@clef-sh/cli 0.1.13-beta.88 → 0.1.13

package/dist/index.cjs

@@ -21959,7 +21959,12 @@ var VALID_KMS_PROVIDERS;
 var init_types2 = __esm({
   "../core/src/kms/types.ts"() {
     "use strict";
-    VALID_KMS_PROVIDERS = ["aws", "gcp", "azure"];
+    VALID_KMS_PROVIDERS = [
+      "aws",
+      "gcp",
+      "azure",
+      "cloud"
+    ];
   }
 });
 
@@ -94826,10 +94831,177 @@ var require_azure = __commonJS({
   }
 });
 
-// ../runtime/dist/kms/index.js
+// ../client/dist/kms.js
 var require_kms = __commonJS({
+  "../client/dist/kms.js"(exports2, module2) {
+    "use strict";
+    var __defProp2 = Object.defineProperty;
+    var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
+    var __getOwnPropNames2 = Object.getOwnPropertyNames;
+    var __hasOwnProp2 = Object.prototype.hasOwnProperty;
+    var __export2 = (target, all) => {
+      for (var name in all)
+        __defProp2(target, name, { get: all[name], enumerable: true });
+    };
+    var __copyProps2 = (to, from, except, desc) => {
+      if (from && typeof from === "object" || typeof from === "function") {
+        for (let key of __getOwnPropNames2(from))
+          if (!__hasOwnProp2.call(to, key) && key !== except)
+            __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc2(from, key)) || desc.enumerable });
+      }
+      return to;
+    };
+    var __toCommonJS = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
+    var kms_exports = {};
+    __export2(kms_exports, {
+      ClefClientError: () => ClefClientError,
+      CloudKmsProvider: () => CloudKmsProvider
+    });
+    module2.exports = __toCommonJS(kms_exports);
+    var ClefClientError = class extends Error {
+      constructor(message, statusCode, fix) {
+        super(message);
+        this.statusCode = statusCode;
+        this.fix = fix;
+        this.name = "ClefClientError";
+      }
+      statusCode;
+      fix;
+    };
+    function resolveToken(explicit) {
+      if (explicit) return explicit;
+      if (typeof process !== "undefined" && process.env?.CLEF_SERVICE_TOKEN) {
+        return process.env.CLEF_SERVICE_TOKEN;
+      }
+      throw new ClefClientError(
+        "No service token configured",
+        void 0,
+        "Set CLEF_SERVICE_TOKEN or pass token in options."
+      );
+    }
+    async function request(baseUrl, opts) {
+      const url = `${baseUrl}${opts.path}`;
+      const headers = {
+        Authorization: `Bearer ${opts.token}`,
+        Accept: "application/json"
+      };
+      if (opts.body !== void 0) {
+        headers["Content-Type"] = "application/json";
+      }
+      const init = {
+        method: opts.method,
+        headers,
+        body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+      };
+      let response;
+      try {
+        response = await opts.fetchFn(url, init);
+      } catch (err) {
+        try {
+          response = await opts.fetchFn(url, init);
+        } catch {
+          throw new ClefClientError(
+            `Connection failed: ${err.message}`,
+            void 0,
+            "Is the endpoint reachable? Check your CLEF_ENDPOINT setting."
+          );
+        }
+      }
+      if (response.status >= 500) {
+        response = await opts.fetchFn(url, init);
+      }
+      if (response.status === 401) {
+        throw new ClefClientError("Authentication failed", 401, "Check your CLEF_SERVICE_TOKEN.");
+      }
+      if (response.status === 503) {
+        throw new ClefClientError("Secrets expired or not loaded", 503, "Check the agent logs.");
+      }
+      if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new ClefClientError(
+          `HTTP ${response.status}: ${text || response.statusText}`,
+          response.status
+        );
+      }
+      const json = await response.json();
+      if (json && typeof json === "object" && "success" in json) {
+        if (!json.success) {
+          throw new ClefClientError(json.message || "Request failed", response.status);
+        }
+        return json.data;
+      }
+      return json;
+    }
+    var CloudKmsProvider = class {
+      endpoint;
+      token;
+      constructor(options) {
+        this.endpoint = options.endpoint;
+        this.token = resolveToken(options.token);
+      }
+      async wrap(_keyId, _plaintext) {
+        throw new ClefClientError(
+          "CloudKmsProvider.wrap() is not supported. Use the keyservice sidecar for encryption."
+        );
+      }
+      async unwrap(keyId, wrappedKey, _algorithm) {
