@invarn/cibuild 2.7.4 → 2.7.5

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.js

@@ -0,0 +1,126 @@
+/**
+ * A value `SecretsManager` was just told to store is a value it can read back.
+ *
+ * It could not, on exactly the repositories that matter. `loadSecrets` sets
+ * `fileLoaded` when it finds a `.cibuild-secrets.json` or a
+ * `CIBUILD_S*`-shaped environment, and every reader begins
+ * `if (!this.fileLoaded) return process.env[...]` — a compatibility fallback
+ * to bare `CIBUILD_`-prefixed variables from before the store existed.
+ * `storeSecret` writes the file but never clears the flag, so on a repository
+ * that had no store — a first `ci init`, which is the only time `ci init`
+ * collects anything — every value collected in that run read back as absent
+ * from the instance that stored it.
+ *
+ * It is not a hypothetical. `ci init` extracts a workflow's keystore target
+ * from `storeFile=` in the `keystore.properties` it collected a moment
+ * earlier, which is how a project whose signing config names
+ * `app/customer.jks` gets its `file@` step pointed there instead of at
+ * `keystore.jks`. That read returned undefined on every fresh repository, so
+ * the resolution silently fell through to the Gradle-detected path — the half
+ * of issue 07 that shipped and never fired.
+ *
+ * The fix is additive rather than a flag flip: the stored data is consulted
+ * first, and the environment fallback stays exactly where it was for anything
+ * the store does not hold. Nothing that resolved before stops resolving.
+ */
+import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { SecretsManager } from './secrets-manager.js';
+const KEYSTORE_PROPERTIES = 'storeFile=app/customer.jks\nstorePassword=x\n';
+let dir;
+let storePath;
+beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'cibuild-store-readback-'));
+    storePath = join(dir, '.cibuild-secrets.json');
+    delete process.env.CIBUILD_KEYSTORE_PROPERTIES;
+    delete process.env.CIBUILD_FROM_THE_ENVIRONMENT;
+});
+afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+    delete process.env.CIBUILD_KEYSTORE_PROPERTIES;
+    delete process.env.CIBUILD_FROM_THE_ENVIRONMENT;
+});
+describe('a repository that had no store yet', () => {
+    test('reads back a workflow-scoped value it just stored', () => {
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
+        expect(sm.getSecret('KEYSTORE_PROPERTIES', 'release')).toBe(KEYSTORE_PROPERTIES);
+        expect(sm.hasSecret('KEYSTORE_PROPERTIES', 'release')).toBe(true);
+        expect(sm.getSecretIdByName('KEYSTORE_PROPERTIES', 'release')).toBe('KEYSTORE_PROPERTIES');
+    });
+    test('is why `ci init` can point a keystore step at the declared target', () => {
+        // The read that silently returned undefined: `ci init` takes the keystore
+        // target out of the properties file it collected in the same run.
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
+        const storeFile = sm
+            .getSecret('KEYSTORE_PROPERTIES', 'release')
+            ?.split('\n')
+            .find((line) => line.trim().startsWith('storeFile='));
+        expect(storeFile).toBe('storeFile=app/customer.jks');
+    });
+    test('reads back a global value it just stored', () => {
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('LOCAL_PROPERTIES', 'BASE_API_URL=x\n');
+        expect(sm.getSecret('LOCAL_PROPERTIES')).toBe('BASE_API_URL=x\n');
+        expect(sm.getAll()).toHaveProperty('LOCAL_PROPERTIES', 'BASE_API_URL=x\n');
+        expect(sm.getAllSecretNames()).toContain('LOCAL_PROPERTIES');
+    });
+    test('keeps a value scoped to the workflow it was stored for', () => {
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('LOCAL_PROPERTIES', 'ci-dynamic', 'primary');
+        sm.storeSecret('LOCAL_PROPERTIES', 'prod', 'release');
+        expect(sm.getSecret('LOCAL_PROPERTIES', 'primary')).toBe('ci-dynamic');
+        expect(sm.getSecret('LOCAL_PROPERTIES', 'release')).toBe('prod');
+        // No global value was stored, so a workflow nobody stored for has none.
+        expect(sm.getSecret('LOCAL_PROPERTIES', 'pull-request')).toBeUndefined();
+    });
+});
+describe('the environment fallback', () => {
+    test('still answers for a key the store does not hold', () => {
+        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('LOCAL_PROPERTIES', 'stored');
+        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBe('inherited');
+        expect(sm.hasSecret('FROM_THE_ENVIRONMENT')).toBe(true);
+        expect(sm.getAll()).toMatchObject({
+            FROM_THE_ENVIRONMENT: 'inherited',
+            LOCAL_PROPERTIES: 'stored',
+        });
+    });
+    test('answers for everything when nothing has been stored', () => {
+        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
+        const sm = new SecretsManager(storePath);
+        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBe('inherited');
+        expect(sm.getAll()).toEqual({ FROM_THE_ENVIRONMENT: 'inherited' });
+    });
+    test('loses to a value that was actually stored', () => {
+        process.env.CIBUILD_KEYSTORE_PROPERTIES = 'from-the-environment';
+        const sm = new SecretsManager(storePath);
+        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
+        expect(sm.getSecret('KEYSTORE_PROPERTIES', 'release')).toBe(KEYSTORE_PROPERTIES);
+    });
+});
+describe('a repository that already had a store', () => {
+    test('is unchanged — the file is the answer and the environment is not consulted', () => {
+        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
+        writeFileSync(storePath, JSON.stringify({ global: { A: 'from-the-file' }, workflows: {} }), { mode: 0o600 });
+        const sm = new SecretsManager(storePath);
+        expect(sm.getSecret('A')).toBe('from-the-file');
+        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBeUndefined();
+        expect(sm.getAll()).toEqual({ A: 'from-the-file' });
+    });
+    test('still lets a workflow value beat the global one', () => {
+        writeFileSync(storePath, JSON.stringify({
+            global: { A: 'global' },
+            workflows: { release: { A: 'release' } },
+        }), { mode: 0o600 });
+        const sm = new SecretsManager(storePath);
+        expect(sm.getSecret('A', 'release')).toBe('release');
+        expect(sm.getSecret('A', 'primary')).toBe('global');
+        expect(sm.getAll('release')).toEqual({ A: 'release' });
+    });
+});
+//# sourceMappingURL=a-value-this-instance-stored-is-a-value-it-has.test.js.map

