@kitsi/cli 0.0.1

package/dist/bin/pipeline-authoring.js

@@ -0,0 +1,151 @@
+import { resolve as resolvePath } from 'node:path';
+import * as dsl from '../dsl/index.js';
+import * as ops from '../ops/index.js';
+import { VERSION } from '../version.js';
+const KITSI_GLOBALS_KEY = Symbol.for('kitsi.globals');
+export const KITSI_TYPES_VERSION = VERSION;
+export const KITSI_GLOBALS = {
+    plan: dsl.plan,
+    task: dsl.task,
+    step: dsl.step,
+    kit: dsl.kit,
+    image: dsl.image,
+    service: dsl.service,
+    registry: dsl.registry,
+    sh: ops.sh,
+    secret: ops.secret,
+    env: ops.env,
+    param: ops.param,
+    out: ops.out,
+    emit: ops.emit,
+    use: ops.use,
+    pack: ops.pack,
+    unpack: ops.unpack,
+    artifact: ops.artifact,
+    cache: ops.cache,
+    cacheOr: ops.cacheOr,
+    report: ops.report,
+    annotate: ops.annotate,
+    summary: ops.summary,
+    bind: ops.bind,
+};
+export const registerPipelineGlobals = () => {
+    const target = globalThis;
+    if (target[KITSI_GLOBALS_KEY])
+        return;
+    Object.assign(target, KITSI_GLOBALS);
+    Object.defineProperty(target, KITSI_GLOBALS_KEY, {
+        value: true,
+        enumerable: false,
+        configurable: false,
+        writable: false,
+    });
+};
+export const KITSI_TYPES_HEADER = `// @kitsi-types v${KITSI_TYPES_VERSION}
+// Generated by kitsi types - do not edit manually
+`;
+export const parseKitsiTypesVersion = (contents) => {
+    const match = contents.match(/@kitsi-types v([0-9A-Za-z._-]+)/);
+    return match?.[1] ?? null;
+};
+const buildGlobalDeclarations = () => {
+    const globals = [
+        'plan',
+        'task',
+        'step',
+        'kit',
+        'image',
+        'service',
+        'registry',
+        'sh',
+        'secret',
+        'env',
+        'param',
+        'out',
+        'emit',
+        'use',
+        'pack',
+        'unpack',
+        'artifact',
+        'cache',
+        'cacheOr',
+        'report',
+        'annotate',
+        'summary',
+        'bind',
+    ];
+    return globals.map((name) => `  const ${name}: typeof import('@kitsi/cli').${name};`);
+};
+const buildTypeExports = () => [
+    "type PlanBuilder = import('@kitsi/cli').PlanBuilder;",
+    "type TaskBuilder = import('@kitsi/cli').TaskBuilder;",
+    "type StepBuilder = import('@kitsi/cli').StepBuilder;",
+    "type StepGenerator = import('@kitsi/cli').StepGenerator;",
+    "type StepCtx = import('@kitsi/cli').StepCtx;",
+    "type KitBuilder = import('@kitsi/cli').KitBuilder;",
+    "type ImageBuilder = import('@kitsi/cli').ImageBuilder;",
+    "type ServiceBuilder = import('@kitsi/cli').ServiceBuilder;",
+    "type Registry = import('@kitsi/cli').Registry;",
+    "type CommandBuilder = import('@kitsi/cli').CommandBuilder;",
+    "type CommandOp = import('@kitsi/cli').CommandOp;",
+    "type EnvOp = import('@kitsi/cli').EnvOp;",
+    "type SecretRef = import('@kitsi/cli').SecretRef;",
+    "type ParamRef<T> = import('@kitsi/cli').ParamRef<T>;",
+    "type CacheOp = import('@kitsi/cli').CacheOp;",
+    "type CacheOrOp = import('@kitsi/cli').CacheOrOp;",
+    "type CacheMountOp = import('@kitsi/cli').CacheMountOp;",
+    "type BundleRef = import('@kitsi/cli').BundleRef;",
+    "type PackOp = import('@kitsi/cli').PackOp;",
+    "type UnpackOp = import('@kitsi/cli').UnpackOp;",
+    "type EmitOp<T> = import('@kitsi/cli').EmitOp<T>;",
+    "type UseOp<T> = import('@kitsi/cli').UseOp<T>;",
+    "type ValueRef<T> = import('@kitsi/cli').ValueRef<T>;",
+    "type ArtifactUploadOp = import('@kitsi/cli').ArtifactUploadOp;",
+    "type ArtifactDownloadOp = import('@kitsi/cli').ArtifactDownloadOp;",
+    "type ReportOp = import('@kitsi/cli').ReportOp;",
+    "type AnnotateOp = import('@kitsi/cli').AnnotateOp;",
+    "type SummaryOp = import('@kitsi/cli').SummaryOp;",
+    "type BindServiceOp = import('@kitsi/cli').BindServiceOp;",
+];
+export const createKitsiTypes = () => {
+    const lines = [
+        KITSI_TYPES_HEADER.trimEnd(),
+        '',
+        'declare global {',
+        ...buildGlobalDeclarations(),
+        '}',
+        '',
+        ...buildTypeExports(),
+        '',
+        'export {};',
+        '',
+    ];
+    return lines.join('\n');
+};
+export const createKitsiTsconfig = () => `${JSON.stringify({
+    $schema: 'https://json.schemastore.org/tsconfig',
+    compilerOptions: {
+        target: 'ESNext',
+        module: 'ESNext',
+        moduleResolution: 'bundler',
+        strict: true,
+        noEmit: true,
+        skipLibCheck: true,
+        types: [],
+    },
+    include: ['*.ts'],
+    exclude: ['node_modules'],
+}, null, 2)}\n`;
+export const resolvePipelinePath = (cwd, config) => {
+    const candidate = config.pipeline ?? config.pipelineFile ?? '.kitsi/pipeline.ts';
+    return resolvePath(cwd, candidate);
+};
+export const resolveTypesPath = (cwd, config) => {
+    const candidate = config.types?.path ?? '.kitsi/kitsi.d.ts';
+    return resolvePath(cwd, candidate);
+};
+export const resolveTsconfigPath = (cwd, config) => {
+    const candidate = config.tsconfig?.path ?? '.kitsi/tsconfig.json';
+    return resolvePath(cwd, candidate);
+};
+//# sourceMappingURL=pipeline-authoring.js.map

