@catladder/cli 5.8.1 → 5.9.0

package/dist/apps/cli/src/vault/bw.js

@@ -67,14 +67,40 @@ const getBwSession = async (io, { allowPrompt }) => {
 };
 exports.getBwSession = getBwSession;
 /**
- * runs a bw command with the given session and returns stdout
+ * runs a bw command with the given session and returns stdout.
+ *
+ * `input` is written to stdin: use it for payloads (e.g. the secrets of
+ * `bw create item`), which would otherwise be visible in `ps` and be
+ * echoed by node's "Command failed" error.
  */
-const runBw = async (session, args) => {
-    const { stdout } = await execFile("bw", [...args, "--raw", "--nointeraction"], {
-        env: { ...process.env, BW_SESSION: session },
-        maxBuffer: 50 * 1024 * 1024,
+const runBw = async (session, args, input) => {
+    const fullArgs = [...args, "--raw", "--nointeraction"];
+    const env = { ...process.env, BW_SESSION: session };
+    if (input === undefined) {
+        const { stdout } = await execFile("bw", fullArgs, {
+            env,
+            maxBuffer: 50 * 1024 * 1024,
+        });
+        return stdout;
+    }
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)("bw", fullArgs, {
+            env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (data) => (stdout += data.toString("utf-8")));
+        child.stderr.on("data", (data) => (stderr += data.toString("utf-8")));
+        child.on("error", reject);
+        child.on("close", (code) => code === 0
+            ? resolve(stdout)
+            : reject(new Error(`bw ${args[0]} failed: ${stderr.trim()}`)));
+        child.stdin.on("error", () => {
+            // bw exiting early closes the pipe, the close handler reports why
+        });
+        child.stdin.end(input);
     });
-    return stdout;
 };
 exports.runBw = runBw;
 const runBwJson = async (session, args) => JSON.parse(await (0, exports.runBw)(session, args));

package/dist/apps/cli/src/vault/bw.js.map

@@ -1 +1 @@
-{"version":3,"file":"bw.js","sourceRoot":"","sources":["../../../../../src/vault/bw.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,sDAI8B;AAE9B,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,oBAAqB,SAAQ,KAAK;IACtC;QACE,KAAK,CACH,0GAA0G,CAC3G,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAG,CAAC,IAAc,EAAmB,EAAE,CACpE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IAC9B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;QAC5C,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,KAAK,EACvB,OAAsB,EAC8B,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YAClD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,EAAE,WAAW,EAA4B,EACxB,EAAE;IACnB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,MAAM,KAAK,iBAAiB;QAC1B,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,uCAAuC,CAC5C,CAAC;IACF,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC,CAAC;IACH,MAAM,IAAA,2BAAa,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA7BW,QAAA,YAAY,gBA6BvB;AAEF;;GAEG;AACI,MAAM,KAAK,GAAG,KAAK,EACxB,OAAe,EACf,IAAc,EACG,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAC/B,IAAI,EACJ,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,EACrC;QACE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE;QAC5C,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAbW,QAAA,KAAK,SAahB;AAEK,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAe,EACf,IAAc,EACF,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAH3C,QAAA,SAAS,aAGkC"}
+{"version":3,"file":"bw.js","sourceRoot":"","sources":["../../../../../src/vault/bw.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,sDAI8B;AAE9B,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,oBAAqB,SAAQ,KAAK;IACtC;QACE,KAAK,CACH,0GAA0G,CAC3G,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAG,CAAC,IAAc,EAAmB,EAAE,CACpE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IAC9B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,EAAE;QAC5C,KAAK,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC;KACtC,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;QAC1B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,KAAK,EACvB,OAAsB,EAC8B,EAAE;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YAClD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACrE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACnC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAa,EACb,EAAE,WAAW,EAA4B,EACxB,EAAE;IACnB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACtD,CAAC,CAAC,MAAM,CAAC,MAAM,IAAA,2BAAa,EAAC,kBAAkB,CAAC,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,CAAC;IAED,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CACL,MAAM,KAAK,iBAAiB;QAC1B,CAAC,CAAC,8BAA8B;QAChC,CAAC,CAAC,uCAAuC,CAC5C,CAAC;IACF,EAAE,aAAF,EAAE,uBAAF,EAAE,CAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC;QAC9C,MAAM,KAAK,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;KAClD,CAAC,CAAC;IACH,MAAM,IAAA,2BAAa,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AA7BW,QAAA,YAAY,gBA6BvB;AAEF;;;;;;GAMG;AACI,MAAM,KAAK,GAAG,KAAK,EACxB,OAAe,EACf,IAAc,EACd,KAAc,EACG,EAAE;IACnB,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE;YAChD,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,QAAQ,EAAE;YAClC,GAAG;YACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;YACR,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAChE,CAAC;QACF,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAC3B,kEAAkE;QACpE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAlCW,QAAA,KAAK,SAkChB;AAEK,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAe,EACf,IAAc,EACF,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,aAAK,EAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAH3C,QAAA,SAAS,aAGkC"}

package/dist/apps/cli/src/vault/cache.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.updateSecretsCache = exports.writeSecretsCache = exports.readSecretsCache = void 0;
 const promises_1 = require("fs/promises");
 const path_1 = require("path");
+const writePrivateFile_1 = require("../utils/writePrivateFile");
 const gitProjectInformation_1 = require("../git/gitProjectInformation");
 const getCacheFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder");
 const getCachePath = async () => (0, path_1.join)(await getCacheFolder(), "secrets.json");
@@ -17,7 +18,7 @@ const readSecretsCache = async () => {
 exports.readSecretsCache = readSecretsCache;
 const writeSecretsCache = async (vaultId, secrets) => {
     const folder = await getCacheFolder();
-    await (0, promises_1.mkdir)(folder, { recursive: true });
+    await (0, promises_1.mkdir)(folder, { recursive: true, mode: 0o700 });
     // the folder ignores itself, so the cache can never be committed
     await (0, promises_1.writeFile)((0, path_1.join)(folder, ".gitignore"), "*\n");
     const cache = {
@@ -25,7 +26,9 @@ const writeSecretsCache = async (vaultId, secrets) => {
         updatedAt: new Date().toISOString(),
         secrets,
     };
-    await (0, promises_1.writeFile)(await getCachePath(), JSON.stringify(cache, null, 2));
+    const path = await getCachePath();
+    // may hold key material (local access keys): owner only
+    await (0, writePrivateFile_1.writePrivateFile)(path, JSON.stringify(cache, null, 2));
 };
 exports.writeSecretsCache = writeSecretsCache;
 /**

package/dist/apps/cli/src/vault/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../../../src/vault/cache.ts"],"names":[],"mappings":";;;AAAA,0CAAyD;AACzD,+BAA4B;AAC5B,wEAAkE;AA6BlE,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,IAAA,WAAI,EAAC,MAAM,IAAA,0CAAkB,GAAE,EAAE,YAAY,CAAC,CAAC;AAEjD,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC,IAAA,WAAI,EAAC,MAAM,cAAc,EAAE,EAAE,cAAc,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,KAAK,IAAkC,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,MAAM,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AANW,QAAA,gBAAgB,oBAM3B;AAEK,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAAe,EACf,OAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,MAAM,IAAA,gBAAK,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,iEAAiE;IACjE,MAAM,IAAA,oBAAS,EAAC,IAAA,WAAI,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAiB;QAC1B,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;KACR,CAAC;IACF,MAAM,IAAA,oBAAS,EAAC,MAAM,YAAY,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC,CAAC;AAdW,QAAA,iBAAiB,qBAc5B;AAEF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAAe,EACf,GAAW,EACX,aAAqB,EACrB,MAA8B,EACf,EAAE;;IACjB,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAC1C,MAAM,OAAO,GACX,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,MAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,GAAG;QACb,GAAG,OAAO,CAAC,GAAG,CAAC;QACf,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,0CAAG,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE;KACjE,CAAC;IACF,MAAM,IAAA,yBAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,CAAC;AAdW,QAAA,kBAAkB,sBAc7B"