@catladder/cli 0.0.0-next-4e7c6848 → 0.0.0-next-8b9ad5ca

package/dist/cli/src/vault/VaultManager.js

@@ -0,0 +1,131 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.VaultManager = void 0;
+const pipeline_1 = require("../../../pipeline/src/index.js");
+const BitwardenVault_1 = require("./BitwardenVault");
+const cache_1 = require("./cache");
+const GitlabVault_1 = require("./GitlabVault");
+/**
+ * only secrets of this env are cached locally — the other envs'
+ * secrets have no business sitting on developer machines
+ */
+const CACHED_ENV = "local";
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+class VaultManager {
+  constructor(config, options = {}) {
+    var _a, _b;
+    this.config = config;
+    /** refresh mode bypasses the cache only once per manager */
+    this.refreshed = false;
+    this.mode = (_a = options.mode) !== null && _a !== void 0 ? _a : "auto";
+    this.io = (_b = options.io) !== null && _b !== void 0 ? _b : null;
+    this.vault = this.createVault();
+  }
+  createVault() {
+    const vaultConfig = (0, pipeline_1.getVaultConfig)(this.config);
+    switch (vaultConfig.type) {
+      case "gitlab":
+        return new GitlabVault_1.GitlabVault();
+      case "bitwarden":
+        return new BitwardenVault_1.BitwardenVault(this.config, vaultConfig, this.mode === "auto" || this.mode === "refresh");
+    }
+  }
+  /**
+   * the vault secrets, served from the local cache when it contains
+   * all required names; otherwise (depending on the mode) refreshed
+   * from the vault. Only the "local" env is (re-)cached.
+   */
+  async readSecrets(requiredNames, io = this.io) {
+    const bypassCache = this.mode === "refresh" && !this.refreshed;
+    const cache = bypassCache ? null : await (0, cache_1.readSecretsCache)();
+    // known entries include recorded misses (null values), so declared
+    // but intentionally unset secrets don't force a vault refresh
+    const known = (cache === null || cache === void 0 ? void 0 : cache.vaultId) === this.vault.id ? flattenSecrets(cache.secrets) : undefined;
+    const missing = requiredNames.filter(name => !(name in (known !== null && known !== void 0 ? known : {})));
+    // nothing missing (or nothing required at all): don't touch the vault
+    if (missing.length === 0 && (known || requiredNames.length === 0)) {
+      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    }
+    if (this.mode === "offline") {
+      if (missing.length > 0) {
+        io === null || io === void 0 ? void 0 : io.log(`⚠️ vault is offline (--vault-mode offline) and ${missing.length} secrets are not in the local cache: ${missing.join(", ")}`);
+      }
+      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    }
+    const secrets = await this.vault.readAllSecrets(io);
+    this.refreshed = true;
+    await (0, cache_1.writeSecretsCache)(this.vault.id, await this.cacheableSubset(secrets));
+    return secrets;
+  }
+  /**
+   * writes secrets of one env/component to the vault and updates the
+   * local cache (write-through, "local" env only)
+   */
+  async writeSecrets(env, componentName, secrets, io = this.io) {
+    if (!io) {
+      throw new Error("writing to the vault requires an interactive context");
+    }
+    await this.vault.writeSecrets(io, env, componentName, secrets);
+    if (env === CACHED_ENV) {
+      await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [key, typeof value === "string" ? value : JSON.stringify(value)])));
+    }
+  }
+  /**
+   * the subset of the vault secrets that may be cached: the declared
+   * secrets of the "local" env, per component, as a hierarchy
+   */
+  async cacheableSubset(flatSecrets) {
+    const local = {};
+    for (const componentName of Object.keys(this.config.components)) {
+      const keys = await this.declaredSecretKeys(componentName);
+      const values = Object.fromEntries(keys.map(key => {
+        var _a;
+        return [key,
+        // null records "absent in the vault" (a known miss)
+        (_a = flatSecrets[(0, pipeline_1.getSecretVarName)(CACHED_ENV, componentName, key)]) !== null && _a !== void 0 ? _a : null];
+      }));
+      if (Object.keys(values).length > 0) {
+        local[componentName] = values;
+      }
+    }
+    return Object.keys(local).length > 0 ? {
+      [CACHED_ENV]: local
+    } : {};
+  }
+  async declaredSecretKeys(componentName) {
+    try {
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, pipeline_1.getEnvironment)({
+        config: this.config,
+        componentName,
+        env: CACHED_ENV
+      });
+      return [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys].map(({
+        key
+      }) => key);
+    } catch (_a) {
+      // components without a local env simply have nothing to cache
+      return [];
+    }
+  }
+}
+exports.VaultManager = VaultManager;
+/**
+ * the cache hierarchy as a flat map of raw secret variable names
+ * (null values = recorded misses)
+ */
+const flattenSecrets = secrets => Object.fromEntries(Object.entries(secrets).flatMap(([env, components]) => Object.entries(components).flatMap(([componentName, values]) => Object.entries(values).map(([key, value]) => [(0, pipeline_1.getSecretVarName)(env, componentName, key), value]))));
+/**
+ * only actual values — recorded misses stay unresolved, like any other
+ * unset variable
+ */
+const withoutMisses = known => Object.fromEntries(Object.entries(known).filter(entry => entry[1] !== null));

