@clef-sh/runtime 0.1.6-beta.32

package/dist/poller.js

@@ -0,0 +1,329 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArtifactPoller = void 0;
+const crypto = __importStar(require("crypto"));
+const decrypt_1 = require("./decrypt");
+const kms_1 = require("./kms");
+/**
+ * Periodically fetches a published artifact, decrypts it, and swaps the
+ * secrets cache when a new revision is detected.
+ */
+/** Minimum poll interval in milliseconds (floor for all scheduling). */
+const MIN_POLL_MS = 5_000;
+class ArtifactPoller {
+    timer = null;
+    lastContentHash = null;
+    lastRevision = null;
+    lastExpiresAt = null;
+    decryptor = new decrypt_1.AgeDecryptor();
+    options;
+    telemetryOverride;
+    constructor(options) {
+        this.options = options;
+    }
+    /** Set or replace the telemetry emitter (e.g. after resolving token from secrets). */
+    setTelemetry(emitter) {
+        this.telemetryOverride = emitter;
+    }
+    get telemetry() {
+        return this.telemetryOverride ?? this.options.telemetry;
+    }
+    /** Fetch, validate, decrypt, and cache the artifact. */
+    async fetchAndDecrypt() {
+        let raw;
+        let contentHash;
+        try {
+            const result = await this.options.source.fetch();
+            raw = result.raw;
+            contentHash = result.contentHash;
+            // Content-hash short-circuit: skip parse+decrypt if unchanged
+            if (contentHash && contentHash === this.lastContentHash)
+                return;
+            // Write to disk cache on successful fetch
+            this.options.diskCache?.write(raw, contentHash);
+        }
+        catch (err) {
+            this.telemetry?.fetchFailed({
+                error: err instanceof Error ? err.message : String(err),
+                diskCacheAvailable: !!this.options.diskCache?.read(),
+            });
+            const ttl = this.options.cacheTtl;
+            // Attempt disk cache fallback
+            if (this.options.diskCache) {
+                const cached = this.options.diskCache.read();
+                if (cached) {
+                    // Check if disk cache has also expired
+                    if (ttl !== undefined) {
+                        const fetchedAt = this.options.diskCache.getFetchedAt();
+                        if (fetchedAt && (Date.now() - new Date(fetchedAt).getTime()) / 1000 > ttl) {
+                            this.options.cache.wipe();
+                            this.options.diskCache.purge();
+                            this.telemetry?.cacheExpired({
+                                cacheTtlSeconds: ttl,
+                                diskCachePurged: true,
+                            });
+                            throw new Error("Secrets cache expired: no successful refresh within TTL");
+                        }
+                    }
+                    raw = cached;
+                    contentHash = this.options.diskCache.getCachedSha();
+                    // If the cached hash matches, still skip
+                    if (contentHash && contentHash === this.lastContentHash)
+                        return;
+                }
+                else {
+                    // No disk cache content — check in-memory TTL
+                    if (ttl !== undefined && this.options.cache.isExpired(ttl)) {
+                        this.options.cache.wipe();
+                        this.telemetry?.cacheExpired({
+                            cacheTtlSeconds: ttl,
+                            diskCachePurged: false,
+                        });
+                        throw new Error("Secrets cache expired: no successful refresh within TTL");
+                    }
+                    throw err;
+                }
+            }
+            else {
+                // No disk cache configured — check in-memory TTL
+                if (ttl !== undefined && this.options.cache.isExpired(ttl)) {
+                    this.options.cache.wipe();
+                    this.telemetry?.cacheExpired({
+                        cacheTtlSeconds: ttl,
+                        diskCachePurged: false,
+                    });