package/dist/src/yaml/converter.d.ts

@@ -15,6 +15,54 @@ export interface ConversionResult {
     warnings: string[];
     skippedSteps: number;
 }
+/**
+ * A credential a `file@` step writes, and where it goes.
+ */
+export interface CredentialTarget {
+    targetPath: string;
+    varName: string;
+}
+/** A cache step's declared paths, and which step declared them. */
+export interface CachePathDeclaration {
+    stepName: string;
+    cachePaths: string[];
+}
+export interface SwallowedCredential {
+    stepName: string;
+    cachePath: string;
+    targetPath: string;
+    varName: string;
+}
+/**
+ * True when caching `cachePath` would sweep up the file at `targetPath`.
+ *
+ * Only a project-relative entry can: `cache.ts` classifies a `~`- or
+ * `/`-rooted entry as absolute and stores it from the filesystem root, so it
+ * is somewhere the checkout is not. An entry naming the checkout itself (`.`,
+ * `./`) contains everything.
+ */
+export declare function cacheEntryContains(cachePath: string, targetPath: string): boolean;
+/**
+ * Every credential a workflow's cache steps would archive.
+ *
+ * `cache-push` uploads whatever `cache_paths` names, and that archive is
+ * stored where the *next* build pulls it from — so a credential swept into it
+ * outlives the build that received it. Everything else about a credential's
+ * life is bounded: the runner pushes the checkout and the guest root onto
+ * `cleanupPaths` and removes them in a `finally`, the guest gets
+ * `rm -rf`, and `tart delete` reclaims the VM. The cache store is the one
+ * place a file can survive all of that, which makes this the single hole in
+ * "nothing survives a build".
+ *
+ * No pipeline in play trips it — every one of them caches `~/.gradle/caches`,
+ * `~/.gradle/wrapper` and `.gradle`, and none of those contains a credential —
+ * so this is a guard on a mistake that is easy to make and impossible to see:
+ * adding `.` to `cache_paths` is a plausible way to speed up a build, and it
+ * would publish the keystore.
+ */
+export declare function credentialsSwallowedByCache(credentials: readonly CredentialTarget[], caches: readonly CachePathDeclaration[]): SwallowedCredential[];
+/** The refusal text for one swallowed credential. */
+export declare function swallowedCredentialMessage(workflowName: string, swallowed: SwallowedCredential): string;
 /**
  * Converts a YAML pipeline workflow to PipelineDef format
  * @param pipeline Parsed YAML pipeline