package/dist/cli/src/vault/VaultManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VaultManager.js","sourceRoot":"","sources":["../../../../src/vault/VaultManager.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAE7B,qDAAkD;AAElD,mCAIiB;AACjB,+CAA4C;AAG5C;;;GAGG;AACH,MAAM,UAAU,GAAG,OAAO,CAAC;AAW3B;;;;GAIG;AACH,MAAa,YAAY;IAUvB,YACmB,MAAc,EAC/B,UAA+B,EAAE;;QADhB,WAAM,GAAN,MAAM,CAAQ;QAJjC,4DAA4D;QACpD,cAAS,GAAG,KAAK,CAAC;QAMxB,IAAI,CAAC,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC;QACnC,IAAI,CAAC,EAAE,GAAG,MAAA,OAAO,CAAC,EAAE,mCAAI,IAAI,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW;QACjB,MAAM,WAAW,GAAG,IAAA,yBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,IAAI,yBAAW,EAAE,CAAC;YAC3B,KAAK,WAAW;gBACd,OAAO,IAAI,+BAAc,CACvB,IAAI,CAAC,MAAM,EACX,WAAW,EACX,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAChD,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,aAAuB,EACvB,KAAgB,IAAI,CAAC,EAAE;QAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAA,wBAAgB,GAAE,CAAC;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,KAAK,GACT,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,MAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,sEAAsE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,kDAAkD,OAAO,CAAC,MAAM,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,IAAA,yBAAiB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,aAAqB,EACrB,OAAgC,EAChC,KAAgB,IAAI,CAAC,EAAE;QAEvB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAA,0BAAkB,EACtB,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,GAAG,EACH,aAAa,EACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5C,GAAG;gBACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC1D,CAAC,CACH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmC;QAEnC,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAA2B,EAAE;;gBAAC,OAAA;oBACzC,GAAG;oBACH,oDAAoD;oBACpD,MAAA,WAAW,CAAC,IAAA,2BAAgB,EAAC,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,mCAAI,IAAI;iBACtE,CAAA;aAAA,CAAC,CACH,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC;gBAC7D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa;gBACb,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,WAAM,CAAC;YACP,8DAA8D;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AA9ID,oCA8IC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAG,CACrB,OAAsB,EACS,EAAE,CACjC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3C,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC;IACzC,KAAK;CACN,CAAC,CACH,CACF,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,KAAoC,EACZ,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CACxD,CACF,CAAC"}

package/dist/cli/src/vault/bw.d.ts

@@ -0,0 +1,15 @@
+import type { IO } from "../core/types";
+/**
+ * a working bw session: reuses the cached one, otherwise unlocks (or
+ * logs in) interactively — unless prompting is disabled
+ */
+export declare const getBwSession: (io: IO | null, {
+  allowPrompt
+}: {
+  allowPrompt: boolean;
+}) => Promise<string>;
+/**
+ * runs a bw command with the given session and returns stdout
+ */
+export declare const runBw: (session: string, args: string[]) => Promise<string>;
+export declare const runBwJson: <T>(session: string, args: string[]) => Promise<T>;

