@catladder/cli 0.0.0-next-ace3dbf2 → 0.0.0-next-31a23584

package/dist/apps/cli/src/utils/readStdin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readStdin.js","sourceRoot":"","sources":["../../../../../src/utils/readStdin.ts"],"names":[],"mappings":";;;AAAA,4EAA4E;AACrE,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AANW,QAAA,SAAS,aAMpB"}

package/dist/apps/cli/src/utils/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../../../../src/utils/shell.ts"],"names":[],"mappings":";;;AAAA,iEAA8C;AAEvC,MAAM,QAAQ,GAAG,KAAK,EAAE,SAAiB,EAAE,OAAe,EAAE,EAAE;IACnE,MAAM,OAAO,GAAG,oBAAoB,OAAO,OAAO,SAAS,4BAA4B,CAAC;IACxF,IAAI,CAAC;QACH,MAAM,IAAA,6BAAK,EAAC,OAAO,EAAE;YACnB,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,IAAI;YACX,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,KAAK,EAAE,EAAE;aACV;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,sCAAsC;QACtC,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAjBW,QAAA,QAAQ,YAiBnB"}

package/dist/apps/cli/src/vault/BitwardenVault.d.ts

@@ -0,0 +1,24 @@
+import type { Config } from "../../../../packages/pipeline/src/index.js";
+import type { IO } from "../core/types";
+import type { SecretsVault } from "./types";
+export declare class BitwardenVault implements SecretsVault {
+    private readonly config;
+    /**
+     * whether a locked bitwarden may be unlocked interactively
+     * (false with catenv --vault-mode no-prompt)
+     */
+    private readonly allowPrompt;
+    readonly id: string;
+    private readonly collectionName;
+    constructor(config: Config, options: {
+        collection?: string;
+    }, 
+    /**
+     * whether a locked bitwarden may be unlocked interactively
+     * (false with catenv --vault-mode no-prompt)
+     */
+    allowPrompt: boolean);
+    private session;
+    readAllSecrets(io: IO | null): Promise<Record<string, string>>;
+    writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
+}

package/dist/apps/cli/src/vault/BitwardenVault.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BitwardenVault = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const yaml_1 = require("yaml");
+const bw_1 = require("./bw");
+const DEFAULT_COLLECTION = "catladder";
+const SECURE_NOTE_TYPE = 2;
+/**
+ * one yaml note per env and component:
+ * `<customerName>/<appName>/<env>/<componentName>/secrets.yml`
+ */
+const itemName = (config, env, componentName) => `${config.customerName}/${config.appName}/${env}/${componentName}/secrets.yml`;
+const itemPrefix = (config) => `${config.customerName}/${config.appName}/`;
+/**
+ * parses env and componentName back out of an item name
+ */
+const parseItemName = (config, name) => {
+    const match = name
+        .slice(itemPrefix(config).length)
+        .match(/^([^/]+)\/([^/]+)\/secrets\.yml$/);
+    return match ? { env: match[1], componentName: match[2] } : null;
+};
+const findCollection = async (session, collectionName) => {
+    const collections = await (0, bw_1.runBwJson)(session, [
+        "list",
+        "collections",
+        "--search",
+        collectionName,
+    ]);
+    const collection = collections.find((c) => c.name === collectionName);
+    if (!collection) {
+        throw new Error(`bitwarden collection '${collectionName}' not found — create it and make sure you have access`);
+    }
+    return collection;
+};
+const encodePayload = (payload) => Buffer.from(JSON.stringify(payload), "utf-8").toString("base64");
+class BitwardenVault {
+    constructor(config, options, 
+    /**
+     * whether a locked bitwarden may be unlocked interactively
+     * (false with catenv --vault-mode no-prompt)
+     */
+    allowPrompt) {
+        var _a;
+        this.config = config;
+        this.allowPrompt = allowPrompt;
+        this.collectionName = (_a = options.collection) !== null && _a !== void 0 ? _a : DEFAULT_COLLECTION;
+        this.id = `bitwarden:${this.collectionName}`;
+    }
+    session(io) {
+        return (0, bw_1.getBwSession)(io, { allowPrompt: this.allowPrompt });
+    }
+    async readAllSecrets(io) {
+        const { config, collectionName } = this;
+        const bwSession = await this.session(io);
+        const collection = await findCollection(bwSession, collectionName);
+        const items = await (0, bw_1.runBwJson)(bwSession, [
+            "list",
+            "items",
+            "--collectionid",
+            collection.id,
+        ]);
+        const secrets = {};
+        for (const item of items) {
+            const parsed = parseItemName(config, item.name);
+            if (!parsed || !item.notes) {
+                continue;
+            }
+            const values = (0, yaml_1.parse)(item.notes);
+            Object.entries(values !== null && values !== void 0 ? values : {}).forEach(([key, value]) => {
+                secrets[(0, pipeline_1.getSecretVarName)(parsed.env, parsed.componentName, key)] =
+                    typeof value === "string" ? value : JSON.stringify(value);
+            });
+        }
+        return secrets;
+    }
+    async writeSecrets(io, env, componentName, secrets) {
+        const { config, collectionName } = this;
+        const bwSession = await this.session(io);
+        const collection = await findCollection(bwSession, collectionName);
+        const name = itemName(config, env, componentName);
+        const existing = (await (0, bw_1.runBwJson)(bwSession, [
+            "list",
+            "items",
+            "--collectionid",
+            collection.id,
+            "--search",
+            name,
+        ])).find((item) => item.name === name);
+        const notes = (0, yaml_1.stringify)(secrets);
+        if (existing) {
+            await (0, bw_1.runBw)(bwSession, [
+                "edit",
+                "item",
+                existing.id,
+                encodePayload({ ...existing, notes }),
+            ]);
+        }
+        else {
+            await (0, bw_1.runBw)(bwSession, [
+                "create",
+                "item",
+                encodePayload({
+                    type: SECURE_NOTE_TYPE,
+                    secureNote: { type: 0 },
+                    name,
+                    notes,
+                    ...(collection.organizationId
+                        ? {
+                            organizationId: collection.organizationId,
+                            collectionIds: [collection.id],
+                        }
+                        : {}),
+                }),
+            ]);
+        }
+    }
+}
+exports.BitwardenVault = BitwardenVault;
+//# sourceMappingURL=BitwardenVault.js.map

