@ebay-dt/bonfire-cli 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Bonfire contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,52 @@
+# `@ebay-dt/bonfire-cli`
+
+The Bonfire preparation command for local development.
+
+## Usage
+
+Add the package to an application and run this before Next.js development:
+
+```json
+{
+  "scripts": {
+    "dev": "bonfire prepare && next dev"
+  }
+}
+```
+
+```sh
+bonfire prepare [--root <application-root>]
+```
+
+`prepare` validates `BF_SESSION_SECRET` from the process environment when it
+is supplied. Otherwise it safely creates or updates `<root>/.env.local` with
+32 random bytes encoded as hexadecimal, without rotating an existing valid
+secret. It also ensures `.env.local` is ignored by `<root>/.gitignore`.
+
+For values already in `.env.local`, the command accepts only literal values:
+unquoted `#`, `$` variable expansion, and malformed or multiline quotes are
+rejected. This keeps the value validated by Bonfire identical to the value
+loaded by Next.js. Put secrets requiring other dotenv syntax in the process
+environment instead.
+
+The command never invokes GitHub CLI, loads application configuration, or
+prints the secret. It exits with `0` on success, `1` on validation or
+filesystem failure, and `2` for invalid command syntax.
+
+## Branch preparation
+
+Before starting Next.js in development, run:
+
+```sh
+bonfire branch prepare --root <application-root> --hostname <hostname>
+```
+
+The command loads environment values with Next-compatible precedence and
+honors `BF_DISABLE_AUTO_BRANCH_SWITCH=true`. Disabled mode performs no GitHub
+CLI or Git operation. When switching is enabled, `BF_PROTOTYPE_BASE_BRANCH`
+overrides the default `main` base branch and must name an existing local or
+fetched branch; preparation fails rather than silently using another branch. When enabled, an already-authenticated GitHub CLI user
+is prepared on their login branch through `@ebay-dt/bonfire-node`. Missing or
+unauthenticated GitHub CLI is a successful deferred result; other failures
+return exit code `1`. The command never starts interactive authentication or
+prints identity, credentials, paths, or Git output.

package/dist/bin.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=bin.d.ts.map

package/dist/bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.d.ts","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":""}

package/dist/bin.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { run } from "./command.js";
+const exitCode = await run();
+process.exitCode = exitCode;
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,MAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAC;AAC7B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC"}

package/dist/branch-prepare.d.ts

@@ -0,0 +1,14 @@
+import { type GitHubCliClientLike, type PrototypeLifecycle } from "@ebay-dt/bonfire-node";
+import type { BranchPrepareCommandOptions } from "./command.js";
+export type CliEnvironmentLoader = (root: string) => Readonly<Record<string, string | undefined>>;
+export type BranchPrepareDependencies = {
+    environment?: Readonly<Record<string, string | undefined>>;
+    loadEnvironment?: CliEnvironmentLoader;
+    githubCli?: GitHubCliClientLike;
+    lifecycle?: Pick<PrototypeLifecycle, "prepareBranch">;
+};
+export declare class BranchPrepareError extends Error {
+    constructor(message: string);
+}
+export declare function runBranchPrepare(options: BranchPrepareCommandOptions, dependencies: BranchPrepareDependencies): Promise<number>;
+//# sourceMappingURL=branch-prepare.d.ts.map

package/dist/branch-prepare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-prepare.d.ts","sourceRoot":"","sources":["../src/branch-prepare.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,KACT,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAElD,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,SAAS,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;CACvD,CAAC;AAEF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAMD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,2BAA2B,EACpC,YAAY,EAAE,yBAAyB,GACtC,OAAO,CAAC,MAAM,CAAC,CAiDjB"}