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../../../src/vault/cache.ts"],"names":[],"mappings":";;;AAAA,0CAAyD;AACzD,+BAA4B;AAC5B,gEAA6D;AAC7D,wEAAkE;AA6BlE,MAAM,cAAc,GAAG,KAAK,IAAI,EAAE,CAChC,IAAA,WAAI,EAAC,MAAM,IAAA,0CAAkB,GAAE,EAAE,YAAY,CAAC,CAAC;AAEjD,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE,CAAC,IAAA,WAAI,EAAC,MAAM,cAAc,EAAE,EAAE,cAAc,CAAC,CAAC;AAEvE,MAAM,gBAAgB,GAAG,KAAK,IAAkC,EAAE;IACvE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,MAAM,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AANW,QAAA,gBAAgB,oBAM3B;AAEK,MAAM,iBAAiB,GAAG,KAAK,EACpC,OAAe,EACf,OAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,cAAc,EAAE,CAAC;IACtC,MAAM,IAAA,gBAAK,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,iEAAiE;IACjE,MAAM,IAAA,oBAAS,EAAC,IAAA,WAAI,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAiB;QAC1B,OAAO;QACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;KACR,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,wDAAwD;IACxD,MAAM,IAAA,mCAAgB,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC,CAAC;AAhBW,QAAA,iBAAiB,qBAgB5B;AAEF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAAe,EACf,GAAW,EACX,aAAqB,EACrB,MAA8B,EACf,EAAE;;IACjB,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAC1C,MAAM,OAAO,GACX,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,MAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,GAAG;QACb,GAAG,OAAO,CAAC,GAAG,CAAC;QACf,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,0CAAG,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE;KACjE,CAAC;IACF,MAAM,IAAA,yBAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,CAAC;AAdW,QAAA,kBAAkB,sBAc7B"}

package/dist/bundles/catenv/index.js

@@ -331,6 +331,7 @@ exports.createVaultManagerGetter = createVaultManagerGetter;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 const getProjectConfig_1 = __nccwpck_require__(70478);
+const keyFiles_1 = __nccwpck_require__(70180);
 const printVariables_1 = __nccwpck_require__(32507);
 const verboseBanner_1 = __nccwpck_require__(95423);
 const writeDotEnvFiles_1 = __nccwpck_require__(16699);
@@ -356,6 +357,8 @@ exports["default"] = async (choice, options) => {
     if (options === null || options === void 0 ? void 0 : options.verbose) {
         (0, verboseBanner_1.printVerboseBanner)();
     }
+    // before the env vars are resolved: they point at the key files
+    await (0, keyFiles_1.writeLocalAccessKeyFiles)(io, config);
     await Promise.all([
         (0, pipeline_1.generatePipelineFiles)(context),
         (0, writeDotEnvFiles_1.writeDotEnvFiles)(context, choice),
@@ -671,6 +674,7 @@ program.parse();
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getJobOnlyEnvVarsResolved = exports.getEnvVarsResolved = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.invalidateProjectConfig = exports.getProjectConfig = exports.parseChoice = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
+const keyFiles_1 = __nccwpck_require__(70180);
 const gitlab_1 = __nccwpck_require__(17697);
 const projects_1 = __nccwpck_require__(20575);
 var parseChoice_1 = __nccwpck_require__(70769);
@@ -791,12 +795,19 @@ const getEnvVarsResolved = async (io, env, componentName) => {
     const envionment = await (0, exports.getEnvironment)(env, componentName);
     // in the pipeline the secrets alreadyy exists  and bash will expand them
     // but here we need to manually load them
-    return resolveSecrets(io, [
+    const resolved = await resolveSecrets(io, [
         {
             envVars: envionment.envVars,
             secretEnvVarKeys: envionment.secretEnvVarKeys,
         },
     ]);
+    if (env !== "local")
+        return resolved;
+    // paths of the local access key files (written by catenv)
+    return {
+        ...resolved,
+        ...(await (0, keyFiles_1.getLocalAccessKeyFileVars)(await (0, exports.getProjectConfig)(), componentName)),
+    };
 };
 exports.getEnvVarsResolved = getEnvVarsResolved;
 /**
@@ -931,6 +942,127 @@ exports.gitProjectInformation = gitProjectInformation;
 
 /***/ }),
 
+/***/ 83228:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getDeclaredLocalAccessEnvs = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+/**
+ * the envs of a component declaring gcp local access. An invalid
+ * declaration yields none instead of throwing: catenv and the vault
+ * cache must keep working (`project doctor` and `project setup` report
+ * the invalid declaration loudly).