package/dist/bin/pipeline-authoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-authoring.js","sourceRoot":"","sources":["../../src/bin/pipeline-authoring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AACvC,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAGxC,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAE3C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,GAAG,EAAE,GAAG,CAAC,GAAG;IACZ,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,GAAG,EAAE,GAAG,CAAC,GAAG;IACZ,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,GAAG,EAAE,GAAG,CAAC,GAAG;IACZ,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,GAAG,EAAE,GAAG,CAAC,GAAG;IACZ,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,KAAK,EAAE,GAAG,CAAC,KAAK;IAChB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,MAAM,EAAE,GAAG,CAAC,MAAM;IAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;IACtB,OAAO,EAAE,GAAG,CAAC,OAAO;IACpB,IAAI,EAAE,GAAG,CAAC,IAAI;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAS,EAAE;IAChD,MAAM,MAAM,GAAG,UAAmE,CAAC;IACnF,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAAE,OAAO;IACtC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE;QAC/C,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,mBAAmB;;CAExE,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAgB,EAAiB,EAAE;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAChE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,GAAa,EAAE;IAC7C,MAAM,OAAO,GAAsC;QACjD,MAAM;QACN,MAAM;QACN,MAAM;QACN,KAAK;QACL,OAAO;QACP,SAAS;QACT,UAAU;QACV,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,OAAO;QACP,KAAK;QACL,MAAM;QACN,KAAK;QACL,MAAM;QACN,QAAQ;QACR,UAAU;QACV,OAAO;QACP,SAAS;QACT,QAAQ;QACR,UAAU;QACV,SAAS;QACT,MAAM;KACP,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,iCAAiC,IAAI,GAAG,CAAC,CAAC;AACxF,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,GAAa,EAAE,CAAC;IACvC,sDAAsD;IACtD,sDAAsD;IACtD,sDAAsD;IACtD,0DAA0D;IAC1D,8CAA8C;IAC9C,oDAAoD;IACpD,wDAAwD;IACxD,4DAA4D;IAC5D,gDAAgD;IAChD,4DAA4D;IAC5D,kDAAkD;IAClD,0CAA0C;IAC1C,kDAAkD;IAClD,sDAAsD;IACtD,8CAA8C;IAC9C,kDAAkD;IAClD,wDAAwD;IACxD,kDAAkD;IAClD,4CAA4C;IAC5C,gDAAgD;IAChD,kDAAkD;IAClD,gDAAgD;IAChD,sDAAsD;IACtD,gEAAgE;IAChE,oEAAoE;IACpE,gDAAgD;IAChD,oDAAoD;IACpD,kDAAkD;IAClD,0DAA0D;CAC3D,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAW,EAAE;IAC3C,MAAM,KAAK,GAAG;QACZ,kBAAkB,CAAC,OAAO,EAAE;QAC5B,EAAE;QACF,kBAAkB;QAClB,GAAG,uBAAuB,EAAE;QAC5B,GAAG;QACH,EAAE;QACF,GAAG,gBAAgB,EAAE;QACrB,EAAE;QACF,YAAY;QACZ,EAAE;KACH,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAW,EAAE,CAC9C,GAAG,IAAI,CAAC,SAAS,CACf;IACE,OAAO,EAAE,uCAAuC;IAChD,eAAe,EAAE;QACf,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,QAAQ;QAChB,gBAAgB,EAAE,SAAS;QAC3B,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,EAAE;KACV;IACD,OAAO,EAAE,CAAC,MAAM,CAAC;IACjB,OAAO,EAAE,CAAC,cAAc,CAAC;CAC1B,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;AAER,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,MAAmB,EAAU,EAAE;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,IAAI,oBAAoB,CAAC;IACjF,OAAO,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAE,MAAmB,EAAU,EAAE;IAC3E,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,mBAAmB,CAAC;IAC5D,OAAO,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,MAAmB,EAAU,EAAE;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAsB,CAAC;IAClE,OAAO,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC,CAAC"}

