@lucern/sdk 0.3.0-alpha.17 → 0.3.0-alpha.3

package/dist/infisicalRuntime.js

@@ -1,346 +0,0 @@
-import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath, GENERATED_INFISICAL_RUNTIME_ENV } from '@lucern/contracts';
-
-// src/infisicalRuntime.ts
-var InfisicalRuntimeError = class extends Error {
-  code;
-  status;
-  constructor(args) {
-    super(args.message);
-    this.name = "InfisicalRuntimeError";
-    this.code = args.code;
-    this.status = args.status;
-  }
-};
-function readInfisicalRuntimeBootstrap(env = {}, overrides = {}) {
-  if (isInfisicalRuntimeDisabled(env)) {
-    return null;
-  }
-  const bootstrapEnv = INFISICAL_RUNTIME_MANIFEST.bootstrapEnv;
-  const clientId = overrides.clientId ?? readFirst(env, bootstrapEnv.clientId);
-  const clientSecret = overrides.clientSecret ?? readFirst(env, bootstrapEnv.clientSecret);
-  const hasAuthSignal = Boolean(clientId || clientSecret);
-  if (!hasAuthSignal) {
-    return null;
-  }
-  if (!clientId || !clientSecret) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_BOOTSTRAP_INCOMPLETE",
-      message: "Infisical runtime bootstrap requires both INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET."
-    });
-  }
-  return {
-    apiUrl: overrides.apiUrl ?? readFirst(env, bootstrapEnv.apiUrl) ?? INFISICAL_RUNTIME_DEFAULT_API_URL,
-    projectId: overrides.projectId ?? readFirst(env, bootstrapEnv.projectId) ?? INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,
-    clientId,
-    clientSecret,
-    environment: normalizeInfisicalEnvironment(
-      overrides.environment ?? readFirst(env, bootstrapEnv.environment)
-    ),
-    organizationSlug: overrides.organizationSlug ?? readFirst(env, bootstrapEnv.organizationSlug)
-  };
-}
-function isInfisicalRuntimeDisabled(env = {}) {
-  return INFISICAL_RUNTIME_MANIFEST.bootstrapEnv.disabled.some(
-    (name) => isTruthyEnv(env[name])
-  );
-}
-async function hydrateInfisicalRuntimeEnv(options) {
-  const env = options.env ?? {};
-  const baseBootstrap = readInfisicalRuntimeBootstrap(env, options.bootstrap);
-  const bootstrap = baseBootstrap ? {
-    ...baseBootstrap,
-    ...Object.fromEntries(
-      Object.entries(options.bootstrap ?? {}).filter(
-        ([, value]) => value !== void 0
-      )
-    ),
-    apiUrl: trimTrailingSlash(
-      options.bootstrap?.apiUrl ?? baseBootstrap.apiUrl
-    )
-  } : null;
-  if (!bootstrap) {
-    return {
-      status: "disabled",
-      surfaceId: options.surfaceId,
-      values: {},
-      sourcePaths: []
-    };
-  }
-  const surface = findInfisicalRuntimeSurface(options.surfaceId);
-  if (!surface) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNKNOWN_SURFACE",
-      message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`
-    });
-  }
-  const fallbackDelivery = surface.fallback;
-  if (surface.delivery !== "runtime_fetch" && fallbackDelivery !== "runtime_fetch") {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNSUPPORTED_SURFACE_DELIVERY",
-      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces or surfaces with a runtime_fetch fallback.`
-    });
-  }
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_FETCH_UNAVAILABLE",
-      message: "No fetch implementation is available for Infisical runtime hydration."
-    });
-  }
-  const token = await loginWithUniversalAuth(bootstrap, fetchImpl);
-  const values = {};
-  const missingRequired = [];
-  const sourcePaths = /* @__PURE__ */ new Set();
-  const variables = options.includeGeneratedSurfaceVariables ? generatedSurfaceVariables(options.surfaceId) : contractSurfaceVariables(surface.sourcePathIds);
-  for (const runtimeVariable of variables) {
-    sourcePaths.add(runtimeVariable.secretPath);
-    const secretValue = await readVariableSecret({
-      bootstrap,
-      fetchImpl,
-      token,
-      secretPath: runtimeVariable.secretPath,
-      variable: runtimeVariable
-    });
-    if (!secretValue) {
-      if (runtimeVariable.required) {
-        missingRequired.push(runtimeVariable.name);
-      }
-      continue;
-    }
-    values[runtimeVariable.name] = secretValue.value;
-    for (const alias of runtimeVariable.aliases ?? []) {
-      values[alias] = secretValue.value;
-    }
-  }
-  if (missingRequired.length > 0) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_REQUIRED_SECRETS_MISSING",
-      message: `Missing required Infisical runtime secrets: ${missingRequired.join(", ")}.`
-    });
-  }
-  return {
-    status: "hydrated",
-    surfaceId: options.surfaceId,
-    environment: bootstrap.environment,
-    values,
-    sourcePaths: [...sourcePaths]
-  };
-}
-function applyInfisicalRuntimeEnv(result, targetEnv, options = {}) {
-  for (const [key, value] of Object.entries(result.values)) {
-    if (options.overrideExisting || !targetEnv[key]) {
-      targetEnv[key] = value;
-    }
-  }
-}
-function normalizeInfisicalEnvironment(value) {
-  if (value === "dev" || value === "staging" || value === "prod") {
-    return value;
-  }
-  if (value === "development") {
-    return "dev";
-  }
-  if (value === "production") {
-    return "prod";
-  }
-  return "prod";
-}
-async function loginWithUniversalAuth(bootstrap, fetchImpl) {
-  const response = await fetchImpl(
-    `${trimTrailingSlash(bootstrap.apiUrl)}/api/v1/auth/universal-auth/login`,
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        clientId: bootstrap.clientId,
-        clientSecret: bootstrap.clientSecret,
-        ...bootstrap.organizationSlug ? { organizationSlug: bootstrap.organizationSlug } : {}
-      })
-    }
-  );
-  const body = await readJson(response);
-  if (!response.ok) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNIVERSAL_AUTH_FAILED",
-      status: response.status,
-      message: `Infisical Universal Auth failed with HTTP ${response.status}: ${messageFromBody(body)}`
-    });
-  }
-  const accessToken = readNestedString(body, ["accessToken"]);
-  if (!accessToken) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNIVERSAL_AUTH_INVALID_RESPONSE",
-      message: "Infisical Universal Auth response did not include accessToken."
