@hubble-ventures/infisicml 2.0.0 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +37 -0
- package/README.md +61 -56
- package/dist/commands/export-gha.d.ts.map +1 -1
- package/dist/commands/export-gha.js +4 -4
- package/dist/commands/export-gha.js.map +1 -1
- package/dist/commands/paths.d.ts.map +1 -1
- package/dist/commands/paths.js +4 -4
- package/dist/commands/paths.js.map +1 -1
- package/dist/commands/pull.d.ts.map +1 -1
- package/dist/commands/pull.js +12 -9
- package/dist/commands/pull.js.map +1 -1
- package/dist/commands/run.d.ts.map +1 -1
- package/dist/commands/run.js +4 -4
- package/dist/commands/run.js.map +1 -1
- package/dist/commands/validate.js +2 -2
- package/dist/commands/validate.js.map +1 -1
- package/dist/config.d.ts +4 -3
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js.map +1 -1
- package/dist/hooks.d.ts +2 -2
- package/dist/hooks.js +2 -2
- package/dist/index.d.ts +2 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -2
- package/dist/index.js.map +1 -1
- package/dist/manifest.d.ts +45 -0
- package/dist/manifest.d.ts.map +1 -1
- package/dist/manifest.js +70 -2
- package/dist/manifest.js.map +1 -1
- package/dist/registry.d.ts +28 -5
- package/dist/registry.d.ts.map +1 -1
- package/dist/registry.js +38 -13
- package/dist/registry.js.map +1 -1
- package/package.json +2 -1
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,41 @@ All notable changes to `infisicml` are documented here. The format follows
|
|
|
4
4
|
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres
|
|
5
5
|
to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
6
6
|
|
|
7
|
+
## [2.1.0] - 2026-07-18
|
|
8
|
+
|
|
9
|
+
### Added
|
|
10
|
+
|
|
11
|
+
- **YAML manifests, as the primary format.** Each package's manifest may now be
|
|
12
|
+
`secrets.yaml`, `secrets.yml`, or `secrets.json` — the same schema either way.
|
|
13
|
+
YAML is the default and reads best for hand-authored manifests; JSON stays
|
|
14
|
+
fully supported (handy for generated manifests). Discovery prefers YAML, but a
|
|
15
|
+
directory containing **more than one** manifest file is a **hard error** rather
|
|
16
|
+
than a silent pick — a stale extra manifest must never change which secret tree
|
|
17
|
+
a non-interactive lane (`export-gha` → `GITHUB_ENV`) writes. No migration is
|
|
18
|
+
required — existing `secrets.json` files keep working unchanged.
|
|
19
|
+
|
|
20
|
+
```yaml
|
|
21
|
+
# secrets.yaml
|
|
22
|
+
secrets:
|
|
23
|
+
- clerk:
|
|
24
|
+
- CLERK_PUBLISHABLE_KEY: VITE_CLERK_PUBLISHABLE_KEY
|
|
25
|
+
- posthog:
|
|
26
|
+
- POSTHOG_PROJECT_TOKEN
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
The ambiguity error is **scoped to the package actually being loaded**:
|
|
30
|
+
discovery now enumerates packages without parsing them, so a single ambiguous
|
|
31
|
+
(or invalid) directory no longer aborts commands that don't touch it — `pull web`
|
|
32
|
+
or `paths web` succeed even if an unrelated `apps/legacy/` holds two manifests;
|
|
33
|
+
only a command that loads that package (`pull legacy`, `pull` with no ids,
|
|
34
|
+
`list`, `validate`) surfaces the error.
|
|
35
|
+
|
|
36
|
+
New public API: `findManifestFile`, `hasManifestFile`, `loadManifestFromDir`,
|
|
37
|
+
`parseManifestFile`, `MANIFEST_FILENAMES`, the `ManifestFile` / `ManifestFormat`
|
|
38
|
+
types, plus `discoverPackages` / `loadPackage` and the `PackageRef` type for
|
|
39
|
+
two-phase (enumerate-then-load) discovery. A discovered `PackageManifest` now
|
|
40
|
+
carries the `file` it was loaded from.
|
|
41
|
+
|
|
7
42
|
## [2.0.0] - 2026-07-17
|
|
8
43
|
|
|
9
44
|
### Changed (breaking — manifest format)
|
|
@@ -163,6 +198,8 @@ changes to either ship only in a new major.
|
|
|
163
198
|
- **Published JSON Schema** for `secrets.json`, served from
|
|
164
199
|
`https://cdn.jsdelivr.net/npm/@hubble-ventures/infisicml@1/schema/secrets.schema.json`.
|
|
165
200
|
|
|
201
|
+
[2.1.0]: https://github.com/hubble-ventures/infisicml/releases/tag/v2.1.0
|
|
202
|
+
[2.0.0]: https://github.com/hubble-ventures/infisicml/releases/tag/v2.0.0
|
|
166
203
|
[1.2.0]: https://github.com/hubble-ventures/infisicml/releases/tag/v1.2.0
|
|
167
204
|
[1.1.0]: https://github.com/hubble-ventures/infisicml/releases/tag/v1.1.0
|
|
168
205
|
[1.0.0]: https://github.com/hubble-ventures/infisicml/releases/tag/v1.0.0
|
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
**Infisical Secret Orchestration** — federated, per-package secret manifests for monorepos, unified across local development and CI.
|
|
4
4
|
|
|
5
|
-
[Infisical](https://infisical.com) gives you a vault and the primitives to read from it (a CLI, a REST API, machine-identity auth, a GitHub Action). All of those operate on **one folder / one environment / one process at a time**. Infisicml is the layer above that: it lets each package in a monorepo declare which vault folders it needs in a committed `secrets.
|
|
5
|
+
[Infisical](https://infisical.com) gives you a vault and the primitives to read from it (a CLI, a REST API, machine-identity auth, a GitHub Action). All of those operate on **one folder / one environment / one process at a time**. Infisicml is the layer above that: it lets each package in a monorepo declare which vault folders it needs in a committed manifest (`secrets.yaml`, or `secrets.json`), then materializes those secrets **the same way** whether you're a developer running a local pull or a CI job exporting into `GITHUB_ENV`.
|
|
6
6
|
|
|
7
7
|
> Infisicml orchestrates Infisical. It stores no secrets and never sees your vault contents at rest — the vault, auth, and secret values stay in Infisical.