package/dist/branch-prepare.js

@@ -0,0 +1,51 @@
+import nextEnv from "@next/env";
+import { parseAutomaticBranchSwitchSetting, parseHostname, } from "@ebay-dt/bonfire-core";
+import { GitHubCliClient, GitHubCliError, LocalPrototypeLifecycle, } from "@ebay-dt/bonfire-node";
+import { resolve } from "node:path";
+export class BranchPrepareError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BranchPrepareError";
+    }
+}
+function loadEnvironment(root) {
+    return nextEnv.loadEnvConfig(root, true, undefined, false).combinedEnv;
+}
+export async function runBranchPrepare(options, dependencies) {
+    const root = resolve(options.root);
+    const environment = dependencies.environment ??
+        dependencies.loadEnvironment?.(root) ??
+        loadEnvironment(root);
+    const mode = parseAutomaticBranchSwitchSetting(environment.BF_DISABLE_AUTO_BRANCH_SWITCH);
+    const hostname = parseHostname(options.hostname);
+    if (mode === "disabled") {
+        console.log("Automatic branch switching is disabled.");
+        return 0;
+    }
+    const githubCli = dependencies.githubCli ?? new GitHubCliClient({ hostname });
+    let identity;
+    try {
+        identity = await githubCli.getUser();
+    }
+    catch (error) {
+        if (error instanceof GitHubCliError &&
+            (error.reason === "missing" || error.reason === "unauthenticated")) {
+            console.log("Branch preparation deferred; GitHub CLI authentication is not available.");
+            return 0;
+        }
+        throw new BranchPrepareError("Unable to resolve GitHub CLI identity.");
+    }
+    const lifecycle = dependencies.lifecycle ??
+        new LocalPrototypeLifecycle({
+            repositoryRoot: root,
+            primaryBranch: environment.BF_PROTOTYPE_BASE_BRANCH,
+            automaticBranchSwitch: mode,
+        });
+    const result = await lifecycle.prepareBranch(identity);
+    if (!result.ok) {
+        throw new BranchPrepareError(`Branch preparation failed with ${result.error.code}.`);
+    }
+    console.log("Branch preparation complete.");
+    return 0;
+}
+//# sourceMappingURL=branch-prepare.js.map

package/dist/branch-prepare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branch-prepare.js","sourceRoot":"","sources":["../src/branch-prepare.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EACL,iCAAiC,EACjC,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,cAAc,EACd,uBAAuB,GAGxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAoC,EACpC,YAAuC;IAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,WAAW,GACf,YAAY,CAAC,WAAW;QACxB,YAAY,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,iCAAiC,CAC5C,WAAW,CAAC,6BAA6B,CAC1C,CAAC;IACF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEjD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK,YAAY,cAAc;YAC/B,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,CAAC,EAClE,CAAC;YACD,OAAO,CAAC,GAAG,CACT,0EAA0E,CAC3E,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,wCAAwC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,SAAS,GACb,YAAY,CAAC,SAAS;QACtB,IAAI,uBAAuB,CAAC;YAC1B,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,WAAW,CAAC,wBAAwB;YACnD,qBAAqB,EAAE,IAAI;SAC5B,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/command.d.ts

@@ -0,0 +1,16 @@
+import { type BranchPrepareDependencies } from "./branch-prepare.js";
+export declare class CliSyntaxError extends Error {
+    constructor(message: string);
+}
+export type PrepareCommandOptions = {
+    root: string;
+};
+export type BranchPrepareCommandOptions = {
+    root: string;
+    hostname: string;
+};
+type CliCommandOptions = PrepareCommandOptions | BranchPrepareCommandOptions;
+export declare function parseArgs(argv: readonly string[]): CliCommandOptions;
+export declare function run(argv?: readonly string[], dependencies?: BranchPrepareDependencies): Promise<number>;
+export {};
+//# sourceMappingURL=command.d.ts.map

package/dist/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,qBAAqB,CAAC;AAE7B,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,iBAAiB,GAAG,qBAAqB,GAAG,2BAA2B,CAAC;AA6E7E,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAQpE;AAED,wBAAsB,GAAG,CACvB,IAAI,GAAE,SAAS,MAAM,EAA0B,EAC/C,YAAY,GAAE,yBAA8B,GAC3C,OAAO,CAAC,MAAM,CAAC,CAuCjB"}