+ */
+const getDeclaredLocalAccessEnvs = (config, componentName) => {
+    try {
+        return (0, pipeline_1.getLocalAccessGcpEnvs)(config, componentName);
+    }
+    catch (_a) {
+        return [];
+    }
+};
+exports.getDeclaredLocalAccessEnvs = getDeclaredLocalAccessEnvs;
+//# sourceMappingURL=declared.js.map
+
+/***/ }),
+
+/***/ 70180:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.writeLocalAccessKeyFiles = exports.getLocalAccessKeyFileVars = exports.getLocalAccessKeyFileVarName = exports.getLocalAccessKeyFileName = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+const promises_1 = __nccwpck_require__(91943);
+const fs_1 = __nccwpck_require__(79896);
+const path_1 = __nccwpck_require__(16928);
+const writePrivateFile_1 = __nccwpck_require__(14550);
+const declared_1 = __nccwpck_require__(83228);
+const gitProjectInformation_1 = __nccwpck_require__(86884);
+const sanitize = (s) => s.replace(/[^A-Za-z0-9]+/g, "_");
+/** file name of a component/env key, relative to the local access folder */
+const getLocalAccessKeyFileName = (env, componentName) => `gcp-${sanitize(env)}-${sanitize(componentName)}.json`;
+exports.getLocalAccessKeyFileName = getLocalAccessKeyFileName;
+/**
+ * env var exposing the key file path. Deliberately NOT
+ * GOOGLE_APPLICATION_CREDENTIALS: the key must only be used where a
+ * command opts in (isolated gcloud config), never by ADC.
+ */
+const getLocalAccessKeyFileVarName = (env) => `CATLADDER_LOCAL_ACCESS_GCP_${sanitize(env).toUpperCase()}_KEY_FILE`;
+exports.getLocalAccessKeyFileVarName = getLocalAccessKeyFileVarName;
+// inside .catladder/, which ignores itself (see vault/cache.ts)
+const getFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder", "local-access");
+/**
+ * env vars pointing at the key files that exist for the component
+ * (only paths, no secrets)
+ */
+const getLocalAccessKeyFileVars = async (config, componentName) => {
+    const folder = await getFolder();
+    return Object.fromEntries((0, declared_1.getDeclaredLocalAccessEnvs)(config, componentName)
+        .map((env) => [
+        (0, exports.getLocalAccessKeyFileVarName)(env),
+        (0, path_1.join)(folder, (0, exports.getLocalAccessKeyFileName)(env, componentName)),
+    ])
+        .filter(([, path]) => (0, fs_1.existsSync)(path)));
+};
+exports.getLocalAccessKeyFileVars = getLocalAccessKeyFileVars;
+/**
+ * writes the stored local access service account keys to gitignored
+ * files (mode 0600) and removes files of declarations that are gone.
+ * A no-op without any declaration (nothing is created). Never throws:
+ * a vault that cannot be reached or an invalid declaration (reported by
+ * `project doctor`) must not break catenv.
+ *
+ * The key is only read through the cache; if setup rotated it on another
+ * machine, refresh with `catenv --vault-mode refresh`.
