@catladder/cli 0.0.0-next-e9e5af68 → 0.0.0-next-aea5d3ad

package/dist/cli/src/vault/BitwardenVault.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.BitwardenVault = void 0;
 const pipeline_1 = require("../../../pipeline/src/index.js");
 const yaml_1 = require("yaml");
@@ -14,94 +11,111 @@ const SECURE_NOTE_TYPE = 2;
  * `<customerName>/<appName>/<env>/<componentName>/secrets.yml`
  */
 const itemName = (config, env, componentName) => `${config.customerName}/${config.appName}/${env}/${componentName}/secrets.yml`;
-const itemPrefix = config => `${config.customerName}/${config.appName}/`;
+const itemPrefix = (config) => `${config.customerName}/${config.appName}/`;
 /**
  * parses env and componentName back out of an item name
  */
 const parseItemName = (config, name) => {
-  const match = name.slice(itemPrefix(config).length).match(/^([^/]+)\/([^/]+)\/secrets\.yml$/);
-  return match ? {
-    env: match[1],
-    componentName: match[2]
-  } : null;
+    const match = name
+        .slice(itemPrefix(config).length)
+        .match(/^([^/]+)\/([^/]+)\/secrets\.yml$/);
+    return match ? { env: match[1], componentName: match[2] } : null;
 };
 const findCollection = async (session, collectionName) => {
-  const collections = await (0, bw_1.runBwJson)(session, ["list", "collections", "--search", collectionName]);
-  const collection = collections.find(c => c.name === collectionName);
-  if (!collection) {
-    throw new Error(`bitwarden collection '${collectionName}' not found — create it and make sure you have access`);
-  }
-  return collection;
+    const collections = await (0, bw_1.runBwJson)(session, [
+        "list",
+        "collections",
+        "--search",
+        collectionName,
+    ]);
+    const collection = collections.find((c) => c.name === collectionName);
+    if (!collection) {
+        throw new Error(`bitwarden collection '${collectionName}' not found — create it and make sure you have access`);
+    }
+    return collection;
 };
-const encodePayload = payload => Buffer.from(JSON.stringify(payload), "utf-8").toString("base64");
+const encodePayload = (payload) => Buffer.from(JSON.stringify(payload), "utf-8").toString("base64");
 class BitwardenVault {
-  constructor(config, options,
-  /**
-   * whether a locked bitwarden may be unlocked interactively
-   * (false with catenv --vault-mode no-prompt)
-   */
-  allowPrompt) {
-    var _a;
-    this.config = config;
-    this.allowPrompt = allowPrompt;
-    this.collectionName = (_a = options.collection) !== null && _a !== void 0 ? _a : DEFAULT_COLLECTION;
-    this.id = `bitwarden:${this.collectionName}`;
-  }
-  session(io) {
-    return (0, bw_1.getBwSession)(io, {
-      allowPrompt: this.allowPrompt
-    });
-  }
-  async readAllSecrets(io) {
-    const {
-      config,
-      collectionName
-    } = this;
-    const bwSession = await this.session(io);
-    const collection = await findCollection(bwSession, collectionName);
-    const items = await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id]);
-    const secrets = {};
-    for (const item of items) {
-      const parsed = parseItemName(config, item.name);
-      if (!parsed || !item.notes) {
-        continue;
-      }
-      const values = (0, yaml_1.parse)(item.notes);
-      Object.entries(values !== null && values !== void 0 ? values : {}).forEach(([key, value]) => {
-        secrets[(0, pipeline_1.getSecretVarName)(parsed.env, parsed.componentName, key)] = typeof value === "string" ? value : JSON.stringify(value);
-      });
+    constructor(config, options, 
+    /**
+     * whether a locked bitwarden may be unlocked interactively
+     * (false with catenv --vault-mode no-prompt)
+     */
+    allowPrompt) {
+        var _a;
+        this.config = config;
+        this.allowPrompt = allowPrompt;
+        this.collectionName = (_a = options.collection) !== null && _a !== void 0 ? _a : DEFAULT_COLLECTION;
+        this.id = `bitwarden:${this.collectionName}`;
+    }
+    session(io) {
+        return (0, bw_1.getBwSession)(io, { allowPrompt: this.allowPrompt });
+    }
+    async readAllSecrets(io) {
+        const { config, collectionName } = this;
+        const bwSession = await this.session(io);
+        const collection = await findCollection(bwSession, collectionName);
+        const items = await (0, bw_1.runBwJson)(bwSession, [
+            "list",
+            "items",
+            "--collectionid",
+            collection.id,
+        ]);
+        const secrets = {};
+        for (const item of items) {
+            const parsed = parseItemName(config, item.name);
+            if (!parsed || !item.notes) {
+                continue;
+            }
+            const values = (0, yaml_1.parse)(item.notes);
+            Object.entries(values !== null && values !== void 0 ? values : {}).forEach(([key, value]) => {
+                secrets[(0, pipeline_1.getSecretVarName)(parsed.env, parsed.componentName, key)] =
+                    typeof value === "string" ? value : JSON.stringify(value);
+            });
+        }
+        return secrets;
     }
-    return secrets;
-  }
-  async writeSecrets(io, env, componentName, secrets) {
-    const {
-      config,
-      collectionName
-    } = this;
-    const bwSession = await this.session(io);
-    const collection = await findCollection(bwSession, collectionName);
-    const name = itemName(config, env, componentName);
-    const existing = (await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id, "--search", name])).find(item => item.name === name);
-    const notes = (0, yaml_1.stringify)(secrets);
-    if (existing) {
-      await (0, bw_1.runBw)(bwSession, ["edit", "item", existing.id, encodePayload({
-        ...existing,
-        notes
-      })]);
-    } else {
-      await (0, bw_1.runBw)(bwSession, ["create", "item", encodePayload({
-        type: SECURE_NOTE_TYPE,
-        secureNote: {
-          type: 0
-        },
-        name,
-        notes,
-        ...(collection.organizationId ? {
-          organizationId: collection.organizationId,
-          collectionIds: [collection.id]
-        } : {})
-      })]);
+    async writeSecrets(io, env, componentName, secrets) {
+        const { config, collectionName } = this;
+        const bwSession = await this.session(io);
+        const collection = await findCollection(bwSession, collectionName);
+        const name = itemName(config, env, componentName);
+        const existing = (await (0, bw_1.runBwJson)(bwSession, [
+            "list",
+            "items",
+            "--collectionid",
+            collection.id,
+            "--search",
+            name,
+        ])).find((item) => item.name === name);
+        const notes = (0, yaml_1.stringify)(secrets);
+        if (existing) {
+            await (0, bw_1.runBw)(bwSession, [
+                "edit",
+                "item",
+                existing.id,
+                encodePayload({ ...existing, notes }),
+            ]);
+        }
+        else {
+            await (0, bw_1.runBw)(bwSession, [
+                "create",
+                "item",
+                encodePayload({
+                    type: SECURE_NOTE_TYPE,
+                    secureNote: { type: 0 },
+                    name,
+                    notes,
+                    ...(collection.organizationId
+                        ? {
+                            organizationId: collection.organizationId,
+                            collectionIds: [collection.id],
+                        }
+                        : {}),
+                }),
+            ]);
+        }
     }
-  }
 }
-exports.BitwardenVault = BitwardenVault;
+exports.BitwardenVault = BitwardenVault;
+//# sourceMappingURL=BitwardenVault.js.map