|
|
8
8
|
|
|
@@ -10,11 +10,11 @@
|
|
|
10
10
|
|
|
11
11
|
| Problem | Native Infisical | Infisicml |
|
|
12
12
|
|---|---|---|
|
|
13
|
-
| N packages each need a different slice of the vault | Hand-write export commands per app×folder | One committed `secrets.json` per package, auto-discovered |
|
|
13
|
+
| N packages each need a different slice of the vault | Hand-write export commands per app×folder | One committed manifest (`secrets.yaml`/`.json`) per package, auto-discovered |
|
|
14
14
|
| Dev uses the CLI, CI uses the API | Two integrations kept in sync by hand | One `SecretsProvider` abstraction; identical downstream logic |
|
|
15
15
|
| Vault names a secret once, but Vite wants `VITE_*` and Next wants `NEXT_PUBLIC_*` | Each workflow re-derives the prefixed copy | Declare `aliases` once; applied in dev **and** CI |
|
|
16
16
|
| Skip the pull in CI when vars are already injected | Bash guards in every workflow | `ci.skipWhenEnv` / `ci.stubInCi` policy |
|
|
17
|
-
| A deploy needs exactly the runtime keys, not the deploy creds | Hand-maintained allowlist | `profiles` + `advertiseKeys` hook —
|
|
17
|
+
| A deploy needs exactly the runtime keys, not the deploy creds | Hand-maintained allowlist | `profiles` + `advertiseKeys` hook — the manifest is the source of truth |
|
|
18
18
|
| A client must read a shared vendor folder without ever receiving its server secrets | Split the vault or accept over-fetch | `fetch: "keys"` requests only the named keys — the vault never transmits the rest |
|
|
19
19
|
|
|
20
20
|
## Install
|
|
@@ -40,45 +40,51 @@ Requires the [`infisical` CLI](https://infisical.com/docs/cli/overview) for loca
|
|
|
40
40
|
});
|
|
41
41
|
```
|
|
42
42
|
|
|
43
|
-
2. Add a `secrets.
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
]
|
|
69
|
-
}
|
|
43
|
+
2. Add a `secrets.yaml` next to each package (YAML is the primary format;
|
|
44
|
+
`secrets.json` is equally supported — see the note below). `secrets` is an
|
|
45
|
+
**array of folders** mirroring your Infisical structure; each folder is
|
|
46
|
+
`name: [ ...contents ]`. Inside a folder's array, a **bare string** is a
|
|
47
|
+
plain key, an entry with a **string value** `SOURCE: TARGET` is an alias, and
|
|
48
|
+
an entry with an **array value** `sub: [ ... ]` is a subfolder. Every emitted
|
|
49
|
+
key is named (default-deny; there is no wildcard).
|
|
50
|
+
|
|
51
|
+
```yaml
|
|
52
|
+
# yaml-language-server: $schema=https://cdn.jsdelivr.net/npm/@hubble-ventures/infisicml@2/schema/secrets.schema.json
|
|
53
|
+
output: .env # written next to this manifest; defaults to .env.secrets
|
|
54
|
+
secrets:
|
|
55
|
+
# Canonical vault key → the prefixed name a build tool expects.
|
|
56
|
+
- clerk:
|
|
57
|
+
- CLERK_PUBLISHABLE_KEY: VITE_CLERK_PUBLISHABLE_KEY
|
|
58
|
+
# Fan one canonical key out to several prefixes: repeat the alias, one
|
|
59
|
+
# target each (an array value would mean a subfolder, not multi-target).
|
|
60
|
+
- google:
|
|
61
|
+
- GOOGLE_MAPS_API_KEY: EXPO_PUBLIC_GOOGLE_MAPS_API_KEY
|
|
62
|
+
- GOOGLE_MAPS_API_KEY: VITE_GOOGLE_MAPS_API_KEY
|
|
63
|
+
- posthog:
|
|
64
|
+
- POSTHOG_PROJECT_TOKEN
|
|
65
|
+
# A real Infisical subfolder at /posthog/eu.
|
|
66
|
+
- eu:
|
|
67
|
+
- POSTHOG_EU_HOST
|
|
70
68
|
```
|
|
71
69
|
|
|
72
70
|
An alias entry emits **both** its canonical name and the target. Keys you
|
|
73
71
|
don't name are never pulled, so a client package can share a vendor folder yet
|
|
74
72
|
emit only the public key — the server secret is simply undeclared.
|
|
75
73
|
|
|
74
|
+
> **Format:** each package's manifest may be `secrets.yaml`, `secrets.yml`, or
|
|
75
|
+
> `secrets.json` — the same schema either way. YAML is the default and reads
|
|
76
|
+
> best for hand-authored manifests; JSON is handy for generated ones. If a
|
|
77
|
+
> directory has more than one, `secrets.yaml` wins. See
|
|
78
|
+
> [`examples/yaml/secrets.yaml`](./examples/yaml/secrets.yaml) and
|
|
79
|
+
> [`examples/json/secrets.json`](./examples/json/secrets.json) for the same manifest in
|
|
80
|
+
> both formats.
|
|
81
|
+
|
|
76
82
|
3. Pull secrets into gitignored `.env.secrets` files:
|
|
77
83
|
|
|
78
84
|
```bash
|
|
79
85
|
npx infisicml pull # every package
|
|
80
86
|
npx infisicml pull web api --force # specific ids, bypass the exists-check
|
|
81
|
-
npx infisicml validate # check every
|
|
87
|
+
npx infisicml validate # check every manifest against the schema
|
|
82
88
|
```
|
|
83
89
|
|
|
84
90
|
See [`examples/`](./examples) for a fuller config and manifest.
|
|
@@ -90,7 +96,7 @@ See [`examples/`](./examples) for a fuller config and manifest.
|
|
|
90
96
|
| `pull [ids...]` | Write `.env.secrets` locally (uses `infisical export`) |
|
|
91
97
|
| `export-gha <id>` | Mask + append secrets to `GITHUB_ENV` (REST API + GitHub OIDC) |
|
|
92
98
|
| `list` | Show every manifest's folder tree and declared keys |
|
|
93
|
-
| `validate` | Validate every
|
|
99
|
+
| `validate` | Validate every manifest against the schema |
|
|
94
100
|
| `paths <id>` | Print resolved folder paths (`--comma` for scripting) |
|
|
95
101
|
| `run <id> -- <cmd...>` | Thin `infisical run` wrapper (prefer `pull` + `.env.secrets`) |
|
|
96
102
|
|
|
@@ -139,18 +145,18 @@ Log in once as yourself; infisicml shells out to `infisical export` under your s
|
|
|
139
145
|
|
|
140
146
|
```bash
|
|
141
147
|
infisical login # authenticate as you
|
|
142
|
-
npx infisicml pull # write .env.secrets next to every
|
|
148
|
+
npx infisicml pull # write .env.secrets next to every manifest
|
|
143
149
|
```
|
|
144
150
|
|
|
145
151
|
Load `.env.secrets` however your dev runtime already loads env files. See [`examples/local-dev.md`](./examples/local-dev.md) for package-script and task-runner wiring.
|
|
146
152
|
|
|
147
153
|
## Concepts
|
|
148
154
|
|
|
149
|
-
- **Manifest (`secrets.json`)** — per package: `secrets` (an array of folders → keys), optional `profiles`, `fetch`, `ci`, `environments`, `output`.
|
|
150
|
-
- **Output file** — `output` sets the written filename (default `.env.secrets`), placed **next to the manifest**. Because each package owns its own
|
|
151
|
-
- **Secrets tree** — an **array of folders** mirroring your Infisical vault; each folder is `
|
|
155
|
+
- **Manifest (`secrets.yaml` or `secrets.json`)** — per package: `secrets` (an array of folders → keys), optional `profiles`, `fetch`, `ci`, `environments`, `output`. YAML is the default format; JSON is equally supported. When a directory has both, `secrets.yaml` wins.