package/dist/command.js

@@ -0,0 +1,113 @@
+import { prepare, PrepareError } from "./prepare.js";
+import { BranchPrepareError, runBranchPrepare, } from "./branch-prepare.js";
+export class CliSyntaxError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CliSyntaxError";
+    }
+}
+function parseRootOption(argv, start) {
+    const value = argv[start + 1];
+    if (!value || value.startsWith("--")) {
+        throw new CliSyntaxError("The --root option requires a value");
+    }
+    return { root: value, nextIndex: start + 2 };
+}
+function parsePrepareArgs(argv) {
+    let root = process.cwd();
+    let rootProvided = false;
+    for (let index = 1; index < argv.length;) {
+        if (argv[index] !== "--root") {
+            throw new CliSyntaxError(`Unknown option: ${argv[index]}`);
+        }
+        if (rootProvided) {
+            throw new CliSyntaxError("The --root option may only be provided once");
+        }
+        const parsed = parseRootOption(argv, index);
+        root = parsed.root;
+        rootProvided = true;
+        index = parsed.nextIndex;
+    }
+    return { root };
+}
+function parseBranchPrepareArgs(argv) {
+    let root = process.cwd();
+    let hostname;
+    let rootProvided = false;
+    let hostnameProvided = false;
+    for (let index = 2; index < argv.length;) {
+        const option = argv[index];
+        if (option === "--root") {
+            if (rootProvided) {
+                throw new CliSyntaxError("The --root option may only be provided once");
+            }
+            const parsed = parseRootOption(argv, index);
+            root = parsed.root;
+            rootProvided = true;
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (option === "--hostname") {
+            if (hostnameProvided) {
+                throw new CliSyntaxError("The --hostname option may only be provided once");
+            }
+            const value = argv[index + 1];
+            if (!value || value.startsWith("--")) {
+                throw new CliSyntaxError("The --hostname option requires a value");
+            }
+            hostname = value;
+            hostnameProvided = true;
+            index += 2;
+            continue;
+        }
+        throw new CliSyntaxError(`Unknown option: ${option}`);
+    }
+    if (hostname === undefined) {
+        throw new CliSyntaxError("Usage: bonfire branch prepare --root <application-root> --hostname <hostname>");
+    }
+    return { root, hostname };
+}
+export function parseArgs(argv) {
+    if (argv[0] === "prepare")
+        return parsePrepareArgs(argv);
+    if (argv[0] === "branch" && argv[1] === "prepare") {
+        return parseBranchPrepareArgs(argv);
+    }
+    throw new CliSyntaxError("Usage: bonfire prepare [--root <application-root>] | bonfire branch prepare --root <application-root> --hostname <hostname>");
+}
+export async function run(argv = process.argv.slice(2), dependencies = {}) {
+    const isBranchPrepare = argv[0] === "branch";
+    try {
+        const options = parseArgs(argv);
+        if ("hostname" in options) {
+            return await runBranchPrepare(options, dependencies);
+        }
+        const result = await prepare(options);
+        const descriptions = {
+            environment: "the process environment",
+            existing: ".env.local",
+            generated: "a newly generated value in .env.local",
+        };
+        console.log(`Bonfire preparation complete; BF_SESSION_SECRET came from ${descriptions[result.source]}.`);
+        return 0;
+    }
+    catch (error) {
+        if (error instanceof CliSyntaxError) {
+            console.error(`bonfire: ${error.message}`);
+            return 2;
+        }
+        if (isBranchPrepare) {
+            const message = error instanceof BranchPrepareError
+                ? error.message
+                : "Unable to load branch preparation configuration.";
+            console.error(`bonfire branch prepare failed: ${message}`);
+            return 1;
+        }
+        const message = error instanceof PrepareError || error instanceof Error
+            ? error.message
+            : "an unknown error occurred";
+        console.error(`bonfire prepare failed: ${message}`);
+        return 1;
+    }
+}
+//# sourceMappingURL=command.js.map

package/dist/command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.js","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAaD,SAAS,eAAe,CACtB,IAAuB,EACvB,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,cAAc,CAAC,oCAAoC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,cAAc,CAAC,mBAAmB,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,cAAc,CAAC,6CAA6C,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACnB,YAAY,GAAG,IAAI,CAAC;QACpB,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAuB;IAEvB,IAAI,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,QAA4B,CAAC;IACjC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,cAAc,CAAC,6CAA6C,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACnB,YAAY,GAAG,IAAI,CAAC;YACpB,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;YACzB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,IAAI,gBAAgB,EAAE,CAAC;gBACrB,MAAM,IAAI,cAAc,CACtB,iDAAiD,CAClD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,cAAc,CAAC,wCAAwC,CAAC,CAAC;YACrE,CAAC;YACD,QAAQ,GAAG,KAAK,CAAC;YACjB,gBAAgB,GAAG,IAAI,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,cAAc,CACtB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,cAAc,CACtB,6HAA6H,CAC9H,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAAI,GAAsB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAC/C,YAAY,GAA8B,EAAE;IAE5C,MAAM,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,YAAY,GAAG;YACnB,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,uCAAuC;SAC1C,CAAC;QACX,OAAO,CAAC,GAAG,CACT,6DAA6D,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAC5F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,OAAO,GACX,KAAK,YAAY,kBAAkB;gBACjC,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,kDAAkD,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,OAAO,GACX,KAAK,YAAY,YAAY,IAAI,KAAK,YAAY,KAAK;YACrD,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,2BAA2B,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/env-file.d.ts