+                    throw new Error("Secrets cache expired: no successful refresh within TTL");
+                }
+                throw err;
+            }
+        }
+        // Check for revocation before full validation — a revoked artifact
+        // won't have ciphertext/revision fields.
+        const parsed = JSON.parse(raw);
+        if (parsed.revokedAt) {
+            this.options.cache.wipe();
+            this.options.diskCache?.purge();
+            this.lastRevision = null;
+            this.lastContentHash = null;
+            this.telemetry?.artifactRevoked({
+                revokedAt: String(parsed.revokedAt),
+            });
+            throw new Error(`Artifact revoked: ${parsed.identity}/${parsed.environment} at ${parsed.revokedAt}`);
+        }
+        // Validate, decrypt, and cache — emit artifact.invalid on any failure
+        await this.validateDecryptAndCache(raw, contentHash);
+    }
+    /**
+     * Validate the artifact, decrypt it, and swap the cache.
+     * Emits `artifact.invalid` on any validation or decryption failure,
+     * and `artifact.expired` / `artifact.refreshed` on their respective paths.
+     */
+    async validateDecryptAndCache(raw, contentHash) {
+        let artifact;
+        try {
+            artifact = this.parseAndValidate(raw);
+        }
+        catch (err) {
+            this.telemetry?.artifactInvalid({
+                reason: classifyValidationError(err),
+                error: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+        // Check artifact-level expiry
+        if (artifact.expiresAt && Date.now() > new Date(artifact.expiresAt).getTime()) {
+            this.options.cache.wipe();
+            this.options.diskCache?.purge();
+            this.telemetry?.artifactExpired({ expiresAt: artifact.expiresAt });
+            throw new Error(`Artifact expired at ${artifact.expiresAt}`);
+        }
+        // Skip if revision unchanged
+        if (artifact.revision === this.lastRevision)
+            return;
+        // Verify integrity
+        const hash = crypto.createHash("sha256").update(artifact.ciphertext).digest("hex");
+        if (hash !== artifact.ciphertextHash) {
+            const err = new Error(`Artifact integrity check failed: expected hash ${artifact.ciphertextHash}, got ${hash}`);
+            this.telemetry?.artifactInvalid({
+                reason: "integrity",
+                error: err.message,
+            });
+            throw err;
+        }
+        // Resolve the age private key
+        let agePrivateKey;
+        if (artifact.envelope) {
+            // KMS envelope: unwrap the ephemeral private key via KMS
+            try {
+                const kms = (0, kms_1.createKmsProvider)(artifact.envelope.provider);
+                const wrappedKey = Buffer.from(artifact.envelope.wrappedKey, "base64");
+                const unwrapped = await kms.unwrap(artifact.envelope.keyId, wrappedKey, artifact.envelope.algorithm);
+                // Note: unwrapped Buffer is zeroed below, but the resulting JS string is
+                // immutable and cannot be cleared (inherent V8/Node.js limitation). Accepted risk.
+                agePrivateKey = unwrapped.toString("utf-8");
+                unwrapped.fill(0);
+            }
+            catch (err) {
+                this.telemetry?.artifactInvalid({
+                    reason: "kms_unwrap",
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                throw err;
+            }
+        }
+        else {
+            // Age-only: use the static private key (config error, not artifact.invalid)
+            if (!this.options.privateKey) {
+                throw new Error("Artifact requires an age private key. Set CLEF_AGENT_AGE_KEY or use KMS envelope encryption.");
+            }
+            agePrivateKey = this.options.privateKey;
+        }
+        // Decrypt
+        try {
+            const plaintext = await this.decryptor.decrypt(artifact.ciphertext, agePrivateKey);
+            const values = JSON.parse(plaintext);
+            // Atomic swap
+            this.options.cache.swap(values, artifact.keys, artifact.revision);