|
|
156
|
+
- **Output file** — `output` sets the written filename (default `.env.secrets`), placed **next to the manifest**. Because each package owns its own manifest, this gives a distinct file per package: a root manifest with `"output": ".env.local"` writes the repo-root `.env.local`; a manifest in `apps/backend` with `"output": ".env"` writes `apps/backend/.env`. `output` is a filename only (no path separators) — to target a different directory, place the manifest in that directory.
|
|
157
|
+
- **Secrets tree** — an **array of folders** mirroring your Infisical vault; each folder is `name: [ ...contents ]`. Inside the array: a bare string is a plain key, a mapping with a string value `SOURCE: TARGET` is an alias, and a mapping with an array value `sub: [ ... ]` is a real subfolder. Every emitted key is named — there is no wildcard, so a folder never leaks a key you didn't declare (default-deny). See [Key selection](#key-selection-the-tree-is-the-allowlist) below.
|
|
152
158
|
- **Profiles** — named alternate trees that *replace* the base `secrets` when `--profile` is set. The base tree is runtime secrets; a profile can add deploy/release folders (e.g. `fly`).
|
|
153
|
-
- **Aliases** — an alias entry `
|
|
159
|
+
- **Aliases** — an alias entry `SOURCE: TARGET` maps a canonical vault key to one target. To fan a single key out to every framework prefix (`EXPO_PUBLIC_*`, `VITE_*`, `NEXT_PUBLIC_*`), repeat the entry — one target each (an array value means a subfolder). Both the canonical name and each target are emitted. Real secrets of a target name always win; the operation is idempotent and never overwrites.
|
|
154
160
|
- **Fetch mode** — `fetch: "keys"` requests only the declared keys, so the vault never transmits the rest (wire-level least privilege). Default `"folder"` reads whole folders and selects the declared keys locally. See [Wire-level least privilege](#wire-level-least-privilege-fetch-keys) below.
|
|
155
161
|
- **CI skip/stub** — `ci.skipWhenEnv` skips the pull when all listed vars are already set in CI; `ci.stubInCi` always stubs in CI. Both write a `.env.secrets` from `process.env` instead of calling Infisical.
|
|
156
162
|
- **Optional keys** — `environments.<slug>.optionalKeys` downgrade a missing declared key to a `::notice::` instead of a failure.
|
|
@@ -169,15 +175,15 @@ A web/mobile client needs **only** the publishable key. Because the tree is defa
|
|
|
169
175
|
name that one key and nothing else is pulled — `STRIPE_SECRET_KEY` is simply never declared,
|
|
170
176
|
so it can't reach a Vite/Expo client build's env (or, via the CI action, `GITHUB_ENV`).
|
|
171
177
|
|
|
172
|
-
```
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
178
|
+
```yaml
|
|
179
|
+
# apps/web/secrets.yaml — a client package
|
|
180
|
+
secrets:
|
|
181
|
+
- stripe:
|
|
182
|
+
- STRIPE_PUBLISHABLE_KEY: EXPO_PUBLIC_STRIPE_PUBLISHABLE_KEY
|
|
183
|
+
- google:
|
|
184
|
+
- GOOGLE_MAPS_API_KEY: EXPO_PUBLIC_GOOGLE_MAPS_API_KEY
|
|
185
|
+
- vercel:
|
|
186
|
+
- VERCEL_AUTOMATION_BYPASS_SECRET
|
|
181
187
|
```
|
|
182
188
|
|
|
183
189
|
The written `.env.secrets` (and, in CI, `GITHUB_ENV`) contains **only** the declared keys and
|
|
@@ -202,15 +208,14 @@ machine / the CI runner — they're just never written to `.env` or `GITHUB_ENV`
|
|
|
202
208
|
setups that's fine. When you need the vault to **not even transmit** the secrets you don't
|
|
203
209
|
use, set `fetch: "keys"`:
|
|
204
210
|
|
|
205
|
-
```
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
212
|
-
|
|
213
|
-
}
|
|
211
|
+
```yaml
|
|
212
|
+
# apps/web/secrets.yaml — client package, strict wire-level least privilege
|
|
213
|
+
fetch: keys
|
|
214
|
+
secrets:
|
|
215
|
+
- stripe:
|
|
216
|
+
- STRIPE_PUBLISHABLE_KEY: EXPO_PUBLIC_STRIPE_PUBLISHABLE_KEY
|
|
217
|
+
- google:
|
|
218
|
+
- GOOGLE_MAPS_API_KEY
|
|
214
219
|
```
|
|
215
220
|
|
|
216
221
|
In `keys` mode infisicml reads **only** the declared keys. Where the guarantee bites depends on
|
|
@@ -309,7 +314,7 @@ works if you ever need it.
|
|
|
309
314
|
|
|
310
315
|
## Design
|
|
311
316
|
|
|
312
|
-
Everything repo-specific lives in `infisicml.config` — package discovery, the project-id source, the OIDC audience, and deploy-time key advertisement are all configuration, so nothing about one repo's layout is baked into the tool. The manifest contract (`secrets.json`) is the stable public interface, versioned via the [published JSON Schema](./schema/secrets.schema.json).
|
|
317
|
+
Everything repo-specific lives in `infisicml.config` — package discovery, the project-id source, the OIDC audience, and deploy-time key advertisement are all configuration, so nothing about one repo's layout is baked into the tool. The manifest contract (`secrets.yaml` or `secrets.json`) is the stable public interface, versioned via the [published JSON Schema](./schema/secrets.schema.json).
|
|
313
318
|
|
|
314
319
|
## License
|
|
315
320
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"export-gha.d.ts","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,cAAc,EAAE,EAC5B,WAAW,EAAE,cAAc,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB9C;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"export-gha.d.ts","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,cAAc,EAAE,EAC5B,WAAW,EAAE,cAAc,EAAE,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B;IAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB9C;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyE3E"}
|
|
@@ -6,7 +6,7 @@ import { runAdvertiseKeysHooks } from "../hooks.js";
|
|
|
6
6
|
import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
|
|
7
7
|
import { resolveOptionalKeys } from "../optional-keys.js";
|
|
8
8
|
import { RemoteProvider } from "../providers/remote.js";
|
|
9
|
-
import {
|
|
9
|
+
import { discoverPackages, loadPackage } from "../registry.js";
|
|
10
10
|
/**
|
|
11
11
|
* Canonical (pre-alias) key names to advertise, split runtime vs all.
|
|
12
12
|
*
|
|
@@ -48,11 +48,11 @@ export async function runExportGha(options) {
|
|
|
48
48
|
if (!projectSlug) {
|
|
49
49
|
throw new Error("INFISICAL_PROJECT_SLUG required");
|
|
50
50
|
}
|
|
51
|
-
const
|
|
52
|
-
|
|
53
|
-
if (!manifest) {
|
|
51
|
+
const ref = discoverPackages(config).find((p) => p.id === options.packageId);
|
|
52
|
+
if (!ref) {
|
|
54
53
|
throw new Error(`Unknown package id: ${options.packageId}`);
|
|
55
54
|
}
|
|
55
|
+
const manifest = loadPackage(ref);
|
|
56
56
|
// The base tree holds the app's runtime secrets; a profile (e.g. `deploy`)
|
|
57
57
|
// may replace it with a superset that also carries deploy-time credentials.