@@ -0,0 +1,25 @@
+export declare const BONFIRE_SESSION_SECRET = "BF_SESSION_SECRET";
+export declare const SESSION_SECRET_BYTES = 32;
+export type SecretGenerator = () => string;
+export type ParsedEnvEntry = {
+    key: string;
+    value: string;
+    line: number;
+    valueStart: number;
+    valueEnd: number;
+    quote: '"' | "'" | null;
+};
+export declare class SessionSecretError extends Error {
+    constructor(message?: string);
+}
+export declare class SessionSecretSyntaxError extends Error {
+    constructor(message?: string);
+}
+export declare function validateSessionSecret(value: unknown): asserts value is string;
+export declare function generateSessionSecret(): string;
+export declare function parseEnvEntries(content: string): ParsedEnvEntry[];
+export declare function validateLiteralSessionSecretEntry(content: string, entry: ParsedEnvEntry): void;
+export declare function replaceOrAppendSecret(content: string, secret: string): string;
+export declare function readEnvFile(path: string): Promise<string | null>;
+export declare function writeFileAtomically(path: string, content: string, mode?: number): Promise<void>;
+//# sourceMappingURL=env-file.d.ts.map

package/dist/env-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.d.ts","sourceRoot":"","sources":["../src/env-file.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,MAAM,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC;AAE3C,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;CACzB,CAAC;AAOF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YACE,OAAO,SAA2D,EAInE;CACF;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,SAA+C,EAGjE;CACF;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAO7E;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AA4GD,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAgBjE;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,cAAc,GACpB,IAAI,CA6CN;AAQD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAsC7E;AAoBD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAItE;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,SAAQ,GACX,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/env-file.js