+            this.lastRevision = artifact.revision;
+            this.lastContentHash = contentHash ?? null;
+            this.lastExpiresAt = artifact.expiresAt ?? null;
+            this.options.onRefresh?.(artifact.revision);
+            this.telemetry?.artifactRefreshed({
+                revision: artifact.revision,
+                keyCount: artifact.keys.length,
+                kmsEnvelope: !!artifact.envelope,
+            });
+        }
+        catch (err) {
+            // Don't double-emit for errors already classified above
+            if (err instanceof Error && !err.message.includes("integrity check failed")) {
+                this.telemetry?.artifactInvalid({
+                    reason: err instanceof SyntaxError ? "payload_parse" : "decrypt",
+                    error: err.message,
+                });
+            }
+            throw err;
+        }
+    }
+    /** Start the polling loop. Performs an initial fetch immediately. */
+    async start() {
+        // Initial fetch — fail fast if source is unreachable
+        await this.fetchAndDecrypt();
+        this.scheduleNext();
+    }
+    /** Start only the polling schedule (no initial fetch). */
+    startPolling() {
+        if (this.timer)
+            return;
+        this.scheduleNext();
+    }
+    /** Stop the polling loop. */
+    stop() {
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
+    }
+    /** Whether the poller is currently running. */
+    isRunning() {
+        return this.timer !== null;
+    }
+    /** Compute the next poll delay and schedule a fetch. */
+    scheduleNext() {
+        const delayMs = this.computeNextPollMs();
+        this.timer = setTimeout(async () => {
+            this.timer = null;
+            try {
+                await this.fetchAndDecrypt();
+            }
+            catch (err) {
+                this.options.onError?.(err instanceof Error ? err : new Error(String(err)));
+            }
+            this.scheduleNext();
+        }, delayMs);
+    }
+    /** Compute ms until next poll: 80% of expiresAt remaining, or cacheTtl / 10 fallback. */
+    computeNextPollMs() {
+        // If the artifact has an expiresAt, refresh at 80% of remaining time
+        if (this.lastExpiresAt) {
+            const msRemaining = new Date(this.lastExpiresAt).getTime() - Date.now();
+            if (msRemaining > 0) {
+                return Math.max(msRemaining * 0.8, MIN_POLL_MS);
+            }
+            // Already expired — poll immediately (with floor)
+            return MIN_POLL_MS;
+        }
+        // Fallback: derive from cacheTtl (default 30s if no TTL configured)
+        const ttl = this.options.cacheTtl;
+        if (ttl !== undefined) {
+            return Math.max((ttl / 10) * 1000, MIN_POLL_MS);
+        }
+        return 30_000;
+    }
+    parseAndValidate(raw) {
+        const artifact = JSON.parse(raw);
+        if (artifact.version !== 1) {
+            throw new Error(`Unsupported artifact version: ${artifact.version}`);
+        }
+        if (!artifact.ciphertext || !artifact.revision || !artifact.ciphertextHash) {
+            throw new Error("Invalid artifact: missing required fields.");
+        }
+        if (artifact.envelope) {
+            if (!artifact.envelope.provider ||
+                !artifact.envelope.keyId ||
+                !artifact.envelope.wrappedKey ||
+                !artifact.envelope.algorithm) {
+                throw new Error("Invalid artifact: incomplete envelope fields.");
+            }
+        }
+        return artifact;
+    }
+}
+exports.ArtifactPoller = ArtifactPoller;
+/** Classify a validation error from parseAndValidate into a machine-readable reason. */
+function classifyValidationError(err) {
+    if (err instanceof SyntaxError)
+        return "json_parse";
+    const msg = err instanceof Error ? err.message : "";
+    if (msg.includes("Unsupported artifact version"))
+        return "unsupported_version";
+    if (msg.includes("missing required fields"))
+        return "missing_fields";
+    if (msg.includes("incomplete envelope"))
+        return "incomplete_envelope";
+    return "unknown";
+}
+//# sourceMappingURL=poller.js.map