-    });
-  }
-  return accessToken;
-}
-async function readVariableSecret(args) {
-  const names = [args.variable.name, ...args.variable.aliases ?? []];
-  for (const name of names) {
-    const value = await readSecretValue({
-      bootstrap: args.bootstrap,
-      fetchImpl: args.fetchImpl,
-      token: args.token,
-      secretPath: args.secretPath,
-      name,
-      optional: true
-    });
-    if (value) {
-      return { name, value };
-    }
-  }
-  return null;
-}
-function contractSurfaceVariables(sourcePathIds) {
-  return sourcePathIds.flatMap((pathId) => {
-    const path = findInfisicalRuntimePath(pathId);
-    if (!path) {
-      throw new InfisicalRuntimeError({
-        code: "INFISICAL_UNKNOWN_PATH",
-        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
-      });
-    }
-    return path.variables.map((variable) => ({
-      ...variable,
-      secretPath: path.secretPath
-    }));
-  });
-}
-function generatedSurfaceVariables(surfaceId) {
-  const surface = GENERATED_INFISICAL_RUNTIME_ENV.surfaces[surfaceId];
-  if (!surface) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNKNOWN_SURFACE",
-      message: `Unknown generated Lucern Infisical runtime surface: ${surfaceId}.`
-    });
-  }
-  return surface.variables.map(generatedVariableToRuntimeVariable);
-}
-function generatedVariableToRuntimeVariable(variable) {
-  const aliases = /* @__PURE__ */ new Set([
-    ...variable.envNames.filter((name) => name !== variable.canonicalName),
-    ...variable.aliases
-  ]);
-  return {
-    name: variable.canonicalName,
-    required: variable.required,
-    secret: variable.secret,
-    public: variable.public,
-    aliases: [...aliases],
-    description: variable.description,
-    secretPath: variable.sourcePath
-  };
-}
-async function readSecretValue(args) {
-  const params = new URLSearchParams({
-    projectId: args.bootstrap.projectId,
-    environment: args.bootstrap.environment,
-    secretPath: args.secretPath,
-    type: "shared",
-    viewSecretValue: "true",
-    expandSecretReferences: "true",
-    includeImports: "true"
-  });
-  const response = await args.fetchImpl(
-    `${trimTrailingSlash(args.bootstrap.apiUrl)}/api/v4/secrets/${encodeURIComponent(args.name)}?${params.toString()}`,
-    {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${args.token}`
-      }
-    }
-  );
-  const body = await readJson(response);
-  if (response.status === 404 && args.optional) {
-    return null;
-  }
-  if (!response.ok) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_SECRET_READ_FAILED",
-      status: response.status,
-      message: `Infisical secret ${args.name} read failed with HTTP ${response.status}: ${messageFromBody(body)}`
-    });
-  }
-  return readNestedString(body, ["secret", "secretValue"]);
-}
-async function readJson(response) {
-  try {
-    return await response.json();
-  } catch (error) {
-    debugInfisicalRuntimeFallback("response.json", error);
-    return void 0;
-  }
-}
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function readNestedString(value, path) {
-  let current = value;
-  for (const key of path) {
-    if (!isRecord(current) || !(key in current)) {
-      return null;
-    }
-    current = current[key];
-  }
-  return typeof current === "string" && current.length > 0 ? current : null;
-}
-function messageFromBody(body) {
-  if (!isRecord(body)) {
-    return "no response body";
-  }
-  for (const key of ["message", "error", "errorMessage"]) {
-    if (typeof body[key] === "string") {
-      return body[key];
-    }
-  }
-  return JSON.stringify(body);
-}
-function readFirst(env, names) {
-  for (const name of names) {
-    const value = env[name]?.trim();
-    if (value) {
-      return value;
-    }
-  }
-  return void 0;
-}
-function isTruthyEnv(value) {
-  return ["1", "true", "yes", "on"].includes(value?.toLowerCase() ?? "");
-}
-function trimTrailingSlash(value) {
-  return value.replace(/\/+$/u, "");
-}
-function debugInfisicalRuntimeFallback(message, error) {
-  const env = globalThis.process?.env;
-  if (env?.LUCERN_COMPAT_FALLBACK_DEBUG !== "1" && env?.LUCERN_INFISICAL_RUNTIME_DEBUG !== "1") {
-    return;
-  }
-  console.debug(`[infisical-runtime] ${message}`, {
-    error: formatInfisicalRuntimeError(error)
-  });
-}
-function formatInfisicalRuntimeError(error) {
-  if (error instanceof Error) {