package/dist/cli/src/vault/GitlabVault.d.ts

@@ -5,7 +5,7 @@ import type { SecretsVault } from "./types";
  * as the secret store
  */
 export declare class GitlabVault implements SecretsVault {
-  readonly id = "gitlab";
-  readAllSecrets(io: IO | null): Promise<Record<string, string>>;
-  writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
-}
+    readonly id = "gitlab";
+    readAllSecrets(io: IO | null): Promise<Record<string, string>>;
+    writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
+}

package/dist/cli/src/vault/GitlabVault.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitlabVault = void 0;
 const gitlab_1 = require("../utils/gitlab");
 /**
@@ -10,15 +7,16 @@ const gitlab_1 = require("../utils/gitlab");
  * as the secret store
  */
 class GitlabVault {
-  constructor() {
-    this.id = "gitlab";
-  }
-  async readAllSecrets(io) {
-    const variables = await (0, gitlab_1.getAllVariables)(io);
-    return Object.fromEntries(variables.map(v => [v.key, v.value]));
-  }
-  async writeSecrets(io, env, componentName, secrets) {
-    await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
-  }
+    constructor() {
+        this.id = "gitlab";
+    }
+    async readAllSecrets(io) {
+        const variables = await (0, gitlab_1.getAllVariables)(io);
+        return Object.fromEntries(variables.map((v) => [v.key, v.value]));
+    }
+    async writeSecrets(io, env, componentName, secrets) {
+        await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+    }
 }
-exports.GitlabVault = GitlabVault;
+exports.GitlabVault = GitlabVault;
+//# sourceMappingURL=GitlabVault.js.map