package/dist/src/yaml/converter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../src/yaml/converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AAMzE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AA6CD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAgK3B;AAwGD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,EAAE,CAEtE"}
+{"version":3,"file":"converter.d.ts","sourceRoot":"","sources":["../../../src/yaml/converter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAA4B,MAAM,YAAY,CAAC;AAMzE,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,WAAW,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAaD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAaD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CASjF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,MAAM,EAAE,SAAS,oBAAoB,EAAE,GACtC,mBAAmB,EAAE,CAgBvB;AAED,qDAAqD;AACrD,wBAAgB,0BAA0B,CACxC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,mBAAmB,GAC7B,MAAM,CAaR;AAkCD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,QAAQ,EAChB,YAAY,CAAC,EAAE,MAAM,EACrB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAyM3B;AAwGD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,EAAE,CAEtE"}

package/dist/src/yaml/converter.js

@@ -21,6 +21,87 @@ const CACHE_STEPS = new Set(['cache-pull', 'cache-push']);
 function isCacheStep(stepName) {
     return CACHE_STEPS.has(stepName);
 }
+/**
+ * Trailing slashes and a leading `./` off, backslashes forward. `.` and the
+ * empty string both mean "the whole checkout".
+ */
+function normalizeCheckoutPath(path) {
+    const forward = path.trim().replace(/\\/g, '/');
+    const withoutLead = forward.replace(/^\.\//, '');
+    const withoutTrail = withoutLead.replace(/\/+$/, '');
+    return withoutTrail === '.' ? '' : withoutTrail;
+}
+/**
+ * True when caching `cachePath` would sweep up the file at `targetPath`.
+ *
+ * Only a project-relative entry can: `cache.ts` classifies a `~`- or
+ * `/`-rooted entry as absolute and stores it from the filesystem root, so it
+ * is somewhere the checkout is not. An entry naming the checkout itself (`.`,
+ * `./`) contains everything.
+ */
+export function cacheEntryContains(cachePath, targetPath) {
+    const raw = cachePath.trim();
+    if (raw.startsWith('~') || raw.startsWith('/'))
+        return false;
+    const cache = normalizeCheckoutPath(raw);
+    const target = normalizeCheckoutPath(targetPath);
+    if (target === '')
+        return false;
+    if (cache === '')
+        return true;
+    return target === cache || target.startsWith(`${cache}/`);
+}
+/**
+ * Every credential a workflow's cache steps would archive.
+ *
+ * `cache-push` uploads whatever `cache_paths` names, and that archive is
+ * stored where the *next* build pulls it from — so a credential swept into it
+ * outlives the build that received it. Everything else about a credential's
+ * life is bounded: the runner pushes the checkout and the guest root onto
+ * `cleanupPaths` and removes them in a `finally`, the guest gets
+ * `rm -rf`, and `tart delete` reclaims the VM. The cache store is the one
+ * place a file can survive all of that, which makes this the single hole in
+ * "nothing survives a build".
+ *
+ * No pipeline in play trips it — every one of them caches `~/.gradle/caches`,
+ * `~/.gradle/wrapper` and `.gradle`, and none of those contains a credential —
+ * so this is a guard on a mistake that is easy to make and impossible to see:
+ * adding `.` to `cache_paths` is a plausible way to speed up a build, and it
+ * would publish the keystore.
+ */
+export function credentialsSwallowedByCache(credentials, caches) {
+    const found = [];
+    for (const cache of caches) {
+        for (const cachePath of cache.cachePaths) {
+            for (const credential of credentials) {
+                if (!cacheEntryContains(cachePath, credential.targetPath))
+                    continue;
+                found.push({
+                    stepName: cache.stepName,
