@lucern/sdk 1.0.11 → 1.0.13

package/dist/infisicalRuntime.js

@@ -1,346 +1,339 @@
-import { INFISICAL_RUNTIME_MANIFEST, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_DEFAULT_API_URL, findInfisicalRuntimeSurface, findInfisicalRuntimePath, GENERATED_INFISICAL_RUNTIME_ENV } from '@lucern/contracts';
-
-// src/infisicalRuntime.ts
-var InfisicalRuntimeError = class extends Error {
-  code;
-  status;
-  constructor(args) {
-    super(args.message);
-    this.name = "InfisicalRuntimeError";
-    this.code = args.code;
-    this.status = args.status;
-  }
-};
-function readInfisicalRuntimeBootstrap(env = {}, overrides = {}) {
-  if (isInfisicalRuntimeDisabled(env)) {
-    return null;
-  }
-  const bootstrapEnv = INFISICAL_RUNTIME_MANIFEST.bootstrapEnv;
-  const clientId = overrides.clientId ?? readFirst(env, bootstrapEnv.clientId);
-  const clientSecret = overrides.clientSecret ?? readFirst(env, bootstrapEnv.clientSecret);
-  const hasAuthSignal = Boolean(clientId || clientSecret);
-  if (!hasAuthSignal) {
-    return null;
-  }
-  if (!clientId || !clientSecret) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_BOOTSTRAP_INCOMPLETE",
-      message: "Infisical runtime bootstrap requires both INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET."
-    });
-  }
-  return {
-    apiUrl: overrides.apiUrl ?? readFirst(env, bootstrapEnv.apiUrl) ?? INFISICAL_RUNTIME_DEFAULT_API_URL,
-    projectId: overrides.projectId ?? readFirst(env, bootstrapEnv.projectId) ?? INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,
-    clientId,
-    clientSecret,
-    environment: normalizeInfisicalEnvironment(
-      overrides.environment ?? readFirst(env, bootstrapEnv.environment)
-    ),
-    organizationSlug: overrides.organizationSlug ?? readFirst(env, bootstrapEnv.organizationSlug)
-  };
-}
-function isInfisicalRuntimeDisabled(env = {}) {
-  return INFISICAL_RUNTIME_MANIFEST.bootstrapEnv.disabled.some(
-    (name) => isTruthyEnv(env[name])
-  );
+import { INFISICAL_RUNTIME_DEFAULT_API_URL, INFISICAL_RUNTIME_DEFAULT_PROJECT_ID, INFISICAL_RUNTIME_MANIFEST, findInfisicalRuntimePath, findInfisicalRuntimeSurface, GENERATED_INFISICAL_RUNTIME_ENV, } from "@lucern/contracts";
+export class InfisicalRuntimeError extends Error {
+    code;
+    status;
+    constructor(args) {
+        super(args.message);
+        this.name = "InfisicalRuntimeError";
+        this.code = args.code;
+        this.status = args.status;
+    }
 }
-async function hydrateInfisicalRuntimeEnv(options) {
-  const env = options.env ?? {};
-  const baseBootstrap = readInfisicalRuntimeBootstrap(env, options.bootstrap);
-  const bootstrap = baseBootstrap ? {
-    ...baseBootstrap,
-    ...Object.fromEntries(
-      Object.entries(options.bootstrap ?? {}).filter(
-        ([, value]) => value !== void 0
-      )
-    ),
-    apiUrl: trimTrailingSlash(
-      options.bootstrap?.apiUrl ?? baseBootstrap.apiUrl
-    )
-  } : null;
-  if (!bootstrap) {
+export function readInfisicalRuntimeBootstrap(env = {}, overrides = {}) {
+    if (isInfisicalRuntimeDisabled(env)) {
+        return null;
+    }
+    const bootstrapEnv = INFISICAL_RUNTIME_MANIFEST.bootstrapEnv;
+    const clientId = overrides.clientId ?? readFirst(env, bootstrapEnv.clientId);
+    const clientSecret = overrides.clientSecret ?? readFirst(env, bootstrapEnv.clientSecret);
+    const hasAuthSignal = Boolean(clientId || clientSecret);
+    if (!hasAuthSignal) {
+        return null;
+    }
+    if (!clientId || !clientSecret) {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_BOOTSTRAP_INCOMPLETE",
+            message: "Infisical runtime bootstrap requires both INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET.",
+        });
+    }
     return {
-      status: "disabled",
-      surfaceId: options.surfaceId,
-      values: {},
-      sourcePaths: []
+        apiUrl: overrides.apiUrl ??