+ */
+const writeLocalAccessKeyFiles = async (io, config) => {
+    const wanted = Object.keys(config.components).flatMap((componentName) => (0, declared_1.getDeclaredLocalAccessEnvs)(config, componentName).map((env) => ({
+        env,
+        componentName,
+        secretName: (0, pipeline_1.getSecretVarName)("local", componentName, (0, pipeline_1.getLocalAccessGcpSecretName)(env)),
+        fileName: (0, exports.getLocalAccessKeyFileName)(env, componentName),
+    })));
+    const folder = await getFolder();
+    if (wanted.length === 0 && !(0, fs_1.existsSync)(folder))
+        return;
+    try {
+        const secrets = wanted.length > 0
+            ? await (await io.getVaultManager()).readSecrets(wanted.map((w) => w.secretName), io)
+            : {};
+        await (0, promises_1.mkdir)(folder, { recursive: true, mode: 0o700 });
+        // the parent folder ignores itself
+        await (0, promises_1.writeFile)((0, path_1.join)(folder, "..", ".gitignore"), "*\n");
+        const written = new Set();
+        for (const { secretName, fileName, env, componentName } of wanted) {
+            const key = secrets[secretName];
+            if (!key) {
+                io.log(`⚠️ no local access key for ${env}:${componentName} in the secret store — run \`catladder project setup\` (or \`catenv --vault-mode refresh\` if it was set up on another machine)`);
+                continue;
+            }
+            const path = (0, path_1.join)(folder, fileName);
+            await (0, writePrivateFile_1.writePrivateFile)(path, key);
+            written.add(fileName);
+        }
+        for (const file of await (0, promises_1.readdir)(folder)) {
+            if (!written.has(file)) {
+                await (0, promises_1.rm)((0, path_1.join)(folder, file), { force: true });
+            }
+        }
+    }
+    catch (e) {
+        io.log(`⚠️ could not write local access keys: ${e.message}`);
+    }
+};
+exports.writeLocalAccessKeyFiles = writeLocalAccessKeyFiles;
+//# sourceMappingURL=keyFiles.js.map
+
+/***/ }),
+
 /***/ 55689:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -1347,6 +1479,38 @@ exports.getProjectNamespace = getProjectNamespace;
 
 /***/ }),
 
+/***/ 14550:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.writePrivateFile = void 0;
+const promises_1 = __nccwpck_require__(91943);
+/**
+ * writes a file readable by the owner only. Goes through a 0600 temp
+ * file and a rename, so the content is never visible with looser
+ * permissions (writing first and chmod-ing afterwards would leave an
+ * existing 0644 file readable until the chmod).
+ */
+const writePrivateFile = async (path, content) => {
+    const tmp = `${path}.${process.pid}.tmp`;
+    try {
+        await (0, promises_1.writeFile)(tmp, content, { mode: 0o600 });
+        // the mode is only applied when the file is created
+        await (0, promises_1.chmod)(tmp, 0o600);
+        await (0, promises_1.rename)(tmp, path);
+    }
+    catch (e) {
+        await (0, promises_1.rm)(tmp, { force: true });
+        throw e;
+    }
+};
+exports.writePrivateFile = writePrivateFile;
+//# sourceMappingURL=writePrivateFile.js.map
+
+/***/ }),
+
 /***/ 42827:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -1453,30 +1617,21 @@ class BitwardenVault {
             : {};
         const notes = (0, yaml_1.stringify)({ ...previous, ...secrets });
         if (existing) {
-            await (0, bw_1.runBw)(bwSession, [
-                "edit",
-                "item",
-                existing.id,
-                encodePayload({ ...existing, notes }),
-            ]);
+            await (0, bw_1.runBw)(bwSession, ["edit", "item", existing.id], encodePayload({ ...existing, notes }));
         }
         else {
-            await (0, bw_1.runBw)(bwSession, [
-                "create",
-                "item",
-                encodePayload({
-                    type: SECURE_NOTE_TYPE,
-                    secureNote: { type: 0 },
-                    name,
-                    notes,
-                    ...(collection.organizationId
-                        ? {
-                            organizationId: collection.organizationId,
-                            collectionIds: [collection.id],
-                        }
-                        : {}),
-                }),
-            ]);
+            await (0, bw_1.runBw)(bwSession, ["create", "item"], encodePayload({
+                type: SECURE_NOTE_TYPE,
+                secureNote: { type: 0 },
+                name,
+                notes,
+                ...(collection.organizationId
+                    ? {
+                        organizationId: collection.organizationId,
+                        collectionIds: [collection.id],
+                    }
+                    : {}),
+            }));
         }
     }
 }
@@ -1523,6 +1678,7 @@ exports.GitlabVault = GitlabVault;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.VaultManager = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
+const declared_1 = __nccwpck_require__(83228);
 const BitwardenVault_1 = __nccwpck_require__(42827);
 const cache_1 = __nccwpck_require__(57011);
 const GitlabVault_1 = __nccwpck_require__(6020);
@@ -1605,6 +1761,15 @@ class VaultManager {
             ])));
         }
     }
+    /**
+     * updates the local cache only (the vault already holds the values),
+     * "local" env only
+     */
+    async cacheSecrets(env, componentName, secrets) {
+        if (env !== CACHED_ENV)
+            return;
+        await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, secrets);
+    }
     /**
      * the subset of the vault secrets that may be cached: the declared
      * secrets of the "local" env, per component, as a hierarchy
@@ -1628,6 +1793,14 @@ class VaultManager {
         return Object.keys(local).length > 0 ? { [CACHED_ENV]: local } : {};
     }
     async declaredSecretKeys(componentName) {
+        return [
+            ...(await this.declaredEnvSecretKeys(componentName)),
+            // the local access keys `project setup` provisions are not part
+            // of any env's vars, but belong to the cached local secrets
+            ...(0, declared_1.getDeclaredLocalAccessEnvs)(this.config, componentName).map(pipeline_1.getLocalAccessGcpSecretName),
+        ];
+    }
+    async declaredEnvSecretKeys(componentName) {
         try {
             const { secretEnvVarKeys, jobOnlyVars } = await (0, pipeline_1.getEnvironment)({
                 config: this.config,
@@ -1737,14 +1910,40 @@ const getBwSession = async (io, { allowPrompt }) => {
 };
 exports.getBwSession = getBwSession;
 /**
- * runs a bw command with the given session and returns stdout
+ * runs a bw command with the given session and returns stdout.