+                    cachePath: cachePath.trim(),
+                    targetPath: credential.targetPath,
+                    varName: credential.varName,
+                });
+            }
+        }
+    }
+    return found;
+}
+/** The refusal text for one swallowed credential. */
+export function swallowedCredentialMessage(workflowName, swallowed) {
+    return [
+        `Workflow "${workflowName}" would cache a credential.`,
+        ``,
+        `  The ${swallowed.stepName} step lists "${swallowed.cachePath}" in cache_paths, and that`,
+        `  contains "${swallowed.targetPath}" — the file written from the ${swallowed.varName} secret.`,
+        ``,
+        `  A cached credential outlives the build. The archive is stored where the next`,
+        `  build pulls it from, and nothing removes it when the sandbox is destroyed.`,
+        ``,
+        `  Narrow the cache_paths entry to the directories the build needs cached, or`,
+        `  write the credential somewhere outside them.`,
+    ].join('\n');
+}
 /**
  * Mapping of common unsupported steps to CI Build alternatives
  */
@@ -98,6 +179,11 @@ export async function convertYAMLToPipelineDef(pipeline, config, workflowName, y
     const steps = [];
     const stepsOrder = [];
     let stepCounter = 0;
+    // Collected as the steps are converted, checked once at the end: a cache
+    // step can be declared before the `file@` step whose target it would
+    // swallow, so neither one alone can answer the question.
+    const credentialTargets = [];
+    const cacheDeclarations = [];
     for (const yamlStep of workflowSteps) {
         // Parse step (sub-task 3.8)
         const parsedStep = parseStep(yamlStep, stepCounter);
@@ -154,6 +240,27 @@ export async function convertYAMLToPipelineDef(pipeline, config, workflowName, y
             }
             throw error;
         }
+        // Both halves of the cache-swallows-a-credential question, read off the
+        // interpolated inputs so `$PROJECT_LOCATION` and friends are already the
+        // paths they will be at runtime.
+        if (resolvedStepName === 'file') {
+            const targetPath = interpolatedInputs?.target_path;
+            const varName = interpolatedInputs?.var_name;
+            if (typeof targetPath === 'string' && typeof varName === 'string') {
+                credentialTargets.push({ targetPath, varName });
+            }
+        }
+        if (isCacheStep(resolvedStepName)) {
+            const declared = interpolatedInputs?.cache_paths;
+            const cachePaths = Array.isArray(declared)
+                ? declared.filter((p) => typeof p === 'string')
+                : typeof declared === 'string'
+                    ? [declared]
+                    : [];
+            if (cachePaths.length > 0) {
+                cacheDeclarations.push({ stepName: resolvedStepName, cachePaths });
+            }
+        }
         // Execute step to get script
         const stepDef = await stepExecutor.execute(interpolatedInputs, envResolver.getAll(), config);
         // Generate unique step ID
@@ -174,6 +281,16 @@ export async function convertYAMLToPipelineDef(pipeline, config, workflowName, y
             }
         }
     }
+    // Step 4b: refuse a pipeline that would archive a credential.
+    //
+    // Thrown at generation time for the same reason issue 03's missing-credential
+    // refusal is: it is the only place that can see the whole workflow, and the
+    // alternative is a build that succeeds while publishing a key. A pipeline
+    // configuration error, and the author is the one who can fix it.
+    const swallowed = credentialsSwallowedByCache(credentialTargets, cacheDeclarations);
+    if (swallowed.length > 0) {
+        throw new YAMLConversionError(swallowed.map((s) => swallowedCredentialMessage(selectedWorkflowName, s)).join('\n\n'));
+    }
     // Step 5: Create PipelineDef
     const pipelineDef = {
         name: `${selectedWorkflowName} (YAML)`,