package/dist/poller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poller.js","sourceRoot":"","sources":["../src/poller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAEjC,uCAAyC;AAGzC,+BAA0C;AA+C1C;;;GAGG;AACH,wEAAwE;AACxE,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,MAAa,cAAc;IACjB,KAAK,GAAyC,IAAI,CAAC;IACnD,eAAe,GAAkB,IAAI,CAAC;IACtC,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IAC3B,SAAS,GAAG,IAAI,sBAAY,EAAE,CAAC;IAC/B,OAAO,CAAgB;IAChC,iBAAiB,CAAoB;IAE7C,YAAY,OAAsB;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,sFAAsF;IACtF,YAAY,CAAC,OAAyB;QACpC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,eAAe;QACnB,IAAI,GAAW,CAAC;QAChB,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACjB,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAEjC,8DAA8D;YAC9D,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe;gBAAE,OAAO;YAEhE,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;gBAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;aACrD,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAClC,8BAA8B;YAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,MAAM,EAAE,CAAC;oBACX,uCAAuC;oBACvC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;wBACxD,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;4BAC3E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;4BAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;4BAC/B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;gCAC3B,eAAe,EAAE,GAAG;gCACpB,eAAe,EAAE,IAAI;6BACtB,CAAC,CAAC;4BACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;wBAC7E,CAAC;oBACH,CAAC;oBACD,GAAG,GAAG,MAAM,CAAC;oBACb,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;oBACpD,yCAAyC;oBACzC,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe;wBAAE,OAAO;gBAClE,CAAC;qBAAM,CAAC;oBACN,8CAA8C;oBAC9C,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;wBAC1B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;4BAC3B,eAAe,EAAE,GAAG;4BACpB,eAAe,EAAE,KAAK;yBACvB,CAAC,CAAC;wBACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oBAC7E,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,iDAAiD;gBACjD,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAC1B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;wBAC3B,eAAe,EAAE,GAAG;wBACpB,eAAe,EAAE,KAAK;qBACvB,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,OAAO,MAAM,CAAC,SAAS,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CACnC,GAAW,EACX,WAA+B;QAE/B,IAAI,QAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,uBAAuB,CAAC,GAAG,CAAC;gBACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8BAA8B;QAC9B,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO;QAEpD,mBAAmB;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kDAAkD,QAAQ,CAAC,cAAc,SAAS,IAAI,EAAE,CACzF,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,GAAG,CAAC,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8BAA8B;QAC9B,IAAI,aAAqB,CAAC;QAC1B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,uBAAiB,EAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACvE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,CAChC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EACvB,UAAU,EACV,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAC5B,CAAC;gBACF,yEAAyE;gBACzE,mFAAmF;gBACnF,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;oBAC9B,MAAM,EAAE,YAAY;oBACpB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1C,CAAC;QAED,UAAU;QACV,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACnF,MAAM,MAAM,GAA2B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE7D,cAAc;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACtC,IAAI,CAAC,eAAe,GAAG,WAAW,IAAI,IAAI,CAAC;YAC3C,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;gBAC9B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wDAAwD;YACxD,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;oBAC9B,MAAM,EAAE,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;oBAChE,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,KAAK;QACT,qDAAqD;QACrD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,0DAA0D;IAC1D,YAAY;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,6BAA6B;IAC7B,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED,wDAAwD;IAChD,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED,yFAAyF;IACjF,iBAAiB;QACvB,qEAAqE;QACrE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC,CAAC;YAClD,CAAC;YACD,kDAAkD;YAClD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,MAAM,QAAQ,GAAqB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QAEvE,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC3B,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;gBACxB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBAC7B,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAC5B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAzSD,wCAySC;AAED,wFAAwF;AACxF,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,WAAW;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC/E,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/secrets-cache.d.ts