package/dist/apps/cli/src/vault/BitwardenVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BitwardenVault.js","sourceRoot":"","sources":["../../../../../src/vault/BitwardenVault.ts"],"names":[],"mappings":";;;AAAA,kDAAuD;AAEvD,+BAAwC;AAExC,6BAAsD;AAGtD,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAW3B;;;GAGG;AACH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,aAAqB,EAAU,EAAE,CAC9E,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,aAAa,cAAc,CAAC;AAEjF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CACpC,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;AAE9C;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;SAChC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAe,EACf,cAAsB,EACC,EAAE;IACzB,MAAM,WAAW,GAAG,MAAM,IAAA,cAAS,EAAiB,OAAO,EAAE;QAC3D,MAAM;QACN,aAAa;QACb,UAAU;QACV,cAAc;KACf,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yBAAyB,cAAc,uDAAuD,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE,CACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEnE,MAAa,cAAc;IAKzB,YACmB,MAAc,EAC/B,OAAgC;IAChC;;;OAGG;IACc,WAAoB;;QANpB,WAAM,GAAN,MAAM,CAAQ;QAMd,gBAAW,GAAX,WAAW,CAAS;QAErC,IAAI,CAAC,cAAc,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,kBAAkB,CAAC;QAC/D,IAAI,CAAC,EAAE,GAAG,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/C,CAAC;IAEO,OAAO,CAAC,EAAa;QAC3B,OAAO,IAAA,iBAAY,EAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAa;QAChC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACjD,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,KAAK,CAAmC,CAAC;YACnE,MAAM,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACpD,OAAO,CAAC,IAAA,2BAAgB,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,OAAgC;QAEhC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,CACf,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACnC,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;YACb,UAAU;YACV,IAAI;SACL,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAErC,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,CAAC;QAEjC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAA,UAAK,EAAC,SAAS,EAAE;gBACrB,MAAM;gBACN,MAAM;gBACN,QAAQ,CAAC,EAAE;gBACX,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,UAAK,EAAC,SAAS,EAAE;gBACrB,QAAQ;gBACR,MAAM;gBACN,aAAa,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;oBACvB,IAAI;oBACJ,KAAK;oBACL,GAAG,CAAC,UAAU,CAAC,cAAc;wBAC3B,CAAC,CAAC;4BACE,cAAc,EAAE,UAAU,CAAC,cAAc;4BACzC,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;yBAC/B;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAlGD,wCAkGC"}

