@lucern/sdk 0.3.0-alpha.3 → 0.3.0-alpha.5

package/dist/infisicalRuntime.d.ts

@@ -0,0 +1,42 @@
+import { InfisicalRuntimeEnvironment, InfisicalRuntimeSurfaceId } from '@lucern/contracts';
+
+type InfisicalRuntimeEnv = Record<string, string | undefined>;
+type InfisicalRuntimeFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+type InfisicalRuntimeBootstrapConfig = {
+    apiUrl: string;
+    projectId: string;
+    clientId: string;
+    clientSecret: string;
+    environment: InfisicalRuntimeEnvironment;
+    organizationSlug?: string;
+};
+type InfisicalRuntimeHydrateOptions = {
+    surfaceId: InfisicalRuntimeSurfaceId;
+    env?: InfisicalRuntimeEnv;
+    fetchImpl?: InfisicalRuntimeFetch;
+    bootstrap?: Partial<InfisicalRuntimeBootstrapConfig>;
+};
+type InfisicalRuntimeHydrationResult = {
+    status: "disabled" | "hydrated";
+    surfaceId: InfisicalRuntimeSurfaceId;
+    environment?: InfisicalRuntimeEnvironment;
+    values: Record<string, string>;
+    sourcePaths: string[];
+};
+declare class InfisicalRuntimeError extends Error {
+    readonly code: string;
+    readonly status?: number;
+    constructor(args: {
+        code: string;
+        message: string;
+        status?: number;
+    });
+}
+declare function readInfisicalRuntimeBootstrap(env?: InfisicalRuntimeEnv, overrides?: Partial<InfisicalRuntimeBootstrapConfig>): InfisicalRuntimeBootstrapConfig | null;
+declare function isInfisicalRuntimeDisabled(env?: InfisicalRuntimeEnv): boolean;
+declare function hydrateInfisicalRuntimeEnv(options: InfisicalRuntimeHydrateOptions): Promise<InfisicalRuntimeHydrationResult>;
+declare function applyInfisicalRuntimeEnv(result: Pick<InfisicalRuntimeHydrationResult, "values">, targetEnv: InfisicalRuntimeEnv, options?: {
+    overrideExisting?: boolean;
+}): void;
+
+export { type InfisicalRuntimeBootstrapConfig, type InfisicalRuntimeEnv, InfisicalRuntimeError, type InfisicalRuntimeFetch, type InfisicalRuntimeHydrateOptions, type InfisicalRuntimeHydrationResult, applyInfisicalRuntimeEnv, hydrateInfisicalRuntimeEnv, isInfisicalRuntimeDisabled, readInfisicalRuntimeBootstrap };

package/dist/infisicalRuntime.js

@@ -0,0 +1,291 @@
+import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath } from '@lucern/contracts';
+
+// src/infisicalRuntime.ts
+var InfisicalRuntimeError = class extends Error {
+  code;
+  status;
+  constructor(args) {
+    super(args.message);
+    this.name = "InfisicalRuntimeError";
+    this.code = args.code;
+    this.status = args.status;
+  }
+};
+function readInfisicalRuntimeBootstrap(env = {}, overrides = {}) {
+  if (isInfisicalRuntimeDisabled(env)) {
+    return null;
+  }
+  const bootstrapEnv = INFISICAL_RUNTIME_MANIFEST.bootstrapEnv;
+  const clientId = overrides.clientId ?? readFirst(env, bootstrapEnv.clientId);
+  const clientSecret = overrides.clientSecret ?? readFirst(env, bootstrapEnv.clientSecret);
+  const hasAuthSignal = Boolean(clientId || clientSecret);
+  if (!hasAuthSignal) {
+    return null;
+  }
+  if (!clientId || !clientSecret) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_BOOTSTRAP_INCOMPLETE",
+      message: "Infisical runtime bootstrap requires both INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET."
+    });
+  }
+  return {
+    apiUrl: overrides.apiUrl ?? readFirst(env, bootstrapEnv.apiUrl) ?? INFISICAL_RUNTIME_DEFAULT_API_URL,
+    projectId: overrides.projectId ?? readFirst(env, bootstrapEnv.projectId) ?? INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,
+    clientId,
+    clientSecret,
+    environment: normalizeInfisicalEnvironment(
+      overrides.environment ?? readFirst(env, bootstrapEnv.environment)
+    ),
+    organizationSlug: overrides.organizationSlug ?? readFirst(env, bootstrapEnv.organizationSlug)
+  };
+}
+function isInfisicalRuntimeDisabled(env = {}) {
+  return INFISICAL_RUNTIME_MANIFEST.bootstrapEnv.disabled.some(
+    (name) => isTruthyEnv(env[name])
+  );
+}
+async function hydrateInfisicalRuntimeEnv(options) {
+  const env = options.env ?? {};
+  const bootstrap = mergeBootstrap(
+    readInfisicalRuntimeBootstrap(env, options.bootstrap),
+    options.bootstrap
+  );
+  if (!bootstrap) {
+    return {
+      status: "disabled",
+      surfaceId: options.surfaceId,
+      values: {},
+      sourcePaths: []
+    };
+  }
+  const surface = findInfisicalRuntimeSurface(options.surfaceId);
+  if (!surface) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNKNOWN_SURFACE",
+      message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`
+    });
+  }
+  if (surface.delivery !== "runtime_fetch") {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNSUPPORTED_SURFACE_DELIVERY",
+      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces.`
+    });
+  }
+  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_FETCH_UNAVAILABLE",
+      message: "No fetch implementation is available for Infisical runtime hydration."