package/dist/bin/pipeline-discovery.d.ts

@@ -0,0 +1,3 @@
+import type { FileSystem } from './context.js';
+export declare const discoverPipelineFiles: (cwd: string, fs: FileSystem) => Promise<string[]>;
+//# sourceMappingURL=pipeline-discovery.d.ts.map

package/dist/bin/pipeline-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-discovery.d.ts","sourceRoot":"","sources":["../../src/bin/pipeline-discovery.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAwC/C,eAAO,MAAM,qBAAqB,GAAU,KAAK,MAAM,EAAE,IAAI,UAAU,KAAG,OAAO,CAAC,MAAM,EAAE,CAMzF,CAAC"}

package/dist/bin/pipeline-discovery.js

@@ -0,0 +1,50 @@
+import { join, relative } from 'node:path';
+const KITSI_DIR = '.kitsi';
+const IGNORED_DIRS = new Set(['node_modules', 'cache', 'artifacts', 'profiles']);
+const IGNORED_FILES = new Set(['kitsi.d.ts', 'tsconfig.json', 'package.json']);
+const PIPELINE_EXTENSIONS = new Set(['.ts', '.js', '.mts', '.cts', '.mjs', '.cjs']);
+const isPipelineFile = (name) => {
+    if (IGNORED_FILES.has(name))
+        return false;
+    if (name.endsWith('.d.ts'))
+        return false;
+    const ext = name.slice(name.lastIndexOf('.'));
+    return PIPELINE_EXTENSIONS.has(ext);
+};
+const walk = async (dir, fs, files, root) => {
+    let entries = [];
+    try {
+        entries = await fs.readdir(dir);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const fullPath = join(dir, entry);
+        let stats;
+        try {
+            stats = await fs.stat(fullPath);
+        }
+        catch {
+            continue;
+        }
+        if (stats.isDirectory()) {
+            if (IGNORED_DIRS.has(entry))
+                continue;
+            await walk(fullPath, fs, files, root);
+            continue;
+        }
+        if (isPipelineFile(entry)) {
+            files.push(relative(root, fullPath));
+        }
+    }
+};
+export const discoverPipelineFiles = async (cwd, fs) => {
+    const root = join(cwd, KITSI_DIR);
+    if (!fs.existsSync(root))
+        return [];
+    const files = [];
+    await walk(root, fs, files, cwd);
+    return files.sort();
+};
+//# sourceMappingURL=pipeline-discovery.js.map