package/dist/cli/src/vault/VaultManager.d.ts

@@ -2,12 +2,12 @@ import type { Config } from "../../../pipeline/src/index.js";
 import type { IO } from "../core/types";
 import type { SecretsMode, SecretsVault } from "./types";
 export type VaultManagerOptions = {
-  mode?: SecretsMode;
-  /**
-   * default IO for vault interactions (logging, unlock prompts).
-   * Method-level io takes precedence.
-   */
-  io?: IO | null;
+    mode?: SecretsMode;
+    /**
+     * default IO for vault interactions (logging, unlock prompts).
+     * Method-level io takes precedence.
+     */
+    io?: IO | null;
 };
 /**
  * owns the configured vault, the secrets mode and the local cache.
@@ -15,29 +15,29 @@ export type VaultManagerOptions = {
  * only receive mirrored copies.
  */
 export declare class VaultManager {
-  private readonly config;
-  readonly mode: SecretsMode;
-  readonly vault: SecretsVault;
-  private readonly io;
-  /** refresh mode bypasses the cache only once per manager */
-  private refreshed;
-  constructor(config: Config, options?: VaultManagerOptions);
-  private createVault;
-  /**
-   * the vault secrets, served from the local cache when it contains
-   * all required names; otherwise (depending on the mode) refreshed
-   * from the vault. Only the "local" env is (re-)cached.
-   */
-  readSecrets(requiredNames: string[], io?: IO | null): Promise<Record<string, string>>;
-  /**
-   * writes secrets of one env/component to the vault and updates the
-   * local cache (write-through, "local" env only)
-   */
-  writeSecrets(env: string, componentName: string, secrets: Record<string, unknown>, io?: IO | null): Promise<void>;
-  /**
-   * the subset of the vault secrets that may be cached: the declared
-   * secrets of the "local" env, per component, as a hierarchy
-   */
-  private cacheableSubset;
-  private declaredSecretKeys;
-}
+    private readonly config;
+    readonly mode: SecretsMode;
+    readonly vault: SecretsVault;
+    private readonly io;
+    /** refresh mode bypasses the cache only once per manager */
+    private refreshed;
+    constructor(config: Config, options?: VaultManagerOptions);
+    private createVault;
+    /**
+     * the vault secrets, served from the local cache when it contains
+     * all required names; otherwise (depending on the mode) refreshed
+     * from the vault. Only the "local" env is (re-)cached.
+     */
+    readSecrets(requiredNames: string[], io?: IO | null): Promise<Record<string, string>>;
+    /**
+     * writes secrets of one env/component to the vault and updates the
+     * local cache (write-through, "local" env only)
+     */
+    writeSecrets(env: string, componentName: string, secrets: Record<string, unknown>, io?: IO | null): Promise<void>;
+    /**
+     * the subset of the vault secrets that may be cached: the declared
+     * secrets of the "local" env, per component, as a hierarchy
+     */
+    private cacheableSubset;
+    private declaredSecretKeys;
+}