+    });
+  }
+  const token = await loginWithUniversalAuth(bootstrap, fetchImpl);
+  const values = {};
+  const missingRequired = [];
+  const sourcePaths = [];
+  for (const pathId of surface.sourcePathIds) {
+    const path = findInfisicalRuntimePath(pathId);
+    if (!path) {
+      throw new InfisicalRuntimeError({
+        code: "INFISICAL_UNKNOWN_PATH",
+        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
+      });
+    }
+    sourcePaths.push(path.secretPath);
+    for (const variable of path.variables) {
+      const runtimeVariable = variable;
+      const secretValue = await readVariableSecret({
+        bootstrap,
+        fetchImpl,
+        token,
+        secretPath: path.secretPath,
+        variable: runtimeVariable
+      });
+      if (!secretValue) {
+        if (runtimeVariable.required) {
+          missingRequired.push(runtimeVariable.name);
+        }
+        continue;
+      }
+      values[runtimeVariable.name] = secretValue.value;
+      for (const alias of runtimeVariable.aliases ?? []) {
+        values[alias] = secretValue.value;
+      }
+    }
+  }
+  if (missingRequired.length > 0) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_REQUIRED_SECRETS_MISSING",
+      message: `Missing required Infisical runtime secrets: ${missingRequired.join(", ")}.`
+    });
+  }
+  return {
+    status: "hydrated",
+    surfaceId: options.surfaceId,
+    environment: bootstrap.environment,
+    values,
+    sourcePaths
+  };
+}
+function applyInfisicalRuntimeEnv(result, targetEnv, options = {}) {
+  for (const [key, value] of Object.entries(result.values)) {
+    if (options.overrideExisting || !targetEnv[key]) {
+      targetEnv[key] = value;
+    }
+  }
+}
+function normalizeInfisicalEnvironment(value) {
+  if (value === "dev" || value === "staging" || value === "prod") {
+    return value;
+  }
+  if (value === "development") {
+    return "dev";
+  }
+  if (value === "production") {
+    return "prod";
+  }
+  return "prod";
+}
+function mergeBootstrap(base, overrides) {
+  if (!base) {
+    return null;
+  }
+  return {
+    ...base,
+    ...compact(overrides ?? {}),
+    apiUrl: trimTrailingSlash(overrides?.apiUrl ?? base.apiUrl)
+  };
+}
+async function loginWithUniversalAuth(bootstrap, fetchImpl) {
+  const response = await fetchImpl(
+    `${trimTrailingSlash(bootstrap.apiUrl)}/api/v1/auth/universal-auth/login`,
+    {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        clientId: bootstrap.clientId,
+        clientSecret: bootstrap.clientSecret,
+        ...bootstrap.organizationSlug ? { organizationSlug: bootstrap.organizationSlug } : {}
+      })
+    }
+  );
+  const body = await readJson(response);
+  if (!response.ok) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNIVERSAL_AUTH_FAILED",
+      status: response.status,
+      message: `Infisical Universal Auth failed with HTTP ${response.status}: ${messageFromBody(body)}`
+    });
+  }
+  const accessToken = readNestedString(body, ["accessToken"]);
+  if (!accessToken) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_UNIVERSAL_AUTH_INVALID_RESPONSE",
+      message: "Infisical Universal Auth response did not include accessToken."