+ *
+ * `input` is written to stdin: use it for payloads (e.g. the secrets of
+ * `bw create item`), which would otherwise be visible in `ps` and be
+ * echoed by node's "Command failed" error.
  */
-const runBw = async (session, args) => {
-    const { stdout } = await execFile("bw", [...args, "--raw", "--nointeraction"], {
-        env: { ...process.env, BW_SESSION: session },
-        maxBuffer: 50 * 1024 * 1024,
+const runBw = async (session, args, input) => {
+    const fullArgs = [...args, "--raw", "--nointeraction"];
+    const env = { ...process.env, BW_SESSION: session };
+    if (input === undefined) {
+        const { stdout } = await execFile("bw", fullArgs, {
+            env,
+            maxBuffer: 50 * 1024 * 1024,
+        });
+        return stdout;
+    }
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)("bw", fullArgs, {
+            env,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (data) => (stdout += data.toString("utf-8")));
+        child.stderr.on("data", (data) => (stderr += data.toString("utf-8")));
+        child.on("error", reject);
+        child.on("close", (code) => code === 0
+            ? resolve(stdout)
+            : reject(new Error(`bw ${args[0]} failed: ${stderr.trim()}`)));
+        child.stdin.on("error", () => {
+            // bw exiting early closes the pipe, the close handler reports why
+        });
+        child.stdin.end(input);
     });
-    return stdout;
 };
 exports.runBw = runBw;
 const runBwJson = async (session, args) => JSON.parse(await (0, exports.runBw)(session, args));
@@ -1762,6 +1961,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.updateSecretsCache = exports.writeSecretsCache = exports.readSecretsCache = void 0;
 const promises_1 = __nccwpck_require__(91943);
 const path_1 = __nccwpck_require__(16928);
+const writePrivateFile_1 = __nccwpck_require__(14550);
 const gitProjectInformation_1 = __nccwpck_require__(86884);
 const getCacheFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder");
 const getCachePath = async () => (0, path_1.join)(await getCacheFolder(), "secrets.json");
@@ -1776,7 +1976,7 @@ const readSecretsCache = async () => {
 exports.readSecretsCache = readSecretsCache;
 const writeSecretsCache = async (vaultId, secrets) => {
     const folder = await getCacheFolder();
-    await (0, promises_1.mkdir)(folder, { recursive: true });
+    await (0, promises_1.mkdir)(folder, { recursive: true, mode: 0o700 });
     // the folder ignores itself, so the cache can never be committed
     await (0, promises_1.writeFile)((0, path_1.join)(folder, ".gitignore"), "*\n");
     const cache = {
@@ -1784,7 +1984,9 @@ const writeSecretsCache = async (vaultId, secrets) => {
         updatedAt: new Date().toISOString(),
         secrets,
     };
-    await (0, promises_1.writeFile)(await getCachePath(), JSON.stringify(cache, null, 2));
+    const path = await getCachePath();
+    // may hold key material (local access keys): owner only