-    return `${error.name}: ${error.message}`;
-  }
-  if (typeof error === "string") {
-    return error;
-  }
-  if (typeof error === "number" || typeof error === "boolean") {
-    return String(error);
-  }
-  if (error && typeof error === "object") {
-    const keys = Object.keys(error).slice(0, 5);
-    if (keys.length > 0) {
-      return `Unknown Infisical runtime error object with keys: ${keys.join(", ")}`;
-    }
-  }
-  return "Unknown Infisical runtime error shape";
-}
-
-export { InfisicalRuntimeError, applyInfisicalRuntimeEnv, hydrateInfisicalRuntimeEnv, isInfisicalRuntimeDisabled, readInfisicalRuntimeBootstrap };
-//# sourceMappingURL=infisicalRuntime.js.map
-//# sourceMappingURL=infisicalRuntime.js.map

package/dist/infisicalRuntime.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/infisicalRuntime.ts"],"names":[],"mappings":";;;AA8CO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,IAAA;AAAA,EACA,MAAA;AAAA,EAET,YAAY,IAAA,EAA0D;AACpE,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AAAA,EACrB;AACF;AAYO,SAAS,8BACd,GAAA,GAA2B,EAAC,EAC5B,SAAA,GAAsD,EAAC,EACf;AACxC,EAAA,IAAI,0BAAA,CAA2B,GAAG,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,eAAe,0BAAA,CAA2B,YAAA;AAChD,EAAA,MAAM,WAAW,SAAA,CAAU,QAAA,IAAY,SAAA,CAAU,GAAA,EAAK,aAAa,QAAQ,CAAA;AAC3E,EAAA,MAAM,eACJ,SAAA,CAAU,YAAA,IAAgB,SAAA,CAAU,GAAA,EAAK,aAAa,YAAY,CAAA;AACpE,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,QAAA,IAAY,YAAY,CAAA;AAEtD,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,EAAc;AAC9B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,gCAAA;AAAA,MACN,OAAA,EACE;AAAA,KACH,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,QACE,SAAA,CAAU,MAAA,IACV,UAAU,GAAA,EAAK,YAAA,CAAa,MAAM,CAAA,IAClC,iCAAA;AAAA,IACF,WACE,SAAA,CAAU,SAAA,IACV,UAAU,GAAA,EAAK,YAAA,CAAa,SAAS,CAAA,IACrC,oCAAA;AAAA,IACF,QAAA;AAAA,IACA,YAAA;AAAA,IACA,WAAA,EAAa,6BAAA;AAAA,MACX,SAAA,CAAU,WAAA,IAAe,SAAA,CAAU,GAAA,EAAK,aAAa,WAAW;AAAA,KAClE;AAAA,IACA,kBACE,SAAA,CAAU,gBAAA,IACV,SAAA,CAAU,GAAA,EAAK,aAAa,gBAAgB;AAAA,GAChD;AACF;AAEO,SAAS,0BAAA,CACd,GAAA,GAA2B,EAAC,EACnB;AACT,EAAA,OAAO,0BAAA,CAA2B,aAAa,QAAA,CAAS,IAAA;AAAA,IAAK,CAAC,IAAA,KAC5D,WAAA,CAAY,GAAA,CAAI,IAAI,CAAC;AAAA,GACvB;AACF;AAEA,eAAsB,2BACpB,OAAA,EAC0C;AAC1C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,EAAC;AAC5B,EAAA,MAAM,aAAA,GAAgB,6BAAA,CAA8B,GAAA,EAAK,OAAA,CAAQ,SAAS,CAAA;AAC1E,EAAA,MAAM,YAAY,aAAA,GACd;AAAA,IACE,GAAG,aAAA;AAAA,IACH,GAAG,MAAA,CAAO,WAAA;AAAA,MACR,OAAO,OAAA,CAAQ,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA,CAAE,MAAA;AAAA,QACtC,CAAC,GAAG,KAAK,MAAM,KAAA,KAAU;AAAA;AAC3B,KACF;AAAA,IACA,MAAA,EAAQ,iBAAA;AAAA,MACN,OAAA,CAAQ,SAAA,EAAW,MAAA,IAAU,aAAA,CAAc;AAAA;AAC7C,GACF,GACA,IAAA;AACJ,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,UAAA;AAAA,MACR,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,EAAC;AAAA,MACT,aAAa;AAAC,KAChB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,2BAAA,CAA4B,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,2BAAA;AAAA,MACN,OAAA,EAAS,CAAA,0CAAA,EAA6C,OAAA,CAAQ,SAAS,CAAA,CAAA;AAAA,KACxE,CAAA;AAAA,EACH;AACA,EAAA,MAAM,mBAAoB,OAAA,CAAkC,QAAA;AAC5D,EAAA,IACE,OAAA,CAAQ,QAAA,KAAa,eAAA,IACrB,gBAAA,KAAqB,eAAA,EACrB;AACA,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,wCAAA;AAAA,MACN,SAAS,CAAA,EAAG,OAAA,CAAQ,EAAE,CAAA,MAAA,EAAS,QAAQ,QAAQ,CAAA,mGAAA;AAAA,KAChD,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,UAAA,CAAW,KAAA;AAClD,EAAA,IAAI,OAAO,cAAc,UAAA,EAAY;AACnC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,6BAAA;AAAA,MACN,OAAA,EACE;AAAA,KACH,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,sBAAA,CAAuB,SAAA,EAAW,SAAS,CAAA;AAC/D,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,MAAM,kBAA4B,EAAC;AACnC,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAY;AAEpC,EAAA,MAAM,SAAA,GAAY,QAAQ,gCAAA,GACtB,yBAAA,CAA0B,QAAQ,SAAS,CAAA,GAC3C,wBAAA,CAAyB,OAAA,CAAQ,aAAa,CAAA;AAElD,EAAA,KAAA,MAAW,mBAAmB,SAAA,EAAW;AACvC,IAAA,WAAA,CAAY,GAAA,CAAI,gBAAgB,UAAU,CAAA;AAC1C,IAAA,MAAM,WAAA,GAAc,MAAM,kBAAA,CAAmB;AAAA,MAC3C,SAAA;AAAA,MACA,SAAA;AAAA,MACA,KAAA;AAAA,MACA,YAAY,eAAA,CAAgB,UAAA;AAAA,MAC5B,QAAA,EAAU;AAAA,KACX,CAAA;AAED,IAAA,IAAI,CAAC,WAAA,EAAa;AAChB,MAAA,IAAI,gBAAgB,QAAA,EAAU;AAC5B,QAAA,eAAA,CAAgB,IAAA,CAAK,gBAAgB,IAAI,CAAA;AAAA,MAC3C;AACA,MAAA;AAAA,IACF;AAEA,IAAA,MAAA,CAAO,eAAA,CAAgB,IAAI,CAAA,GAAI,WAAA,CAAY,KAAA;AAC3C,IAAA,KAAA,MAAW,KAAA,IAAS,eAAA,CAAgB,OAAA,IAAW,EAAC