@devdogsuga/backstage 0.1.3 → 0.1.4

package/dist/client-B7HhuTaA.js

@@ -0,0 +1,429 @@
+import { w as findRepoRoot } from "./telemetry-Bjoz29Hl.js";
+import { n as loadEnv } from "./peers-B0KDkI6a.js";
+import { o as unwrap } from "./ui-CdKo8mLw.js";
+import { a as readTokenFromVault, c as EnvDocument, o as saveTokenToVault, t as VAULT_ITEM_NAME } from "./vault-C8LYJFOQ.js";
+import { dirname, join, resolve } from "node:path";
+import { log, password, select, text } from "@clack/prompts";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+//#region src/bws/token.ts
+/**
+* Finding the Secrets Manager access token, in four places, in order.
+*
+*   1. `--access-token`   explicit, and explicit beats ambient
+*   2. `BWS_ACCESS_TOKEN` the environment, which includes your `.env`,
+*                         since `with-env` loads it for every command
+*   3. the Bitwarden Password Manager vault, via the bundled `bw`
+*                         (`env` signs in and unlocks it for itself)
+*   4. ask, and offer to save it to `.env` (the default) or the vault, so
+*      this is the last time
+*
+* The ordering logic is separated from the four implementations because it is
+* the part that can be wrong invisibly. A chain that silently prefers a stale
+* environment variable over a rotated vault entry authenticates as the wrong
+* account and reports nothing, so the order is asserted rather than assumed.
+*/
+var NoAccessTokenError = class extends Error {};
+async function resolveToken(sources) {
+	const announce = sources.onSource ?? (() => void 0);
+	if (sources.explicit) {
+		announce("flag");
+		return sources.explicit;
+	}
+	if (sources.env) {
+		announce("environment");
+		return sources.env;
+	}
+	const stored = await sources.fromVault();
+	if (stored) {
+		announce("vault");
+		return stored;
+	}
+	const typed = await sources.prompt();
+	if (!typed) throw new NoAccessTokenError("No access token. Put BWS_ACCESS_TOKEN in your .env (an interactive run offers to do this for you), pass --access-token, or store one in your Bitwarden vault. See docs/toolkit/guides/env/commands.md.");
+	announce("prompt");
+	if (await sources.offerSave()) try {
+		await sources.save(typed);
+	} catch (err) {
+		log.warn(`Could not save to your vault: ${err instanceof Error ? err.message : String(err)}. Continuing with the token you typed.`);
+	}
+	return typed;
+}
+/**
+* A weak shape check, to turn a paste error into a sentence rather than a 401.
+*
+* Machine account tokens are `0.<uuid>.<secret>:<secret>`. This checks the
+* leading version segment only, and **warns rather than refuses**: the format
+* is Bitwarden's to change, and a tool that rejects a valid token because its
+* prefix moved is worse than one that passes a bad token to `bws` and lets the
+* real error surface.
+*/
+function looksLikeAccessToken(value) {
+	return /^\d+\.[0-9a-f-]{36}\./i.test(value.trim());
+}
+/** The interactive half. Masked, and never echoed back. */
+async function promptForToken() {
+	if (!process.stdin.isTTY) return void 0;
+	const typed = unwrap(await password({
+		message: "Paste the Secrets Manager access token for the `admin` account",
+		mask: "•",
+		validate: (v) => (v ?? "").trim() === "" ? "An access token is required." : void 0
+	})).trim();
+	if (!looksLikeAccessToken(typed)) log.warn("That does not look like a machine account access token (they start `0.<uuid>.`). Continuing anyway — if it is wrong, Bitwarden will say so.");
+	return typed;
+}
+//#endregion
+//#region src/bws/retry.ts
+/**
+* Retrying exactly one failure class: HTTP 429, rate limiting.
+*
+* A 429 is the server saying "correct request, wrong minute", the only error
+* where trying the same thing again IS the fix. Everything else (bad token,
+* missing project, malformed input) re-throws untouched on the first attempt,
+* because retrying those just triples the time to the real message.
+*
+* Written for the Secrets Manager calls, where the minute matters: a push is
+* ~45 sequential writes plus a login, several targets get pushed back-to-back,
+* and Bitwarden's identity endpoint rate-limits repeated access-token logins
+* aggressively. The login half is also fixed at the source, since the client
+* now caches its login in a state file, so the retry is the belt on that
+* suspender.