package/dist/src/yaml/env-resolver.d.ts

@@ -23,6 +23,30 @@ export declare class ChecksumFileMissingError extends Error {
     readonly stepName?: string | undefined;
     constructor(filePath: string, stepName?: string | undefined);
 }
+/**
+ * A credential slot scoped to a workflow the pipeline does not have.
+ *
+ * Thrown at generation time, before any step converts, because every way of
+ * getting the name wrong is otherwise silent. A slot naming a workflow nobody
+ * runs declares the credential for nobody: `file@1.0.0` finds no key in its
+ * map, calls the credential optional and skips it with a warning, and
+ * `ci secrets upload` cheerfully pushes a value under the same wrong name.
+ * Two green halves and a build that dies later inside the project's own build
+ * tool.
+ *
+ * The underscore case gets its own sentence because the workflow is right
+ * there in the pipeline. `encodeSecretName` upper-cases the workflow and turns
+ * dashes into underscores, so decoding turns every underscore back into a
+ * dash: a workflow genuinely called `my_wf` can only ever be addressed as
+ * `my-wf`, and "no such workflow" about a workflow that plainly exists reads
+ * as a defect in us rather than a name that cannot survive the round trip.
+ */
+export declare class UnknownWorkflowSlotError extends Error {
+    readonly slot: string;
+    readonly varName: string;
+    readonly workflow: string;
+    constructor(slot: string, varName: string, workflow: string, declared: string[]);
+}
 /**
  * EnvResolver handles environment variable merging and interpolation
  */
@@ -35,6 +59,10 @@ export declare class EnvResolver {
      * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
      */
     private declaredVars;
+    /** The workflow being resolved. Decides which scoped slots apply — `slotKeyFor`. */
+    private workflowName;
+    /** Every workflow this pipeline declares. A scoped slot has to name one of them. */
+    private declaredWorkflows;
     constructor(pipeline: YAMLPipeline, workflow: YAMLWorkflow, workflowName: string, platform: Platform, stack?: string, yamlFilePath?: string);
     /**
      * Gets the value of an environment variable
@@ -111,6 +139,30 @@ export declare class EnvResolver {
      * Merges environment variables from YAML array format
      * @param envArray Array of environment variable objects
      */
+    /**
+     * The variable a declared `envs` key stands for, or null when the
+     * declaration belongs to a different workflow.
+     *
+     * A credential two workflows cannot share is declared once per workflow,
+     * under the same name a workflow-scoped secret carries — the pipeline says
+     * `CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: ""` where it used to say
+     * `LOCAL_PROPERTIES: ""`. The build still reads the credential under its
+     * plain name, so the declaration has to mean the plain name: it is what puts
+     * an unsupplied key in the map for `file@1.0.0` to refuse over, and what
+     * lets `importDeclaredFromProcessEnv` accept a value delivered flat.
+     *
+     * A slot naming another workflow is dropped rather than declared. Declaring
+     * it would make this workflow demand a value only that one was ever going to
+     * be given. The decoding lives here, beside the decoding of the secret
+     * itself, so the steps keep reading their plain `var_name` and never learn
+     * the convention exists.
+     *
+     * A slot naming a workflow the pipeline does not have is refused rather than
+     * dropped — see `UnknownWorkflowSlotError`. Dropping it silently is the same
+     * outcome as never declaring the credential, which is the green skip issue 03
+     * exists to end.
+     */
+    private slotKeyFor;
     private mergeEnvVars;
     /**
      * Fills a declared-but-still-empty variable from the process environment.

package/dist/src/yaml/env-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAiEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;IACvC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA0B;gBAG5C,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IAkCvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH,OAAO,CAAC,YAAY;IAoBpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}
+{"version":3,"file":"env-resolver.d.ts","sourceRoot":"","sources":["../../../src/yaml/env-resolver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAc,QAAQ,EAAE,MAAM,YAAY,CAAC;AAkEnF,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,MAAM;aACjB,IAAI,CAAC,EAAE,MAAM;gBAFb,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,IAAI,CAAC,EAAE,MAAM,YAAA;CAUhC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;aAE/B,QAAQ,EAAE,MAAM;aAChB,QAAQ,CAAC,EAAE,MAAM;gBADjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAEd,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;CAgChF;AAED;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,cAAc,CAA0B;IAChD,OAAO,CAAC,cAAc,CAAiB;IACvC;;;OAGG;IACH,OAAO,CAAC,YAAY,CAA0B;IAC9C,oFAAoF;IACpF,OAAO,CAAC,YAAY,CAAS;IAC7B,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAAW;gBAGlC,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM;IAoCvB;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKrC;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAMtC;;;OAGG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQhC;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAqCnD;;;;;OAKG;IACH,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;IAoBnD;;;OAGG;IACH,sBAAsB,IAAI,IAAI;IAQ9B;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;IAalB;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA4FtB;;;OAGG;IACH;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,OAAO,CAAC,UAAU;IAiBlB,OAAO,CAAC,YAAY;IAsBpB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,4BAA4B;IAUpC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAuB9B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAS5B;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,QAAQ,EAClB,KAAK,CAAC,EAAE,MAAM,GACb,WAAW,CAOb"}