@@ -0,0 +1,23 @@
+/** In-memory secrets cache with single-reference swap. */
+export declare class SecretsCache {
+    private snapshot;
+    /** Replace the cached secrets in a single reference assignment. */
+    swap(values: Record<string, string>, keys: string[], revision: string): void;
+    /** Whether the cache has exceeded the given TTL (seconds). */
+    isExpired(ttlSeconds: number): boolean;
+    /** Clear the cached snapshot. */
+    wipe(): void;
+    /** Epoch ms when the cache was last swapped, or null if never loaded. */
+    getSwappedAt(): number | null;
+    /** Get a single secret value by key. Returns undefined if not cached or key missing. */
+    get(key: string): string | undefined;
+    /** Get all cached secret values. Returns null if not yet loaded. */
+    getAll(): Record<string, string> | null;
+    /** Get the list of available secret key names. */
+    getKeys(): string[];
+    /** Get the current artifact revision, or null if not loaded. */
+    getRevision(): string | null;
+    /** Whether the cache has been loaded at least once. */
+    isReady(): boolean;
+}
+//# sourceMappingURL=secrets-cache.d.ts.map

package/dist/secrets-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-cache.d.ts","sourceRoot":"","sources":["../src/secrets-cache.ts"],"names":[],"mappings":"AAOA,0DAA0D;AAC1D,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAA8B;IAE9C,mEAAmE;IACnE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI5E,8DAA8D;IAC9D,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAKtC,iCAAiC;IACjC,IAAI,IAAI,IAAI;IAIZ,yEAAyE;IACzE,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,wFAAwF;IACxF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,oEAAoE;IACpE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAMvC,kDAAkD;IAClD,OAAO,IAAI,MAAM,EAAE;IAKnB,gEAAgE;IAChE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,uDAAuD;IACvD,OAAO,IAAI,OAAO;CAGnB"}

package/dist/secrets-cache.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsCache = void 0;
+/** In-memory secrets cache with single-reference swap. */
+class SecretsCache {
+    snapshot = null;
+    /** Replace the cached secrets in a single reference assignment. */
+    swap(values, keys, revision) {
+        this.snapshot = { values: { ...values }, keys: [...keys], revision, swappedAt: Date.now() };
+    }
+    /** Whether the cache has exceeded the given TTL (seconds). */
+    isExpired(ttlSeconds) {
+        if (!this.snapshot)
+            return false;
+        return (Date.now() - this.snapshot.swappedAt) / 1000 > ttlSeconds;
+    }
+    /** Clear the cached snapshot. */
+    wipe() {
+        this.snapshot = null;
+    }
+    /** Epoch ms when the cache was last swapped, or null if never loaded. */
+    getSwappedAt() {
+        return this.snapshot?.swappedAt ?? null;
+    }
+    /** Get a single secret value by key. Returns undefined if not cached or key missing. */
+    get(key) {
+        return this.snapshot?.values[key];
+    }
+    /** Get all cached secret values. Returns null if not yet loaded. */
+    getAll() {
+        const s = this.snapshot;
+        if (!s)
+            return null;
+        return { ...s.values };
+    }
+    /** Get the list of available secret key names. */
+    getKeys() {
+        const s = this.snapshot;
+        return s ? [...s.keys] : [];
+    }
+    /** Get the current artifact revision, or null if not loaded. */
+    getRevision() {
+        return this.snapshot?.revision ?? null;
+    }
+    /** Whether the cache has been loaded at least once. */
+    isReady() {
+        return this.snapshot !== null;
+    }
+}
+exports.SecretsCache = SecretsCache;
+//# sourceMappingURL=secrets-cache.js.map

package/dist/secrets-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-cache.js","sourceRoot":"","sources":["../src/secrets-cache.ts"],"names":[],"mappings":";;;AAOA,0DAA0D;AAC1D,MAAa,YAAY;IACf,QAAQ,GAAyB,IAAI,CAAC;IAE9C,mEAAmE;IACnE,IAAI,CAAC,MAA8B,EAAE,IAAc,EAAE,QAAgB;QACnE,IAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,8DAA8D;IAC9D,SAAS,CAAC,UAAkB;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,UAAU,CAAC;IACpE,CAAC;IAED,iCAAiC;IACjC,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,wFAAwF;IACxF,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,kDAAkD;IAClD,OAAO;QACL,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;CACF;AAnDD,oCAmDC"}