package/dist/cli/src/vault/bw.js

@@ -0,0 +1,89 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.runBwJson = exports.runBw = exports.getBwSession = void 0;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const preferences_1 = require("../utils/preferences");
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+const SESSION_PREFERENCE = "bwsession";
+class BitwardenLockedError extends Error {
+  constructor() {
+    super("bitwarden is locked and prompting is disabled — run `bw unlock` or catenv without --vault-mode no-prompt");
+  }
+}
+/**
+ * runs an interactive bw command that prints a session key on stdout
+ * (login/unlock) while the user types the password on the terminal
+ */
+const interactiveSessionCommand = args => new Promise((resolve, reject) => {
+  var _a;
+  const child = (0, child_process_1.spawn)("bw", [...args, "--raw"], {
+    stdio: ["inherit", "pipe", "inherit"]
+  });
+  let session = "";
+  (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on("data", data => session += data.toString("utf-8"));
+  child.on("error", reject);
+  child.on("close", code => code === 0 && session.trim() ? resolve(session.trim()) : reject(new Error(`bw ${args[0]} failed`)));
+});
+const getBwStatus = async session => {
+  try {
+    const {
+      stdout
+    } = await execFile("bw", ["status"], {
+      env: {
+        ...process.env,
+        ...(session ? {
+          BW_SESSION: session
+        } : {})
+      }
+    });
+    return JSON.parse(stdout).status;
+  } catch (_a) {
+    return "unauthenticated";
+  }
+};
+/**
+ * a working bw session: reuses the cached one, otherwise unlocks (or
+ * logs in) interactively — unless prompting is disabled
+ */
+const getBwSession = async (io, {
+  allowPrompt
+}) => {
+  const cached = (await (0, preferences_1.hasPreference)(SESSION_PREFERENCE)) ? String(await (0, preferences_1.getPreference)(SESSION_PREFERENCE)) : null;
+  const status = await getBwStatus(cached);
+  if (status === "unlocked" && cached) {
+    return cached;
+  }
+  if (!allowPrompt) {
+    throw new BitwardenLockedError();
+  }
+  io === null || io === void 0 ? void 0 : io.log("");
+  io === null || io === void 0 ? void 0 : io.log(status === "unauthenticated" ? "# Please login to Bitwarden:" : "# Bitwarden is locked, please unlock:");
+  io === null || io === void 0 ? void 0 : io.log("");
+  const session = await interactiveSessionCommand([status === "unauthenticated" ? "login" : "unlock"]);
+  await (0, preferences_1.setPreference)(SESSION_PREFERENCE, session);
+  await (0, exports.runBw)(session, ["sync"]);
+  return session;
+};
+exports.getBwSession = getBwSession;
+/**
+ * runs a bw command with the given session and returns stdout
+ */
+const runBw = async (session, args) => {
+  const {
+    stdout
+  } = await execFile("bw", [...args, "--raw", "--nointeraction"], {
+    env: {
+      ...process.env,
+      BW_SESSION: session
+    },
+    maxBuffer: 50 * 1024 * 1024
+  });
+  return stdout;
+};
+exports.runBw = runBw;
+const runBwJson = async (session, args) => JSON.parse(await (0, exports.runBw)(session, args));
+exports.runBwJson = runBwJson;

package/dist/cli/src/vault/bw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bw.js","sourceRoot":"","sources":["../../../../src/vault/bw.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,sDAI8B;AAE9B,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,oBAAqB,SAAQ,KAAK;IACtC;QACE,KAAK,CACH,0GAA0G,CAC3G,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAG,CAAC,IAAc,EAAmB,EAAE,CACpE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IAC9B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;QAC5C,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,KAAK,EACvB,OAAsB,EAC8B,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YAClD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,EAAE,WAAW,EAA4B,EACxB,EAAE;IACnB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,MAAM,KAAK,iBAAiB;QAC1B,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,uCAAuC,CAC5C,CAAC;IACF,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC,CAAC;IACH,MAAM,IAAA,2BAAa,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA7BW,QAAA,YAAY,gBA6BvB;AAEF;;GAEG;AACI,MAAM,KAAK,GAAG,KAAK,EACxB,OAAe,EACf,IAAc,EACG,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAC/B,IAAI,EACJ,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,EACrC;QACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE;QAC5C,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAbW,QAAA,KAAK,SAahB;AAEK,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAe,EACf,IAAc,EACF,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAH3C,QAAA,SAAS,aAGkC"}

package/dist/cli/src/vault/cache.d.ts

@@ -0,0 +1,38 @@
+/**
+ * hierarchical: env -> componentName -> key -> value.
+ * Only the "local" env is ever cached — other envs' secrets have no
+ * business sitting on developer machines.
+ *
+ * `null` records a declared secret that was absent in the vault at the
+ * last refresh (e.g. deploy credentials that intentionally don't exist
+ * for local) — a known miss, so it doesn't force re-contacting the
+ * vault on every run.
+ */
+export type CachedSecrets = {
+  [env: string]: {
+    [componentName: string]: {
+      [key: string]: string | null;
+    };
+  };
+};
+/**
+ * local, project-scoped cache of the vault secrets, so that frequent
+ * catenv runs don't have to contact the vault (e.g. unlock bitwarden)
+ * every time. Plaintext — like the .env files catenv writes anyway —
+ * but never committed (the folder ignores itself).
+ */
+type SecretsCache = {
+  /** the vault this cache was filled from */
+  vaultId: string;
+  updatedAt: string;
+  secrets: CachedSecrets;
+};
+export declare const readSecretsCache: () => Promise<SecretsCache | null>;
+export declare const writeSecretsCache: (vaultId: string, secrets: CachedSecrets) => Promise<void>;
+/**
+ * merges freshly written secrets of one env/component into the cache
+ * (write-through from config-secrets), so the next catenv run doesn't
+ * need the vault
+ */
+export declare const updateSecretsCache: (vaultId: string, env: string, componentName: string, values: Record<string, string>) => Promise<void>;
+export {};