package/dist/bin/pipeline-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-discovery.js","sourceRoot":"","sources":["../../src/bin/pipeline-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG3C,MAAM,SAAS,GAAG,QAAQ,CAAC;AAC3B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AACjF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;AAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAE,EAAc,EAAE,KAAe,EAAE,IAAY,EAAiB,EAAE;IAC/F,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,KAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAS;YACtC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,GAAW,EAAE,EAAc,EAAqB,EAAE;IAC5F,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC"}

package/dist/bin/pipeline.d.ts

@@ -0,0 +1,3 @@
+import type { Registry } from '../dsl/registry.js';
+export declare const loadRegistry: (cwd: string, filePath: string) => Promise<Registry>;
+//# sourceMappingURL=pipeline.d.ts.map

package/dist/bin/pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/bin/pipeline.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAkDnD,eAAO,MAAM,YAAY,GAAU,KAAK,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,QAAQ,CAmBlF,CAAC"}

package/dist/bin/pipeline.js

@@ -0,0 +1,67 @@
+import { resolve as resolvePath } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { PlanBuilder } from '../dsl/plan.js';
+import { registry } from '../dsl/registry.js';
+import { PipelineError } from './errors/index.js';
+import { registerPipelineGlobals } from './pipeline-authoring.js';
+const isPlanBuilder = (value) => {
+    if (value instanceof PlanBuilder)
+        return true;
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return typeof candidate.config?.name === 'string' && Array.isArray(candidate.config?.tasks);
+};
+const isRegistry = (value) => {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return Array.isArray(candidate.plans) && candidate.plans.every(isPlanBuilder);
+};
+const isTypeScriptFile = (filePath) => filePath.endsWith('.ts') || filePath.endsWith('.mts') || filePath.endsWith('.cts');
+const validateRuntime = (filePath) => {
+    const runtime = process.env.KITSI_RUNTIME?.toLowerCase();
+    if (!runtime)
+        return;
+    if (runtime !== 'bun' && runtime !== 'node') {
+        throw new Error(`Unsupported runtime "${runtime}"`);
+    }
+    if (runtime === 'bun' && !process.versions?.bun) {
+        throw new Error('KITSI_RUNTIME=bun requires Bun to load TypeScript pipelines');
+    }
+    if (runtime === 'node' && isTypeScriptFile(filePath) && !process.versions?.bun) {
+        throw new Error('KITSI_RUNTIME=node cannot load TypeScript pipelines');
+    }
+};
+const resolveExportedRegistry = (loaded) => {
+    const exported = loaded.ci ?? loaded.default;
+    if (!exported) {
+        throw new Error(`Pipeline file must export "ci" (got: ${Object.keys(loaded).join(', ') || 'no exports'})`);
+    }
+    if (isRegistry(exported))
+        return exported;
+    if (isPlanBuilder(exported))
+        return registry(exported);
+    if (Array.isArray(exported) && exported.every(isPlanBuilder)) {
+        return registry(...exported);
+    }
+    throw new Error('Pipeline export must be a plan or registry');
+};
+export const loadRegistry = async (cwd, filePath) => {
+    const resolved = resolvePath(cwd, filePath);
+    const moduleUrl = pathToFileURL(resolved).href;
+    try {
+        validateRuntime(filePath);
+        registerPipelineGlobals();
+        const loaded = await import(moduleUrl);
+        return resolveExportedRegistry(loaded);
+    }
+    catch (error) {
+        const suffix = filePath.endsWith('.ts') && !process.versions?.bun
+            ? ' (Tip: run with Bun for .ts pipeline files)'
+            : '';
+        const message = error instanceof Error ? error.message : String(error);
+        throw new PipelineError(`Failed to load pipeline file "${filePath}"${suffix}: ${message}`, resolved);
+    }
+};
+//# sourceMappingURL=pipeline.js.map