@@ -0,0 +1,257 @@
+import { randomBytes } from "node:crypto";
+import { chmod, lstat, open, readFile, rename, unlink } from "node:fs/promises";
+import { dirname, join } from "node:path";
+export const BONFIRE_SESSION_SECRET = "BF_SESSION_SECRET";
+export const SESSION_SECRET_BYTES = 32;
+export class SessionSecretError extends Error {
+    constructor(message = "BF_SESSION_SECRET must contain at least 32 UTF-8 bytes") {
+        super(message);
+        this.name = "SessionSecretError";
+    }
+}
+export class SessionSecretSyntaxError extends Error {
+    constructor(message = "BF_SESSION_SECRET must use a literal value") {
+        super(message);
+        this.name = "SessionSecretSyntaxError";
+    }
+}
+export function validateSessionSecret(value) {
+    if (typeof value !== "string" ||
+        Buffer.byteLength(value, "utf8") < SESSION_SECRET_BYTES) {
+        throw new SessionSecretError();
+    }
+}
+export function generateSessionSecret() {
+    return randomBytes(SESSION_SECRET_BYTES).toString("hex");
+}
+function syntaxError(message) {
+    throw new SessionSecretSyntaxError(`BF_SESSION_SECRET ${message}`);
+}
+function splitLines(content) {
+    const lines = [];
+    let start = 0;
+    for (let index = 0; index < content.length; index += 1) {
+        if (content[index] !== "\n" && content[index] !== "\r")
+            continue;
+        const ending = content[index] === "\r" && content[index + 1] === "\n"
+            ? "\r\n"
+            : (content[index] ?? "");
+        lines.push({ text: content.slice(start, index), ending });
+        start = index + ending.length;
+        if (ending.length === 2)
+            index += 1;
+    }
+    if (start < content.length)
+        lines.push({ text: content.slice(start), ending: "" });
+    return lines;
+}
+function firstUnescapedQuote(text, quote) {
+    for (let index = 1; index < text.length; index += 1) {
+        if (text[index] !== quote || text[index - 1] === "\\")
+            continue;
+        let slashes = 0;
+        for (let previous = index - 1; previous >= 0 && text[previous] === "\\"; previous -= 1) {
+            slashes += 1;
+        }
+        if (slashes % 2 === 0)
+            return index;
+    }
+    return -1;
+}
+function decodeQuotedValue(value, quote) {
+    if (quote === "'")
+        return value;
+    return value.replace(/\\([\\"nrt])/g, (_match, escaped) => {
+        switch (escaped) {
+            case "n":
+                return "\n";
+            case "r":
+                return "\r";
+            case "t":
+                return "\t";
+            default:
+                return escaped;
+        }
+    });
+}
+function parseValue(line, afterEquals) {
+    let start = afterEquals;
+    while (/\s/.test(line[start] ?? ""))
+        start += 1;
+    if (start >= line.length || line[start] === "#") {
+        return {
+            value: "",
+            valueStart: afterEquals,
+            valueEnd: afterEquals,
+            quote: null,
+        };
+    }
+    const firstCharacter = line[start];
+    const quote = firstCharacter === '"' ? '"' : firstCharacter === "'" ? "'" : null;
+    if (quote) {
+        const close = firstUnescapedQuote(line.slice(start), quote);
+        if (close >= 0) {
+            const end = start + close + 1;
+            const rest = line.slice(end).trimStart();
+            if (rest.length === 0 || rest.startsWith("#")) {
+                return {
+                    value: decodeQuotedValue(line.slice(start + 1, end - 1), quote),
+                    valueStart: start,
+                    valueEnd: end,
+                    quote,
+                };
+            }
+        }
+    }
+    let end = line.length;
+    for (let index = start; index < line.length; index += 1) {
+        if (line[index] === "#") {
+            end = index;
+            break;
+        }
+    }
+    while (end > start && /\s/.test(line[end - 1] ?? ""))
+        end -= 1;
+    return {
+        value: line.slice(start, end),
+        valueStart: start,
+        valueEnd: end,
+        quote: null,
+    };
+}
+export function parseEnvEntries(content) {
+    const entries = [];
+    for (const [index, line] of splitLines(content).entries()) {
+        const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line.text);
+        if (!match)
+            continue;
+        const fullMatch = match[0];
+        const key = match[1];
+        if (!fullMatch || !key)
+            continue;
+        const afterEquals = fullMatch.length;
+        const parsed = parseValue(line.text, afterEquals);
+        entries.push({ key, line: index, ...parsed });
+    }
+    return entries;
+}
+export function validateLiteralSessionSecretEntry(content, entry) {
+    const line = splitLines(content)[entry.line]?.text;
+    if (line === undefined)
+        syntaxError("has an invalid assignment");
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+    if (!match || match[1] !== BONFIRE_SESSION_SECRET) {
+        syntaxError("has an invalid assignment");
+    }
+    const rawValue = line.slice(match[0].length).trim();
+    if (rawValue.length === 0 || rawValue.startsWith("#"))
+        return;
+    if (rawValue.startsWith('"') ||
+        rawValue.startsWith("'") ||
+        rawValue.startsWith("`")) {
+        if (rawValue.startsWith("`")) {
+            syntaxError("must not use unsupported backtick quoting");
+        }
+        const quote = rawValue[0] === '"' ? '"' : "'";
+        const close = firstUnescapedQuote(rawValue, quote);
+        if (close < 0)
+            syntaxError("must not contain an unterminated or multiline quote");
+        const quotedValue = rawValue.slice(1, close);
+        const remainder = rawValue.slice(close + 1).trimStart();
+        if (remainder.length > 0 && !remainder.startsWith("#")) {
+            syntaxError("must use a complete quoted value");
+        }
+        if (quotedValue.includes("$")) {
+            syntaxError("must not use variable expansion");
+        }
+        if (quotedValue.includes("\\")) {
+            syntaxError("must not use escape sequences");
+        }
+        return;
+    }
+    if (rawValue.includes("#")) {
+        syntaxError("must not contain # in an unquoted value");
+    }
+    if (rawValue.includes("$")) {
+        syntaxError("must not use variable expansion");
+    }
+}
+function newlineFor(content) {
+    if (content.includes("\r\n"))
+        return "\r\n";
+    if (content.includes("\r"))
+        return "\r";
+    return "\n";
+}
+export function replaceOrAppendSecret(content, secret) {
+    validateSessionSecret(secret);
+    const lines = splitLines(content);
+    const entries = parseEnvEntries(content).filter((entry) => entry.key === BONFIRE_SESSION_SECRET);
+    if (entries.length > 1) {
+        throw new SessionSecretError("Multiple BF_SESSION_SECRET assignments were found");
+    }
+    if (entries.length === 1) {
+        const entry = entries[0];
+        if (!entry)
+            throw new SessionSecretError("BF_SESSION_SECRET assignment was not found");
+        const line = lines[entry.line];
+        if (!line)
+            throw new SessionSecretError("BF_SESSION_SECRET line was not found");
+        const replacement = entry.quote
+            ? `${entry.quote}${secret}${entry.quote}`
+            : secret;
+        line.text = `${line.text.slice(0, entry.valueStart)}${replacement}${line.text.slice(entry.valueEnd)}`;
+        const result = lines.map(({ text, ending }) => text + ending).join("");
+        return result.endsWith("\n") || result.endsWith("\r")
+            ? result
+            : `${result}${newlineFor(content)}`;
+    }
+    const newline = newlineFor(content);
+    const suffix = content.length === 0 || content.endsWith("\n") || content.endsWith("\r")
+        ? ""
+        : newline;
+    return `${content}${suffix}${BONFIRE_SESSION_SECRET}=${secret}${newline}`;
+}
+async function existingMode(path) {
+    try {
+        const stats = await lstat(path);
+        if (stats.isSymbolicLink())
+            throw new Error(`Refusing to follow symlink: ${path}`);
+        return stats.mode & 0o7777;
+    }
+    catch (error) {
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+export async function readEnvFile(path) {
+    const mode = await existingMode(path);
+    if (mode === undefined)
+        return null;
+    return readFile(path, "utf8");
+}
+export async function writeFileAtomically(path, content, mode = 0o600) {
+    const currentMode = await existingMode(path);
+    const fileMode = currentMode ?? mode;
+    const temporaryPath = join(dirname(path), `.${path.split(/[\\/]/).pop() ?? "bonfire"}.tmp-${process.pid}-${randomBytes(8).toString("hex")}`);
+    let handle;
+    try {
+        handle = await open(temporaryPath, "wx", fileMode);
+        await handle.writeFile(content, "utf8");
+        await handle.close();
+        handle = undefined;
+        await rename(temporaryPath, path);
+        if (currentMode !== undefined)
+            await chmod(path, currentMode);
+    }
+    finally {
+        if (handle)
+            await handle.close().catch(() => undefined);
+        await unlink(temporaryPath).catch(() => undefined);
+    }
+}
+//# sourceMappingURL=env-file.js.map

