+    async writeSecrets(env, componentName, secrets, io = this.io) {
+        if (!io) {
+            throw new Error("writing to the vault requires an interactive context");
+        }
+        await this.vault.writeSecrets(io, env, componentName, secrets);
+        if (env === CACHED_ENV) {
+            await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [
+                key,
+                typeof value === "string" ? value : JSON.stringify(value),
+            ])));
+        }
+    }
+    /**
+     * the subset of the vault secrets that may be cached: the declared
+     * secrets of the "local" env, per component, as a hierarchy
+     */
+    async cacheableSubset(flatSecrets) {
+        const local = {};
+        for (const componentName of Object.keys(this.config.components)) {
+            const keys = await this.declaredSecretKeys(componentName);
+            const values = Object.fromEntries(keys.map((key) => {
+                var _a;
+                return [
+                    key,
+                    // null records "absent in the vault" (a known miss)
+                    (_a = flatSecrets[(0, pipeline_1.getSecretVarName)(CACHED_ENV, componentName, key)]) !== null && _a !== void 0 ? _a : null,
+                ];
+            }));
+            if (Object.keys(values).length > 0) {
+                local[componentName] = values;
+            }
+        }
+        return Object.keys(local).length > 0 ? { [CACHED_ENV]: local } : {};
+    }
+    async declaredSecretKeys(componentName) {
+        try {
+            const { secretEnvVarKeys, jobOnlyVars } = await (0, pipeline_1.getEnvironment)({
+                config: this.config,
+                componentName,
+                env: CACHED_ENV,
+            });
+            return [
+                ...secretEnvVarKeys,
+                ...jobOnlyVars.build.secretEnvVarKeys,
+                ...jobOnlyVars.deploy.secretEnvVarKeys,
+            ].map(({ key }) => key);
+        }
+        catch (_a) {
+            // components without a local env simply have nothing to cache
+            return [];
+        }
+    }
+}
+exports.VaultManager = VaultManager;
+/**
+ * the cache hierarchy as a flat map of raw secret variable names
+ * (null values = recorded misses)
+ */
+const flattenSecrets = (secrets) => Object.fromEntries(Object.entries(secrets).flatMap(([env, components]) => Object.entries(components).flatMap(([componentName, values]) => Object.entries(values).map(([key, value]) => [
+    (0, pipeline_1.getSecretVarName)(env, componentName, key),
+    value,
+]))));
+/**
+ * only actual values — recorded misses stay unresolved, like any other
+ * unset variable
+ */
+const withoutMisses = (known) => Object.fromEntries(Object.entries(known).filter((entry) => entry[1] !== null));
+//# sourceMappingURL=VaultManager.js.map

package/dist/apps/cli/src/vault/VaultManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VaultManager.js","sourceRoot":"","sources":["../../../../../src/vault/VaultManager.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAE7B,qDAAkD;AAElD,mCAIiB;AACjB,+CAA4C;AAG5C;;;GAGG;AACH,MAAM,UAAU,GAAG,OAAO,CAAC;AAW3B;;;;GAIG;AACH,MAAa,YAAY;IAUvB,YACmB,MAAc,EAC/B,UAA+B,EAAE;;QADhB,WAAM,GAAN,MAAM,CAAQ;QAJjC,4DAA4D;QACpD,cAAS,GAAG,KAAK,CAAC;QAMxB,IAAI,CAAC,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC;QACnC,IAAI,CAAC,EAAE,GAAG,MAAA,OAAO,CAAC,EAAE,mCAAI,IAAI,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW;;QACjB,MAAM,WAAW,GAAG,IAAA,yBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,IAAI,yBAAW,EAAE,CAAC;YAC3B,KAAK,WAAW;gBACd,OAAO,IAAI,+BAAc,CACvB,IAAI,CAAC,MAAM,EACX,WAAW;gBACX,6DAA6D;gBAC7D,4DAA4D;gBAC5D,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;oBAC/C,CAAC,MAAA,MAAA,IAAI,CAAC,EAAE,0CAAE,WAAW,mCAAI,IAAI,CAAC,CACjC,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,aAAuB,EACvB,KAAgB,IAAI,CAAC,EAAE;QAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAA,wBAAgB,GAAE,CAAC;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,KAAK,GACT,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,MAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,sEAAsE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,kDAAkD,OAAO,CAAC,MAAM,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,IAAA,yBAAiB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,aAAqB,EACrB,OAAgC,EAChC,KAAgB,IAAI,CAAC,EAAE;QAEvB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAA,0BAAkB,EACtB,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,GAAG,EACH,aAAa,EACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5C,GAAG;gBACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC1D,CAAC,CACH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmC;QAEnC,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAA2B,EAAE;;gBAAC,OAAA;oBACzC,GAAG;oBACH,oDAAoD;oBACpD,MAAA,WAAW,CAAC,IAAA,2BAAgB,EAAC,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,mCAAI,IAAI;iBACtE,CAAA;aAAA,CAAC,CACH,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC;gBAC7D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa;gBACb,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,WAAM,CAAC;YACP,8DAA8D;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAjJD,oCAiJC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAG,CACrB,OAAsB,EACS,EAAE,CACjC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3C,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC;IACzC,KAAK;CACN,CAAC,CACH,CACF,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,KAAoC,EACZ,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CACxD,CACF,CAAC"}