+    });
+  }
+  return accessToken;
+}
+async function readVariableSecret(args) {
+  const names = [args.variable.name, ...args.variable.aliases ?? []];
+  for (const name of names) {
+    const value = await readSecretValue({
+      bootstrap: args.bootstrap,
+      fetchImpl: args.fetchImpl,
+      token: args.token,
+      secretPath: args.secretPath,
+      name,
+      optional: true
+    });
+    if (value) {
+      return { name, value };
+    }
+  }
+  return null;
+}
+async function readSecretValue(args) {
+  const params = new URLSearchParams({
+    projectId: args.bootstrap.projectId,
+    environment: args.bootstrap.environment,
+    secretPath: args.secretPath,
+    type: "shared",
+    viewSecretValue: "true",
+    expandSecretReferences: "true",
+    includeImports: "true"
+  });
+  const response = await args.fetchImpl(
+    `${trimTrailingSlash(args.bootstrap.apiUrl)}/api/v4/secrets/${encodeURIComponent(args.name)}?${params.toString()}`,
+    {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${args.token}`
+      }
+    }
+  );
+  const body = await readJson(response);
+  if (response.status === 404 && args.optional) {
+    return null;
+  }
+  if (!response.ok) {
+    throw new InfisicalRuntimeError({
+      code: "INFISICAL_SECRET_READ_FAILED",
+      status: response.status,
+      message: `Infisical secret ${args.name} read failed with HTTP ${response.status}: ${messageFromBody(body)}`
+    });
+  }
+  return readNestedString(body, ["secret", "secretValue"]);
+}
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return void 0;
+  }
+}
+function readNestedString(value, path) {
+  let current = value;
+  for (const key of path) {
+    if (!current || typeof current !== "object" || !(key in current)) {
+      return null;
+    }
+    current = current[key];
+  }
+  return typeof current === "string" && current.length > 0 ? current : null;
+}
+function messageFromBody(body) {
+  if (!body || typeof body !== "object") {
+    return "no response body";
+  }
+  const record = body;
+  for (const key of ["message", "error", "errorMessage"]) {
+    if (typeof record[key] === "string") {
+      return record[key];
+    }
+  }
+  return JSON.stringify(body);
+}
+function readFirst(env, names) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function isTruthyEnv(value) {
+  return ["1", "true", "yes", "on"].includes(value?.toLowerCase() ?? "");
+}
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/u, "");
+}
+function compact(value) {
+  return Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== void 0)
+  );
+}
+
+export { InfisicalRuntimeError, applyInfisicalRuntimeEnv, hydrateInfisicalRuntimeEnv, isInfisicalRuntimeDisabled, readInfisicalRuntimeBootstrap };
+//# sourceMappingURL=infisicalRuntime.js.map
+//# sourceMappingURL=infisicalRuntime.js.map

package/dist/infisicalRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/infisicalRuntime.ts"],"names":[],"mappings":";;;AA0CO,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EACtC,IAAA;AAAA,EACA,MAAA;AAAA,EAET,YAAY,IAAA,EAA0D;AACpE,IAAA,KAAA,CAAM,KAAK,OAAO,CAAA;AAClB,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AACZ,IAAA,IAAA,CAAK,OAAO,IAAA,CAAK,IAAA;AACjB,IAAA,IAAA,CAAK,SAAS,IAAA,CAAK,MAAA;AAAA,EACrB;AACF;AAEO,SAAS,8BACd,GAAA,GAA2B,EAAC,EAC5B,SAAA,GAAsD,EAAC,EACf;AACxC,EAAA,IAAI,0BAAA,CAA2B,GAAG,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,MAAM,eAAe,0BAAA,CAA2B,YAAA;AAChD,EAAA,MAAM,WAAW,SAAA,CAAU,QAAA,IAAY,SAAA,CAAU,GAAA,EAAK,aAAa,QAAQ,CAAA;AAC3E,EAAA,MAAM,eACJ,SAAA,CAAU,YAAA,IAAgB,SAAA,CAAU,GAAA,EAAK,aAAa,YAAY,CAAA;AACpE,EAAA,MAAM,aAAA,GAAgB,OAAA,CAAQ,QAAA,IAAY,YAAY,CAAA;AAEtD,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,OAAO,IAAA;AAAA,EACT;AAEA,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,YAAA,EAAc;AAC9B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,gCAAA;AAAA,MACN,OAAA,EACE;AAAA,KACH,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,QACE,SAAA,CAAU,MAAA,IACV,UAAU,GAAA,EAAK,YAAA,CAAa,MAAM,CAAA,IAClC,iCAAA;AAAA,IACF,WACE,SAAA,CAAU,SAAA,IACV,UAAU,GAAA,EAAK,YAAA,CAAa,SAAS,CAAA,IACrC,oCAAA;AAAA,IACF,QAAA;AAAA,IACA,YAAA;AAAA,IACA,WAAA,EAAa,6BAAA;AAAA,MACX,SAAA,CAAU,WAAA,IAAe,SAAA,CAAU,GAAA,EAAK,aAAa,WAAW;AAAA,KAClE;AAAA,IACA,kBACE,SAAA,CAAU,gBAAA,IACV,SAAA,CAAU,GAAA,EAAK,aAAa,gBAAgB;AAAA,GAChD;AACF;AAEO,SAAS,0BAAA,CACd,GAAA,GAA2B,EAAC,EACnB;AACT,EAAA,OAAO,0BAAA,CAA2B,aAAa,QAAA,CAAS,IAAA;AAAA,IAAK,CAAC,IAAA,KAC5D,WAAA,CAAY,GAAA,CAAI,IAAI,CAAC;AAAA,GACvB;AACF;AAEA,eAAsB,2BACpB,OAAA,EAC0C;AAC1C,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,EAAC;AAC5B,EAAA,MAAM,SAAA,GAAY,cAAA;AAAA,IAChB,6BAAA,CAA8B,GAAA,EAAK,OAAA,CAAQ,SAAS,CAAA;AAAA,IACpD,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,UAAA;AAAA,MACR,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,QAAQ,EAAC;AAAA,MACT,aAAa;AAAC,KAChB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,2BAAA,CAA4B,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,2BAAA;AAAA,MACN,OAAA,EAAS,CAAA,0CAAA,EAA6C,OAAA,CAAQ,SAAS,CAAA,CAAA;AAAA,KACxE,CAAA;AAAA,EACH;AACA,EAAA,IAAI,OAAA,CAAQ,aAAa,eAAA,EAAiB;AACxC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,wCAAA;AAAA,MACN,SAAS,CAAA,EAAG,OAAA,CAAQ,EAAE,CAAA,MAAA,EAAS,QAAQ,QAAQ,CAAA,yDAAA;AAAA,KAChD,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,UAAA,CAAW,KAAA;AAClD,EAAA,IAAI,OAAO,cAAc,UAAA,EAAY;AACnC,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,6BAAA;AAAA,MACN,OAAA,EACE;AAAA,KACH,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,KAAA,GAAQ,MAAM,sBAAA,CAAuB,SAAA,EAAW,SAAS,CAAA;AAC/D,EAAA,MAAM,SAAiC,EAAC;AACxC,EAAA,MAAM,kBAA4B,EAAC;AACnC,EAAA,MAAM,cAAwB,EAAC;AAE/B,EAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,aAAA,EAAe;AAC1C,IAAA,MAAM,IAAA,GAAO,yBAAyB,MAAM,CAAA;AAC5C,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,QAC9B,IAAA,EAAM,wBAAA;AAAA,QACN,OAAA,EAAS,0CAA0C,MAAM,CAAA,CAAA;AAAA,OAC1D,CAAA;AAAA,IACH;AACA,IAAA,WAAA,CAAY,IAAA,CAAK,KAAK,UAAU,CAAA;AAEhC,IAAA,KAAA,MAAW,QAAA,IAAY,KAAK,SAAA,EAAW;AACrC,MAAA,MAAM,eAAA,GAA4C,QAAA;AAClD,MAAA,MAAM,WAAA,GAAc,MAAM,kBAAA,CAAmB;AAAA,QAC3C,SAAA;AAAA,QACA,SAAA;AAAA,QACA,KAAA;AAAA,QACA,YAAY,IAAA,CAAK,UAAA;AAAA,QACjB,QAAA,EAAU;AAAA,OACX,CAAA;AAED,MAAA,IAAI,CAAC,WAAA,EAAa;AAChB,QAAA,IAAI,gBAAgB,QAAA,EAAU;AAC5B,UAAA,eAAA,CAAgB,IAAA,CAAK,gBAAgB,IAAI,CAAA;AAAA,QAC3C;AACA,QAAA;AAAA,MACF;AAEA,MAAA,MAAA,CAAO,eAAA,CAAgB,IAAI,CAAA,GAAI,WAAA,CAAY,KAAA;AAC3C,MAAA,KAAA,MAAW,KAAA,IAAS,eAAA,CAAgB,OAAA,IAAW,EAAC,EAAG;AACjD,QAAA,MAAA,CAAO,KAAK,IAAI,WAAA,CAAY,KAAA;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,eAAA,CAAgB,SAAS,CAAA,EAAG;AAC9B,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,oCAAA;AAAA,MACN,OAAA,EAAS,CAAA,4CAAA,EAA+C,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,KACnF,CAAA;AAAA,EACH;AAEA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,UAAA;AAAA,IACR,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,aAAa,SAAA,CAAU,WAAA;AAAA,IACvB,MAAA;AAAA,IACA;AAAA,GACF;AACF;AAEO,SAAS,wBAAA,CACd,MAAA,EACA,SAAA,EACA,OAAA,GAA0C,EAAC,EACrC;AACN,EAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,MAAM,CAAA,EAAG;AACxD,IAAA,IAAI,OAAA,CAAQ,gBAAA,IAAoB,CAAC,SAAA,CAAU,GAAG,CAAA,EAAG;AAC/C,MAAA,SAAA,CAAU,GAAG,CAAA,GAAI,KAAA;AAAA,IACnB;AAAA,EACF;AACF;AAEA,SAAS,8BACP,KAAA,EAC6B;AAC7B,EAAA,IAAI,KAAA,KAAU,KAAA,IAAS,KAAA,KAAU,SAAA,IAAa,UAAU,MAAA,EAAQ;AAC9D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,UAAU,aAAA,EAAe;AAC3B,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI,UAAU,YAAA,EAAc;AAC1B,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,cAAA,CACP,MACA,SAAA,EACwC;AACxC,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO;AAAA,IACL,GAAG,IAAA;AAAA,IACH,GAAG,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA;AAAA,IAC1B,MAAA,EAAQ,iBAAA,CAAkB,SAAA,EAAW,MAAA,IAAU,KAAK,MAAM;AAAA,GAC5D;AACF;AAEA,eAAe,sBAAA,CACb,WACA,SAAA,EACiB;AACjB,EAAA,MAAM,WAAW,MAAM,SAAA;AAAA,IACrB,CAAA,EAAG,iBAAA,CAAkB,SAAA,CAAU,MAAM,CAAC,CAAA,iCAAA,CAAA;AAAA,IACtC;AAAA,MACE,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,QACnB,UAAU,SAAA,CAAU,QAAA;AAAA,QACpB,cAAc,SAAA,CAAU,YAAA;AAAA,QACxB,GAAI,UAAU,gBAAA,GACV,EAAE,kBAAkB,SAAA,CAAU,gBAAA,KAC9B;AAAC,OACN;AAAA;AACH,GACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,iCAAA;AAAA,MACN,