package/dist/bin/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../../src/bin/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,MAAM,aAAa,GAAG,CAAC,KAAc,EAAwB,EAAE;IAC7D,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAyD,CAAC;IAC5E,OAAO,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAC9F,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAc,EAAqB,EAAE;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAA4B,CAAC;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAChF,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAW,EAAE,CACrD,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAErF,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAQ,EAAE;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,MAA+B,EAAY,EAAE;IAC5E,MAAM,QAAQ,GACX,MAA8C,CAAC,EAAE,IAAK,MAAgC,CAAC,OAAO,CAAC;IAClG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,wCAAwC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,GAAG,CAC1F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,aAAa,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,OAAO,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAqB,EAAE;IACrF,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC1B,uBAAuB,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,uBAAuB,CAAC,MAAiC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG;YAChD,CAAC,CAAC,6CAA6C;YAC/C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,aAAa,CACrB,iCAAiC,QAAQ,IAAI,MAAM,KAAK,OAAO,EAAE,EACjE,QAAQ,CACT,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/bin/profiles/secrets/encrypted.d.ts

@@ -0,0 +1,4 @@
+import type { SecretSource } from '../storage.js';
+export declare const encryptSecret: (value: string, password: string) => SecretSource;
+export declare const decryptSecret: (secret: SecretSource, password: string) => string;
+//# sourceMappingURL=encrypted.d.ts.map

package/dist/bin/profiles/secrets/encrypted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.d.ts","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/encrypted.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAsBlD,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,EAAE,UAAU,MAAM,KAAG,YAgB/D,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,YAAY,EAAE,UAAU,MAAM,KAAG,MAatE,CAAC"}

package/dist/bin/profiles/secrets/encrypted.js

@@ -0,0 +1,50 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { argon2id } from '@noble/hashes/argon2';
+import { utf8ToBytes } from '@noble/hashes/utils';
+import { InvalidArgumentsError } from '../../errors/index.js';
+const DEFAULT_PARAMS = {
+    memory: 65_536,
+    passes: 3,
+    parallelism: 1,
+};
+const deriveKey = (password, salt, params) => {
+    const key = argon2id(utf8ToBytes(password), salt, {
+        m: params.memory,
+        t: params.passes,
+        p: params.parallelism,
+        dkLen: 32,
+    });
+    return Buffer.from(key);
+};
+export const encryptSecret = (value, password) => {
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const params = DEFAULT_PARAMS;
+    const key = deriveKey(password, salt, params);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const encrypted = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return {
+        source: 'encrypted',
+        payload: encrypted.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: tag.toString('base64'),
+        salt: salt.toString('base64'),
+        params,
+    };
+};
+export const decryptSecret = (secret, password) => {
+    if (secret.source !== 'encrypted') {
+        throw new InvalidArgumentsError('Secret is not encrypted');
+    }
+    const salt = Buffer.from(secret.salt, 'base64');
+    const key = deriveKey(password, salt, secret.params);
+    const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(secret.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(secret.tag, 'base64'));
+    const decrypted = Buffer.concat([
+        decipher.update(Buffer.from(secret.payload, 'base64')),
+        decipher.final(),
+    ]);
+    return decrypted.toString('utf8');
+};
+//# sourceMappingURL=encrypted.js.map

package/dist/bin/profiles/secrets/encrypted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypted.js","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/encrypted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,MAAM,cAAc,GAAG;IACrB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,SAAS,GAAG,CAChB,QAAgB,EAChB,IAAgB,EAChB,MAA+D,EACvD,EAAE;IACV,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE;QAChD,CAAC,EAAE,MAAM,CAAC,MAAM;QAChB,CAAC,EAAE,MAAM,CAAC,MAAM;QAChB,CAAC,EAAE,MAAM,CAAC,WAAW;QACrB,KAAK,EAAE,EAAE;KACV,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,QAAgB,EAAgB,EAAE;IAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,MAAM;KACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAoB,EAAE,QAAgB,EAAU,EAAE;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC,CAAC"}

package/dist/bin/profiles/secrets/env.d.ts

@@ -0,0 +1,3 @@
+import type { SecretSource } from '../storage.js';
+export declare const resolveEnvSecret: (name: string, entry: SecretSource, env: Record<string, string | undefined>) => string;
+//# sourceMappingURL=env.d.ts.map