package/dist/cli/src/vault/cache.js

@@ -0,0 +1,53 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.updateSecretsCache = exports.writeSecretsCache = exports.readSecretsCache = void 0;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const gitProjectInformation_1 = require("../git/gitProjectInformation");
+const getCacheFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder");
+const getCachePath = async () => (0, path_1.join)(await getCacheFolder(), "secrets.json");
+const readSecretsCache = async () => {
+  try {
+    return JSON.parse(await (0, promises_1.readFile)(await getCachePath(), "utf-8"));
+  } catch (_a) {
+    return null;
+  }
+};
+exports.readSecretsCache = readSecretsCache;
+const writeSecretsCache = async (vaultId, secrets) => {
+  const folder = await getCacheFolder();
+  await (0, promises_1.mkdir)(folder, {
+    recursive: true
+  });
+  // the folder ignores itself, so the cache can never be committed
+  await (0, promises_1.writeFile)((0, path_1.join)(folder, ".gitignore"), "*\n");
+  const cache = {
+    vaultId,
+    updatedAt: new Date().toISOString(),
+    secrets
+  };
+  await (0, promises_1.writeFile)(await getCachePath(), JSON.stringify(cache, null, 2));
+};
+exports.writeSecretsCache = writeSecretsCache;
+/**
+ * merges freshly written secrets of one env/component into the cache
+ * (write-through from config-secrets), so the next catenv run doesn't
+ * need the vault
+ */
+const updateSecretsCache = async (vaultId, env, componentName, values) => {
+  var _a;
+  const existing = await (0, exports.readSecretsCache)();
+  const secrets = (existing === null || existing === void 0 ? void 0 : existing.vaultId) === vaultId ? existing.secrets : {};
+  secrets[env] = {
+    ...secrets[env],
+    [componentName]: {
+      ...((_a = secrets[env]) === null || _a === void 0 ? void 0 : _a[componentName]),
+      ...values
+    }
+  };
+  await (0, exports.writeSecretsCache)(vaultId, secrets);
+};
+exports.updateSecretsCache = updateSecretsCache;

package/dist/cli/src/vault/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../../src/vault/cache.ts"],"names":[],"mappings":";;;AAAA,0CAAyD;AACzD,+BAA4B;AAC5B,wEAAkE;AA6BlE,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,IAAA,WAAI,EAAC,MAAM,IAAA,0CAAkB,GAAE,EAAE,YAAY,CAAC,CAAC;AAEjD,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC,IAAA,WAAI,EAAC,MAAM,cAAc,EAAE,EAAE,cAAc,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,KAAK,IAAkC,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,MAAM,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AANW,QAAA,gBAAgB,oBAM3B;AAEK,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAAe,EACf,OAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,MAAM,IAAA,gBAAK,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,iEAAiE;IACjE,MAAM,IAAA,oBAAS,EAAC,IAAA,WAAI,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAiB;QAC1B,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;KACR,CAAC;IACF,MAAM,IAAA,oBAAS,EAAC,MAAM,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AAdW,QAAA,iBAAiB,qBAc5B;AAEF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAAe,EACf,GAAW,EACX,aAAqB,EACrB,MAA8B,EACf,EAAE;;IACjB,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAC1C,MAAM,OAAO,GACX,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,MAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,GAAG;QACb,GAAG,OAAO,CAAC,GAAG,CAAC;QACf,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,0CAAG,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE;KACjE,CAAC;IACF,MAAM,IAAA,yBAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,CAAC;AAdW,QAAA,kBAAkB,sBAc7B"}

package/dist/cli/src/vault/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./types";
+export * from "./VaultManager";
+export { GitlabVault } from "./GitlabVault";
+export { BitwardenVault } from "./BitwardenVault";
+export { updateSecretsCache } from "./cache";

package/dist/cli/src/vault/index.js

@@ -0,0 +1,48 @@
+"use strict";
+
+var __createBinding = this && this.__createBinding || (Object.create ? function (o, m, k, k2) {
+  if (k2 === undefined) k2 = k;
+  var desc = Object.getOwnPropertyDescriptor(m, k);
+  if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+    desc = {
+      enumerable: true,
+      get: function () {
+        return m[k];
+      }
+    };
+  }
+  Object.defineProperty(o, k2, desc);
+} : function (o, m, k, k2) {
+  if (k2 === undefined) k2 = k;
+  o[k2] = m[k];
+});
+var __exportStar = this && this.__exportStar || function (m, exports) {
+  for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.updateSecretsCache = exports.BitwardenVault = exports.GitlabVault = void 0;
+__exportStar(require("./types"), exports);
+__exportStar(require("./VaultManager"), exports);
+var GitlabVault_1 = require("./GitlabVault");
+Object.defineProperty(exports, "GitlabVault", {
+  enumerable: true,
+  get: function () {
+    return GitlabVault_1.GitlabVault;
+  }
+});
+var BitwardenVault_1 = require("./BitwardenVault");
+Object.defineProperty(exports, "BitwardenVault", {
+  enumerable: true,
+  get: function () {
+    return BitwardenVault_1.BitwardenVault;
+  }
+});
+var cache_1 = require("./cache");
+Object.defineProperty(exports, "updateSecretsCache", {
+  enumerable: true,
+  get: function () {
+    return cache_1.updateSecretsCache;
+  }
+});