|
|
58
58
|
const allFolders = resolveCompiledFolders(manifest.config, options.profile);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"export-gha.js","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"export-gha.js","sourceRoot":"","sources":["../../src/commands/export-gha.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAa/D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAA4B,EAC5B,WAA6B,EAC7B,OAA+B;IAE/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,SAAS;YAC7C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrB,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAyB;IAC1D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,gBAAgB,CAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAC9C,CAAC;IACF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAClC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;QAClC,MAAM,EAAE,MAAM,CAAC,eAAe;QAC9B,WAAW;QACX,UAAU;QACV,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,MAAM,CAAC,IAAI,EAAE,YAAY;KACnE,CAAC,CAAC;IAEH,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CACT,0BAA0B,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,GAAG,CAC1E,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,8EAA8E;IAC9E,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,QAAQ,EACR,OAAO,EACP,UAAU,EACV,SAAS,CACV,CAAC;IACF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,kBAAkB,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/D,wBAAwB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEhD,iEAAiE;IACjE,8EAA8E;IAC9E,4EAA4E;IAC5E,+CAA+C;IAC/C,qBAAqB,CACnB,aAAa,EACb,MAAM,CAAC,KAAK,EAAE,aAAa,EAC3B,oBAAoB,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CACtD,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCnE"}
|
package/dist/commands/paths.js
CHANGED
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
import { loadConfig } from "../config.js";
|
|
2
2
|
import { normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, } from "../manifest.js";
|
|
3
|
-
import {
|
|
3
|
+
import { discoverPackages, loadPackage } from "../registry.js";
|
|
4
4
|
export async function runPaths(options) {
|
|
5
5
|
const config = await loadConfig(options.cwd);
|
|
6
|
-
const
|
|
7
|
-
|
|
8
|
-
if (!manifest) {
|
|
6
|
+
const ref = discoverPackages(config).find((p) => p.id === options.packageId);
|
|
7
|
+
if (!ref) {
|
|
9
8
|
throw new Error(`Unknown package id: ${options.packageId}`);
|
|
10
9
|
}
|
|
10
|
+
const manifest = loadPackage(ref);
|
|
11
11
|
const folders = resolveCompiledFolders(manifest.config, options.profile);
|
|
12
12
|
const normalized = folders.map((f) => normalizeFolderPath(f.path));
|
|
13
13
|
// `paths` feeds the infisical CLI, which fetches whole folders — the tree's
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/commands/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAS/D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAClC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEnE,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,iCAAiC;IACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,WAAW,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CACX,WAAW,OAAO,CAAC,SAAS,6GAA6G,CAC1I,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,
|
|
1
|
+
{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6EjE"}
|
package/dist/commands/pull.js
CHANGED
|
@@ -3,7 +3,7 @@ import { loadConfig } from "../config.js";
|
|
|
3
3
|
import { shouldSkipInfisicalPull } from "../ci-skip.js";
|
|
4
4
|
import { commandExists, LocalProvider } from "../providers/local.js";
|
|
5
5
|
import { pullManifest } from "../pull.js";
|
|
6
|
-
import {
|
|
6
|
+
import { discoverPackages, loadPackage } from "../registry.js";
|
|
7
7
|
export async function runPull(options) {
|
|
8
8
|
const config = await loadConfig(options.cwd);
|
|
9
9
|
const repoRoot = config.repoRoot;
|
|
@@ -11,27 +11,30 @@ export async function runPull(options) {
|
|
|
11
11
|
if (!config.projectId) {
|
|
12
12
|
throw new Error("INFISICAL_PROJECT_ID not resolved — set config.projectId, projectIdEnvFile, or the INFISICAL_PROJECT_ID env var");
|
|
13
13
|
}
|
|
14
|
-
|
|
14
|
+
// Select target packages first, then load only those — so an unrelated
|
|
15
|
+
// package with an ambiguous or invalid manifest never blocks a scoped pull.
|
|
16
|
+
let targets = discoverPackages(config);
|
|
15
17
|
if (options.here) {
|
|
16
18
|
const cwd = process.cwd();
|
|
17
|
-
const match =
|
|
19
|
+
const match = targets.find((p) => resolve(p.dir) === resolve(cwd));
|
|
18
20
|
if (!match) {
|
|
19
|
-
throw new Error(`No secrets
|
|
21
|
+
throw new Error(`No secrets manifest in ${cwd}`);
|
|
20
22
|
}
|
|
21
|
-
|
|
23
|
+
targets = [match];
|
|
22
24
|
}
|
|
23
25
|
else if (options.ids.length > 0) {
|
|
24
26
|
const allowed = new Set(options.ids);
|
|
25
|
-
|
|
26
|
-
const missing = options.ids.filter((id) => !
|
|
27
|
+
targets = targets.filter((p) => allowed.has(p.id));
|
|
28
|
+
const missing = options.ids.filter((id) => !targets.some((p) => p.id === id));
|
|
27
29
|
if (missing.length > 0) {
|
|
28
30
|
throw new Error(`Unknown package id(s): ${missing.join(", ")}`);
|
|
29
31
|
}
|
|
30
32
|
}
|
|
31
|
-
if (
|
|
32
|
-
console.log("No secrets
|
|
33
|
+
if (targets.length === 0) {
|
|
34
|
+
console.log("No secrets manifests found.");
|
|
33
35
|
return;
|
|
34
36
|
}
|
|
37
|
+
const manifests = targets.map(loadPackage);
|
|
35
38
|
// The infisical CLI is only needed for manifests that will actually pull.