package/dist/cli/src/vault/VaultManager.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.VaultManager = void 0;
 const pipeline_1 = require("../../../pipeline/src/index.js");
 const BitwardenVault_1 = require("./BitwardenVault");
@@ -19,113 +16,122 @@ const CACHED_ENV = "local";
  * only receive mirrored copies.
  */
 class VaultManager {
-  constructor(config, options = {}) {
-    var _a, _b;
-    this.config = config;
-    /** refresh mode bypasses the cache only once per manager */
-    this.refreshed = false;
-    this.mode = (_a = options.mode) !== null && _a !== void 0 ? _a : "auto";
-    this.io = (_b = options.io) !== null && _b !== void 0 ? _b : null;
-    this.vault = this.createVault();
-  }
-  createVault() {
-    const vaultConfig = (0, pipeline_1.getVaultConfig)(this.config);
-    switch (vaultConfig.type) {
-      case "gitlab":
-        return new GitlabVault_1.GitlabVault();
-      case "bitwarden":
-        return new BitwardenVault_1.BitwardenVault(this.config, vaultConfig, this.mode === "auto" || this.mode === "refresh");
+    constructor(config, options = {}) {
+        var _a, _b;
+        this.config = config;
+        /** refresh mode bypasses the cache only once per manager */
+        this.refreshed = false;
+        this.mode = (_a = options.mode) !== null && _a !== void 0 ? _a : "auto";
+        this.io = (_b = options.io) !== null && _b !== void 0 ? _b : null;
+        this.vault = this.createVault();
     }
-  }
-  /**
-   * the vault secrets, served from the local cache when it contains
-   * all required names; otherwise (depending on the mode) refreshed
-   * from the vault. Only the "local" env is (re-)cached.
-   */
-  async readSecrets(requiredNames, io = this.io) {
-    const bypassCache = this.mode === "refresh" && !this.refreshed;
-    const cache = bypassCache ? null : await (0, cache_1.readSecretsCache)();
-    // known entries include recorded misses (null values), so declared
-    // but intentionally unset secrets don't force a vault refresh
-    const known = (cache === null || cache === void 0 ? void 0 : cache.vaultId) === this.vault.id ? flattenSecrets(cache.secrets) : undefined;
-    const missing = requiredNames.filter(name => !(name in (known !== null && known !== void 0 ? known : {})));
-    // nothing missing (or nothing required at all): don't touch the vault
-    if (missing.length === 0 && (known || requiredNames.length === 0)) {
-      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    createVault() {
+        const vaultConfig = (0, pipeline_1.getVaultConfig)(this.config);
+        switch (vaultConfig.type) {
+            case "gitlab":
+                return new GitlabVault_1.GitlabVault();
+            case "bitwarden":
+                return new BitwardenVault_1.BitwardenVault(this.config, vaultConfig, this.mode === "auto" || this.mode === "refresh");
+        }
     }
-    if (this.mode === "offline") {
-      if (missing.length > 0) {
-        io === null || io === void 0 ? void 0 : io.log(`⚠️ vault is offline (--vault-mode offline) and ${missing.length} secrets are not in the local cache: ${missing.join(", ")}`);
-      }
-      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    /**
+     * the vault secrets, served from the local cache when it contains
+     * all required names; otherwise (depending on the mode) refreshed
+     * from the vault. Only the "local" env is (re-)cached.
+     */
+    async readSecrets(requiredNames, io = this.io) {
+        const bypassCache = this.mode === "refresh" && !this.refreshed;
+        const cache = bypassCache ? null : await (0, cache_1.readSecretsCache)();
+        // known entries include recorded misses (null values), so declared
+        // but intentionally unset secrets don't force a vault refresh
+        const known = (cache === null || cache === void 0 ? void 0 : cache.vaultId) === this.vault.id
+            ? flattenSecrets(cache.secrets)
+            : undefined;
+        const missing = requiredNames.filter((name) => !(name in (known !== null && known !== void 0 ? known : {})));
+        // nothing missing (or nothing required at all): don't touch the vault
+        if (missing.length === 0 && (known || requiredNames.length === 0)) {
+            return withoutMisses(known !== null && known !== void 0 ? known : {});
+        }
+        if (this.mode === "offline") {
+            if (missing.length > 0) {
+                io === null || io === void 0 ? void 0 : io.log(`⚠️ vault is offline (--vault-mode offline) and ${missing.length} secrets are not in the local cache: ${missing.join(", ")}`);
+            }
+            return withoutMisses(known !== null && known !== void 0 ? known : {});
+        }
+        const secrets = await this.vault.readAllSecrets(io);
+        this.refreshed = true;
+        await (0, cache_1.writeSecretsCache)(this.vault.id, await this.cacheableSubset(secrets));
+        return secrets;
     }
-    const secrets = await this.vault.readAllSecrets(io);
-    this.refreshed = true;
-    await (0, cache_1.writeSecretsCache)(this.vault.id, await this.cacheableSubset(secrets));
-    return secrets;
-  }
-  /**
-   * writes secrets of one env/component to the vault and updates the
-   * local cache (write-through, "local" env only)
-   */
-  async writeSecrets(env, componentName, secrets, io = this.io) {
-    if (!io) {
-      throw new Error("writing to the vault requires an interactive context");
+    /**
+     * writes secrets of one env/component to the vault and updates the
+     * local cache (write-through, "local" env only)
+     */