+*/
+function isRateLimited(err) {
+	const message = err instanceof Error ? err.message : String(err);
+	return /\b429\b|too many requests|rate.?limit/i.test(message);
+}
+const wait$1 = (ms) => new Promise((r) => setTimeout(r, ms));
+async function withRateLimitRetry(op, { retries = 3, baseMs = 5e3, sleep = wait$1, doing }) {
+	for (let attempt = 0;; attempt++) try {
+		return await op();
+	} catch (err) {
+		if (!isRateLimited(err) || attempt >= retries) throw err;
+		const ms = baseMs * 2 ** attempt;
+		log.warn(`Bitwarden rate-limited ${doing} (HTTP 429). Waiting ${ms / 1e3}s and retrying (${attempt + 1}/${retries})…`);
+		await sleep(ms);
+	}
+}
+//#endregion
+//#region src/bws/pace.ts
+const WRITE_GAP_MS = 1100;
+const wait = (ms) => new Promise((r) => setTimeout(r, ms));
+function makePacer(now = Date.now, sleep = wait) {
+	let notBefore = 0;
+	let chain = Promise.resolve();
+	return (kind) => {
+		const gap = kind === "write" ? WRITE_GAP_MS : 350;
+		const turn = chain.then(async () => {
+			const pause = notBefore - now();
+			if (pause > 0) await sleep(pause);
+			notBefore = now() + gap;
+		});
+		chain = turn.catch(() => void 0);
+		return turn;
+	};
+}
+//#endregion
+//#region src/bws/store.ts
+/**
+* Saving a prompted value into the developer's own `.env`.
+*
+* The development file only, by construction: the path is fixed to
+* `fileFor("development")`, so no caller can point this at a vault target's
+* file. Those are what `env push` uploads, and the values saved here
+* (`BWS_ACCESS_TOKEN`, `BWS_ORG_ID`) exist so they never ride a push. The
+* token is refused there by name anyway; this keeps the write from ever being
+* the thing that needs refusing.
+*
+* `EnvDocument.set` revives the commented line the rendered file already
+* carries (never-store keys ship as `# KEY=""` with their documentation), so a
+* saved value lands under its own doc comment rather than appended bare.
+*/
+async function saveToDevEnv(key, value) {
+	const { fileFor } = await loadEnv();
+	const path = resolve(findRepoRoot(), fileFor("development"));
+	let doc;
+	try {
+		doc = EnvDocument.parse(await readFile(path, "utf8"));
+	} catch {
+		doc = EnvDocument.empty();
+	}
+	doc.set(key, value);
+	await writeFile(path, doc.toString());
+}
+//#endregion
+//#region src/bws/client.ts
+/**
+* Secrets Manager, through the official SDK. No `bws` binary to install.
+*
+* This wrapped the `bws` CLI until 2026-08-19. The CLI was the right call
+* against the raw REST API: Secrets Manager is end-to-end encrypted, the
+* server stores ciphertext, and the client derives the key that opens it from
+* the access token, so `fetch` returns blobs and reimplementing the crypto is
+* not a trade worth making. `@bitwarden/sdk-napi` is that same client-side
+* crypto (the same Rust core the CLI wraps), loaded in-process, which buys two
+* things the CLI could not:
+*
+*   * **Nothing to install.** The SDK is a dependency of this package, so
+*     `pnpm install` is the whole setup. No "install bws from the releases
+*     page" step, and no version somebody's laptop drifted on.
+*   * **No credential in argv.** `bws secret create` took the VALUE as a
+*     positional argument, visible to `ps` for the length of the call, a
+*     documented property of the tool this wrapper could only apologize for.
+*     In-process values never touch a process table.
+*
+* ⚠️ Imported LAZILY, at the first real call. The SDK is a native module, and
+* loading it at import time would tax every `cli:no-env` path, the CI guards
+* included, with a `.node` binary none of them use.
+*
+* The one thing the SDK needs that the CLI did not: the ORGANIZATION ID. The
+* CLI derived it from the access token's login response; the SDK's every list
+* and create takes it as an argument, and nothing in its API discovers it. It
+* is a public identifier (a UUID that confers nothing), read from `BWS_ORG_ID`.
+* See the declaration in `packages/devtools/env.ts`.
+*/
+var BwsError = class extends Error {};
+/**
+* One pacer for the process: every Secrets Manager request funnels through
+* it, spaced under the published per-IP limits so the 429 retry stays a
+* backstop instead of the plan. See `pace.ts` for the numbers and sources.
+*/
+const pace = makePacer();
+let explicitToken;
+let resolved;
+/** Where a just-typed token goes, picked in `offerSave`, used in `save`. */
+let saveDestination = "no";
+/** Records `--access-token`, before any command runs. */
+function setExplicitAccessToken(token) {
+	explicitToken = token;
+	resolved = void 0;
+}
+/**
+* The access token, found once per process.
+*
+* Memoized as a **promise**, not a value: resolution can prompt, and a single
+* command makes several Secrets Manager calls. Caching the value alone would
+* still let two concurrent calls open two prompts over each other.
+*
+* Whatever the source, the token reaches the SDK as a function argument in
+* this process, never argv, never a child's environment.