|
|
36
39
|
// Mirror pullManifest's own skip decision exactly so CI stubs never demand a
|
|
37
40
|
// tool they don't use.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../src/commands/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAY/D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAoB;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC;IAEzD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,4EAA4E;IAC5E,IAAI,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEvC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAChC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAC1C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAE3C,0EAA0E;IAC1E,6EAA6E;IAC7E,uBAAuB;IACvB,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CACzD,CAAC;IAEF,IAAI,cAAc,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,CAAC;;YAChC,OAAO,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,WAAW,MAAM,YAAY,OAAO,aAAa,SAAS,CAAC,MAAM,eAAe,CACjF,CAAC;AACJ,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,
|
|
1
|
+
{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,wBAAsB,OAAO,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAqClE"}
|
package/dist/commands/run.js
CHANGED
|
@@ -2,16 +2,16 @@ import { spawnSync } from "node:child_process";
|
|
|
2
2
|
import { loadConfig } from "../config.js";
|
|
3
3
|
import { normalizeEnvSlug } from "../env-slug.js";
|
|
4
4
|
import { normalizeFolderPath, resolveCompiledFolders } from "../manifest.js";
|
|
5
|
-
import {
|
|
5
|
+
import { discoverPackages, loadPackage } from "../registry.js";
|
|
6
6
|
export async function runExec(options) {
|
|
7
7
|
const config = await loadConfig(options.cwd);
|
|
8
8
|
const repoRoot = config.repoRoot;
|
|
9
9
|
const envName = normalizeEnvSlug(process.env.INFISICAL_ENV ?? options.env);
|
|
10
|
-
const
|
|
11
|
-
|
|
12
|
-
if (!manifest) {
|
|
10
|
+
const ref = discoverPackages(config).find((p) => p.id === options.packageId);
|
|
11
|
+
if (!ref) {
|
|
13
12
|
throw new Error(`Unknown package id: ${options.packageId}`);
|
|
14
13
|
}
|
|
14
|
+
const manifest = loadPackage(ref);
|
|
15
15
|
if (process.env.INFISICAL_DISABLE === "1") {
|
|
16
16
|
const result = spawnSync(options.command[0], options.command.slice(1), {
|
|
17
17
|
stdio: "inherit",
|
package/dist/commands/run.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAU/D,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAmB;IAC/C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAClC,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrE,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,QAAQ;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvC,QAAQ;QACR,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,SAAS,CACtB,WAAW,EACX,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EACnE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,CACpC,CAAC;IAEF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC"}
|
|
@@ -5,10 +5,10 @@ export async function runValidate(cwd) {
|
|
|
5
5
|
const config = await loadConfig(cwd);
|
|
6
6
|
const manifests = discoverManifests(config);
|
|
7
7
|
let errors = 0;
|
|
8
|
-
for (const { id,
|
|
8
|
+
for (const { id, config: m, file } of manifests) {
|
|
9
9
|
const result = secretsManifestSchema.safeParse(m);
|
|
10
10
|
if (!result.success) {
|
|
11
|
-
console.error(`❌ ${id} (${
|
|
11
|
+
console.error(`❌ ${id} (${file.path}):`);
|
|
12
12
|
for (const issue of result.error.issues) {
|
|
13
13
|
console.error(` ${issue.path.join(".")}: ${issue.message}`);
|
|
14
14
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,EAAE,EAAE,
|
|
1
|
+
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/commands/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAY;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;YACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,IAAI,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,sBAAsB,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,oBAAoB,CAAC,CAAC;AACzD,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* How Infisicml discovers per-package
|
|
3
|
-
* driven entirely by config, so no repo layout is
|
|
2
|
+
* How Infisicml discovers per-package secrets manifests (`secrets.yaml`, or
|
|
3
|
+
* `secrets.json`). Discovery is driven entirely by config, so no repo layout is
|
|
4
|
+
* baked into the tool.
|
|
4
5
|
*/
|
|
5
6
|
export type DiscoveryConfig = {
|
|
6
7
|
/**
|
|
7
8
|
* Parent directories scanned one level deep. Any immediate child directory
|
|
8
|
-
* containing a
|
|
9
|
+
* containing a secrets manifest becomes a package whose id is the child dir
|
|
9
10
|
* name (e.g. `roots: ["nextjs-apps", "vite-apps"]`).
|
|
10
11
|
*/
|
|
11
12
|
roots?: string[];
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,CAAC,EAAE;QACL,wDAAwD;QACxD,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,KAAK,CAAC,EAAE;QACN,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;KACrC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,eAAe,GAAG;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAErE;AAqDD,wBAAsB,UAAU,CAAC,GAAG,SAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAY7E"}
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA0D1C,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;CACtB,CAAC;AAEF,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClC,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,QAAQ,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAoB,CAAC;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAElD,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAuB;IACjE,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC9E,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,oBAAoB;gBAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACtE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAClD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC"}
|
package/dist/hooks.d.ts
CHANGED
|
@@ -10,8 +10,8 @@ export declare function keysForScope(hook: AdvertiseKeysHook, input: AdvertiseIn
|
|
|
10
10
|
* Write each configured `advertiseKeys` hook's key list to GITHUB_ENV as a
|
|
11
11
|
* plain (unmasked, non-secret) comma-separated var. Key NAMES only — values are
|
|
12
12
|
* never advertised. A deploy step forwards exactly these keys by value from the
|
|
13
|
-
* job env, so
|
|
14
|
-
* the app (no hand-maintained allowlist in the workflow).
|
|
13
|
+
* job env, so the secrets manifest stays the single source of truth for what
|
|
14
|
+
* lands on the app (no hand-maintained allowlist in the workflow).
|
|
15
15
|
*/
|
|
16
16
|
export declare function runAdvertiseKeysHooks(githubEnvPath: string, hooks: AdvertiseKeysHook[] | undefined, input: AdvertiseInput): void;
|
|
17
17
|
//# sourceMappingURL=hooks.d.ts.map
|
package/dist/hooks.js
CHANGED
|
@@ -7,8 +7,8 @@ export function keysForScope(hook, input) {
|
|
|
7
7
|
* Write each configured `advertiseKeys` hook's key list to GITHUB_ENV as a
|
|
8
8
|
* plain (unmasked, non-secret) comma-separated var. Key NAMES only — values are
|
|
9
9
|
* never advertised. A deploy step forwards exactly these keys by value from the
|
|
10
|
-
* job env, so
|
|
11
|
-
* the app (no hand-maintained allowlist in the workflow).
|
|
10
|
+
* job env, so the secrets manifest stays the single source of truth for what
|
|
11
|
+
* lands on the app (no hand-maintained allowlist in the workflow).
|
|
12
12
|
*/
|
|
13
13
|
export function runAdvertiseKeysHooks(githubEnvPath, hooks, input) {
|
|
14
14
|
for (const hook of hooks ?? []) {
|
package/dist/index.d.ts
CHANGED
|
@@ -6,12 +6,12 @@ export { normalizeEnvSlug } from "./env-slug.js";
|
|
|
6
6
|
export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
|
|
7
7
|
export { type AdvertiseInput, keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
|
|
8
8
|
export { enforceKnownKeys } from "./include.js";
|
|
9
|
-
export { loadManifestJson, normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, type SecretsManifest, secretsManifestSchema, } from "./manifest.js";
|
|
9
|
+
export { findManifestFile, hasManifestFile, loadManifestFromDir, loadManifestJson, MANIFEST_FILENAMES, MANIFEST_LABEL, type ManifestFile, type ManifestFormat, normalizeFolderPath, parseManifestFile, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, type SecretsManifest, secretsManifestSchema, } from "./manifest.js";
|
|
10
10
|
export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
|
|
11
11
|