+    async writeSecrets(env, componentName, secrets, io = this.io) {
+        if (!io) {
+            throw new Error("writing to the vault requires an interactive context");
+        }
+        await this.vault.writeSecrets(io, env, componentName, secrets);
+        if (env === CACHED_ENV) {
+            await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [
+                key,
+                typeof value === "string" ? value : JSON.stringify(value),
+            ])));
+        }
     }
-    await this.vault.writeSecrets(io, env, componentName, secrets);
-    if (env === CACHED_ENV) {
-      await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [key, typeof value === "string" ? value : JSON.stringify(value)])));
+    /**
+     * the subset of the vault secrets that may be cached: the declared
+     * secrets of the "local" env, per component, as a hierarchy
+     */
+    async cacheableSubset(flatSecrets) {
+        const local = {};
+        for (const componentName of Object.keys(this.config.components)) {
+            const keys = await this.declaredSecretKeys(componentName);
+            const values = Object.fromEntries(keys.map((key) => {
+                var _a;
+                return [
+                    key,
+                    // null records "absent in the vault" (a known miss)
+                    (_a = flatSecrets[(0, pipeline_1.getSecretVarName)(CACHED_ENV, componentName, key)]) !== null && _a !== void 0 ? _a : null,
+                ];
+            }));
+            if (Object.keys(values).length > 0) {
+                local[componentName] = values;
+            }
+        }
+        return Object.keys(local).length > 0 ? { [CACHED_ENV]: local } : {};
     }
-  }
-  /**
-   * the subset of the vault secrets that may be cached: the declared
-   * secrets of the "local" env, per component, as a hierarchy
-   */
-  async cacheableSubset(flatSecrets) {
-    const local = {};
-    for (const componentName of Object.keys(this.config.components)) {
-      const keys = await this.declaredSecretKeys(componentName);
-      const values = Object.fromEntries(keys.map(key => {
-        var _a;
-        return [key,
-        // null records "absent in the vault" (a known miss)
-        (_a = flatSecrets[(0, pipeline_1.getSecretVarName)(CACHED_ENV, componentName, key)]) !== null && _a !== void 0 ? _a : null];
-      }));
-      if (Object.keys(values).length > 0) {
-        local[componentName] = values;
-      }
+    async declaredSecretKeys(componentName) {
+        try {
+            const { secretEnvVarKeys, jobOnlyVars } = await (0, pipeline_1.getEnvironment)({
+                config: this.config,
+                componentName,
+                env: CACHED_ENV,
+            });
+            return [
+                ...secretEnvVarKeys,
+                ...jobOnlyVars.build.secretEnvVarKeys,
+                ...jobOnlyVars.deploy.secretEnvVarKeys,
+            ].map(({ key }) => key);
+        }
+        catch (_a) {
+            // components without a local env simply have nothing to cache
+            return [];
+        }
     }
-    return Object.keys(local).length > 0 ? {
-      [CACHED_ENV]: local
-    } : {};
-  }
-  async declaredSecretKeys(componentName) {
-    try {
-      const {
-        secretEnvVarKeys,
-        jobOnlyVars
-      } = await (0, pipeline_1.getEnvironment)({
-        config: this.config,
-        componentName,
-        env: CACHED_ENV
-      });
-      return [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys].map(({
-        key
-      }) => key);
-    } catch (_a) {
-      // components without a local env simply have nothing to cache
-      return [];
-    }
-  }
 }
 exports.VaultManager = VaultManager;
 /**
  * the cache hierarchy as a flat map of raw secret variable names
  * (null values = recorded misses)
  */
-const flattenSecrets = secrets => Object.fromEntries(Object.entries(secrets).flatMap(([env, components]) => Object.entries(components).flatMap(([componentName, values]) => Object.entries(values).map(([key, value]) => [(0, pipeline_1.getSecretVarName)(env, componentName, key), value]))));
+const flattenSecrets = (secrets) => Object.fromEntries(Object.entries(secrets).flatMap(([env, components]) => Object.entries(components).flatMap(([componentName, values]) => Object.entries(values).map(([key, value]) => [
+    (0, pipeline_1.getSecretVarName)(env, componentName, key),
+    value,
+]))));
 /**
  * only actual values — recorded misses stay unresolved, like any other
  * unset variable
  */
-const withoutMisses = known => Object.fromEntries(Object.entries(known).filter(entry => entry[1] !== null));
+const withoutMisses = (known) => Object.fromEntries(Object.entries(known).filter((entry) => entry[1] !== null));
+//# sourceMappingURL=VaultManager.js.map

package/dist/cli/src/vault/bw.d.ts

@@ -3,13 +3,11 @@ import type { IO } from "../core/types";
  * a working bw session: reuses the cached one, otherwise unlocks (or
  * logs in) interactively — unless prompting is disabled
  */
-export declare const getBwSession: (io: IO | null, {
-  allowPrompt
-}: {
-  allowPrompt: boolean;
+export declare const getBwSession: (io: IO | null, { allowPrompt }: {
+    allowPrompt: boolean;
 }) => Promise<string>;
 /**
  * runs a bw command with the given session and returns stdout
  */
 export declare const runBw: (session: string, args: string[]) => Promise<string>;
-export declare const runBwJson: <T>(session: string, args: string[]) => Promise<T>;
+export declare const runBwJson: <T>(session: string, args: string[]) => Promise<T>;