,EAAG;AACjD,MAAA,MAAA,CAAO,KAAK,IAAI,WAAA,CAAY,KAAA;AAAA,IAC9B;AAAA,EACF;AAEA,EAAA,IAAI,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,oCAAA;AAAA,MACN,OAAA,EAAS,CAAA,4CAAA,EAA+C,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,KACnF,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,UAAA;AAAA,IACR,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,aAAa,SAAA,CAAU,WAAA;AAAA,IACvB,MAAA;AAAA,IACA,WAAA,EAAa,CAAC,GAAG,WAAW;AAAA,GAC9B;AACF;AAEO,SAAS,wBAAA,CACd,MAAA,EACA,SAAA,EACA,OAAA,GAA0C,EAAC,EACrC;AACN,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,EAAG;AACxD,IAAA,IAAI,OAAA,CAAQ,gBAAA,IAAoB,CAAC,SAAA,CAAU,GAAG,CAAA,EAAG;AAC/C,MAAA,SAAA,CAAU,GAAG,CAAA,GAAI,KAAA;AAAA,IACnB;AAAA,EACF;AACF;AAEA,SAAS,8BACP,KAAA,EAC6B;AAC7B,EAAA,IAAI,KAAA,KAAU,KAAA,IAAS,KAAA,KAAU,SAAA,IAAa,UAAU,MAAA,EAAQ;AAC9D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,UAAU,aAAA,EAAe;AAC3B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,UAAU,YAAA,EAAc;AAC1B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,sBAAA,CACb,WACA,SAAA,EACiB;AACjB,EAAA,MAAM,WAAW,MAAM,SAAA;AAAA,IACrB,CAAA,EAAG,iBAAA,CAAkB,SAAA,CAAU,MAAM,CAAC,CAAA,iCAAA,CAAA;AAAA,IACtC;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,UAAU,SAAA,CAAU,QAAA;AAAA,QACpB,cAAc,SAAA,CAAU,YAAA;AAAA,QACxB,GAAI,UAAU,gBAAA,GACV,EAAE,kBAAkB,SAAA,CAAU,gBAAA,KAC9B;AAAC,OACN;AAAA;AACH,GACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,iCAAA;AAAA,MACN,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,SAAS,CAAA,0CAAA,EAA6C,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,eAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,KAChG,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,IAAA,EAAM,CAAC,aAAa,CAAC,CAAA;AAC1D,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,2CAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,EACH;AACA,EAAA,OAAO,WAAA;AACT;AAEA,eAAe,mBAAmB,IAAA,EAMkB;AAClD,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,GAAI,IAAA,CAAK,QAAA,CAAS,OAAA,IAAW,EAAG,CAAA;AACnE,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,MAAM,eAAA,CAAgB;AAAA,MAClC,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,IAAA;AAAA,MACA,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAO,EAAE,MAAM,KAAA,EAAM;AAAA,IACvB;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,yBACP,aAAA,EAC4B;AAC5B,EAAA,OAAO,aAAA,CAAc,OAAA,CAAQ,CAAC,MAAA,KAAW;AACvC,IAAA,MAAM,IAAA,GAAO,yBAAyB,MAAM,CAAA;AAC5C,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,QAC9B,IAAA,EAAM,wBAAA;AAAA,QACN,OAAA,EAAS,0CAA0C,MAAM,CAAA,CAAA;AAAA,OAC1D,CAAA;AAAA,IACH;AACA,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,MAAc;AAAA,MACvC,GAAG,QAAA;AAAA,MACH,YAAY,IAAA,CAAK;AAAA,KACnB,CAAE,CAAA;AAAA,EACJ,CAAC,CAAA;AACH;AAEA,SAAS,0BACP,SAAA,EAC4B;AAC5B,EAAA,MAAM,OAAA,GAAU,+BAAA,CAAgC,QAAA,CAAS,SAAS,CAAA;AAClE,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,2BAAA;AAAA,MACN,OAAA,EAAS,uDAAuD,SAAS,CAAA,CAAA;AAAA,KAC1E,CAAA;AAAA,EACH;AACA,EAAA,OAAO,OAAA,CAAQ,SAAA,CAAU,GAAA,CAAI,kCAAkC,CAAA;AACjE;AAEA,SAAS,mCACP,QAAA,EAC0B;AAC1B,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAY;AAAA,IAC9B,GAAG,SAAS,QAAA,CAAS,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,KAAS,SAAS,aAAa,CAAA;AAAA,IACrE,GAAG,QAAA,CAAS;AAAA,GACb,CAAA;AACD,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,CAAS,aAAA;AAAA,IACf,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,OAAA,EAAS,CAAC,GAAG,OAAO,CAAA;AAAA,IACpB,aAAa,QAAA,CAAS,WAAA;AAAA,IACtB,YAAY,QAAA,CAAS;AAAA,GACvB;AACF;AAEA,eAAe,gBAAgB,IAAA,EAOJ;AACzB,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IACjC,SAAA,EAAW,KAAK,SAAA,CAAU,SAAA;AAAA,IAC1B,WAAA,EAAa,KAAK,SAAA,CAAU,WAAA;AAAA,IAC5B,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,IAAA,EAAM,QAAA;AAAA,IACN,eAAA,EAAiB,MAAA;AAAA,IACjB,sBAAA,EAAwB,MAAA;AAAA,IACxB,cAAA,EAAgB;AAAA,GACjB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA;AAAA,IAC1B,CAAA,EAAG,iBAAA,CAAkB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,IAChH;AAAA,MACE,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA;AAAA;AACrC;AACF,GACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,8BAAA;AAAA,MACN,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,OAAA,EAAS,CAAA,iBAAA,EAAoB,IAAA,CAAK,IAAI,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,EAAA,EAAK,eAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,KAC1G,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,gBAAA,CAAiB,IAAA,EAAM,CAAC,QAAA,EAAU,aAAa,CAAC,CAAA;AACzD;AAEA,eAAe,SAAS,QAAA,EAAsC;AAC5D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,SAAS,KAAA,EAAO;AACd,IAAA,6BAAA,CAA8B,iBAAiB,KAAK,CAAA;AACpD,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAEA,SAAS,gBAAA,CAAiB,OAAgB,IAAA,EAAwC;AAChF,EAAA,IAAI,OAAA,GAAmB,KAAA;AACvB,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,IAAI,CAAC,QAAA,CAAS,OAAO,CAAA,IAAK,EAAE,OAAO,OAAA,CAAA,EAAU;AAC3C,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAA,GAAU,QAAQ,GAAG,CAAA;AAAA,EACvB;AACA,EAAA,OAAO,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,MAAA,GAAS,IAAI,OAAA,GAAU,IAAA;AACvE;AAEA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,IAAI,CAAC,QAAA,CAAS,IAAI,CAAA,EAAG;AACnB,IAAA,OAAO,kBAAA;AAAA,EACT;AACA,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,SAAA,EAAW,OAAA,EAAS,cAAc,CAAA,EAAG;AACtD,IAAA,IAAI,OAAO,IAAA,CAAK,GAAG,CAAA,KAAM,QAAA,EAAU;AACjC,MAAA,OAAO,KAAK,GAAG,CAAA;AAAA,IACjB;AAAA,EACF;AACA,EAAA,OAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAC5B;AAEA,SAAS,SAAA,CACP,KACA,KAAA,EACoB;AACpB,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,IAAA,EAAK;AAC9B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,YAAY,KAAA,EAAoC;AACvD,EAAA,OAAO,CAAC,GAAA,EAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,EAAE,QAAA,CAAS,KAAA,EAAO,WAAA,EAAY,IAAK,EAAE,CAAA;AACvE;AAEA,SAAS,kBAAkB,KAAA,EAAuB;AAChD,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA;AAClC;AAEA,SAAS,6BAAA,CAA8B,SAAiB,KAAA,EAAsB;AAC5E,EAAA,MAAM,GAAA,GACJ,WAGA,OAAA,EAAS,GAAA;AACX,EAAA,IACE,GAAA,EAAK,4BAAA,KAAiC,GAAA,IACtC,GAAA,EAAK,mCAAmC,GAAA,EACxC;AACA,IAAA;AAAA,EACF;AACA,EAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,EAAI;AAAA,IAC9C,KAAA,EAAO,4BAA4B,KAAK;AAAA,GACzC,CAAA;AACH;AAEA,SAAS,4BAA4B,KAAA,EAAwB;AAC3D,EAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,MAAM,OAAO,CAAA,CAAA;AAAA,EACxC;AACA,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,UAAU,SAAA,EAAW;AAC3D,IAAA,OAAO,OAAO,KAAK,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACtC,IAAA,MAAM,OAAO,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,KAAA,CAAM,GAAG,CAAC,CAAA;AAC1C,IAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,MAAA,OAAO,CAAA,kDAAA,EAAqD,IAAA,CAAK,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC7E;AAAA,EACF;AACA,EAAA,OAAO,uCAAA;AACT","file":"infisicalRuntime.js","sourcesContent":["import {\n  INFISICAL_RUNTIME_DEFAULT_API_URL,\n  INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,\n  INFISICAL_RUNTIME_MANIFEST,\n  findInfisicalRuntimePath,\n  findInfisicalRuntimeSurface,\n  GENERATED_INFISICAL_RUNTIME_ENV,\n  type GeneratedInfisicalEnvVariable,\n  type InfisicalRuntimeEnvironment,\n  type InfisicalRuntimePathId,\n  type InfisicalRuntimeSurfaceId,\n  type InfisicalRuntimeVariable,\n} from \"@lucern/contracts\";\n\nexport type InfisicalRuntimeEnv = Record<string, string | undefined>;\n\nexport type InfisicalRuntimeFetch = (\n  input: string | URL,\n  init?: RequestInit\n) => Promise<Response>;\n\nexport type InfisicalRuntimeBootstrapConfig = {\n  apiUrl: string;\n  projectId: string;\n  clientId: string;\n  clientSecret: string;\n  environment: InfisicalRuntimeEnvironment;\n  organizationSlug?: string;\n};\n\nexport type InfisicalRuntimeHydrateOptions = {\n  surfaceId: InfisicalRuntimeSurfaceId;\n  env?: InfisicalRuntimeEnv;\n  fetchImpl?: InfisicalRuntimeFetch;\n  bootstrap?: Partial<InfisicalRuntimeBootstrapConfig>;\n  includeGeneratedSurfaceVariables?: boolean;\n};\n\nexport type InfisicalRuntimeHydrationResult = {\n  status: \"disabled\" | \"hydrated\";\n  surfaceId: InfisicalRuntimeSurfaceId;\n  environment?: InfisicalRuntimeEnvironment;\n  values: Record<string, string>;\n  sourcePaths: string[];\n};\n\nexport class InfisicalRuntimeError extends Error {\n  readonly code: string;\n  readonly status?: number;\n\n  constructor(args: { code: string; message: string; status?: number }) {\n    super(args.message);\n    this.name = \"InfisicalRuntimeError\";\n    this.code = args.code;\n    this.status = args.status;\n  }\n}\n\ntype RuntimeHydrationVariable = {\n  readonly name: string;\n  readonly required: boolean;\n  readonly secret: boolean;\n  readonly public: boolean;\n  readonly aliases?: readonly string[];\n  readonly description: string;\n  readonly secretPath: string;\n};\n\nexport function readInfisicalRuntimeBootstrap(\n  