export { commandExists, LocalProvider } from "./providers/local.js";
|
|
12
12
|
export { RemoteProvider } from "./providers/remote.js";
|
|
13
13
|
export type { SecretsProvider } from "./providers/types.js";
|
|
14
14
|
export { type PullResult, pullManifest, writeInjectedSecretsStub, } from "./pull.js";
|
|
15
|
-
export { discoverManifests, type PackageManifest } from "./registry.js";
|
|
15
|
+
export { discoverManifests, discoverPackages, loadPackage, type PackageManifest, type PackageRef, } from "./registry.js";
|
|
16
16
|
export { type CompiledFolder, type CompiledKey, compileTree, type FolderArray, type FolderEntry, type SecretsTree, treeSchema, } from "./tree.js";
|
|
17
17
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,eAAe,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,KAAK,UAAU,EACf,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,aAAa,EAClB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,KAAK,aAAa,EAClB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,iBAAiB,EACtB,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,UAAU,EACV,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,cAAc,EACnB,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,eAAe,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,KAAK,UAAU,EACf,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,UAAU,GACX,MAAM,WAAW,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -6,11 +6,11 @@ export { normalizeEnvSlug } from "./env-slug.js";
|
|
|
6
6
|
export { appendPlainToGithubEnv, appendSecretsToGithubEnv, appendSecretToGithubEnv, } from "./github-env.js";
|
|
7
7
|
export { keysForScope, runAdvertiseKeysHooks, } from "./hooks.js";
|
|
8
8
|
export { enforceKnownKeys } from "./include.js";
|
|
9
|
-
export { loadManifestJson, normalizeFolderPath, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, secretsManifestSchema, } from "./manifest.js";
|
|
9
|
+
export { findManifestFile, hasManifestFile, loadManifestFromDir, loadManifestJson, MANIFEST_FILENAMES, MANIFEST_LABEL, normalizeFolderPath, parseManifestFile, resolveCompiledFolders, resolveFetchMode, resolveSecretsOutputPath, secretsManifestSchema, } from "./manifest.js";
|
|
10
10
|
export { logMissingOptionalKeys, resolveOptionalKeys, } from "./optional-keys.js";
|
|
11
11
|
export { commandExists, LocalProvider } from "./providers/local.js";
|
|
12
12
|
export { RemoteProvider } from "./providers/remote.js";
|
|
13
13
|
export { pullManifest, writeInjectedSecretsStub, } from "./pull.js";
|
|
14
|
-
export { discoverManifests } from "./registry.js";
|
|
14
|
+
export { discoverManifests, discoverPackages, loadPackage, } from "./registry.js";
|
|
15
15
|
export { compileTree, treeSchema, } from "./tree.js";
|
|
16
16
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EAEpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,YAAY,EAGZ,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EAExB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAEL,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAEZ,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EAEpB,IAAI,EACJ,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,YAAY,EAGZ,UAAU,GAEX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,YAAY,EACZ,qBAAqB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAGd,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EAExB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAEL,YAAY,EACZ,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GAGZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,WAAW,EAIX,UAAU,GACX,MAAM,WAAW,CAAC"}
|
package/dist/manifest.d.ts
CHANGED
|
@@ -67,6 +67,51 @@ export declare const secretsManifestSchema: z.ZodObject<{
|
|
|
67
67
|
}>;
|
|
68
68
|
export type SecretsManifest = z.infer<typeof secretsManifestSchema>;
|
|
69
69
|
export declare function loadManifestJson(raw: unknown): SecretsManifest;
|
|
70
|
+
export declare const MANIFEST_FILENAMES: readonly ["secrets.yaml", "secrets.yml", "secrets.json"];
|
|
71
|
+
/** A generic name for the manifest, for messages that shouldn't hardcode an extension. */
|
|
72
|
+
export declare const MANIFEST_LABEL = "secrets manifest";
|
|
73
|
+
export type ManifestFormat = "yaml" | "json";
|
|
74
|
+
export type ManifestFile = {
|
|
75
|
+
/** Absolute (or as-passed) path to the manifest file. */
|
|
76
|
+
path: string;
|
|
77
|
+
/** Bare filename, e.g. `secrets.yaml`. */
|
|
78
|
+
filename: string;
|
|
79
|
+
format: ManifestFormat;
|
|
80
|
+
};
|
|
81
|
+
/**
|
|
82
|
+
* Locate the manifest file in `dir`, preferring YAML over JSON
|
|
83
|
+
* ({@link MANIFEST_FILENAMES}). Returns `null` when no manifest exists.
|
|
84
|
+
*
|
|
85
|
+
* A directory with more than one manifest file is a hard error: picking a winner
|
|
86
|
+
* by preference order would let a stale or experimental `secrets.yaml` left next
|
|
87
|
+
* to the intended `secrets.json` (or vice versa) silently change which secret
|
|
88
|
+
* tree is pulled — and non-interactive lanes (the GitHub Action's `export-gha`)
|
|
89
|
+
* would write it into `GITHUB_ENV` and still succeed. Refuse instead of guessing;
|
|
90
|
+
* the operator removes the extra file to resolve.
|
|
91
|
+
*/
|
|
92
|
+
/**
|
|
93
|
+
* Cheap presence check: does `dir` hold at least one manifest file? Used to
|
|
94
|
+
* enumerate package directories without parsing or resolving ambiguity, so
|
|
95
|
+
* discovery never throws on a manifest a command won't actually load.
|
|
96
|
+
*/
|
|
97
|
+
export declare function hasManifestFile(dir: string): boolean;
|
|
98
|
+
export declare function findManifestFile(dir: string): ManifestFile | null;
|
|
99
|
+
/**
|
|
100
|
+
* Parse a manifest file's contents into the raw object, dispatching on format.
|
|
101
|
+
* YAML is a superset of JSON, but we parse each with its own reader so error
|
|
102
|
+
* messages point at the right syntax. Does not validate against the schema —
|
|
103
|
+
* call {@link loadManifestJson} for that.
|
|
104
|
+
*/
|
|
105
|
+
export declare function parseManifestFile(file: ManifestFile): unknown;
|
|
106
|
+
/**
|
|
107
|
+
* Find, read, parse, and schema-validate the manifest in `dir`. Returns the
|
|
108
|
+
* validated manifest plus the file it came from, or `null` when no manifest
|
|
109
|
+
* file exists.
|
|
110
|
+
*/
|
|
111
|
+
export declare function loadManifestFromDir(dir: string): {
|
|
112
|
+
manifest: SecretsManifest;
|
|
113
|
+
file: ManifestFile;
|
|
114
|
+
} | null;
|
|
70
115
|
/**
|
|
71
116
|
* Compile the effective folder tree into an ordered {@link CompiledFolder} list.
|
|
72
117
|
* A profile's `tree` replaces the root `tree` when a profile is set (same
|
package/dist/manifest.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,KAAK,cAAc,EAGpB,MAAM,WAAW,CAAC;AASnB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyChC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CAE9D;AAMD,eAAO,MAAM,kBAAkB,0DAIrB,CAAC;AAEX,0FAA0F;AAC1F,eAAO,MAAM,cAAc,qBAAqB,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7C,MAAM,MAAM,YAAY,GAAG;IACzB,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAkBjE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAG7D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAI1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,cAAc,EAAE,CASlB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,eAAe,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,QAAQ,GAAG,MAAM,CAMnB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAiBR"}
|
package/dist/manifest.js
CHANGED
|
@@ -1,4 +1,6 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { existsSync, readFileSync } from "node:fs";
|
|
2
|
+
import { join, resolve, sep } from "node:path";
|
|
3
|
+
import { parse as parseYaml } from "yaml";
|
|
2
4
|
import { z } from "zod";
|
|
3
5
|
import { compileTree, treeSchema, } from "./tree.js";
|
|
4
6
|
// How secrets are read from the vault. `folder` (default) fetches whole folders
|
|
@@ -46,6 +48,72 @@ export const secretsManifestSchema = z.object({
|
|
|
46
48
|
export function loadManifestJson(raw) {
|
|
47
49
|
return secretsManifestSchema.parse(raw);
|
|
48
50
|
}
|
|
51
|
+
// Manifest filenames in preference order. YAML is the primary, recommended
|
|
52
|
+
// format; JSON stays fully supported for anyone who prefers it (or generates
|
|
53
|
+
// manifests programmatically). The first file that exists in a package
|
|
54
|
+
// directory wins, so `secrets.yaml` shadows a stray `secrets.json`.