+*/
+async function accessToken() {
+	resolved ??= resolveToken({
+		explicit: explicitToken,
+		env: process.env.BWS_ACCESS_TOKEN,
+		fromVault: readTokenFromVault,
+		prompt: promptForToken,
+		offerSave: async () => {
+			saveDestination = unwrap(await select({
+				message: "Save it, so this is the last time you paste it?",
+				options: [
+					{
+						value: "env",
+						label: "yes — into .env",
+						hint: "gitignored, this machine only; push refuses it by name"
+					},
+					{
+						value: "vault",
+						label: "yes — into my Bitwarden vault",
+						hint: "needs `pnpm devtools bw login`; follows you across machines"
+					},
+					{
+						value: "no",
+						label: "no — ask me again next time"
+					}
+				],
+				initialValue: "env"
+			}));
+			return saveDestination !== "no";
+		},
+		save: async (token) => {
+			if (saveDestination === "env") {
+				await saveToDevEnv("BWS_ACCESS_TOKEN", token);
+				log.success("Stored in .env — with-env loads it on every run.");
+				return;
+			}
+			if (await saveTokenToVault(token)) log.success(`Stored as "${VAULT_ITEM_NAME}" in your Bitwarden vault.`);
+			else log.warn("Could not save it. The command will continue with the token you typed; nothing was written to your vault.");
+		},
+		onSource: (source) => {
+			if (source === "flag") log.warn("--access-token puts a live credential in argv, where `ps` can read it for the length of the call, and in your shell history. Prefer BWS_ACCESS_TOKEN or the vault.");
+		}
+	}).catch((err) => {
+		resolved = void 0;
+		throw err instanceof NoAccessTokenError ? new BwsError(err.message) : err;
+	});
+	return resolved;
+}
+let resolvedOrgId;
+/**
+* The organization the machine account belongs to: the environment, else a
+* prompt with an offer to save.
+*
+* Prompted rather than only refused because it is the one Secrets Manager
+* input with nothing secret about it: a public UUID that identifies without
+* authorizing. Where nobody can answer (a pipe), the named refusal below is
+* the answer, because an SDK error about a malformed UUID would send somebody
+* debugging the token, which is the one thing that is fine.
+*/
+function organizationId() {
+	resolvedOrgId ??= (async () => {
+		const fromEnv = process.env.BWS_ORG_ID;
+		if (fromEnv) return fromEnv;
+		if (!process.stdin.isTTY) throw new BwsError("BWS_ORG_ID is not set. The Secrets Manager SDK addresses everything by organization id — a public UUID, shown in the Secrets Manager URL (bitwarden.com/#/sm/<org-id>/...) and on the machine-account page. Put it in your .env; it identifies, it does not authorize.");
+		const typed = unwrap(await text({
+			message: "What is the Bitwarden organization id? (the UUID in the Secrets Manager URL: bitwarden.com/#/sm/<org-id>/...)",
+			validate: (v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test((v ?? "").trim()) ? void 0 : "That is not a UUID."
+		})).trim();
+		try {
+			await saveToDevEnv("BWS_ORG_ID", typed);
+			log.success("Stored BWS_ORG_ID in .env.");
+		} catch (err) {
+			log.warn(`Could not save it to .env: ${err instanceof Error ? err.message : String(err)}. Continuing with the id you typed.`);
+		}
+		return typed;
+	})();
+	resolvedOrgId.catch(() => {
+		resolvedOrgId = void 0;
+	});
+	return resolvedOrgId;
+}
+/** The lazily-loaded, logged-in SDK client, one per process. */
+let sdk;
+/**
+* Where the SDK caches its login, so a process is not a fresh authentication.
+*
+* ⚠️ This file is what stops the 429s. Bitwarden's identity endpoint
+* rate-limits repeated access-token logins hard, and "push preflight, audit,
+* push staging, audit, push production, audit" is six devtools processes in
+* two minutes: six logins without this, ONE with it. The `bws` binary kept a
+* state directory for exactly this reason, and the SDK migration dropped it.
+* Per machine account (the token's client-id UUID is in the filename, public
+* by format), under 0700 directories, and outside the repository, because it
+* caches an auth token and must live where nothing syncs or commits it.
+*/
+function stateFileFor(accessToken) {
+	const clientId = /^\d+\.([0-9a-f-]{36})\./i.exec(accessToken)?.[1] ?? "default";
+	return join(homedir(), ".config", "devdogs-devtools", `bws-state-${clientId}.json`);
+}
+async function client() {
+	sdk ??= (async () => {
+		const token = await accessToken();
+		const { BitwardenClient } = await import("@bitwarden/sdk-napi");
+		const instance = new BitwardenClient();
+		try {
+			const stateFile = stateFileFor(token);
+			await mkdir(dirname(stateFile), {
+				recursive: true,
+				mode: 448
+			});
+			await withRateLimitRetry(async () => {
+				await pace("write");
+				return instance.auth().loginAccessToken(token, stateFile);
+			}, { doing: "the login" });
+		} catch (err) {
+			throw new BwsError(describeSdkFailure(err, "logging in"));
+		}
+		return instance;
+	})();
+	sdk.catch(() => {
+		sdk = void 0;
+	});
+	return sdk;
+}
+/**
+* Turns an SDK failure into something with a next step in it.