package/dist/src/yaml/env-resolver.js

@@ -8,6 +8,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { execSync } from 'child_process';
 import { SecretsManager } from './secrets-manager.js';
+import { decodeSecretName } from '../commands/secrets-upload.js';
 import { shellAssignedNamesIn } from './shell-assignments.js';
 /**
  * Hints for common variables that require user configuration
@@ -95,6 +96,58 @@ export class ChecksumFileMissingError extends Error {
         this.name = 'ChecksumFileMissingError';
     }
 }
+/**
+ * A credential slot scoped to a workflow the pipeline does not have.
+ *
+ * Thrown at generation time, before any step converts, because every way of
+ * getting the name wrong is otherwise silent. A slot naming a workflow nobody
+ * runs declares the credential for nobody: `file@1.0.0` finds no key in its
+ * map, calls the credential optional and skips it with a warning, and
+ * `ci secrets upload` cheerfully pushes a value under the same wrong name.
+ * Two green halves and a build that dies later inside the project's own build
+ * tool.
+ *
+ * The underscore case gets its own sentence because the workflow is right
+ * there in the pipeline. `encodeSecretName` upper-cases the workflow and turns
+ * dashes into underscores, so decoding turns every underscore back into a
+ * dash: a workflow genuinely called `my_wf` can only ever be addressed as
+ * `my-wf`, and "no such workflow" about a workflow that plainly exists reads
+ * as a defect in us rather than a name that cannot survive the round trip.
+ */
+export class UnknownWorkflowSlotError extends Error {
+    slot;
+    varName;
+    workflow;
+    constructor(slot, varName, workflow, declared) {
+        // A workflow the pipeline has that differs only in its underscores is the
+        // reason the round trip failed, and naming it is the whole fix.
+        const collapsed = declared.find((name) => name.replace(/_/g, '-') === workflow);
+        const because = collapsed
+            ? `This pipeline has a workflow called "${collapsed}". The name a slot ` +
+                `carries cannot hold an underscore: it is upper-cased and its dashes ` +
+                `become underscores, so decoding turns every underscore back into a ` +
+                `dash and "${collapsed}" can only be addressed as "${workflow}".\n` +
+                `\n` +
+                `Rename the workflow to "${workflow}", or give ${varName} one value ` +
+                `for every workflow by declaring it as "${varName}".`
+            : `This pipeline declares: ${declared.join(', ')}.\n` +
+                `\n` +
+                `Fix the workflow name in the slot, or give ${varName} one value for ` +
+                `every workflow by declaring it as "${varName}".`;
+        super(`${slot} is declared for a workflow this pipeline does not have.\n` +
+            `\n` +
+            `The slot asks for ${varName}, for a workflow called "${workflow}". ` +
+            `Nothing runs under that name, so nothing would ever read the value: ` +
+            `the step that writes ${varName} would find no value and skip, and the ` +
+            `build would fail later for a reason that names your project.\n` +
+            `\n` +
+            `${because}`);
+        this.name = 'UnknownWorkflowSlotError';
+        this.slot = slot;
+        this.varName = varName;
+        this.workflow = workflow;
+    }
+}
 /**
  * EnvResolver handles environment variable merging and interpolation
  */
@@ -107,9 +160,15 @@ export class EnvResolver {
      * not it gave one a value. Read by `importDeclaredFromProcessEnv`.
      */
     declaredVars = new Set();
+    /** The workflow being resolved. Decides which scoped slots apply — `slotKeyFor`. */
+    workflowName;
+    /** Every workflow this pipeline declares. A scoped slot has to name one of them. */
+    declaredWorkflows;
     constructor(pipeline, workflow, workflowName, platform, stack, yamlFilePath) {
         this.envVars = new Map();
         this.secretsManager = new SecretsManager();
+        this.workflowName = workflowName;
+        this.declaredWorkflows = Object.keys(pipeline.workflows ?? {});
         // Step 1: Add built-in environment variables (auto-detected defaults)
         this.addBuiltInVars(workflowName, platform, stack, yamlFilePath);
         // Step 2: Load secrets — overrides auto-detected built-ins with user-stored values
@@ -378,9 +437,48 @@ export class EnvResolver {
      * Merges environment variables from YAML array format
      * @param envArray Array of environment variable objects
      */
+    /**
+     * The variable a declared `envs` key stands for, or null when the
+     * declaration belongs to a different workflow.
+     *
+     * A credential two workflows cannot share is declared once per workflow,
+     * under the same name a workflow-scoped secret carries — the pipeline says
+     * `CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: ""` where it used to say
+     * `LOCAL_PROPERTIES: ""`. The build still reads the credential under its
+     * plain name, so the declaration has to mean the plain name: it is what puts
+     * an unsupplied key in the map for `file@1.0.0` to refuse over, and what
+     * lets `importDeclaredFromProcessEnv` accept a value delivered flat.
+     *
+     * A slot naming another workflow is dropped rather than declared. Declaring
+     * it would make this workflow demand a value only that one was ever going to
+     * be given. The decoding lives here, beside the decoding of the secret
+     * itself, so the steps keep reading their plain `var_name` and never learn
+     * the convention exists.
+     *
+     * A slot naming a workflow the pipeline does not have is refused rather than
+     * dropped — see `UnknownWorkflowSlotError`. Dropping it silently is the same
+     * outcome as never declaring the credential, which is the green skip issue 03
+     * exists to end.
+     */
+    slotKeyFor(key) {
+        const decoded = decodeSecretName(key);
+        if (!decoded)
+            return key;
+        if (decoded.workflow) {
+            if (!this.declaredWorkflows.includes(decoded.workflow)) {
+                throw new UnknownWorkflowSlotError(key, decoded.varName, decoded.workflow, this.declaredWorkflows);
+            }
+            if (decoded.workflow !== this.workflowName)
+                return null;
+        }
+        return decoded.varName;
+    }
     mergeEnvVars(envArray) {
         for (const envObj of envArray) {
-            for (const [key, value] of Object.entries(envObj)) {
+            for (const [declaredKey, value] of Object.entries(envObj)) {
+                const key = this.slotKeyFor(declaredKey);
+                if (key === null)
+                    continue;
                 // Naming the key is the declaration, whatever value follows it
                 this.declaredVars.add(key);
                 // First resolve any secret references