|
|
55
|
+
export const MANIFEST_FILENAMES = [
|
|
56
|
+
"secrets.yaml",
|
|
57
|
+
"secrets.yml",
|
|
58
|
+
"secrets.json",
|
|
59
|
+
];
|
|
60
|
+
/** A generic name for the manifest, for messages that shouldn't hardcode an extension. */
|
|
61
|
+
export const MANIFEST_LABEL = "secrets manifest";
|
|
62
|
+
/**
|
|
63
|
+
* Locate the manifest file in `dir`, preferring YAML over JSON
|
|
64
|
+
* ({@link MANIFEST_FILENAMES}). Returns `null` when no manifest exists.
|
|
65
|
+
*
|
|
66
|
+
* A directory with more than one manifest file is a hard error: picking a winner
|
|
67
|
+
* by preference order would let a stale or experimental `secrets.yaml` left next
|
|
68
|
+
* to the intended `secrets.json` (or vice versa) silently change which secret
|
|
69
|
+
* tree is pulled — and non-interactive lanes (the GitHub Action's `export-gha`)
|
|
70
|
+
* would write it into `GITHUB_ENV` and still succeed. Refuse instead of guessing;
|
|
71
|
+
* the operator removes the extra file to resolve.
|
|
72
|
+
*/
|
|
73
|
+
/**
|
|
74
|
+
* Cheap presence check: does `dir` hold at least one manifest file? Used to
|
|
75
|
+
* enumerate package directories without parsing or resolving ambiguity, so
|
|
76
|
+
* discovery never throws on a manifest a command won't actually load.
|
|
77
|
+
*/
|
|
78
|
+
export function hasManifestFile(dir) {
|
|
79
|
+
return MANIFEST_FILENAMES.some((name) => existsSync(join(dir, name)));
|
|
80
|
+
}
|
|
81
|
+
export function findManifestFile(dir) {
|
|
82
|
+
const present = MANIFEST_FILENAMES.filter((name) => existsSync(join(dir, name)));
|
|
83
|
+
if (present.length === 0)
|
|
84
|
+
return null;
|
|
85
|
+
if (present.length > 1) {
|
|
86
|
+
throw new Error(`Ambiguous secrets manifest in ${dir}: found ${present.join(", ")}. ` +
|
|
87
|
+
`Keep exactly one — remove the extra file(s) so it's unambiguous which secret tree is used.`);
|
|
88
|
+
}
|
|
89
|
+
const [filename] = present;
|
|
90
|
+
return {
|
|
91
|
+
path: join(dir, filename),
|
|
92
|
+
filename,
|
|
93
|
+
format: filename.endsWith(".json") ? "json" : "yaml",
|
|
94
|
+
};
|
|
95
|
+
}
|
|
96
|
+
/**
|
|
97
|
+
* Parse a manifest file's contents into the raw object, dispatching on format.
|
|
98
|
+
* YAML is a superset of JSON, but we parse each with its own reader so error
|
|
99
|
+
* messages point at the right syntax. Does not validate against the schema —
|
|
100
|
+
* call {@link loadManifestJson} for that.
|
|
101
|
+
*/
|
|
102
|
+
export function parseManifestFile(file) {
|
|
103
|
+
const raw = readFileSync(file.path, "utf8");
|
|
104
|
+
return file.format === "yaml" ? parseYaml(raw) : JSON.parse(raw);
|
|
105
|
+
}
|
|
106
|
+
/**
|
|
107
|
+
* Find, read, parse, and schema-validate the manifest in `dir`. Returns the
|
|
108
|
+
* validated manifest plus the file it came from, or `null` when no manifest
|
|
109
|
+
* file exists.
|
|
110
|
+
*/
|
|
111
|
+
export function loadManifestFromDir(dir) {
|
|
112
|
+
const file = findManifestFile(dir);
|
|
113
|
+
if (!file)
|
|
114
|
+
return null;
|
|
115
|
+
return { manifest: loadManifestJson(parseManifestFile(file)), file };
|
|
116
|
+
}
|
|
49
117
|
/**
|
|
50
118
|
* Compile the effective folder tree into an ordered {@link CompiledFolder} list.
|
|
51
119
|
* A profile's `tree` replaces the root `tree` when a profile is set (same
|
|
@@ -55,7 +123,7 @@ export function resolveCompiledFolders(manifest, profile) {
|
|
|
55
123
|
if (profile) {
|
|
56
124
|
const profileConfig = manifest.profiles?.[profile];
|
|
57
125
|
if (!profileConfig) {
|
|
58
|
-
throw new Error(`Unknown profile '${profile}' in
|
|
126
|
+
throw new Error(`Unknown profile '${profile}' in ${MANIFEST_LABEL}`);
|
|
59
127
|
}
|
|
60
128
|
return compileTree(profileConfig.secrets);
|
|
61
129
|
}
|
package/dist/manifest.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AAEnB,gFAAgF;AAChF,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,sDAAsD;AACtD,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,kEAAkE;IAClE,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,CAAC;SACR,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,oDAAoD;QACpD,OAAO,EAAE,UAAU;QACnB,wDAAwD;QACxD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;KAClC,CAAC,CACH;SACA,QAAQ,EAAE;IACb,EAAE,EAAE,CAAC;SACF,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC3C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;SACD,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,WAAW,CAAC;SAClB,QAAQ,EAAE;IACb,wEAAwE;IACxE,8EAA8E;IAC9E,yDAAyD;IACzD,KAAK,EAAE,eAAe,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC;SACZ,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC7C,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAIH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,cAAc;IACd,aAAa;IACb,cAAc;CACN,CAAC;AAEX,0FAA0F;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAYjD;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAC5B,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACnE,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC;IAC3B,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkB;IAClD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAW;IAEX,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,QAAQ,cAAc,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAyB,EACzB,OAAgB;IAEhB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACzD,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAAmB,EACnB,UAAkB;IAElB,IACE,UAAU,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;QAC1C,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,MAAM,KAAK,CAAC,EACvB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,UAAU,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,IACE,WAAW,KAAK,WAAW;QAC3B,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}
|
package/dist/registry.d.ts
CHANGED
|
@@ -1,14 +1,37 @@
|
|
|
1
1
|
import type { ResolvedConfig } from "./config.js";
|
|
2
|
-
import { type SecretsManifest } from "./manifest.js";
|
|
3
|
-
|
|
2
|
+
import { type ManifestFile, type SecretsManifest } from "./manifest.js";
|
|
3
|
+
/** A discovered package: its id and directory, before its manifest is loaded. */
|
|
4
|
+
export type PackageRef = {
|
|
4
5
|
id: string;
|
|
5
6
|
dir: string;
|
|
7
|
+
};
|
|
8
|
+
export type PackageManifest = PackageRef & {
|
|
6
9
|
config: SecretsManifest;
|
|
10
|
+
/** The manifest file this package was loaded from (YAML or JSON). */
|
|
11
|
+
file: ManifestFile;
|
|
7
12
|
};
|
|
8
13
|
/**
|
|
9
|
-
*
|
|
10
|
-
* `config.discovery` — no repo-specific directory constants.
|
|
11
|
-
* `packages` win over `roots`-discovered entries at the same directory.
|
|
14
|
+
* Enumerate every package directory that holds a secrets manifest, driven
|
|
15
|
+
* entirely by `config.discovery` — no repo-specific directory constants.