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,SAAS,CAAA,0CAAA,EAA6C,QAAA,CAAS,MAAM,CAAA,EAAA,EAAK,eAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,KAChG,CAAA;AAAA,EACH;AAEA,EAAA,MAAM,WAAA,GAAc,gBAAA,CAAiB,IAAA,EAAM,CAAC,aAAa,CAAC,CAAA;AAC1D,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,2CAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,EACH;AACA,EAAA,OAAO,WAAA;AACT;AAEA,eAAe,mBAAmB,IAAA,EAMkB;AAClD,EAAA,MAAM,KAAA,GAAQ,CAAC,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,GAAI,IAAA,CAAK,QAAA,CAAS,OAAA,IAAW,EAAG,CAAA;AACnE,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,MAAM,eAAA,CAAgB;AAAA,MAClC,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,IAAA;AAAA,MACA,QAAA,EAAU;AAAA,KACX,CAAA;AACD,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAO,EAAE,MAAM,KAAA,EAAM;AAAA,IACvB;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAEA,eAAe,gBAAgB,IAAA,EAOJ;AACzB,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,IACjC,SAAA,EAAW,KAAK,SAAA,CAAU,SAAA;AAAA,IAC1B,WAAA,EAAa,KAAK,SAAA,CAAU,WAAA;AAAA,IAC5B,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,IAAA,EAAM,QAAA;AAAA,IACN,eAAA,EAAiB,MAAA;AAAA,IACjB,sBAAA,EAAwB,MAAA;AAAA,IACxB,cAAA,EAAgB;AAAA,GACjB,CAAA;AACD,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA;AAAA,IAC1B,CAAA,EAAG,iBAAA,CAAkB,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA,gBAAA,EAAmB,kBAAA,CAAmB,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,EAAI,MAAA,CAAO,UAAU,CAAA,CAAA;AAAA,IAChH;AAAA,MACE,MAAA,EAAQ,KAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA;AAAA;AACrC;AACF,GACF;AAEA,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,QAAQ,CAAA;AACpC,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,QAAA,EAAU;AAC5C,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,IAAI,qBAAA,CAAsB;AAAA,MAC9B,IAAA,EAAM,8BAAA;AAAA,MACN,QAAQ,QAAA,CAAS,MAAA;AAAA,MACjB,OAAA,EAAS,CAAA,iBAAA,EAAoB,IAAA,CAAK,IAAI,CAAA,uBAAA,EAA0B,SAAS,MAAM,CAAA,EAAA,EAAK,eAAA,CAAgB,IAAI,CAAC,CAAA;AAAA,KAC1G,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,gBAAA,CAAiB,IAAA,EAAM,CAAC,QAAA,EAAU,aAAa,CAAC,CAAA;AACzD;AAEA,eAAe,SAAS,QAAA,EAAsC;AAC5D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAEA,SAAS,gBAAA,CAAiB,OAAgB,IAAA,EAAwC;AAChF,EAAA,IAAI,OAAA,GAAmB,KAAA;AACvB,EAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,IAAA,IAAI,CAAC,OAAA,IAAW,OAAO,YAAY,QAAA,IAAY,EAAE,OAAO,OAAA,CAAA,EAAU;AAChE,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAA,GAAW,QAAoC,GAAG,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,MAAA,GAAS,IAAI,OAAA,GAAU,IAAA;AACvE;AAEA,SAAS,gBAAgB,IAAA,EAAuB;AAC9C,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,EAAU;AACrC,IAAA,OAAO,kBAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,IAAA;AACf,EAAA,KAAA,MAAW,GAAA,IAAO,CAAC,SAAA,EAAW,OAAA,EAAS,cAAc,CAAA,EAAG;AACtD,IAAA,IAAI,OAAO,MAAA,CAAO,GAAG,CAAA,KAAM,QAAA,EAAU;AACnC,MAAA,OAAO,OAAO,GAAG,CAAA;AAAA,IACnB;AAAA,EACF;AACA,EAAA,OAAO,IAAA,CAAK,UAAU,IAAI,CAAA;AAC5B;AAEA,SAAS,SAAA,CACP,KACA,KAAA,EACoB;AACpB,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,IAAI,CAAA,EAAG,IAAA,EAAK;AAC9B,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,YAAY,KAAA,EAAoC;AACvD,EAAA,OAAO,CAAC,GAAA,EAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,EAAE,QAAA,CAAS,KAAA,EAAO,WAAA,EAAY,IAAK,EAAE,CAAA;AACvE;AAEA,SAAS,kBAAkB,KAAA,EAAuB;AAChD,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA;AAClC;AAEA,SAAS,QAA2C,KAAA,EAAsB;AACxE,EAAA,OAAO,MAAA,CAAO,WAAA;AAAA,IACZ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,CAAE,MAAA,CAAO,CAAC,GAAG,KAAK,CAAA,KAAM,KAAA,KAAU,MAAS;AAAA,GACjE;AACF","file":"infisicalRuntime.js","sourcesContent":["import {\n  INFISICAL_RUNTIME_DEFAULT_API_URL,\n  INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,\n  INFISICAL_RUNTIME_MANIFEST,\n  findInfisicalRuntimePath,\n  findInfisicalRuntimeSurface,\n  type InfisicalRuntimeEnvironment,\n  type InfisicalRuntimeSurfaceId,\n  type InfisicalRuntimeVariable,\n} from \"@lucern/contracts\";\n\nexport type InfisicalRuntimeEnv = Record<string, string | undefined>;\n\nexport type InfisicalRuntimeFetch = (\n  input: string | URL,\n  init?: RequestInit\n) => Promise<Response>;\n\nexport type InfisicalRuntimeBootstrapConfig = {\n  apiUrl: string;\n  projectId: string;\n  clientId: string;\n  clientSecret: string;\n  environment: InfisicalRuntimeEnvironment;\n  organizationSlug?: string;\n};\n\nexport type InfisicalRuntimeHydrateOptions = {\n  surfaceId: InfisicalRuntimeSurfaceId;\n  env?: InfisicalRuntimeEnv;\n  fetchImpl?: InfisicalRuntimeFetch;\n  bootstrap?: Partial<InfisicalRuntimeBootstrapConfig>;\n};\n\nexport type InfisicalRuntimeHydrationResult = {\n  status: \"disabled\" | \"hydrated\";\n  surfaceId: InfisicalRuntimeSurfaceId;\n  environment?: InfisicalRuntimeEnvironment;\n  values: Record<string, string>;\n  sourcePaths: string[];\n};\n\nexport class InfisicalRuntimeError extends Error {\n  readonly code: string;\n  readonly status?: number;\n\n  constructor(args: { code: string; message: string; status?: number }) {\n    super(args.message);\n    this.name = \"InfisicalRuntimeError\";\n    this.code = args.code;\n    this.status = args.status;\n  }\n}\n\nexport function readInfisicalRuntimeBootstrap(\n  env: InfisicalRuntimeEnv = {},\n  overrides: Partial<InfisicalRuntimeBootstrapConfig> = {}\n): InfisicalRuntimeBootstrapConfig | null {\n  if (isInfisicalRuntimeDisabled(env)) {\n    return null;\n  }\n\n  const bootstrapEnv = INFISICAL_RUNTIME_MANIFEST.bootstrapEnv;\n  const clientId = overrides.clientId ?? readFirst(env, bootstrapEnv.clientId);\n  const clientSecret =\n    overrides.clientSecret ?? readFirst(env, bootstrapEnv.clientSecret);\n  const hasAuthSignal = Boolean(clientId || clientSecret);\n\n  if (!hasAuthSignal) {\n    return null;\n  }\n\n  if (!clientId || !clientSecret) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_BOOTSTRAP_INCOMPLETE\",\n      message:\n        \"Infisical runtime bootstrap requires both INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET.\",\n    });\n  }\n\n  return {\n    apiUrl:\n      overrides.apiUrl ??\n      readFirst(env, bootstrapEnv.apiUrl) ??\n      INFISICAL_RUNTIME_DEFAULT_API_URL,\n    projectId:\n      overrides.projectId ??\n      readFirst(env, bootstrapEnv.projectId) ??\n      INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,\n    clientId,\n    clientSecret,\n    environment: normalizeInfisicalEnvironment(\n      overrides.environment ?? readFirst(env, bootstrapEnv.environment)\n    ),\n    organizationSlug:\n      overrides.organizationSlug ??\n      readFirst(env, bootstrapEnv.organizationSlug),\n  };\n}\n\nexport function isInfisicalRuntimeDisabled(\n  env: InfisicalRuntimeEnv = {}\n): boolean {\n  return INFISICAL_RUNTIME_MANIFEST.bootstrapEnv.disabled.some((name) =>\n    isTruthyEnv(env[name])\n  );\n}\n\nexport async function hydrateInfisicalRuntimeEnv(\n  options: InfisicalRuntimeHydrateOptions\n): Promise<InfisicalRuntimeHydrationResult> {\n  const env = options.env ?? {};\n  const bootstrap = mergeBootstrap(\n    readInfisicalRuntimeBootstrap(env, options.bootstrap),\n    options.bootstrap\n  );\n  if (!bootstrap) {\n    return {\n      status: \"disabled\",\n      surfaceId: options.surfaceId,\n      values: {},\n      sourcePaths: [],\n    };\n  }\n\n  const surface = findInfisicalRuntimeSurface(options.surfaceId);\n  if (!surface) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNKNOWN_SURFACE\",\n      message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`,\n    });\n  }\n  if (surface.delivery !== \"runtime_fetch\") {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNSUPPORTED_SURFACE_DELIVERY\",\n      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces.`,\n    });\n  }\n\n  const fetchImpl = options.fetchImpl ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_FETCH_UNAVAILABLE\",\n      message:\n        \"No fetch implementation is available for Infisical runtime hydration.\",\n    });\n  }\n\n  const token = await loginWithUniversalAuth(bootstrap, fetchImpl);\n  const values: Record<string, string> = {};\n  const missingRequired: string[] = [];\n  const sourcePaths: string[] = [];\n\n  for (const pathId of surface.sourcePathIds) {\n    const path = findInfisicalRuntimePath(pathId);\n    if (!path) {\n      throw new InfisicalRuntimeError({\n        code: \"INFISICAL_UNKNOWN_PATH\",\n        message: `Unknown Lucern Infisical runtime path: ${pathId}.