package/dist/bin/profiles/secrets/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/env.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,eAAO,MAAM,gBAAgB,GAC3B,MAAM,MAAM,EACZ,OAAO,YAAY,EACnB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KACtC,MASF,CAAC"}

package/dist/bin/profiles/secrets/env.js

@@ -0,0 +1,12 @@
+import { InvalidArgumentsError } from '../../errors/index.js';
+export const resolveEnvSecret = (name, entry, env) => {
+    if (entry.source !== 'env') {
+        throw new InvalidArgumentsError(`Secret "${name}" is not an env reference`);
+    }
+    const value = env[entry.env];
+    if (!value) {
+        throw new InvalidArgumentsError(`Secret "${name}" expects env ${entry.env}`);
+    }
+    return value;
+};
+//# sourceMappingURL=env.js.map

package/dist/bin/profiles/secrets/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,IAAY,EACZ,KAAmB,EACnB,GAAuC,EAC/B,EAAE;IACV,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,qBAAqB,CAAC,WAAW,IAAI,2BAA2B,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,WAAW,IAAI,iBAAiB,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC"}

package/dist/bin/profiles/secrets/index.d.ts

@@ -0,0 +1,12 @@
+import type { Profile } from '../storage.js';
+export interface SecretStorage {
+    get: (key: string) => Promise<string | null>;
+    set: (key: string, value: string) => Promise<void>;
+    delete: (key: string) => Promise<void>;
+}
+export interface SecretResolutionOptions {
+    env: Record<string, string | undefined>;
+    promptPassword?: (prompt: string) => Promise<string>;
+}
+export declare const resolveProfileSecrets: (profile: Profile, opts: SecretResolutionOptions) => Promise<Record<string, string>>;
+//# sourceMappingURL=index.d.ts.map

package/dist/bin/profiles/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAgB,MAAM,eAAe,CAAC;AAK3D,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACtD;AA6BD,eAAO,MAAM,qBAAqB,GAChC,SAAS,OAAO,EAChB,MAAM,uBAAuB,KAC5B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOhC,CAAC"}

package/dist/bin/profiles/secrets/index.js

@@ -0,0 +1,34 @@
+import { InvalidArgumentsError, MissingParametersError } from '../../errors/index.js';
+import { decryptSecret } from './encrypted.js';
+import { resolveEnvSecret } from './env.js';
+import { getKeychainSecret } from './keychain.js';
+const resolveSecret = async (name, entry, opts, passwordCache) => {
+    switch (entry.source) {
+        case 'env':
+            return resolveEnvSecret(name, entry, opts.env);
+        case 'keychain':
+            return getKeychainSecret(entry.key);
+        case 'encrypted': {
+            let password = passwordCache.get(entry.salt);
+            if (!password) {
+                if (!opts.promptPassword) {
+                    throw new MissingParametersError([{ name: `password for ${name}`, type: 'secret' }]);
+                }
+                password = await opts.promptPassword(`Password for secret "${name}"`);
+                passwordCache.set(entry.salt, password);
+            }
+            return decryptSecret(entry, password);
+        }
+        default:
+            throw new InvalidArgumentsError(`Unsupported secret source for "${name}"`);
+    }
+};
+export const resolveProfileSecrets = async (profile, opts) => {
+    const resolved = {};
+    const passwordCache = new Map();
+    for (const [name, entry] of Object.entries(profile.secrets ?? {})) {
+        resolved[name] = await resolveSecret(name, entry, opts, passwordCache);
+    }
+    return resolved;
+};
+//# sourceMappingURL=index.js.map

package/dist/bin/profiles/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAalD,MAAM,aAAa,GAAG,KAAK,EACzB,IAAY,EACZ,KAAmB,EACnB,IAA6B,EAC7B,aAAkC,EACjB,EAAE;IACnB,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,UAAU;YACb,OAAO,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,IAAI,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;oBACzB,MAAM,IAAI,sBAAsB,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACvF,CAAC;gBACD,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,wBAAwB,IAAI,GAAG,CAAC,CAAC;gBACtE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD;YACE,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,IAAI,GAAG,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,OAAgB,EAChB,IAA6B,EACI,EAAE;IACnC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC"}