package/dist/apps/cli/src/vault/bw.d.ts

@@ -0,0 +1,13 @@
+import type { IO } from "../core/types";
+/**
+ * a working bw session: reuses the cached one, otherwise unlocks (or
+ * logs in) interactively — unless prompting is disabled
+ */
+export declare const getBwSession: (io: IO | null, { allowPrompt }: {
+    allowPrompt: boolean;
+}) => Promise<string>;
+/**
+ * runs a bw command with the given session and returns stdout
+ */
+export declare const runBw: (session: string, args: string[]) => Promise<string>;
+export declare const runBwJson: <T>(session: string, args: string[]) => Promise<T>;

package/dist/apps/cli/src/vault/bw.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runBwJson = exports.runBw = exports.getBwSession = void 0;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const preferences_1 = require("../utils/preferences");
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+const SESSION_PREFERENCE = "bwsession";
+class BitwardenLockedError extends Error {
+    constructor() {
+        super("bitwarden is locked and prompting is disabled — run `bw unlock` or catenv without --vault-mode no-prompt");
+    }
+}
+/**
+ * runs an interactive bw command that prints a session key on stdout
+ * (login/unlock) while the user types the password on the terminal
+ */
+const interactiveSessionCommand = (args) => new Promise((resolve, reject) => {
+    var _a;
+    const child = (0, child_process_1.spawn)("bw", [...args, "--raw"], {
+        stdio: ["inherit", "pipe", "inherit"],
+    });
+    let session = "";
+    (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on("data", (data) => (session += data.toString("utf-8")));
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 && session.trim()
+        ? resolve(session.trim())
+        : reject(new Error(`bw ${args[0]} failed`)));
+});
+const getBwStatus = async (session) => {
+    try {
+        const { stdout } = await execFile("bw", ["status"], {
+            env: { ...process.env, ...(session ? { BW_SESSION: session } : {}) },
+        });
+        return JSON.parse(stdout).status;
+    }
+    catch (_a) {
+        return "unauthenticated";
+    }
+};
+/**
+ * a working bw session: reuses the cached one, otherwise unlocks (or
+ * logs in) interactively — unless prompting is disabled
+ */
+const getBwSession = async (io, { allowPrompt }) => {
+    const cached = (await (0, preferences_1.hasPreference)(SESSION_PREFERENCE))
+        ? String(await (0, preferences_1.getPreference)(SESSION_PREFERENCE))
+        : null;
+    const status = await getBwStatus(cached);
+    if (status === "unlocked" && cached) {
+        return cached;
+    }
+    if (!allowPrompt) {
+        throw new BitwardenLockedError();
+    }
+    io === null || io === void 0 ? void 0 : io.log("");
+    io === null || io === void 0 ? void 0 : io.log(status === "unauthenticated"
+        ? "# Please login to Bitwarden:"
+        : "# Bitwarden is locked, please unlock:");
+    io === null || io === void 0 ? void 0 : io.log("");
+    const session = await interactiveSessionCommand([
+        status === "unauthenticated" ? "login" : "unlock",
+    ]);
+    await (0, preferences_1.setPreference)(SESSION_PREFERENCE, session);
+    await (0, exports.runBw)(session, ["sync"]);
+    return session;
+};
+exports.getBwSession = getBwSession;
+/**
+ * runs a bw command with the given session and returns stdout
+ */
+const runBw = async (session, args) => {
+    const { stdout } = await execFile("bw", [...args, "--raw", "--nointeraction"], {
+        env: { ...process.env, BW_SESSION: session },
+        maxBuffer: 50 * 1024 * 1024,
+    });
+    return stdout;
+};
+exports.runBw = runBw;
+const runBwJson = async (session, args) => JSON.parse(await (0, exports.runBw)(session, args));
+exports.runBwJson = runBwJson;
+//# sourceMappingURL=bw.js.map