package/dist/sources/file.d.ts

@@ -0,0 +1,9 @@
+import { ArtifactSource, ArtifactFetchResult } from "./types";
+/** Reads an artifact from a local file. */
+export declare class FileArtifactSource implements ArtifactSource {
+    private readonly path;
+    constructor(filePath: string);
+    fetch(): Promise<ArtifactFetchResult>;
+    describe(): string;
+}
+//# sourceMappingURL=file.d.ts.map

package/dist/sources/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/sources/file.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE9D,2CAA2C;AAC3C,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,QAAQ,EAAE,MAAM;IAItB,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAK3C,QAAQ,IAAI,MAAM;CAGnB"}

package/dist/sources/file.js

@@ -0,0 +1,53 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileArtifactSource = void 0;
+const fs = __importStar(require("fs"));
+/** Reads an artifact from a local file. */
+class FileArtifactSource {
+    path;
+    constructor(filePath) {
+        this.path = filePath;
+    }
+    async fetch() {
+        const raw = fs.readFileSync(this.path, "utf-8");
+        return { raw };
+    }
+    describe() {
+        return `file ${this.path}`;
+    }
+}
+exports.FileArtifactSource = FileArtifactSource;
+//# sourceMappingURL=file.js.map

package/dist/sources/file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/sources/file.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AAGzB,2CAA2C;AAC3C,MAAa,kBAAkB;IACZ,IAAI,CAAS;IAE9B,YAAY,QAAgB;QAC1B,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,QAAQ;QACN,OAAO,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;CACF;AAfD,gDAeC"}

package/dist/sources/http.d.ts

@@ -0,0 +1,9 @@
+import { ArtifactSource, ArtifactFetchResult } from "./types";
+/** Fetches an artifact from an HTTP(S) URL. */
+export declare class HttpArtifactSource implements ArtifactSource {
+    private readonly url;
+    constructor(url: string);
+    fetch(): Promise<ArtifactFetchResult>;
+    describe(): string;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/sources/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/sources/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE9D,+CAA+C;AAC/C,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEjB,GAAG,EAAE,MAAM;IAIjB,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAU3C,QAAQ,IAAI,MAAM;CAGnB"}

package/dist/sources/http.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpArtifactSource = void 0;
+/** Fetches an artifact from an HTTP(S) URL. */
+class HttpArtifactSource {
+    url;
+    constructor(url) {
+        this.url = url;
+    }
+    async fetch() {
+        const res = await fetch(this.url);
+        if (!res.ok) {
+            throw new Error(`Failed to fetch artifact from ${this.url}: ${res.status}`);
+        }
+        const raw = await res.text();
+        const etag = res.headers.get("etag") ?? undefined;
+        return { raw, contentHash: etag };
+    }
+    describe() {
+        return `HTTP ${this.url}`;
+    }
+}
+exports.HttpArtifactSource = HttpArtifactSource;
+//# sourceMappingURL=http.js.map

package/dist/sources/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/sources/http.ts"],"names":[],"mappings":";;;AAEA,+CAA+C;AAC/C,MAAa,kBAAkB;IACZ,GAAG,CAAS;IAE7B,YAAY,GAAW;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,QAAQ;QACN,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,CAAC;CACF;AApBD,gDAoBC"}

package/dist/sources/index.d.ts

@@ -0,0 +1,5 @@
+export type { ArtifactSource, ArtifactFetchResult } from "./types";
+export { HttpArtifactSource } from "./http";
+export { FileArtifactSource } from "./file";
+export { VcsArtifactSource } from "./vcs";
+//# sourceMappingURL=index.d.ts.map

package/dist/sources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sources/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC"}

package/dist/sources/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VcsArtifactSource = exports.FileArtifactSource = exports.HttpArtifactSource = void 0;
+var http_1 = require("./http");
+Object.defineProperty(exports, "HttpArtifactSource", { enumerable: true, get: function () { return http_1.HttpArtifactSource; } });
+var file_1 = require("./file");
+Object.defineProperty(exports, "FileArtifactSource", { enumerable: true, get: function () { return file_1.FileArtifactSource; } });
+var vcs_1 = require("./vcs");
+Object.defineProperty(exports, "VcsArtifactSource", { enumerable: true, get: function () { return vcs_1.VcsArtifactSource; } });
+//# sourceMappingURL=index.js.map