|
|
16
|
+
* Explicit `packages` win over `roots`-discovered entries at the same directory.
|
|
17
|
+
*
|
|
18
|
+
* This is a cheap presence scan: it does NOT parse, validate, or resolve
|
|
19
|
+
* manifest ambiguity, so a stale or malformed manifest in one package never
|
|
20
|
+
* blocks discovery of the others. Resolution happens in {@link loadPackage},
|
|
21
|
+
* per package, only for the packages a command actually uses.
|
|
22
|
+
*/
|
|
23
|
+
export declare function discoverPackages(config: ResolvedConfig): PackageRef[];
|
|
24
|
+
/**
|
|
25
|
+
* Resolve, parse, and schema-validate one package's manifest. Throws if the
|
|
26
|
+
* directory is ambiguous (more than one manifest file) or the manifest is
|
|
27
|
+
* invalid — scoped to this package, so an unrelated broken sibling never blocks
|
|
28
|
+
* a command that doesn't load it.
|
|
29
|
+
*/
|
|
30
|
+
export declare function loadPackage(ref: PackageRef): PackageManifest;
|
|
31
|
+
/**
|
|
32
|
+
* Discover and load every package's manifest. Loads all — to load only a
|
|
33
|
+
* targeted subset (so an unrelated ambiguous/broken package can't abort the
|
|
34
|
+
* run), use {@link discoverPackages} + {@link loadPackage} instead.
|
|
12
35
|
*/
|
|
13
36
|
export declare function discoverManifests(config: ResolvedConfig): PackageManifest[];
|
|
14
37
|
//# sourceMappingURL=registry.d.ts.map
|
package/dist/registry.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,
|
|
1
|
+
{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAEvB,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG;IACzC,MAAM,EAAE,eAAe,CAAC;IACxB,qEAAqE;IACrE,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,EAAE,CAwBrE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe,CAO5D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,EAAE,CAE3E"}
|
package/dist/registry.js
CHANGED
|
@@ -1,20 +1,23 @@
|
|
|
1
|
-
import { existsSync, readdirSync
|
|
1
|
+
import { existsSync, readdirSync } from "node:fs";
|
|
2
2
|
import { join, resolve } from "node:path";
|
|
3
|
-
import {
|
|
3
|
+
import { hasManifestFile, loadManifestFromDir, } from "./manifest.js";
|
|
4
4
|
/**
|
|
5
|
-
*
|
|
6
|
-
* `config.discovery` — no repo-specific directory constants.
|
|
7
|
-
* `packages` win over `roots`-discovered entries at the same directory.
|
|
5
|
+
* Enumerate every package directory that holds a secrets manifest, driven
|
|
6
|
+
* entirely by `config.discovery` — no repo-specific directory constants.
|
|
7
|
+
* Explicit `packages` win over `roots`-discovered entries at the same directory.
|
|
8
|
+
*
|
|
9
|
+
* This is a cheap presence scan: it does NOT parse, validate, or resolve
|
|
10
|
+
* manifest ambiguity, so a stale or malformed manifest in one package never
|
|
11
|
+
* blocks discovery of the others. Resolution happens in {@link loadPackage},
|
|
12
|
+
* per package, only for the packages a command actually uses.
|
|
8
13
|
*/
|
|
9
|
-
export function
|
|
14
|
+
export function discoverPackages(config) {
|
|
10
15
|
const { repoRoot } = config;
|
|
11
16
|
const byDir = new Map();
|
|
12
|
-
const
|
|
13
|
-
|
|
14
|
-
if (!existsSync(manifestPath))
|
|
17
|
+
const consider = (dir, id) => {
|
|
18
|
+
if (!hasManifestFile(dir))
|
|
15
19
|
return;
|
|
16
|
-
|
|
17
|
-
byDir.set(resolve(dir), { dir, id, config: parsed });
|
|
20
|
+
byDir.set(resolve(dir), { id, dir });
|
|
18
21
|
};
|
|
19
22
|
for (const root of config.discovery.roots ?? []) {
|
|
20
23
|
const rootAbs = join(repoRoot, root);
|
|
@@ -23,13 +26,35 @@ export function discoverManifests(config) {
|
|
|
23
26
|
for (const entry of readdirSync(rootAbs, { withFileTypes: true })) {
|
|
24
27
|
if (!entry.isDirectory())
|
|
25
28
|
continue;
|
|
26
|
-
|
|
29
|
+
consider(join(rootAbs, entry.name), entry.name);
|
|
27
30
|
}
|
|
28
31
|
}
|
|
29
32
|
// Explicit packages last so a custom id/dir overrides a roots-discovered one.
|
|
30
33
|
for (const { id, dir } of config.discovery.packages ?? []) {
|
|
31
|
-
|
|
34
|
+
consider(join(repoRoot, dir), id);
|
|
32
35
|
}
|
|
33
36
|
return [...byDir.values()].sort((a, b) => a.id.localeCompare(b.id));
|
|
34
37
|
}
|
|
38
|
+
/**
|
|
39
|
+
* Resolve, parse, and schema-validate one package's manifest. Throws if the
|
|
40
|
+
* directory is ambiguous (more than one manifest file) or the manifest is
|
|
41
|
+
* invalid — scoped to this package, so an unrelated broken sibling never blocks
|
|
42
|
+
* a command that doesn't load it.
|
|
43
|
+
*/
|
|
44
|
+
export function loadPackage(ref) {
|
|
45
|
+
const loaded = loadManifestFromDir(ref.dir);
|
|
46
|
+
if (!loaded) {
|
|
47
|
+
// hasManifestFile was true at discovery; the file vanished in between.
|
|
48
|
+
throw new Error(`No secrets manifest in ${ref.dir}`);
|
|
49
|
+
}
|
|
50
|
+
return { id: ref.id, dir: ref.dir, config: loaded.manifest, file: loaded.file };
|
|
51
|
+
}
|
|
52
|
+
/**
|
|
53
|
+
* Discover and load every package's manifest. Loads all — to load only a
|
|
54
|
+
* targeted subset (so an unrelated ambiguous/broken package can't abort the
|
|
55
|
+
* run), use {@link discoverPackages} + {@link loadPackage} instead.
|
|
56
|
+
*/
|
|
57
|
+
export function discoverManifests(config) {
|
|
58
|
+
return discoverPackages(config).map(loadPackage);
|
|
59
|
+
}
|
|
35
60
|
//# sourceMappingURL=registry.js.map
|
package/dist/registry.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,
|
|
1
|
+
{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EACL,eAAe,EACf,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AAcvB;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAU,EAAE,EAAE;QAC3C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;YAAE,OAAO;QAClC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe;IACzC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAsB;IACtD,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACnD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hubble-ventures/infisicml",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.1.0",
|
|
4
4
|
"description": "Infisical Secret Orchestration — federated per-package secret manifests for monorepos, unified across local dev and CI.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"infisical",
|
|
@@ -58,6 +58,7 @@
|
|
|
58
58
|
"version": "npm run build"
|
|
59
59
|
},
|
|
60
60
|
"dependencies": {
|
|
61
|
+
"yaml": "^2.9.0",
|
|
61
62
|
"zod": "^3.23.8"
|
|
62
63
|
},
|
|
63
64
|
"devDependencies": {
|