`,\n      });\n    }\n    sourcePaths.push(path.secretPath);\n\n    for (const variable of path.variables) {\n      const runtimeVariable: InfisicalRuntimeVariable = variable;\n      const secretValue = await readVariableSecret({\n        bootstrap,\n        fetchImpl,\n        token,\n        secretPath: path.secretPath,\n        variable: runtimeVariable,\n      });\n\n      if (!secretValue) {\n        if (runtimeVariable.required) {\n          missingRequired.push(runtimeVariable.name);\n        }\n        continue;\n      }\n\n      values[runtimeVariable.name] = secretValue.value;\n      for (const alias of runtimeVariable.aliases ?? []) {\n        values[alias] = secretValue.value;\n      }\n    }\n  }\n\n  if (missingRequired.length > 0) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_REQUIRED_SECRETS_MISSING\",\n      message: `Missing required Infisical runtime secrets: ${missingRequired.join(\", \")}.`,\n    });\n  }\n\n  return {\n    status: \"hydrated\",\n    surfaceId: options.surfaceId,\n    environment: bootstrap.environment,\n    values,\n    sourcePaths,\n  };\n}\n\nexport function applyInfisicalRuntimeEnv(\n  result: Pick<InfisicalRuntimeHydrationResult, \"values\">,\n  targetEnv: InfisicalRuntimeEnv,\n  options: { overrideExisting?: boolean } = {}\n): void {\n  for (const [key, value] of Object.entries(result.values)) {\n    if (options.overrideExisting || !targetEnv[key]) {\n      targetEnv[key] = value;\n    }\n  }\n}\n\nfunction normalizeInfisicalEnvironment(\n  value: string | undefined\n): InfisicalRuntimeEnvironment {\n  if (value === \"dev\" || value === \"staging\" || value === \"prod\") {\n    return value;\n  }\n  if (value === \"development\") {\n    return \"dev\";\n  }\n  if (value === \"production\") {\n    return \"prod\";\n  }\n  return \"prod\";\n}\n\nfunction mergeBootstrap(\n  base: InfisicalRuntimeBootstrapConfig | null,\n  overrides: Partial<InfisicalRuntimeBootstrapConfig> | undefined\n): InfisicalRuntimeBootstrapConfig | null {\n  if (!base) {\n    return null;\n  }\n  return {\n    ...base,\n    ...compact(overrides ?? {}),\n    apiUrl: trimTrailingSlash(overrides?.apiUrl ?? base.apiUrl),\n  };\n}\n\nasync function loginWithUniversalAuth(\n  bootstrap: InfisicalRuntimeBootstrapConfig,\n  fetchImpl: InfisicalRuntimeFetch\n): Promise<string> {\n  const response = await fetchImpl(\n    `${trimTrailingSlash(bootstrap.apiUrl)}/api/v1/auth/universal-auth/login`,\n    {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({\n        clientId: bootstrap.clientId,\n        clientSecret: bootstrap.clientSecret,\n        ...(bootstrap.organizationSlug\n          ? { organizationSlug: bootstrap.organizationSlug }\n          : {}),\n      }),\n    }\n  );\n\n  const body = await readJson(response);\n  if (!response.ok) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNIVERSAL_AUTH_FAILED\",\n      status: response.status,\n      message: `Infisical Universal Auth failed with HTTP ${response.status}: ${messageFromBody(body)}`,\n    });\n  }\n\n  const accessToken = readNestedString(body, [\"accessToken\"]);\n  if (!accessToken) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_UNIVERSAL_AUTH_INVALID_RESPONSE\",\n      message: \"Infisical Universal Auth response did not include accessToken.\",\n    });\n  }\n  return accessToken;\n}\n\nasync function readVariableSecret(args: {\n  bootstrap: InfisicalRuntimeBootstrapConfig;\n  fetchImpl: InfisicalRuntimeFetch;\n  token: string;\n  secretPath: string;\n  variable: InfisicalRuntimeVariable;\n}): Promise<{ name: string; value: string } | null> {\n  const names = [args.variable.name, ...