package/dist/apps/cli/src/vault/GitlabVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitlabVault.js","sourceRoot":"","sources":["../../../../../src/vault/GitlabVault.ts"],"names":[],"mappings":";;;AACA,4CAAsE;AAGtE;;;GAGG;AACH,MAAa,WAAW;IAAxB;QACW,OAAE,GAAG,QAAQ,CAAC;IAezB,CAAC;IAbC,KAAK,CAAC,cAAc,CAAC,EAAa;QAChC,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAe,EAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,OAAgC;QAEhC,MAAM,IAAA,2BAAkB,EAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;CACF;AAhBD,kCAgBC"}

package/dist/apps/cli/src/vault/VaultManager.d.ts

@@ -0,0 +1,43 @@
+import type { Config } from "../../../../packages/pipeline/src/index.js";
+import type { IO } from "../core/types";
+import type { SecretsMode, SecretsVault } from "./types";
+export type VaultManagerOptions = {
+    mode?: SecretsMode;
+    /**
+     * default IO for vault interactions (logging, unlock prompts).
+     * Method-level io takes precedence.
+     */
+    io?: IO | null;
+};
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+export declare class VaultManager {
+    private readonly config;
+    readonly mode: SecretsMode;
+    readonly vault: SecretsVault;
+    private readonly io;
+    /** refresh mode bypasses the cache only once per manager */
+    private refreshed;
+    constructor(config: Config, options?: VaultManagerOptions);
+    private createVault;
+    /**
+     * the vault secrets, served from the local cache when it contains
+     * all required names; otherwise (depending on the mode) refreshed
+     * from the vault. Only the "local" env is (re-)cached.
+     */
+    readSecrets(requiredNames: string[], io?: IO | null): Promise<Record<string, string>>;
+    /**
+     * writes secrets of one env/component to the vault and updates the
+     * local cache (write-through, "local" env only)
+     */
+    writeSecrets(env: string, componentName: string, secrets: Record<string, unknown>, io?: IO | null): Promise<void>;
+    /**
+     * the subset of the vault secrets that may be cached: the declared
+     * secrets of the "local" env, per component, as a hierarchy
+     */
+    private cacheableSubset;
+    private declaredSecretKeys;
+}