package/dist/bin/profiles/secrets/keychain.d.ts

@@ -0,0 +1,4 @@
+export declare const setKeychainSecret: (key: string, value: string) => Promise<void>;
+export declare const getKeychainSecret: (key: string) => Promise<string>;
+export declare const deleteKeychainSecret: (key: string) => Promise<void>;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/bin/profiles/secrets/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/keychain.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,iBAAiB,GAAU,KAAK,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,IAAI,CAGhF,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,MAAM,CAOnE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,IAAI,CAGpE,CAAC"}

package/dist/bin/profiles/secrets/keychain.js

@@ -0,0 +1,29 @@
+import { InvalidArgumentsError, NotFoundError } from '../../errors/index.js';
+const SERVICE = 'kitsi';
+const loadKeytar = async () => {
+    try {
+        const module = await import('keytar');
+        return module.default ?? module;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new InvalidArgumentsError(`Keychain backend unavailable: ${message}`);
+    }
+};
+export const setKeychainSecret = async (key, value) => {
+    const keytar = await loadKeytar();
+    await keytar.setPassword(SERVICE, key, value);
+};
+export const getKeychainSecret = async (key) => {
+    const keytar = await loadKeytar();
+    const value = await keytar.getPassword(SERVICE, key);
+    if (!value) {
+        throw new NotFoundError(`Keychain entry "${key}" not found`);
+    }
+    return value;
+};
+export const deleteKeychainSecret = async (key) => {
+    const keytar = await loadKeytar();
+    await keytar.deletePassword(SERVICE, key);
+};
+//# sourceMappingURL=keychain.js.map

package/dist/bin/profiles/secrets/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../../src/bin/profiles/secrets/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE7E,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAW,EAAE,KAAa,EAAiB,EAAE;IACnF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAW,EAAmB,EAAE;IACtE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,mBAAmB,GAAG,aAAa,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAW,EAAiB,EAAE;IACvE,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC,CAAC"}

package/dist/bin/profiles/storage.d.ts

@@ -0,0 +1,42 @@
+export type SecretSource = {
+    source: 'env';
+    env: string;
+} | {
+    source: 'keychain';
+    key: string;
+} | {
+    source: 'encrypted';
+    payload: string;
+    iv: string;
+    tag: string;
+    salt: string;
+    params: {
+        memory: number;
+        passes: number;
+        parallelism: number;
+    };
+};
+export interface Profile {
+    name: string;
+    created: string;
+    updated: string;
+    plan: string;
+    parameters: Record<string, string | number | boolean>;
+    secrets: Record<string, SecretSource>;
+    env: Record<string, string>;
+}
+export interface ProfileSummary {
+    name: string;
+    plan: string;
+    updated: string;
+    secretCount: number;
+}
+export declare const listProfiles: (dir: string) => Promise<ProfileSummary[]>;
+export declare const loadProfile: (dir: string, name: string) => Promise<Profile>;
+export declare const saveProfile: (dir: string, profile: Profile) => Promise<void>;
+export declare const deleteProfile: (dir: string, name: string) => Promise<void>;
+export declare const exportProfile: (dir: string, name: string) => Promise<Profile>;
+export declare const importProfile: (dir: string, profile: Profile, name?: string) => Promise<Profile>;
+export declare const resolveProfileDirectory: (dir: string | undefined) => string;
+export declare const profileExists: (dir: string, name: string) => Promise<boolean>;
+//# sourceMappingURL=storage.d.ts.map

package/dist/bin/profiles/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../../src/bin/profiles/storage.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACnC;IACE,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE,CAAC;AAEN,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAgBD,eAAO,MAAM,YAAY,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,cAAc,EAAE,CAiBxE,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,KAAK,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAY5E,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,KAAK,MAAM,EAAE,SAAS,OAAO,KAAG,OAAO,CAAC,IAAI,CAI7E,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,KAAK,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAU3E,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,KAAK,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAE9E,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,KAAK,MAAM,EACX,SAAS,OAAO,EAChB,OAAO,MAAM,KACZ,OAAO,CAAC,OAAO,CAUjB,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,MAGjE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAU,KAAK,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAQ9E,CAAC"}