(args.variable.aliases ?? [])];\n  for (const name of names) {\n    const value = await readSecretValue({\n      bootstrap: args.bootstrap,\n      fetchImpl: args.fetchImpl,\n      token: args.token,\n      secretPath: args.secretPath,\n      name,\n      optional: true,\n    });\n    if (value) {\n      return { name, value };\n    }\n  }\n  return null;\n}\n\nasync function readSecretValue(args: {\n  bootstrap: InfisicalRuntimeBootstrapConfig;\n  fetchImpl: InfisicalRuntimeFetch;\n  token: string;\n  secretPath: string;\n  name: string;\n  optional: boolean;\n}): Promise<string | null> {\n  const params = new URLSearchParams({\n    projectId: args.bootstrap.projectId,\n    environment: args.bootstrap.environment,\n    secretPath: args.secretPath,\n    type: \"shared\",\n    viewSecretValue: \"true\",\n    expandSecretReferences: \"true\",\n    includeImports: \"true\",\n  });\n  const response = await args.fetchImpl(\n    `${trimTrailingSlash(args.bootstrap.apiUrl)}/api/v4/secrets/${encodeURIComponent(args.name)}?${params.toString()}`,\n    {\n      method: \"GET\",\n      headers: {\n        Authorization: `Bearer ${args.token}`,\n      },\n    }\n  );\n\n  const body = await readJson(response);\n  if (response.status === 404 && args.optional) {\n    return null;\n  }\n  if (!response.ok) {\n    throw new InfisicalRuntimeError({\n      code: \"INFISICAL_SECRET_READ_FAILED\",\n      status: response.status,\n      message: `Infisical secret ${args.name} read failed with HTTP ${response.status}: ${messageFromBody(body)}`,\n    });\n  }\n\n  return readNestedString(body, [\"secret\", \"secretValue\"]);\n}\n\nasync function readJson(response: Response): Promise<unknown> {\n  try {\n    return await response.json();\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readNestedString(value: unknown, path: readonly string[]): string | null {\n  let current: unknown = value;\n  for (const key of path) {\n    if (!current || typeof current !== \"object\" || !(key in current)) {\n      return null;\n    }\n    current = (current as Record<string, unknown>)[key];\n  }\n  return typeof current === \"string\" && current.length > 0 ? current : null;\n}\n\nfunction messageFromBody(body: unknown): string {\n  if (!body || typeof body !== \"object\") {\n    return \"no response body\";\n  }\n  const record = body as Record<string, unknown>;\n  for (const key of [\"message\", \"error\", \"errorMessage\"]) {\n    if (typeof record[key] === \"string\") {\n      return record[key];\n    }\n  }\n  return JSON.stringify(body);\n}\n\nfunction readFirst(\n  env: InfisicalRuntimeEnv,\n  names: readonly string[]\n): string | undefined {\n  for (const name of names) {\n    const value = env[name]?.trim();\n    if (value) {\n      return value;\n    }\n  }\n  return undefined;\n}\n\nfunction isTruthyEnv(value: string | undefined): boolean {\n  return [\"1\", \"true\", \"yes\", \"on\"].includes(value?.toLowerCase() ?? \"\");\n}\n\nfunction trimTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/u, \"\");\n}\n\nfunction compact<T extends Record<string, unknown>>(value: T): Partial<T> {\n  return Object.fromEntries(\n    Object.entries(value).filter(([, entry]) => entry !== undefined)\n  ) as Partial<T>;\n}\n"]}

package/dist/jobsClient.js

@@ -82,14 +82,15 @@ function normalizeCanonicalLucernAuthContext(input) {
   );
   const roles = cleanStringList(input.roles);
   const scopes = cleanStringList(input.scopes);
-  if (roles.length === 0 || scopes.length === 0) {
+  const principalType = requirePrincipalType(input.principalType);
+  const authMode = requireAuthMode(input.authMode);
+  const roleBasedInteractiveAuth = authMode === "interactive_user" && roles.length > 0;
+  if (roles.length === 0 || scopes.length === 0 && !roleBasedInteractiveAuth) {
     throw new LucernSdkAuthContextError(
       "membership_missing",
       "Canonical Lucern SDK auth context requires non-empty roles and scopes."
     );
   }
-  const principalType = requirePrincipalType(input.principalType);
-  const authMode = requireAuthMode(input.authMode);
   const subject = cleanString(input.permit?.subject) ?? principalId;
   const tenant = cleanString(input.permit?.tenant) ?? tenantId;
   const workspace = cleanString(input.permit?.workspace) ?? workspaceId;