package/dist/apps/cli/src/vault/VaultManager.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultManager = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const BitwardenVault_1 = require("./BitwardenVault");
+const cache_1 = require("./cache");
+const GitlabVault_1 = require("./GitlabVault");
+/**
+ * only secrets of this env are cached locally — the other envs'
+ * secrets have no business sitting on developer machines
+ */
+const CACHED_ENV = "local";
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+class VaultManager {
+    constructor(config, options = {}) {
+        var _a, _b;
+        this.config = config;
+        /** refresh mode bypasses the cache only once per manager */
+        this.refreshed = false;
+        this.mode = (_a = options.mode) !== null && _a !== void 0 ? _a : "auto";
+        this.io = (_b = options.io) !== null && _b !== void 0 ? _b : null;
+        this.vault = this.createVault();
+    }
+    createVault() {
+        const vaultConfig = (0, pipeline_1.getVaultConfig)(this.config);
+        switch (vaultConfig.type) {
+            case "gitlab":
+                return new GitlabVault_1.GitlabVault();
+            case "bitwarden":
+                return new BitwardenVault_1.BitwardenVault(this.config, vaultConfig, this.mode === "auto" || this.mode === "refresh");
+        }
+    }
+    /**
+     * the vault secrets, served from the local cache when it contains
+     * all required names; otherwise (depending on the mode) refreshed
+     * from the vault. Only the "local" env is (re-)cached.
+     */
+    async readSecrets(requiredNames, io = this.io) {
+        const bypassCache = this.mode === "refresh" && !this.refreshed;
+        const cache = bypassCache ? null : await (0, cache_1.readSecretsCache)();
+        // known entries include recorded misses (null values), so declared
+        // but intentionally unset secrets don't force a vault refresh
+        const known = (cache === null || cache === void 0 ? void 0 : cache.vaultId) === this.vault.id
+            ? flattenSecrets(cache.secrets)
+            : undefined;
+        const missing = requiredNames.filter((name) => !(name in (known !== null && known !== void 0 ? known : {})));
+        // nothing missing (or nothing required at all): don't touch the vault
+        if (missing.length === 0 && (known || requiredNames.length === 0)) {
+            return withoutMisses(known !== null && known !== void 0 ? known : {});
+        }
+        if (this.mode === "offline") {
+            if (missing.length > 0) {
+                io === null || io === void 0 ? void 0 : io.log(`⚠️ vault is offline (--vault-mode offline) and ${missing.length} secrets are not in the local cache: ${missing.join(", ")}`);
+            }
+            return withoutMisses(known !== null && known !== void 0 ? known : {});
+        }
+        const secrets = await this.vault.readAllSecrets(io);
+        this.refreshed = true;
+        await (0, cache_1.writeSecretsCache)(this.vault.id, await this.cacheableSubset(secrets));
+        return secrets;
+    }
+    /**
+     * writes secrets of one env/component to the vault and updates the
+     * local cache (write-through, "local" env only)
+     */
+    async writeSecrets(env, componentName, secrets, io = this.io) {
+        if (!io) {
+            throw new Error("writing to the vault requires an interactive context");
+        }
+        await this.vault.writeSecrets(io, env, componentName, secrets);
+        if (env === CACHED_ENV) {
+            await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [
+                key,
+                typeof value === "string" ? value : JSON.stringify(value),
+            ])));
+        }
+    }
+    /**
+     * the subset of the vault secrets that may be cached: the declared
+     * secrets of the "local" env, per component, as a hierarchy
+     */
+    async cacheableSubset(flatSecrets) {
+        const local = {};
+        for (const componentName of Object.keys(this.config.components)) {
+            const keys = await this.declaredSecretKeys(componentName);
+            const values = Object.fromEntries(keys.map((key) => {
+                var _a;
+                return [
+                    key,
+                    // null records "absent in the vault" (a known miss)
+                    (_a = flatSecrets[(0, pipeline_1.getSecretVarName)(CACHED_ENV, componentName, key)]) !== null && _a !== void 0 ? _a : null,
+                ];
+            }));
+            if (Object.keys(values).length > 0) {
+                local[componentName] = values;
+            }
+        }
+        return Object.keys(local).length > 0 ? { [CACHED_ENV]: local } : {};
+    }
+    async declaredSecretKeys(componentName) {
+        try {
+            const { secretEnvVarKeys, jobOnlyVars } = await (0, pipeline_1.getEnvironment)({
+                config: this.config,
+                componentName,
+                env: CACHED_ENV,
+            });
+            return [
+                ...secretEnvVarKeys,
+                ...jobOnlyVars.build.secretEnvVarKeys,
+                ...jobOnlyVars.deploy.secretEnvVarKeys,
+            ].map(({ key }) => key);
+        }
+        catch (_a) {
+            // components without a local env simply have nothing to cache
+            return [];
+        }
+    }
+}
+exports.VaultManager = VaultManager;
+/**
+ * the cache hierarchy as a flat map of raw secret variable names
+ * (null values = recorded misses)
+ */
+const flattenSecrets = (secrets) => Object.fromEntries(Object.entries(secrets).flatMap(([env, components]) => Object.entries(components).flatMap(([componentName, values]) => Object.entries(values).map(([key, value]) => [
+    (0, pipeline_1.getSecretVarName)(env, componentName, key),
+    value,
+]))));
+/**
+ * only actual values — recorded misses stay unresolved, like any other
+ * unset variable
+ */
+const withoutMisses = (known) => Object.fromEntries(Object.entries(known).filter((entry) => entry[1] !== null));
+//# sourceMappingURL=VaultManager.js.map

package/dist/apps/cli/src/vault/VaultManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VaultManager.js","sourceRoot":"","sources":["../../../../../src/vault/VaultManager.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAE7B,qDAAkD;AAElD,mCAIiB;AACjB,+CAA4C;AAG5C;;;GAGG;AACH,MAAM,UAAU,GAAG,OAAO,CAAC;AAW3B;;;;GAIG;AACH,MAAa,YAAY;IAUvB,YACmB,MAAc,EAC/B,UAA+B,EAAE;;QADhB,WAAM,GAAN,MAAM,CAAQ;QAJjC,4DAA4D;QACpD,cAAS,GAAG,KAAK,CAAC;QAMxB,IAAI,CAAC,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCAAI,MAAM,CAAC;QACnC,IAAI,CAAC,EAAE,GAAG,MAAA,OAAO,CAAC,EAAE,mCAAI,IAAI,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAEO,WAAW;QACjB,MAAM,WAAW,GAAG,IAAA,yBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,IAAI,yBAAW,EAAE,CAAC;YAC3B,KAAK,WAAW;gBACd,OAAO,IAAI,+BAAc,CACvB,IAAI,CAAC,MAAM,EACX,WAAW,EACX,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAChD,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CACf,aAAuB,EACvB,KAAgB,IAAI,CAAC,EAAE;QAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAA,wBAAgB,GAAE,CAAC;QAC5D,mEAAmE;QACnE,8DAA8D;QAC9D,MAAM,KAAK,GACT,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,OAAO,MAAK,IAAI,CAAC,KAAK,CAAC,EAAE;YAC9B,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,sEAAsE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClE,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,kDAAkD,OAAO,CAAC,MAAM,wCAAwC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7H,CAAC;YACJ,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,IAAA,yBAAiB,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,GAAW,EACX,aAAqB,EACrB,OAAgC,EAChC,KAAgB,IAAI,CAAC,EAAE;QAEvB,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAA,0BAAkB,EACtB,IAAI,CAAC,KAAK,CAAC,EAAE,EACb,GAAG,EACH,aAAa,EACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5C,GAAG;gBACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;aAC1D,CAAC,CACH,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmC;QAEnC,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,KAAK,MAAM,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAA2B,EAAE;;gBAAC,OAAA;oBACzC,GAAG;oBACH,oDAAoD;oBACpD,MAAA,WAAW,CAAC,IAAA,2BAAgB,EAAC,UAAU,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,mCAAI,IAAI;iBACtE,CAAA;aAAA,CAAC,CACH,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnC,KAAK,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,aAAqB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,yBAAc,EAAC;gBAC7D,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,aAAa;gBACb,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;YACH,OAAO;gBACL,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,WAAM,CAAC;YACP,8DAA8D;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AA9ID,oCA8IC;AAED;;;GAGG;AACH,MAAM,cAAc,GAAG,CACrB,OAAsB,EACS,EAAE,CACjC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CACpD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,CAC7D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC3C,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC;IACzC,KAAK;CACN,CAAC,CACH,CACF,CACF,CAAC;AAEJ;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,KAAoC,EACZ,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAC1B,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CACxD,CACF,CAAC"}