env: InfisicalRuntimeEnv = {},\n  overrides: Partial<InfisicalRuntimeBootstrapConfig> = {}\n): InfisicalRuntimeBootstrapConfig | null {\n  if (isInfisicalRuntimeDisabled(env)) {\n    return null;\n  }\n\n  const bootstrapEnv = INFISICAL_RUNTIME_MANIFEST.bootstrapEnv;\n  const clientId = overrides.clientId ?? readFirst(env, bootstrapEnv.clientId);\n  const clientSecret =\n    overrides.clientSecret ?? readFirst(env, bootstrapEnv.clientSecret);\n  const hasAuthSignal = Boolean(clientId || clientSecret);\n\n  if (!hasAuthSignal) {\n    return null;\n  }\n\n  if (!clientId || !clientSecret) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_BOOTSTRAP_INCOMPLETE\",\n      message:\n        \"Infisical runtime bootstrap requires both INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET.\",\n    });\n  }\n\n  return {\n    apiUrl:\n      overrides.apiUrl ??\n      readFirst(env, bootstrapEnv.apiUrl) ??\n      INFISICAL_RUNTIME_DEFAULT_API_URL,\n    projectId:\n      overrides.projectId ??\n      readFirst(env, bootstrapEnv.projectId) ??\n      INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,\n    clientId,\n    clientSecret,\n    environment: normalizeInfisicalEnvironment(\n      overrides.environment ?? readFirst(env, bootstrapEnv.environment)\n    ),\n    organizationSlug:\n      overrides.organizationSlug ??\n      readFirst(env, bootstrapEnv.organizationSlug),\n  };\n}\n\nexport function isInfisicalRuntimeDisabled(\n  env: InfisicalRuntimeEnv = {}\n): boolean {\n  return INFISICAL_RUNTIME_MANIFEST.bootstrapEnv.disabled.some((name) =>\n    isTruthyEnv(env[name])\n  );\n}\n\nexport async function hydrateInfisicalRuntimeEnv(\n  options: InfisicalRuntimeHydrateOptions\n): Promise<InfisicalRuntimeHydrationResult> {\n  const env = options.env ?? {};\n  const baseBootstrap = readInfisicalRuntimeBootstrap(env, options.bootstrap);\n  const bootstrap = baseBootstrap\n    ? {\n        ...baseBootstrap,\n        ...Object.fromEntries(\n          Object.entries(options.bootstrap ?? {}).filter(\n            ([, value]) => value !== undefined\n          )\n        ),\n        apiUrl: trimTrailingSlash(\n          options.bootstrap?.apiUrl ?? baseBootstrap.apiUrl\n        ),\n      }\n    : null;\n  if (!bootstrap) {\n    return {\n      status: \"disabled\",\n      surfaceId: options.surfaceId,\n      values: {},\n      sourcePaths: [],\n    };\n  }\n\n  const surface = findInfisicalRuntimeSurface(options.surfaceId);\n  if (!surface) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNKNOWN_SURFACE\",\n      message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`,\n    });\n  }\n  const fallbackDelivery = (surface as { fallback?: string }).fallback;\n  if (\n    surface.delivery !== \"runtime_fetch\" &&\n    fallbackDelivery !== \"runtime_fetch\"\n  ) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNSUPPORTED_SURFACE_DELIVERY\",\n      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces or surfaces with a runtime_fetch fallback.`,\n    });\n  }\n\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_FETCH_UNAVAILABLE\",\n      message:\n        \"No fetch implementation is available for Infisical runtime hydration.\",\n    });\n  }\n\n  const token = await loginWithUniversalAuth(bootstrap, fetchImpl);\n  const values: Record<string, string> = {};\n  const missingRequired: string[] = [];\n  const sourcePaths = new Set<string>();\n\n  const variables = options.includeGeneratedSurfaceVariables\n    ? generatedSurfaceVariables(options.surfaceId)\n    : contractSurfaceVariables(surface.sourcePathIds);\n\n  for (const runtimeVariable of variables) {\n    sourcePaths.add(runtimeVariable.secretPath);\n    const secretValue = await readVariableSecret({\n      bootstrap,\n      fetchImpl,\n      token,\n      secretPath: runtimeVariable.secretPath,\n      variable: runtimeVariable,\n    });\n\n    if (!secretValue) {\n      if (runtimeVariable.required) {\n        missingRequired.push(runtimeVariable.name);\n      }\n      continue;\n    }\n\n    values[runtimeVariable.name] = secretValue.value;\n    for (const alias of runtimeVariable.aliases ?? []) {\n      values[alias] = secretValue.value;\n    }\n  }\n\n  if (missingRequired.length > 0) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_REQUIRED_SECRETS_MISSING\",\n      message: `Missing required Infisical runtime secrets: ${missingRequired.join(\", \")}.