package/dist/apps/cli/src/vault/bw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bw.js","sourceRoot":"","sources":["../../../../../src/vault/bw.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,sDAI8B;AAE9B,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,oBAAqB,SAAQ,KAAK;IACtC;QACE,KAAK,CACH,0GAA0G,CAC3G,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAG,CAAC,IAAc,EAAmB,EAAE,CACpE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IAC9B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;QAC5C,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,KAAK,EACvB,OAAsB,EAC8B,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YAClD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,EAAE,WAAW,EAA4B,EACxB,EAAE;IACnB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,MAAM,KAAK,iBAAiB;QAC1B,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,uCAAuC,CAC5C,CAAC;IACF,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC,CAAC;IACH,MAAM,IAAA,2BAAa,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA7BW,QAAA,YAAY,gBA6BvB;AAEF;;GAEG;AACI,MAAM,KAAK,GAAG,KAAK,EACxB,OAAe,EACf,IAAc,EACG,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAC/B,IAAI,EACJ,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,EACrC;QACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE;QAC5C,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAbW,QAAA,KAAK,SAahB;AAEK,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAe,EACf,IAAc,EACF,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAH3C,QAAA,SAAS,aAGkC"}

package/dist/apps/cli/src/vault/cache.d.ts

@@ -0,0 +1,38 @@
+/**
+ * hierarchical: env -> componentName -> key -> value.
+ * Only the "local" env is ever cached — other envs' secrets have no
+ * business sitting on developer machines.
+ *
+ * `null` records a declared secret that was absent in the vault at the
+ * last refresh (e.g. deploy credentials that intentionally don't exist
+ * for local) — a known miss, so it doesn't force re-contacting the
+ * vault on every run.
+ */
+export type CachedSecrets = {
+    [env: string]: {
+        [componentName: string]: {
+            [key: string]: string | null;
+        };
+    };
+};
+/**
+ * local, project-scoped cache of the vault secrets, so that frequent
+ * catenv runs don't have to contact the vault (e.g. unlock bitwarden)
+ * every time. Plaintext — like the .env files catenv writes anyway —
+ * but never committed (the folder ignores itself).
+ */
+type SecretsCache = {
+    /** the vault this cache was filled from */
+    vaultId: string;
+    updatedAt: string;
+    secrets: CachedSecrets;
+};
+export declare const readSecretsCache: () => Promise<SecretsCache | null>;
+export declare const writeSecretsCache: (vaultId: string, secrets: CachedSecrets) => Promise<void>;
+/**
+ * merges freshly written secrets of one env/component into the cache
+ * (write-through from config-secrets), so the next catenv run doesn't
+ * need the vault
+ */
+export declare const updateSecretsCache: (vaultId: string, env: string, componentName: string, values: Record<string, string>) => Promise<void>;
+export {};

package/dist/apps/cli/src/vault/cache.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateSecretsCache = exports.writeSecretsCache = exports.readSecretsCache = void 0;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const gitProjectInformation_1 = require("../git/gitProjectInformation");
+const getCacheFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder");
+const getCachePath = async () => (0, path_1.join)(await getCacheFolder(), "secrets.json");
+const readSecretsCache = async () => {
+    try {
+        return JSON.parse(await (0, promises_1.readFile)(await getCachePath(), "utf-8"));
+    }
+    catch (_a) {
+        return null;
+    }
+};
+exports.readSecretsCache = readSecretsCache;
+const writeSecretsCache = async (vaultId, secrets) => {
+    const folder = await getCacheFolder();
+    await (0, promises_1.mkdir)(folder, { recursive: true });
+    // the folder ignores itself, so the cache can never be committed
+    await (0, promises_1.writeFile)((0, path_1.join)(folder, ".gitignore"), "*\n");
+    const cache = {
+        vaultId,
+        updatedAt: new Date().toISOString(),
+        secrets,
+    };
+    await (0, promises_1.writeFile)(await getCachePath(), JSON.stringify(cache, null, 2));
+};
+exports.writeSecretsCache = writeSecretsCache;
+/**
+ * merges freshly written secrets of one env/component into the cache
+ * (write-through from config-secrets), so the next catenv run doesn't
+ * need the vault
+ */
+const updateSecretsCache = async (vaultId, env, componentName, values) => {
+    var _a;
+    const existing = await (0, exports.readSecretsCache)();
+    const secrets = (existing === null || existing === void 0 ? void 0 : existing.vaultId) === vaultId ? existing.secrets : {};
+    secrets[env] = {
+        ...secrets[env],
+        [componentName]: { ...(_a = secrets[env]) === null || _a === void 0 ? void 0 : _a[componentName], ...values },
+    };
+    await (0, exports.writeSecretsCache)(vaultId, secrets);
+};
+exports.updateSecretsCache = updateSecretsCache;
+//# sourceMappingURL=cache.js.map