package/dist/src/yaml/secrets-manager.d.ts

@@ -43,17 +43,27 @@ export declare class SecretsManager {
      * Get a secret value by variable name.
      * Workflow-specific value takes precedence over global.
      * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     *
+     * The stored data is consulted before that fallback, and not only when a
+     * file was loaded. `storeSecret` writes the file but cannot make it one this
+     * instance *loaded*, so a value collected by `ci init` on a repository that
+     * had no store — which is the only kind of run that collects anything — read
+     * back as absent from the instance that had just stored it. `ci init`'s own
+     * `getSecret('KEYSTORE_PROPERTIES', wf)`, which is how a workflow's keystore
+     * target is taken from `storeFile=`, returned undefined on every fresh
+     * repository because of it.
      */
     getSecret(name: string, workflow?: string): string | undefined;
     /**
      * Get all secrets merged: global + workflow-specific (workflow overrides global).
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present —
+     * for the keys the store does not hold. See `getSecret`.
      */
     getAll(workflow?: string): Record<string, string>;
     /**
      * Returns the variable name if a secret exists for it, undefined otherwise.
-     * Checks workflow scope first, then global.
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Checks workflow scope first, then global, then the CIBUILD_-prefixed env
+     * vars when no secrets file is present. See `getSecret`.
      */
     getSecretIdByName(name: string, workflow?: string): string | undefined;
     /**