package/dist/env-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../src/env-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAkBvC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YACE,OAAO,GAAG,wDAAwD;QAElE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,4CAA4C;QAChE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,oBAAoB,EACvD,CAAC;QACD,MAAM,IAAI,kBAAkB,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,WAAW,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,IAAI,wBAAwB,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,SAAS;QAEjE,MAAM,MAAM,GACV,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;YACpD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,CAAC,MAAM;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAgB;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,SAAS;QAChE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KACE,IAAI,QAAQ,GAAG,KAAK,GAAG,CAAC,EACxB,QAAQ,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EACxC,QAAQ,IAAI,CAAC,EACb,CAAC;YACD,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,KAAgB;IACxD,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,OAAe,EAAE,EAAE;QAChE,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd,KAAK,GAAG;gBACN,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,OAAO,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,WAAmB;IACnD,IAAI,KAAK,GAAG,WAAW,CAAC;IACxB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,KAAK,IAAI,CAAC,CAAC;IAEhD,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QAChD,OAAO;YACL,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GACT,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,OAAO;oBACL,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC;oBAC/D,UAAU,EAAE,KAAK;oBACjB,QAAQ,EAAE,GAAG;oBACb,KAAK;iBACN,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACxB,GAAG,GAAG,KAAK,CAAC;YACZ,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IAE/D,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;QAC7B,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,GAAG;QACb,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,gDAAgD,CAAC,IAAI,CACjE,IAAI,CAAC,IAAI,CACV,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG;YAAE,SAAS;QACjC,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAAe,EACf,KAAqB;IAErB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACnD,IAAI,IAAI,KAAK,SAAS;QAAE,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAEjE,MAAM,KAAK,GAAG,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,sBAAsB,EAAE,CAAC;QAClD,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAE9D,IACE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EACxB,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,WAAW,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,KAAK,GAAc,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,KAAK,GAAG,CAAC;YACX,WAAW,CAAC,qDAAqD,CAAC,CAAC;QAErE,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACxD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,WAAW,CAAC,iCAAiC,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,WAAW,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,WAAW,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,WAAW,CAAC,iCAAiC,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,MAAc;IACnE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,MAAM,CAC7C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAChD,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,mDAAmD,CACpD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,kBAAkB,CAC1B,4CAA4C,CAC7C,CAAC;QACJ,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK;YAC7B,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE;YACzC,CAAC,CAAC,MAAM,CAAC;QACX,IAAI,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtG,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YACnD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,GAAG,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC;IACd,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,sBAAsB,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,cAAc,EAAE;YACxB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ;YAEvB,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,OAAe,EACf,IAAI,GAAG,KAAK;IAEZ,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,WAAW,IAAI,IAAI,CAAC;IACrC,MAAM,aAAa,GAAG,IAAI,CACxB,OAAO,CAAC,IAAI,CAAC,EACb,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAClG,CAAC;IAEF,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/gitignore.d.ts

@@ -0,0 +1,5 @@
+export declare const BONFIRE_GITIGNORE_BLOCK = "# Bonfire local secrets\n.env.local";
+export declare function isEnvLocalIgnored(content: string): boolean;
+export declare function addManagedGitignoreBlock(content: string): string;
+export declare function ensureEnvLocalIgnored(root: string): Promise<boolean>;
+//# sourceMappingURL=gitignore.d.ts.map

package/dist/gitignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,uBAAuB,wCAAwC,CAAC;AAmC7E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAY1D;AAQD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQhE;AAiBD,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU1E"}