+*
+* The two that actually happen are a rejected token and a token that does not
+* cover the project. The latter surfaces as a bare "not found", because a
+* project you cannot see and a project that does not exist are deliberately
+* the same answer.
+*/
+function describeSdkFailure(err, doing) {
+	const message = err instanceof Error ? err.message : String(err);
+	if (/\b429\b|too many requests/i.test(message)) return `${message}\n\nBitwarden rate-limited this even after the automatic retries. Wait a minute and re-run — the login is cached in a state file now, so re-running does not spend another authentication.`;
+	if (/404|not.?found/i.test(message)) return `${message}\n\nA 404 here usually means the access token is valid but its machine account is not assigned to this project — Secrets Manager reports 'invisible' and 'absent' identically.`;
+	if (/401|unauthoriz|invalid|expired/i.test(message)) return `${message}\n\nThe access token was rejected while ${doing}. It may have been revoked or belong to another organization.`;
+	return message || `Secrets Manager failed with no message while ${doing}.`;
+}
+function iso(value) {
+	if (value instanceof Date) return value.toISOString();
+	if (typeof value === "string" && value !== "") return value;
+}
+/** Resolves a project name to its id. Names are unique within an org. */
+async function projectIdFor(name) {
+	const c = await client();
+	const org = await organizationId();
+	let projects;
+	try {
+		projects = (await withRateLimitRetry(async () => {
+			await pace("read");
+			return c.projects().list(org);
+		}, { doing: "listing projects" })).data;
+	} catch (err) {
+		throw new BwsError(describeSdkFailure(err, "listing projects"));
+	}
+	const match = projects.find((p) => p.name === name);
+	if (!match) {
+		const visible = projects.map((p) => p.name).sort();
+		throw new BwsError(`No project named "${name}".\n` + (visible.length > 0 ? `This token can see: ${visible.join(", ")}` : "This token can see no projects at all, which usually means the machine account has no project assignments yet."));
+	}
+	return match.id;
+}
+async function listSecrets(projectId) {
+	const c = await client();
+	const org = await organizationId();
+	try {
+		const identifiers = (await withRateLimitRetry(async () => {
+			await pace("read");
+			return c.secrets().list(org);
+		}, { doing: "listing secrets" })).data;
+		if (identifiers.length === 0) return [];
+		return (await withRateLimitRetry(async () => {
+			await pace("read");
+			return c.secrets().getByIds(identifiers.map((i) => i.id));
+		}, { doing: "reading secrets" })).data.filter((s) => s.projectId === projectId).map((s) => ({
+			id: s.id,
+			key: s.key,
+			value: s.value,
+			note: s.note,
+			projectId,
+			revisionDate: iso(s.revisionDate)
+		}));
+	} catch (err) {
+		throw new BwsError(describeSdkFailure(err, "listing secrets"));
+	}
+}
+async function createSecret(projectId, key, value, note) {
+	const c = await client();
+	const org = await organizationId();
+	try {
+		await withRateLimitRetry(async () => {
+			await pace("write");
+			return c.secrets().create(org, key, value, note, [projectId]);
+		}, { doing: `creating ${key}` });
+	} catch (err) {
+		throw new BwsError(describeSdkFailure(err, `creating ${key}`));
+	}
+}
+/**
+* Takes the whole secret rather than an id: the SDK's update is a full
+* replace (organization, key, project list included), and every caller
+* already holds the listed secret it is updating.
+*/
+async function updateSecret(secret, value, note) {
+	const c = await client();
+	const org = await organizationId();
+	try {
+		await withRateLimitRetry(async () => {
+			await pace("write");
+			return c.secrets().update(org, secret.id, secret.key, value, note, [secret.projectId]);
+		}, { doing: `updating ${secret.key}` });
+	} catch (err) {
+		throw new BwsError(describeSdkFailure(err, `updating ${secret.key}`));
+	}
+}
+function byKey(secrets) {
+	return new Map(secrets.map((s) => [s.key, s]));
+}
+//#endregion
+export { listSecrets as a, updateSecret as c, createSecret as i, accessToken as n, projectIdFor as o, byKey as r, setExplicitAccessToken as s, BwsError as t };

package/dist/client-DzXQHd58.js

@@ -0,0 +1,2 @@
+import { a as listSecrets, o as projectIdFor } from "./client-B7HhuTaA.js";
+export { listSecrets, projectIdFor };