+    await (0, writePrivateFile_1.writePrivateFile)(path, JSON.stringify(cache, null, 2));
 };
 exports.writeSecretsCache = writeSecretsCache;
 /**
@@ -12677,6 +12879,163 @@ __exportStar(__nccwpck_require__(91804), exports);
 __exportStar(__nccwpck_require__(94143), exports);
 __exportStar(__nccwpck_require__(98011), exports);
 __exportStar(__nccwpck_require__(61459), exports);
+__exportStar(__nccwpck_require__(54165), exports);
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 54165:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.diffRoleBindings = exports.getLocalAccessGcpSecretName = exports.getLocalAccessGcpEnvs = exports.getLocalAccessGcpRoles = exports.getLocalAccessConfig = exports.getDeniedLocalAccessRoleReason = exports.LOCAL_ACCESS_GCP_SA_NAME = exports.LOCAL_ACCESS_GCP_PRESETS = void 0;
+const configruedEnvs_1 = __nccwpck_require__(38866);
+const getEnvConfig_1 = __nccwpck_require__(69578);
+const types_1 = __nccwpck_require__(79689);
+exports.LOCAL_ACCESS_GCP_PRESETS = {
+    // no run.viewer on purpose, see LocalAccessGcpPreset
+    logs: ["roles/logging.viewer"],
+};
+/** name prefix of the service account `project setup` creates (see getGcloudServiceAccountNames) */
+exports.LOCAL_ACCESS_GCP_SA_NAME = "local-diag";
+const ROLE_FORMAT = /^(roles\/[A-Za-z0-9_.]+|projects\/[a-z0-9-]+\/roles\/[A-Za-z0-9_.]+|organizations\/\d+\/roles\/[A-Za-z0-9_.]+)$/;
+/**
+ * roles that are read-only on paper but expose secrets: cloud run
+ * services/jobs carry their secrets as plain env vars, so anything that
+ * may read them reads every deployed secret. Denied even with
+ * `allowAnyRole`.
+ */
+const SECRET_EXPOSING_ROLES = {
+    "roles/viewer": "roles/viewer can read cloud run env vars (secrets)",
+    "roles/run.viewer": "roles/run.viewer can read cloud run env vars (secrets)",
+    "roles/secretmanager.secretAccessor": "this role reads secret values",
+    "roles/secretmanager.admin": "this role reads secret values",
+};
+/**
+ * roles granted without `allowAnyRole`. An explicit list instead of a
+ * name pattern: a role called `*.viewer` / `*.reader` says nothing about
+ * its permissions (custom roles can hold anything, and predefined ones
+ * like storage.objectViewer, cloudfunctions.viewer, compute.viewer or
+ * logging.privateLogViewer expose data or secrets).
+ */
+const SAFE_ROLES = [
+    "roles/logging.viewer",
+    "roles/monitoring.viewer",
+    "roles/errorreporting.viewer",
+];
+/** `roles/foo.bar.v1` -> `foo.bar` (version suffixes must not defeat the checks) */
+const getRoleName = (role) => { var _a; return ((_a = role.split("/").pop()) !== null && _a !== void 0 ? _a : role).replace(/(\.v\d+)+$/i, ""); };
+/**
+ * why a role may not be granted for local access, or undefined if it
+ * is acceptable.
+ *
+ * By default only the roles in {@link SAFE_ROLES} pass; custom roles
+ * and everything else need `allowAnyRole`. `allowAnyRole` lifts the
+ * allow-list, but the obvious write/admin/impersonation roles and the
+ * secret exposing roles stay denied.