`,\n    });\n  }\n\n  return {\n    status: \"hydrated\",\n    surfaceId: options.surfaceId,\n    environment: bootstrap.environment,\n    values,\n    sourcePaths: [...sourcePaths],\n  };\n}\n\nexport function applyInfisicalRuntimeEnv(\n  result: Pick<InfisicalRuntimeHydrationResult, \"values\">,\n  targetEnv: InfisicalRuntimeEnv,\n  options: { overrideExisting?: boolean } = {}\n): void {\n  for (const [key, value] of Object.entries(result.values)) {\n    if (options.overrideExisting || !targetEnv[key]) {\n      targetEnv[key] = value;\n    }\n  }\n}\n\nfunction normalizeInfisicalEnvironment(\n  value: string | undefined\n): InfisicalRuntimeEnvironment {\n  if (value === \"dev\" || value === \"staging\" || value === \"prod\") {\n    return value;\n  }\n  if (value === \"development\") {\n    return \"dev\";\n  }\n  if (value === \"production\") {\n    return \"prod\";\n  }\n  return \"prod\";\n}\n\nasync function loginWithUniversalAuth(\n  bootstrap: InfisicalRuntimeBootstrapConfig,\n  fetchImpl: InfisicalRuntimeFetch\n): Promise<string> {\n  const response = await fetchImpl(\n    `${trimTrailingSlash(bootstrap.apiUrl)}/api/v1/auth/universal-auth/login`,\n    {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({\n        clientId: bootstrap.clientId,\n        clientSecret: bootstrap.clientSecret,\n        ...(bootstrap.organizationSlug\n          ? { organizationSlug: bootstrap.organizationSlug }\n          : {}),\n      }),\n    }\n  );\n\n  const body = await readJson(response);\n  if (!response.ok) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNIVERSAL_AUTH_FAILED\",\n      status: response.status,\n      message: `Infisical Universal Auth failed with HTTP ${response.status}: ${messageFromBody(body)}`,\n    });\n  }\n\n  const accessToken = readNestedString(body, [\"accessToken\"]);\n  if (!accessToken) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNIVERSAL_AUTH_INVALID_RESPONSE\",\n      message: \"Infisical Universal Auth response did not include accessToken.\",\n    });\n  }\n  return accessToken;\n}\n\nasync function readVariableSecret(args: {\n  bootstrap: InfisicalRuntimeBootstrapConfig;\n  fetchImpl: InfisicalRuntimeFetch;\n  token: string;\n  secretPath: string;\n  variable: Pick<InfisicalRuntimeVariable, \"name\" | \"aliases\">;\n}): Promise<{ name: string; value: string } | null> {\n  const names = [args.variable.name, ...(args.variable.aliases ?? [])];\n  for (const name of names) {\n    const value = await readSecretValue({\n      bootstrap: args.bootstrap,\n      fetchImpl: args.fetchImpl,\n      token: args.token,\n      secretPath: args.secretPath,\n      name,\n      optional: true,\n    });\n    if (value) {\n      return { name, value };\n    }\n  }\n  return null;\n}\n\nfunction contractSurfaceVariables(\n  sourcePathIds: readonly InfisicalRuntimePathId[]\n): RuntimeHydrationVariable[] {\n  return sourcePathIds.flatMap((pathId) => {\n    const path = findInfisicalRuntimePath(pathId);\n    if (!path) {\n      throw new InfisicalRuntimeError({\n        code: \"INFISICAL_UNKNOWN_PATH\",\n        message: `Unknown Lucern Infisical runtime path: ${pathId}.`,\n      });\n    }\n    return path.variables.map((variable) => ({\n      ...variable,\n      secretPath: path.secretPath,\n    }));\n  });\n}\n\nfunction generatedSurfaceVariables(\n  surfaceId: InfisicalRuntimeSurfaceId\n): RuntimeHydrationVariable[] {\n  const surface = GENERATED_INFISICAL_RUNTIME_ENV.surfaces[surfaceId];\n  if (!surface) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNKNOWN_SURFACE\",\n      message: `Unknown generated Lucern Infisical runtime surface: ${surfaceId}.`,\n    });\n  }\n  return surface.variables.map(generatedVariableToRuntimeVariable);\n}\n\nfunction generatedVariableToRuntimeVariable(\n  variable: GeneratedInfisicalEnvVariable\n): RuntimeHydrationVariable {\n  const aliases = new Set<string>([\n    ...variable.envNames.filter((name) => name !