package/dist/apps/cli/src/vault/bw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bw.js","sourceRoot":"","sources":["../../../../../src/vault/bw.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,sDAI8B;AAE9B,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,oBAAqB,SAAQ,KAAK;IACtC;QACE,KAAK,CACH,0GAA0G,CAC3G,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAG,CAAC,IAAc,EAAmB,EAAE,CACpE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IAC9B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;QAC5C,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,KAAK,EACvB,OAAsB,EAC8B,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YAClD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,EAAE,WAAW,EAA4B,EACxB,EAAE;IACnB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,MAAM,KAAK,iBAAiB;QAC1B,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,uCAAuC,CAC5C,CAAC;IACF,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC,CAAC;IACH,MAAM,IAAA,2BAAa,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA7BW,QAAA,YAAY,gBA6BvB;AAEF;;GAEG;AACI,MAAM,KAAK,GAAG,KAAK,EACxB,OAAe,EACf,IAAc,EACG,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAC/B,IAAI,EACJ,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,EACrC;QACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE;QAC5C,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAbW,QAAA,KAAK,SAahB;AAEK,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAe,EACf,IAAc,EACF,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAH3C,QAAA,SAAS,aAGkC"}

package/dist/apps/cli/src/vault/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../../../src/vault/cache.ts"],"names":[],"mappings":";;;AAAA,0CAAyD;AACzD,+BAA4B;AAC5B,wEAAkE;AA6BlE,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,IAAA,WAAI,EAAC,MAAM,IAAA,0CAAkB,GAAE,EAAE,YAAY,CAAC,CAAC;AAEjD,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC,IAAA,WAAI,EAAC,MAAM,cAAc,EAAE,EAAE,cAAc,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,KAAK,IAAkC,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,MAAM,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AANW,QAAA,gBAAgB,oBAM3B;AAEK,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAAe,EACf,OAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,MAAM,IAAA,gBAAK,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,iEAAiE;IACjE,MAAM,IAAA,oBAAS,EAAC,IAAA,WAAI,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAiB;QAC1B,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;KACR,CAAC;IACF,MAAM,IAAA,oBAAS,EAAC,MAAM,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AAdW,QAAA,iBAAiB,qBAc5B;AAEF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAAe,EACf,GAAW,EACX,aAAqB,EACrB,MAA8B,EACf,EAAE;;IACjB,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAC1C,MAAM,OAAO,GACX,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,MAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,GAAG;QACb,GAAG,OAAO,CAAC,GAAG,CAAC;QACf,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,0CAAG,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE;KACjE,CAAC;IACF,MAAM,IAAA,yBAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,CAAC;AAdW,QAAA,kBAAkB,sBAc7B"}

package/dist/apps/cli/src/vault/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/vault/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,0CAAwB;AACxB,iDAA+B;AAC/B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,iCAA6C;AAApC,2GAAA,kBAAkB,OAAA"}

package/dist/apps/cli/src/vault/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/vault/types.ts"],"names":[],"mappings":""}