package/dist/apps/cli/src/vault/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../../../src/vault/cache.ts"],"names":[],"mappings":";;;AAAA,0CAAyD;AACzD,+BAA4B;AAC5B,wEAAkE;AA6BlE,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,IAAA,WAAI,EAAC,MAAM,IAAA,0CAAkB,GAAE,EAAE,YAAY,CAAC,CAAC;AAEjD,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC,IAAA,WAAI,EAAC,MAAM,cAAc,EAAE,EAAE,cAAc,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,KAAK,IAAkC,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,MAAM,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AANW,QAAA,gBAAgB,oBAM3B;AAEK,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAAe,EACf,OAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,MAAM,IAAA,gBAAK,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,iEAAiE;IACjE,MAAM,IAAA,oBAAS,EAAC,IAAA,WAAI,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAiB;QAC1B,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;KACR,CAAC;IACF,MAAM,IAAA,oBAAS,EAAC,MAAM,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AAdW,QAAA,iBAAiB,qBAc5B;AAEF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAAe,EACf,GAAW,EACX,aAAqB,EACrB,MAA8B,EACf,EAAE;;IACjB,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAC1C,MAAM,OAAO,GACX,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,MAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,GAAG;QACb,GAAG,OAAO,CAAC,GAAG,CAAC;QACf,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,0CAAG,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE;KACjE,CAAC;IACF,MAAM,IAAA,yBAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,CAAC;AAdW,QAAA,kBAAkB,sBAc7B"}

package/dist/apps/cli/src/vault/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./types";
+export * from "./VaultManager";
+export { GitlabVault } from "./GitlabVault";
+export { BitwardenVault } from "./BitwardenVault";
+export { updateSecretsCache } from "./cache";

package/dist/apps/cli/src/vault/index.js

@@ -0,0 +1,26 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateSecretsCache = exports.BitwardenVault = exports.GitlabVault = void 0;
+__exportStar(require("./types"), exports);
+__exportStar(require("./VaultManager"), exports);
+var GitlabVault_1 = require("./GitlabVault");
+Object.defineProperty(exports, "GitlabVault", { enumerable: true, get: function () { return GitlabVault_1.GitlabVault; } });
+var BitwardenVault_1 = require("./BitwardenVault");
+Object.defineProperty(exports, "BitwardenVault", { enumerable: true, get: function () { return BitwardenVault_1.BitwardenVault; } });
+var cache_1 = require("./cache");
+Object.defineProperty(exports, "updateSecretsCache", { enumerable: true, get: function () { return cache_1.updateSecretsCache; } });
+//# sourceMappingURL=index.js.map

package/dist/apps/cli/src/vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/vault/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,iDAA+B;AAC/B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,iCAA6C;AAApC,2GAAA,kBAAkB,OAAA"}

package/dist/apps/cli/src/vault/types.d.ts

@@ -0,0 +1,33 @@
+import type { IO } from "../core/types";
+/**
+ * a secrets vault is the readable source of truth for secret values.
+ * CI backends (gitlab variables, github secrets) only receive mirrored
+ * copies of what is stored here.
+ */
+export type SecretsVault = {
+    /**
+     * identity of the vault (incl. its config), used to invalidate the
+     * local cache when the vault changes
+     */
+    id: string;
+    /**
+     * all secrets as a flat map of raw secret variable names
+     * (CL_<ENV>_<COMPONENT>_<KEY>) to values
+     */
+    readAllSecrets(io: IO | null): Promise<Record<string, string>>;
+    /**
+     * upserts the secrets of one env and component
+     * (keys as declared in the config, not the raw variable names)
+     */
+    writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
+};
+/**
+ * how secret resolution may interact with the vault:
+ * - auto (default): contact the vault when the local cache is
+ *   incomplete, prompting to unlock if necessary
+ * - no-prompt: contact the vault only if that needs no interaction;
+ *   fail on missing secrets instead of prompting to unlock
+ * - offline: never contact the vault, use only the local cache
+ * - refresh: ignore the local cache once and refresh it from the vault
+ */
+export type SecretsMode = "auto" | "no-prompt" | "offline" | "refresh";

package/dist/apps/cli/src/vault/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/apps/cli/src/vault/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/vault/types.ts"],"names":[],"mappings":""}