package/dist/src/yaml/secrets-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/yaml/secrets-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,UAAU,CAAkB;gBAExB,eAAe,CAAC,EAAE,MAAM;IAMpC,OAAO,CAAC,WAAW;IAqCnB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAkB/B,OAAO,CAAC,WAAW;IAUnB;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAanE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAc;IAEhD;;;OAGG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAU9D;;;OAGG;IACH,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAWjD;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAatE;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAQ7B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAetD,kBAAkB,IAAI,MAAM;CAG7B"}
+{"version":3,"file":"secrets-manager.d.ts","sourceRoot":"","sources":["../../../src/yaml/secrets-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACnD;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,IAAI,CAAc;IAC1B,OAAO,CAAC,UAAU,CAAkB;gBAExB,eAAe,CAAC,EAAE,MAAM;IAMpC,OAAO,CAAC,WAAW;IAqCnB;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAkB/B,OAAO,CAAC,WAAW;IAUnB;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAanE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAc;IAEhD;;;OAGG;IACH,OAAO,CAAC,aAAa;IAUrB;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAa9D;;;;OAIG;IACH,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IASjD;;;;OAIG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAatE;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI7C;;OAEG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,iBAAiB,IAAI,MAAM,EAAE;IAQ7B;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO;IAetD,kBAAkB,IAAI,MAAM;CAG7B"}

package/dist/src/yaml/secrets-manager.js

@@ -129,25 +129,36 @@ export class SecretsManager {
      * Get a secret value by variable name.
      * Workflow-specific value takes precedence over global.
      * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     *
+     * The stored data is consulted before that fallback, and not only when a
+     * file was loaded. `storeSecret` writes the file but cannot make it one this
+     * instance *loaded*, so a value collected by `ci init` on a repository that
+     * had no store — which is the only kind of run that collects anything — read
+     * back as absent from the instance that had just stored it. `ci init`'s own
+     * `getSecret('KEYSTORE_PROPERTIES', wf)`, which is how a workflow's keystore
+     * target is taken from `storeFile=`, returned undefined on every fresh
+     * repository because of it.
      */
     getSecret(name, workflow) {
-        if (!this.fileLoaded) {
-            return process.env[SecretsManager.ENV_PREFIX + name];
-        }
         if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
             return this.data.workflows[workflow][name];
         }
-        return this.data.global[name];
+        if (this.data.global[name] !== undefined) {
+            return this.data.global[name];
+        }
+        if (!this.fileLoaded) {
+            return process.env[SecretsManager.ENV_PREFIX + name];
+        }
+        return undefined;
     }
     /**
      * Get all secrets merged: global + workflow-specific (workflow overrides global).
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present —
+     * for the keys the store does not hold. See `getSecret`.
      */
     getAll(workflow) {
-        if (!this.fileLoaded) {
-            return this.getEnvSecrets();
-        }
-        const merged = { ...this.data.global };
+        const merged = this.fileLoaded ? {} : this.getEnvSecrets();
+        Object.assign(merged, this.data.global);
         if (workflow && this.data.workflows[workflow]) {
             Object.assign(merged, this.data.workflows[workflow]);
         }
@@ -155,19 +166,19 @@ export class SecretsManager {
     }
     /**
      * Returns the variable name if a secret exists for it, undefined otherwise.
-     * Checks workflow scope first, then global.
-     * Falls back to CIBUILD_-prefixed env vars when no secrets file is present.
+     * Checks workflow scope first, then global, then the CIBUILD_-prefixed env
+     * vars when no secrets file is present. See `getSecret`.
      */
     getSecretIdByName(name, workflow) {
-        if (!this.fileLoaded) {
-            return process.env[SecretsManager.ENV_PREFIX + name] !== undefined ? name : undefined;
-        }
         if (workflow && this.data.workflows[workflow]?.[name] !== undefined) {
             return name;
         }
         if (this.data.global[name] !== undefined) {
             return name;
         }
+        if (!this.fileLoaded) {
+            return process.env[SecretsManager.ENV_PREFIX + name] !== undefined ? name : undefined;
+        }
         return undefined;
     }
     /**