+        const result = await request(this.endpoint, {
+          method: "POST",
+          path: "/api/v1/cloud/kms/decrypt",
+          body: {
+            keyArn: keyId,
+            ciphertext: wrappedKey.toString("base64")
+          },
+          token: this.token,
+          fetchFn: globalThis.fetch
+        });
+        return Buffer.from(result.plaintext, "base64");
+      }
+    };
+  }
+});
+
+// ../runtime/dist/kms/index.js
+var require_kms2 = __commonJS({
   "../runtime/dist/kms/index.js"(exports2) {
     "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.AzureKmsProvider = exports2.GcpKmsProvider = exports2.AwsKmsProvider = void 0;
     exports2.createKmsProvider = createKmsProvider;
@@ -94848,7 +95020,7 @@ var require_kms = __commonJS({
     Object.defineProperty(exports2, "AzureKmsProvider", { enumerable: true, get: function() {
       return azure_2.AzureKmsProvider;
     } });
-    function createKmsProvider(provider, options) {
+    async function createKmsProvider(provider, options) {
       switch (provider) {
         case "aws":
           return new aws_1.AwsKmsProvider(options?.region);
@@ -94856,6 +95028,17 @@ var require_kms = __commonJS({
           return new gcp_1.GcpKmsProvider();
         case "azure":
           return new azure_1.AzureKmsProvider();
+        case "cloud": {
+          try {
+            const { CloudKmsProvider } = await Promise.resolve().then(() => __importStar(require_kms()));
+            return new CloudKmsProvider({
+              endpoint: options?.endpoint ?? "",
+              token: options?.token
+            });
+          } catch {
+            throw new Error("Clef Cloud KMS requires @clef-sh/client. Install it with: npm install @clef-sh/client");
+          }
+        }
         default:
           throw new Error(`Unknown KMS provider: ${provider}`);
       }
@@ -94908,7 +95091,7 @@ var require_artifact_decryptor = __commonJS({
     exports2.ArtifactDecryptor = void 0;
     var crypto6 = __importStar(require("crypto"));
     var decrypt_1 = require_decrypt();
-    var kms_1 = require_kms();
+    var kms_1 = require_kms2();
     var ArtifactDecryptor = class {
       ageDecryptor = new decrypt_1.AgeDecryptor();
       privateKey;
@@ -94957,7 +95140,7 @@ var require_artifact_decryptor = __commonJS({
         const envelope = artifact.envelope;
         let dek;
         try {
-          const kms = (0, kms_1.createKmsProvider)(envelope.provider);
+          const kms = await (0, kms_1.createKmsProvider)(envelope.provider);
           const wrappedKey = Buffer.from(envelope.wrappedKey, "base64");
           dek = await kms.unwrap(envelope.keyId, wrappedKey, envelope.algorithm);
         } catch (err) {
@@ -96225,11 +96408,11 @@ var require_dist3 = __commonJS({
     Object.defineProperty(exports2, "createVcsProvider", { enumerable: true, get: function() {
       return index_1.createVcsProvider;
     } });
-    var kms_1 = require_kms();
+    var kms_1 = require_kms2();
     Object.defineProperty(exports2, "AwsKmsProvider", { enumerable: true, get: function() {
       return kms_1.AwsKmsProvider;
     } });
-    var kms_2 = require_kms();
+    var kms_2 = require_kms2();
     Object.defineProperty(exports2, "createKmsProvider", { enumerable: true, get: function() {
       return kms_2.createKmsProvider;
     } });
@@ -99279,7 +99462,7 @@ async function fetchCheckpoint(config) {
 }
 
 // package.json
-var version2 = "0.1.13-beta.88";
+var version2 = "0.1.13";
 var package_default = {
   name: "@clef-sh/cli",
   version: version2,
@@ -101482,7 +101665,7 @@ function registerPackCommand(program3, deps2) {
         const envConfig = si?.environments[environment];
         if (envConfig && isKmsEnvelope(envConfig)) {
           const { createKmsProvider } = await Promise.resolve().then(() => __toESM(require_dist3()));
-          kmsProvider = createKmsProvider(envConfig.kms.provider, {
+          kmsProvider = await createKmsProvider(envConfig.kms.provider, {
             region: envConfig.kms.region
           });
         }
@@ -102356,7 +102539,7 @@ function registerServeCommand(program3, deps2) {
       const envConfig = si.environments[opts.env];
       if (envConfig && isKmsEnvelope(envConfig)) {
         const { createKmsProvider } = await Promise.resolve().then(() => __toESM(require_dist3()));
-        kmsProvider = createKmsProvider(envConfig.kms.provider, {
+        kmsProvider = await createKmsProvider(envConfig.kms.provider, {
           region: envConfig.kms.region
         });
       }