+ */
+const getDeniedLocalAccessRoleReason = (role, options = {}) => {
+    var _a;
+    const secretReason = SECRET_EXPOSING_ROLES[role];
+    if (secretReason)
+        return secretReason;
+    const name = getRoleName(role);
+    if (name === "owner" || name === "editor") {
+        return "owner/editor are full write roles";
+    }
+    const last = (_a = name.split(".").pop()) !== null && _a !== void 0 ? _a : name;
+    if (/admin$/i.test(last)) {
+        return "admin roles can change resources";
+    }
+    if (/(editor|developer|writer|creator|deployer|invoker|builder|publisher|client|user|objectUser)$/i.test(last) &&
+        !/^iam\./.test(name)) {
+        return "this role can change resources";
+    }
+    if (/^iam\./.test(name) &&
+        /(serviceAccountUser|serviceAccountTokenCreator|serviceAccountKeyAdmin|workloadIdentityUser)$/.test(name)) {
+        return "this role allows impersonating service accounts";
+    }
+    if (!options.allowAnyRole && !SAFE_ROLES.includes(role)) {
+        return `only these roles are allowed: ${SAFE_ROLES.join(", ")} (set allowAnyRole: true to grant others at your own risk)`;
+    }
+    return undefined;
+};
+exports.getDeniedLocalAccessRoleReason = getDeniedLocalAccessRoleReason;
+/**
+ * the effective local access declaration of an env: the env's own
+ * declaration replaces the project default entirely
+ */
+const getLocalAccessConfig = (config, env) => {
+    var _a;
+    if (env === "local")
+        return undefined;
+    const envEntry = (_a = config.environments) === null || _a === void 0 ? void 0 : _a[env];
+    const declared = envEntry && envEntry.localAccess !== undefined
+        ? envEntry.localAccess
+        : config.localAccess;
+    return declared || undefined;
+};
+exports.getLocalAccessConfig = getLocalAccessConfig;
+/**
+ * the gcp roles local access grants in `env`: preset roles plus the
+ * explicit ones, deduplicated and sorted. Throws on an unknown preset,
+ * a malformed role or a denied (write/admin) role.
+ */
+const getLocalAccessGcpRoles = (config, env) => {
+    var _a, _b, _c;
+    const gcp = (_a = (0, exports.getLocalAccessConfig)(config, env)) === null || _a === void 0 ? void 0 : _a.gcp;
+    if (!gcp)
+        return [];
+    const roles = new Set();
+    for (const preset of (_b = gcp.presets) !== null && _b !== void 0 ? _b : []) {
+        const presetRoles = exports.LOCAL_ACCESS_GCP_PRESETS[preset];
+        if (!presetRoles) {
+            throw new Error(`localAccess (${env}): unknown gcp preset '${preset}', known: ${Object.keys(exports.LOCAL_ACCESS_GCP_PRESETS).join(", ")}`);
+        }
+        presetRoles.forEach((role) => roles.add(role));
+    }
+    for (const role of (_c = gcp.roles) !== null && _c !== void 0 ? _c : []) {
+        if (!ROLE_FORMAT.test(role)) {
+            throw new Error(`localAccess (${env}): '${role}' is not a valid role (expected e.g. roles/logging.viewer)`);
+        }
+        const reason = (0, exports.getDeniedLocalAccessRoleReason)(role, {
+            allowAnyRole: gcp.allowAnyRole,
+        });
+        if (reason) {
+            throw new Error(`localAccess (${env}): role '${role}' is not allowed (${reason})`);
+        }
+        roles.add(role);
+    }
+    return [...roles].sort();
+};
+exports.getLocalAccessGcpRoles = getLocalAccessGcpRoles;
+/**
+ * the envs of a component that declare gcp local access. Empty for
+ * components that do not deploy to google cloud run.
+ */
+const getLocalAccessGcpEnvs = (config, componentName) => (0, configruedEnvs_1.getAllEnvs)(config, componentName).filter((env) => 
+// only google cloud run envs have a project to grant roles in; the
+// env's own `deploy` overrides the component's
+(0, types_1.isOfDeployType)((0, getEnvConfig_1.getEnvConfig)(config, componentName, env).deploy, "google-cloudrun") && (0, exports.getLocalAccessGcpRoles)(config, env).length > 0);
+exports.getLocalAccessGcpEnvs = getLocalAccessGcpEnvs;
+/**
+ * name of the secret (stored under the `local` env of the component)
+ * holding the service account key of `env`'s local access
+ */
+const getLocalAccessGcpSecretName = (env) => `LOCAL_ACCESS_GCP_${env.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase()}_CREDENTIALS`;
+exports.getLocalAccessGcpSecretName = getLocalAccessGcpSecretName;
+/**
+ * the bindings to add and remove so that `current` matches `desired`.
+ * The local access account is dedicated, so every binding it carries
+ * beyond the declaration is extra.
+ */
+const diffRoleBindings = (desired, current) => ({
+    missing: desired.filter((role) => !current.includes(role)),
+    extra: current.filter((role) => !desired.includes(role)),
+});
+exports.diffRoleBindings = diffRoleBindings;
 //# sourceMappingURL=index.js.map
 
 /***/ }),