package/dist/cli/src/vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/vault/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,iDAA+B;AAC/B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,iCAA6C;AAApC,2GAAA,kBAAkB,OAAA"}

package/dist/cli/src/vault/types.d.ts

@@ -0,0 +1,33 @@
+import type { IO } from "../core/types";
+/**
+ * a secrets vault is the readable source of truth for secret values.
+ * CI backends (gitlab variables, github secrets) only receive mirrored
+ * copies of what is stored here.
+ */
+export type SecretsVault = {
+  /**
+   * identity of the vault (incl. its config), used to invalidate the
+   * local cache when the vault changes
+   */
+  id: string;
+  /**
+   * all secrets as a flat map of raw secret variable names
+   * (CL_<ENV>_<COMPONENT>_<KEY>) to values
+   */
+  readAllSecrets(io: IO | null): Promise<Record<string, string>>;
+  /**
+   * upserts the secrets of one env and component
+   * (keys as declared in the config, not the raw variable names)
+   */
+  writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
+};
+/**
+ * how secret resolution may interact with the vault:
+ * - auto (default): contact the vault when the local cache is
+ *   incomplete, prompting to unlock if necessary
+ * - no-prompt: contact the vault only if that needs no interaction;
+ *   fail on missing secrets instead of prompting to unlock
+ * - offline: never contact the vault, use only the local cache
+ * - refresh: ignore the local cache once and refresh it from the vault
+ */
+export type SecretsMode = "auto" | "no-prompt" | "offline" | "refresh";

package/dist/cli/src/vault/types.js

@@ -0,0 +1,5 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});

package/dist/cli/src/vault/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/vault/types.ts"],"names":[],"mappings":""}

package/dist/pipeline/src/backends/index.d.ts

@@ -1,9 +1,25 @@
-import type { Config, PipelineType } from "../types";
+import type { Config, PipelineOutputOptions, PipelineType, SecretsVaultConfig } from "../types";
 import type { PipelineBackend } from "./types";
 export * from "./types";
 export * from "./gitlab";
 export * from "./github";
 export declare const getPipelineBackend: (type: PipelineType) => PipelineBackend;
+/**
+ * the options of an enabled pipeline type (empty object when enabled
+ * with `true`)
+ */
+export declare const getPipelineOptions: (config: Config, type: PipelineType) => PipelineOutputOptions;
+/**
+ * the git remote pointing to the repository of this pipeline type's CI
+ * system (e.g. during a migration, gitlab may be `origin` and github a
+ * second remote)
+ */
+export declare const getPipelineGitRemote: (config: Config, type: PipelineType) => string;
+/**
+ * the normalized secrets vault of a config (string shorthands resolved
+ * to their object form; defaults to the legacy gitlab store)
+ */
+export declare const getVaultConfig: (config: Config) => Exclude<SecretsVaultConfig, string>;
 /**
  * the pipeline types enabled for this config. Multiple types can be
  * enabled at once (parallel generation, e.g. during a CI migration).

package/dist/pipeline/src/backends/index.js

@@ -22,7 +22,7 @@ var __exportStar = this && this.__exportStar || function (m, exports) {
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.getEnabledPipelineTypes = exports.getPipelineBackend = void 0;
+exports.getEnabledPipelineTypes = exports.getVaultConfig = exports.getPipelineGitRemote = exports.getPipelineOptions = exports.getPipelineBackend = void 0;
 const github_1 = require("./github");
 const gitlab_1 = require("./gitlab");
 __exportStar(require("./types"), exports);
@@ -40,6 +40,38 @@ const getPipelineBackend = type => {
   return createBackend();
 };
 exports.getPipelineBackend = getPipelineBackend;
+/**
+ * the options of an enabled pipeline type (empty object when enabled
+ * with `true`)
+ */
+const getPipelineOptions = (config, type) => {
+  var _a;
+  const value = (_a = config.pipelines) === null || _a === void 0 ? void 0 : _a[type];
+  return typeof value === "object" ? value : {};
+};
+exports.getPipelineOptions = getPipelineOptions;
+/**
+ * the git remote pointing to the repository of this pipeline type's CI
+ * system (e.g. during a migration, gitlab may be `origin` and github a
+ * second remote)
+ */
+const getPipelineGitRemote = (config, type) => {
+  var _a;
+  return (_a = (0, exports.getPipelineOptions)(config, type).gitRemote) !== null && _a !== void 0 ? _a : "origin";
+};
+exports.getPipelineGitRemote = getPipelineGitRemote;
+/**
+ * the normalized secrets vault of a config (string shorthands resolved
+ * to their object form; defaults to the legacy gitlab store)
+ */
+const getVaultConfig = config => {
+  var _a, _b;
+  const vault = (_b = (_a = config.secrets) === null || _a === void 0 ? void 0 : _a.vault) !== null && _b !== void 0 ? _b : "gitlab";
+  return typeof vault === "string" ? {
+    type: vault
+  } : vault;
+};
+exports.getVaultConfig = getVaultConfig;
 /**
  * the pipeline types enabled for this config. Multiple types can be
  * enabled at once (parallel generation, e.g. during a CI migration).