package/dist/gitignore.js

@@ -0,0 +1,95 @@
+import { lstat } from "node:fs/promises";
+import { join } from "node:path";
+import { readEnvFile, writeFileAtomically } from "./env-file.js";
+export const BONFIRE_GITIGNORE_BLOCK = "# Bonfire local secrets\n.env.local";
+function globRegex(pattern) {
+    let expression = "";
+    for (let index = 0; index < pattern.length; index += 1) {
+        const character = pattern[index];
+        if (!character)
+            continue;
+        if (character === "*" && pattern[index + 1] === "*") {
+            expression += ".*";
+            index += 1;
+        }
+        else if (character === "*") {
+            expression += "[^/]*";
+        }
+        else if (character === "?") {
+            expression += "[^/]";
+        }
+        else {
+            expression += character.replace(/[\\^$+?.()|[\]{}]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${expression}$`);
+}
+function patternMatchesTarget(pattern, target) {
+    let normalized = pattern.trimEnd();
+    if (normalized.startsWith("/"))
+        normalized = normalized.slice(1);
+    if (normalized.length === 0)
+        return false;
+    if (normalized.startsWith("**/")) {
+        normalized = normalized.slice(3);
+        return globRegex(normalized).test(target);
+    }
+    if (!normalized.includes("/"))
+        return globRegex(normalized).test(target);
+    return globRegex(normalized).test(target);
+}
+export function isEnvLocalIgnored(content) {
+    let ignored = false;
+    for (const line of content.split(/\r\n|\n|\r/)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const negated = trimmed.startsWith("!") && !trimmed.startsWith("\\!");
+        const pattern = negated ? trimmed.slice(1) : trimmed;
+        if (!patternMatchesTarget(pattern, ".env.local"))
+            continue;
+        ignored = !negated;
+    }
+    return ignored;
+}
+function newlineFor(content) {
+    if (content.includes("\r\n"))
+        return "\r\n";
+    if (content.includes("\r"))
+        return "\r";
+    return "\n";
+}
+export function addManagedGitignoreBlock(content) {
+    if (isEnvLocalIgnored(content))
+        return content;
+    const newline = newlineFor(content);
+    const separator = content.length === 0 || content.endsWith("\n") || content.endsWith("\r")
+        ? ""
+        : newline;
+    return `${content}${separator}${BONFIRE_GITIGNORE_BLOCK.replaceAll("\n", newline)}${newline}`;
+}
+async function isSymlink(path) {
+    try {
+        return (await lstat(path)).isSymbolicLink();
+    }
+    catch (error) {
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+export async function ensureEnvLocalIgnored(root) {
+    const path = join(root, ".gitignore");
+    const content = await readEnvFile(path);
+    if (content !== null && isEnvLocalIgnored(content))
+        return false;
+    if (await isSymlink(path))
+        throw new Error("Refusing to modify symlinked .gitignore");
+    const nextContent = addManagedGitignoreBlock(content ?? "");
+    await writeFileAtomically(path, nextContent, 0o644);
+    return true;
+}
+//# sourceMappingURL=gitignore.js.map

package/dist/gitignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEjE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAE7E,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,SAAS,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpD,UAAU,IAAI,IAAI,CAAC;YACnB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC7B,UAAU,IAAI,OAAO,CAAC;QACxB,CAAC;aAAM,IAAI,SAAS,KAAK,GAAG,EAAE,CAAC;YAC7B,UAAU,IAAI,MAAM,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,UAAU,IAAI,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,MAAc;IAC3D,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrD,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC;YAAE,SAAS;QAC3D,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACtD,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,SAAS,GACb,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC;IACd,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,uBAAuB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ;YAEvB,OAAO,KAAK,CAAC;QACf,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAE7D,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,mBAAmB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/dist/prepare.d.ts

@@ -0,0 +1,17 @@
+import { type SecretGenerator } from "./env-file.js";
+export type PrepareSecretSource = "environment" | "existing" | "generated";
+export type PrepareOptions = {
+    root: string;
+    environment?: Readonly<Record<string, string | undefined>>;
+    generateSecret?: SecretGenerator;
+};
+export type PrepareResult = {
+    source: PrepareSecretSource;
+    envFilePath: string | null;
+    gitignoreChanged: boolean;
+};
+export declare class PrepareError extends Error {
+    constructor(message: string);
+}
+export declare function prepare(options: PrepareOptions): Promise<PrepareResult>;
+//# sourceMappingURL=prepare.d.ts.map

package/dist/prepare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare.d.ts","sourceRoot":"","sources":["../src/prepare.ts"],"names":[],"mappings":"AACA,OAAO,EASL,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAGvB,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,UAAU,GAAG,WAAW,CAAC;AAE3E,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,cAAc,CAAC,EAAE,eAAe,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,qBAAa,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAQD,wBAAsB,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA8E7E"}