package/dist/sources/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sources/index.ts"],"names":[],"mappings":";;;AACA,+BAA4C;AAAnC,0GAAA,kBAAkB,OAAA;AAC3B,+BAA4C;AAAnC,0GAAA,kBAAkB,OAAA;AAC3B,6BAA0C;AAAjC,wGAAA,iBAAiB,OAAA"}

package/dist/sources/types.d.ts

@@ -0,0 +1,15 @@
+/** Result of fetching an artifact from a source. */
+export interface ArtifactFetchResult {
+    /** Raw artifact JSON string. */
+    raw: string;
+    /** VCS SHA / HTTP ETag for change detection. */
+    contentHash?: string;
+}
+/** Strategy interface for fetching packed artifacts. */
+export interface ArtifactSource {
+    /** Fetch the artifact. */
+    fetch(): Promise<ArtifactFetchResult>;
+    /** Human-readable description for logging. */
+    describe(): string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/sources/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sources/types.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,8CAA8C;IAC9C,QAAQ,IAAI,MAAM,CAAC;CACpB"}

package/dist/sources/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/sources/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sources/types.ts"],"names":[],"mappings":""}

package/dist/sources/vcs.d.ts

@@ -0,0 +1,13 @@
+import { VcsProvider } from "../vcs/types";
+import { ArtifactSource, ArtifactFetchResult } from "./types";
+/** Fetches a packed artifact from a VCS provider. */
+export declare class VcsArtifactSource implements ArtifactSource {
+    private readonly provider;
+    private readonly path;
+    private readonly identity;
+    private readonly environment;
+    constructor(provider: VcsProvider, identity: string, environment: string);
+    fetch(): Promise<ArtifactFetchResult>;
+    describe(): string;
+}
+//# sourceMappingURL=vcs.d.ts.map

package/dist/sources/vcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcs.d.ts","sourceRoot":"","sources":["../../src/sources/vcs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAE9D,qDAAqD;AACrD,qBAAa,iBAAkB,YAAW,cAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAc;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAEzB,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAOlE,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAK3C,QAAQ,IAAI,MAAM;CAGnB"}

package/dist/sources/vcs.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VcsArtifactSource = void 0;
+/** Fetches a packed artifact from a VCS provider. */
+class VcsArtifactSource {
+    provider;
+    path;
+    identity;
+    environment;
+    constructor(provider, identity, environment) {
+        this.provider = provider;
+        this.identity = identity;
+        this.environment = environment;
+        this.path = `.clef/packed/${identity}/${environment}.age.json`;
+    }
+    async fetch() {
+        const result = await this.provider.fetchFile(this.path);
+        return { raw: result.content, contentHash: result.sha };
+    }
+    describe() {
+        return `VCS .clef/packed/${this.identity}/${this.environment}.age.json`;
+    }
+}
+exports.VcsArtifactSource = VcsArtifactSource;
+//# sourceMappingURL=vcs.js.map

package/dist/sources/vcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vcs.js","sourceRoot":"","sources":["../../src/sources/vcs.ts"],"names":[],"mappings":";;;AAGA,qDAAqD;AACrD,MAAa,iBAAiB;IACX,QAAQ,CAAc;IACtB,IAAI,CAAS;IACb,QAAQ,CAAS;IACjB,WAAW,CAAS;IAErC,YAAY,QAAqB,EAAE,QAAgB,EAAE,WAAmB;QACtE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,QAAQ,IAAI,WAAW,WAAW,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;IAED,QAAQ;QACN,OAAO,oBAAoB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,WAAW,CAAC;IAC1E,CAAC;CACF;AArBD,8CAqBC"}