package/dist/pipeline/src/backends/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../pipeline/src/backends/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AACA,qCAAyC;AACzC,qCAAyC;AAGzC,0CAAwB;AACxB,2CAAyB;AACzB,2CAAyB;AAEzB,MAAM,QAAQ,GAAmD;IAC/D,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAa,EAAE;IACjC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAa,EAAE;CAClC,CAAC;AAEK,MAAM,kBAAkB,GAAG,CAAC,IAAkB,EAAmB,EAAE;IACxE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AANW,QAAA,kBAAkB,sBAM7B;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAkB,EAAE;;IACxE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,OAAO,GAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAoB,CAAC,MAAM,CAC9D,CAAC,IAAI,EAAE,EAAE,WAAC,OAAA,MAAA,MAAM,CAAC,SAAS,0CAAG,IAAI,CAAC,CAAA,EAAA,CACnC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,MAAA,MAAM,CAAC,YAAY,mCAAI,QAAQ,CAAC,CAAC;AAC3C,CAAC,CAAC;AAbW,QAAA,uBAAuB,2BAalC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../pipeline/src/backends/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAMA,qCAAyC;AACzC,qCAAyC;AAGzC,0CAAwB;AACxB,2CAAyB;AACzB,2CAAyB;AAEzB,MAAM,QAAQ,GAAmD;IAC/D,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAa,EAAE;IACjC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,sBAAa,EAAE;CAClC,CAAC;AAEK,MAAM,kBAAkB,GAAG,CAAC,IAAkB,EAAmB,EAAE;IACxE,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC,CAAC;AANW,QAAA,kBAAkB,sBAM7B;AAEF;;;GAGG;AACI,MAAM,kBAAkB,GAAG,CAChC,MAAc,EACd,IAAkB,EACK,EAAE;;IACzB,MAAM,KAAK,GAAG,MAAA,MAAM,CAAC,SAAS,0CAAG,IAAI,CAAC,CAAC;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC,CAAC;AANW,QAAA,kBAAkB,sBAM7B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,IAAkB,EACV,EAAE,WAAC,OAAA,MAAA,IAAA,0BAAkB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,mCAAI,QAAQ,CAAA,EAAA,CAAC;AAHvD,QAAA,oBAAoB,wBAGmC;AAEpE;;;GAGG;AACI,MAAM,cAAc,GAAG,CAC5B,MAAc,EACuB,EAAE;;IACvC,MAAM,KAAK,GAAG,MAAA,MAAA,MAAM,CAAC,OAAO,0CAAE,KAAK,mCAAI,QAAQ,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC,CAAC;AALW,QAAA,cAAc,kBAKzB;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAAkB,EAAE;;IACxE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,OAAO,GAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAoB,CAAC,MAAM,CAC9D,CAAC,IAAI,EAAE,EAAE,WAAC,OAAA,MAAA,MAAM,CAAC,SAAS,0CAAG,IAAI,CAAC,CAAA,EAAA,CACnC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,MAAA,MAAM,CAAC,YAAY,mCAAI,QAAQ,CAAC,CAAC;AAC3C,CAAC,CAAC;AAbW,QAAA,uBAAuB,2BAalC"}

package/dist/pipeline/src/constants.js

@@ -4,5 +4,5 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-4e7c6848" || "latest";
+exports.PIPELINE_IMAGE_TAG = "next-8b9ad5ca" || "latest";
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || "git.panter.ch:5001/catladder/catladder";

package/dist/pipeline/src/deploy/cloudRun/index.js

@@ -55,13 +55,15 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
     }
     return {};
   },
-  additionalSecretKeys: ctx => [{
+  additionalSecretKeys: ctx => [
+  // deploy-time credentials don't exist for the local env
+  ...(ctx.envType !== "local" ? [{
     key: exports.GCLOUD_DEPLOY_CREDENTIALS_KEY,
     hidden: true
   }, {
     key: exports.GCLOUD_RUN_CANONICAL_HOST_SUFFIX,
     hidden: true
-  }, ...(ctx.deployConfigRaw && ctx.deployConfigRaw.cloudSql ? [{
+  }] : []), ...(ctx.deployConfigRaw && ctx.deployConfigRaw.cloudSql ? [{
     key: "DB_PASSWORD"
   }] : [])],
   getAdditionalEnvVars: ctx => {
@@ -69,7 +71,8 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
       fullName,
       env,
       componentName,
-      deployConfigRaw
+      deployConfigRaw,
+      envType
     } = ctx;
     const HOSTNAME_INTERNAL = (0, BashExpression_1.joinBashExpressions)([fullName, (0, BashExpression_1.getBashVariable)((0, context_1.getSecretVarName)(env, componentName, exports.GCLOUD_RUN_CANONICAL_HOST_SUFFIX))], "-").toLowerCase();
     const jobTriggers = deployConfigRaw && deployConfigRaw.jobs ? Object.fromEntries(Object.entries(deployConfigRaw.jobs).filter(([name, job]) => Boolean(job)).map(([name, job]) => ["CLOUD_RUN_JOB_TRIGGER_URL_" + (0, gitlab_1.sanitizeForBashVariable)(name), (0, cloudRunExecutionUrl_1.getCloudRunJobExecuteUrl)(name, {
@@ -78,7 +81,11 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
       region: deployConfigRaw.region
     })])) : {};
     return {
-      HOSTNAME_INTERNAL,
+      // references the canonical host suffix secret, which doesn't
+      // exist for the local env
+      ...(envType !== "local" ? {
+        HOSTNAME_INTERNAL
+      } : {}),
       ...getCloudSqlVariables(ctx),
       ...jobTriggers,
       DEPLOY_CLOUD_RUN_SERVICE_NAME: (0, getServiceName_1.getServiceNameForEnvContext)(ctx),