package/dist/prepare.js

@@ -0,0 +1,95 @@
+import { join, resolve } from "node:path";
+import { generateSessionSecret, parseEnvEntries, BONFIRE_SESSION_SECRET, readEnvFile, replaceOrAppendSecret, validateLiteralSessionSecretEntry, validateSessionSecret, writeFileAtomically, } from "./env-file.js";
+import { ensureEnvLocalIgnored } from "./gitignore.js";
+export class PrepareError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PrepareError";
+    }
+}
+function hasEnvironmentEntry(environment) {
+    return Object.hasOwn(environment, BONFIRE_SESSION_SECRET);
+}
+export async function prepare(options) {
+    const root = resolve(options.root);
+    const environment = options.environment ?? process.env;
+    if (hasEnvironmentEntry(environment)) {
+        try {
+            validateSessionSecret(environment[BONFIRE_SESSION_SECRET]);
+        }
+        catch {
+            throw new PrepareError("BF_SESSION_SECRET from the process environment is invalid");
+        }
+        return {
+            source: "environment",
+            envFilePath: null,
+            gitignoreChanged: false,
+        };
+    }
+    const envFilePath = join(root, ".env.local");
+    let content;
+    try {
+        content = await readEnvFile(envFilePath);
+    }
+    catch (error) {
+        throw operationalError("Unable to read .env.local", error);
+    }
+    const entries = parseEnvEntries(content ?? "").filter((entry) => entry.key === BONFIRE_SESSION_SECRET);
+    if (entries.length > 1) {
+        throw new PrepareError(".env.local contains duplicate BF_SESSION_SECRET assignments");
+    }
+    const entry = entries[0];
+    if (entry) {
+        try {
+            validateLiteralSessionSecretEntry(content ?? "", entry);
+        }
+        catch (error) {
+            if (error instanceof Error)
+                throw new PrepareError(error.message);
+            throw new PrepareError("BF_SESSION_SECRET assignment is invalid");
+        }
+    }
+    if (entry && entry.value.length > 0) {
+        try {
+            validateSessionSecret(entry.value);
+        }
+        catch {
+            throw new PrepareError("BF_SESSION_SECRET in .env.local is invalid");
+        }
+        const gitignoreChanged = await protectEnvFile(root);
+        return { source: "existing", envFilePath, gitignoreChanged };
+    }
+    const gitignoreChanged = await protectEnvFile(root);
+    const generate = options.generateSecret ?? generateSessionSecret;
+    let secret;
+    try {
+        secret = generate();
+        validateSessionSecret(secret);
+    }
+    catch (error) {
+        if (error instanceof PrepareError)
+            throw error;
+        throw new PrepareError("Unable to generate a valid BF_SESSION_SECRET");
+    }
+    const nextContent = replaceOrAppendSecret(content ?? "", secret);
+    try {
+        await writeFileAtomically(envFilePath, nextContent, 0o600);
+    }
+    catch (error) {
+        throw operationalError("Unable to write .env.local", error);
+    }
+    return { source: "generated", envFilePath, gitignoreChanged };
+}
+async function protectEnvFile(root) {
+    try {
+        return await ensureEnvLocalIgnored(root);
+    }
+    catch (error) {
+        throw operationalError("Unable to protect .env.local with .gitignore", error);
+    }
+}
+function operationalError(context, error) {
+    const detail = error instanceof Error ? error.message : "an unknown filesystem error";
+    return new PrepareError(`${context}: ${detail}`);
+}
+//# sourceMappingURL=prepare.js.map

package/dist/prepare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare.js","sourceRoot":"","sources":["../src/prepare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,qBAAqB,EACrB,iCAAiC,EACjC,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAgBvD,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,WAAyD;IAEzD,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAuB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAEvD,IAAI,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,qBAAqB,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CACpB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC7C,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CACnD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAChD,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CACpB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,iCAAiC,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK;gBAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,IAAI,YAAY,CAAC,yCAAyC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,YAAY,CAAC,4CAA4C,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAEpD,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC;IACjE,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,EAAE,CAAC;QACpB,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,YAAY;YAAE,MAAM,KAAK,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,8CAA8C,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,gBAAgB,CACpB,8CAA8C,EAC9C,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,KAAc;IACvD,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,CAAC;IACzE,OAAO,IAAI,YAAY,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@ebay-dt/bonfire-cli",
+  "version": "0.1.0-alpha.0",
+  "description": "The Bonfire command-line tool.",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "bonfire": "./dist/bin.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.corp.ebay.com/Design-Technology/bonfire",
+    "directory": "packages/cli"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@next/env": "16.3.4",
+    "@ebay-dt/bonfire-core": "0.1.0-alpha.0",
+    "@ebay-dt/bonfire-node": "0.1.0-alpha.0"
+  },
+  "devDependencies": {
+    "@repo/eslint-config": "0.0.0",
+    "@repo/typescript-config": "0.0.0",
+    "@types/node": "20.19.43",
+    "eslint": "10.9.1",
+    "typescript": "7.0.2",
+    "vitest": "^5.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && node scripts/set-bin-mode.mjs",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint .",
+    "pretest": "pnpm build",
+    "test": "vitest run --passWithNoTests --exclude 'dist/**'"
+  }
+}