== variable.canonicalName),\n    ...variable.aliases,\n  ]);\n  return {\n    name: variable.canonicalName,\n    required: variable.required,\n    secret: variable.secret,\n    public: variable.public,\n    aliases: [...aliases],\n    description: variable.description,\n    secretPath: variable.sourcePath,\n  };\n}\n\nasync function readSecretValue(args: {\n  bootstrap: InfisicalRuntimeBootstrapConfig;\n  fetchImpl: InfisicalRuntimeFetch;\n  token: string;\n  secretPath: string;\n  name: string;\n  optional: boolean;\n}): Promise<string | null> {\n  const params = new URLSearchParams({\n    projectId: args.bootstrap.projectId,\n    environment: args.bootstrap.environment,\n    secretPath: args.secretPath,\n    type: \"shared\",\n    viewSecretValue: \"true\",\n    expandSecretReferences: \"true\",\n    includeImports: \"true\",\n  });\n  const response = await args.fetchImpl(\n    `${trimTrailingSlash(args.bootstrap.apiUrl)}/api/v4/secrets/${encodeURIComponent(args.name)}?${params.toString()}`,\n    {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${args.token}`,\n      },\n    }\n  );\n\n  const body = await readJson(response);\n  if (response.status === 404 && args.optional) {\n    return null;\n  }\n  if (!response.ok) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_SECRET_READ_FAILED\",\n      status: response.status,\n      message: `Infisical secret ${args.name} read failed with HTTP ${response.status}: ${messageFromBody(body)}`,\n    });\n  }\n\n  return readNestedString(body, [\"secret\", \"secretValue\"]);\n}\n\nasync function readJson(response: Response): Promise<unknown> {\n  try {\n    return await response.json();\n  } catch (error) {\n    debugInfisicalRuntimeFallback(\"response.json\", error);\n    return undefined;\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction readNestedString(value: unknown, path: readonly string[]): string | null {\n  let current: unknown = value;\n  for (const key of path) {\n    if (!isRecord(current) || !(key in current)) {\n      return null;\n    }\n    current = current[key];\n  }\n  return typeof current === \"string\" && current.length > 0 ? current : null;\n}\n\nfunction messageFromBody(body: unknown): string {\n  if (!isRecord(body)) {\n    return \"no response body\";\n  }\n  for (const key of [\"message\", \"error\", \"errorMessage\"]) {\n    if (typeof body[key] === \"string\") {\n      return body[key];\n    }\n  }\n  return JSON.stringify(body);\n}\n\nfunction readFirst(\n  env: InfisicalRuntimeEnv,\n  names: readonly string[]\n): string | undefined {\n  for (const name of names) {\n    const value = env[name]?.trim();\n    if (value) {\n      return value;\n    }\n  }\n  return undefined;\n}\n\nfunction isTruthyEnv(value: string | undefined): boolean {\n  return [\"1\", \"true\", \"yes\", \"on\"].includes(value?.toLowerCase() ?? \"\");\n}\n\nfunction trimTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/u, \"\");\n}\n\nfunction debugInfisicalRuntimeFallback(message: string, error: unknown): void {\n  const env = (\n    globalThis as {\n      process?: { env?: Record<string, string | undefined> };\n    }\n  ).process?.env;\n  if (\n    env?.LUCERN_COMPAT_FALLBACK_DEBUG !== \"1\" &&\n    env?.LUCERN_INFISICAL_RUNTIME_DEBUG !== \"1\"\n  ) {\n    return;\n  }\n  console.debug(`[infisical-runtime] ${message}`, {\n    error: formatInfisicalRuntimeError(error),\n  });\n}\n\nfunction formatInfisicalRuntimeError(error: unknown): string {\n  if (error instanceof Error) {\n    return `${error.name}: ${error.message}`;\n  }\n  if (typeof error === \"string\") {\n    return error;\n  }\n  if (typeof error === \"number\" || typeof error === \"boolean\") {\n    return String(error);\n  }\n  if (error && typeof error === \"object\") {\n    const keys = Object.keys(error).slice(0, 5);\n    if (keys.length > 0) {\n      return `Unknown Infisical runtime error object with keys: ${keys.join(\", \")}`;\n    }\n  }\n  return \"Unknown Infisical runtime error shape\";\n}\n"]}

package/dist/secrets.d.ts

@@ -1 +0,0 @@
-export { BrokeredSecretLeaseRef, BrokeredSecretRequest, BrokeredSecretResolverOptions, BrokeredSecretResolverResult, McProxyBindingRef, SecretBootstrapOptions, SecretBrokerClient, SecretResolverError, SecretResolverErrorCode, SecretResolverFetch, SecretResolverOptions, SecretResolverResult, requestBrokeredInfisicalSecret, resolveInfisicalSecretFromBinding } from '@lucern/secrets';

package/dist/secrets.js

@@ -1,3 +0,0 @@
-export { SecretResolverError, requestBrokeredInfisicalSecret, resolveInfisicalSecretFromBinding } from '@lucern/secrets';
-//# sourceMappingURL=secrets.js.map
-//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"secrets.js","sourcesContent":[]}