package/dist/pipeline/src/deploy/cloudRun/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../pipeline/src/deploy/cloudRun/index.ts"],"names":[],"mappings":";;;AACA,8DAGmC;AAEnC,2CAAiD;AAEjD,+CAA6D;AAC7D,6CAAkD;AAClD,6CAA8D;AAC9D,uEAAwE;AACxE,+CAI0B;AAC1B,2DAAqE;AAExD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,4HAA4H;AAC/G,QAAA,gCAAgC,GAC3C,gCAAgC,CAAC;AAEnC,MAAM,oBAAoB,GAAG,CAAC,EAC5B,eAAe,EACf,qBAAqB,EACrB,GAAG,EACH,aAAa,EACb,UAAU,GAC4C,EAAE,EAAE;;IAC1D,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAC3B,eAAe,CAAC,QAAQ,EACxB,UAAU,EACV,qBAAqB,EACrB,aAAa,CACd,CAAC;QAEF,MAAM,2BAA2B,GAAG,MAAM,CAAC,OAAO,CAChD,MAAA,eAAe,CAAC,QAAQ,CAAC,uBAAuB,mCAAI,EAAE,CACvD;aACE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG;YACb,kCAAkC,EAChC,eAAe,CAAC,QAAQ,CAAC,sBAAsB;YACjD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAA,eAAe,CAAC,QAAQ,CAAC,MAAM,mCAAI,UAAU;YACtD,WAAW,EAAE,GAAG,GAAG,IAAA,0BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC;SACvE,CAAC;QACF,OAAO;YACL,GAAG,MAAM;YACT,YAAY,EAAE,IAAA,sCAA2B,EACvC,eAAe,CAAC,QAAQ,EACxB,MAAM,CACP,CAAC,MAAM,CAAC,2BAA2B,CAAC;YACrC,iBAAiB,EAAE,IAAA,6BAAkB,EACnC,MAAM,EACN,MAAA,eAAe,CAAC,QAAQ,CAAC,+BAA+B,mCACtD,oCAAyB,CAC5B;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AACW,QAAA,sBAAsB,GACjC;IACE,IAAI,EAAE,2CAA8B;IACpC,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO;gBACL,QAAQ,EAAE;oBACR,oBAAoB,EAAE,OAAO,KAAK,QAAQ;iBAC3C;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7B;YACE,GAAG,EAAE,qCAA6B;YAClC,MAAM,EAAE,IAAI;SACb;QACD;YACE,GAAG,EAAE,wCAAgC;YACrC,MAAM,EAAE,IAAI;SACb;QACD,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ;YACrD,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC;KACR;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC;QAE9D,MAAM,iBAAiB,GAAG,IAAA,oCAAmB,EAC3C;YACE,QAAQ;YACR,IAAA,gCAAe,EACb,IAAA,0BAAgB,EACd,GAAG,EACH,aAAa,EACb,wCAAgC,CACjC,CACF;SACF,EACD,GAAG,CACJ,CAAC,WAAW,EAAE,CAAC;QAChB,MAAM,WAAW,GACf,eAAe,IAAI,eAAe,CAAC,IAAI;YACrC,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;iBACjC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;gBACpB,4BAA4B,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC;gBAC5D,IAAA,+CAAwB,EAAC,IAAI,EAAE;oBAC7B,WAAW,EAAE,QAAQ;oBACrB,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B,CAAC;aACH,CAAC,CACL;YACH,CAAC,CAAC,EAAE,CAAC;QAET,OAAO;YACL,iBAAiB;YACjB,GAAG,oBAAoB,CAAC,GAAG,CAAC;YAC5B,GAAG,WAAW;YACd,6BAA6B,EAAE,IAAA,4CAA2B,EAAC,GAAG,CAAC;YAC/D,2BAA2B,EAAE,eAAe;gBAC1C,CAAC,CAAC,eAAe,CAAC,SAAS;gBAC3B,CAAC,CAAC,SAAS;YACb,uBAAuB,EAAE,eAAe;gBACtC,CAAC,CAAC,eAAe,CAAC,MAAM;gBACxB,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../pipeline/src/deploy/cloudRun/index.ts"],"names":[],"mappings":";;;AACA,8DAGmC;AAEnC,2CAAiD;AAEjD,+CAA6D;AAC7D,6CAAkD;AAClD,6CAA8D;AAC9D,uEAAwE;AACxE,+CAI0B;AAC1B,2DAAqE;AAExD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,4HAA4H;AAC/G,QAAA,gCAAgC,GAC3C,gCAAgC,CAAC;AAEnC,MAAM,oBAAoB,GAAG,CAAC,EAC5B,eAAe,EACf,qBAAqB,EACrB,GAAG,EACH,aAAa,EACb,UAAU,GAC4C,EAAE,EAAE;;IAC1D,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAA,qBAAa,EAC3B,eAAe,CAAC,QAAQ,EACxB,UAAU,EACV,qBAAqB,EACrB,aAAa,CACd,CAAC;QAEF,MAAM,2BAA2B,GAAG,MAAM,CAAC,OAAO,CAChD,MAAA,eAAe,CAAC,QAAQ,CAAC,uBAAuB,mCAAI,EAAE,CACvD;aACE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,MAAM,MAAM,GAAG;YACb,kCAAkC,EAChC,eAAe,CAAC,QAAQ,CAAC,sBAAsB;YACjD,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,MAAA,eAAe,CAAC,QAAQ,CAAC,MAAM,mCAAI,UAAU;YACtD,WAAW,EAAE,GAAG,GAAG,IAAA,0BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC;SACvE,CAAC;QACF,OAAO;YACL,GAAG,MAAM;YACT,YAAY,EAAE,IAAA,sCAA2B,EACvC,eAAe,CAAC,QAAQ,EACxB,MAAM,CACP,CAAC,MAAM,CAAC,2BAA2B,CAAC;YACrC,iBAAiB,EAAE,IAAA,6BAAkB,EACnC,MAAM,EACN,MAAA,eAAe,CAAC,QAAQ,CAAC,+BAA+B,mCACtD,oCAAyB,CAC5B;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AACW,QAAA,sBAAsB,GACjC;IACE,IAAI,EAAE,2CAA8B;IACpC,QAAQ,EAAE,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,EAAE,EAAE;QACzC,IAAI,eAAe,IAAI,eAAe,CAAC,QAAQ,EAAE,CAAC;YAChD,OAAO;gBACL,QAAQ,EAAE;oBACR,oBAAoB,EAAE,OAAO,KAAK,QAAQ;iBAC3C;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;QAC7B,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO;YACzB,CAAC,CAAC;gBACE;oBACE,GAAG,EAAE,qCAA6B;oBAClC,MAAM,EAAE,IAAI;iBACb;gBACD;oBACE,GAAG,EAAE,wCAAgC;oBACrC,MAAM,EAAE,IAAI;iBACb;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,QAAQ;YACrD,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;YAC1B,CAAC,CAAC,EAAE,CAAC;KACR;IACD,oBAAoB,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAEvE,MAAM,iBAAiB,GAAG,IAAA,oCAAmB,EAC3C;YACE,QAAQ;YACR,IAAA,gCAAe,EACb,IAAA,0BAAgB,EACd,GAAG,EACH,aAAa,EACb,wCAAgC,CACjC,CACF;SACF,EACD,GAAG,CACJ,CAAC,WAAW,EAAE,CAAC;QAChB,MAAM,WAAW,GACf,eAAe,IAAI,eAAe,CAAC,IAAI;YACrC,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC;iBACjC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;iBACrC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;gBACpB,4BAA4B,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC;gBAC5D,IAAA,+CAAwB,EAAC,IAAI,EAAE;oBAC7B,WAAW,EAAE,QAAQ;oBACrB,SAAS,EAAE,eAAe,CAAC,SAAS;oBACpC,MAAM,EAAE,eAAe,CAAC,MAAM;iBAC/B,CAAC;aACH,CAAC,CACL;YACH,CAAC,CAAC,EAAE,CAAC;QAET,OAAO;YACL,6DAA6D;YAC7D,0BAA0B;YAC1B,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,oBAAoB,CAAC,GAAG,CAAC;YAC5B,GAAG,WAAW;YACd,6BAA6B,EAAE,IAAA,4CAA2B,EAAC,GAAG,CAAC;YAC/D,2BAA2B,EAAE,eAAe;gBAC1C,CAAC,CAAC,eAAe,CAAC,SAAS;gBAC3B,CAAC,CAAC,SAAS;YACb,uBAAuB,EAAE,eAAe;gBACtC,CAAC,CAAC,eAAe,CAAC,MAAM;gBACxB,CAAC,CAAC,SAAS;SACd,CAAC;IACJ,CAAC;CACF,CAAC"}