+            readFirst(env, bootstrapEnv.apiUrl) ??
+            INFISICAL_RUNTIME_DEFAULT_API_URL,
+        projectId: overrides.projectId ??
+            readFirst(env, bootstrapEnv.projectId) ??
+            INFISICAL_RUNTIME_DEFAULT_PROJECT_ID,
+        clientId,
+        clientSecret,
+        environment: normalizeInfisicalEnvironment(overrides.environment ?? readFirst(env, bootstrapEnv.environment)),
+        organizationSlug: overrides.organizationSlug ??
+            readFirst(env, bootstrapEnv.organizationSlug),
     };
-  }
-  const surface = findInfisicalRuntimeSurface(options.surfaceId);
-  if (!surface) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNKNOWN_SURFACE",
-      message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`
-    });
-  }
-  const fallbackDelivery = surface.fallback;
-  if (surface.delivery !== "runtime_fetch" && fallbackDelivery !== "runtime_fetch") {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNSUPPORTED_SURFACE_DELIVERY",
-      message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces or surfaces with a runtime_fetch fallback.`
-    });
-  }
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  if (typeof fetchImpl !== "function") {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_FETCH_UNAVAILABLE",
-      message: "No fetch implementation is available for Infisical runtime hydration."
-    });
-  }
-  const token = await loginWithUniversalAuth(bootstrap, fetchImpl);
-  const values = {};
-  const missingRequired = [];
-  const sourcePaths = /* @__PURE__ */ new Set();
-  const variables = options.includeGeneratedSurfaceVariables ? generatedSurfaceVariables(options.surfaceId) : contractSurfaceVariables(surface.sourcePathIds);
-  for (const runtimeVariable of variables) {
-    sourcePaths.add(runtimeVariable.secretPath);
-    const secretValue = await readVariableSecret({
-      bootstrap,
-      fetchImpl,
-      token,
-      secretPath: runtimeVariable.secretPath,
-      variable: runtimeVariable
-    });
-    if (!secretValue) {
-      if (runtimeVariable.required) {
-        missingRequired.push(runtimeVariable.name);
-      }
-      continue;
+}
+export function isInfisicalRuntimeDisabled(env = {}) {
+    return INFISICAL_RUNTIME_MANIFEST.bootstrapEnv.disabled.some((name) => isTruthyEnv(env[name]));
+}
+export async function hydrateInfisicalRuntimeEnv(options) {
+    const env = options.env ?? {};
+    const baseBootstrap = readInfisicalRuntimeBootstrap(env, options.bootstrap);
+    const bootstrap = baseBootstrap
+        ? {
+            ...baseBootstrap,
+            ...Object.fromEntries(Object.entries(options.bootstrap ?? {}).filter(([, value]) => value !== undefined)),
+            apiUrl: trimTrailingSlash(options.bootstrap?.apiUrl ?? baseBootstrap.apiUrl),
+        }
+        : null;
+    if (!bootstrap) {
+        return {
+            status: "disabled",
+            surfaceId: options.surfaceId,
+            values: {},
+            sourcePaths: [],
+        };
     }
-    values[runtimeVariable.name] = secretValue.value;
-    for (const alias of runtimeVariable.aliases ?? []) {
-      values[alias] = secretValue.value;
+    const surface = findInfisicalRuntimeSurface(options.surfaceId);
+    if (!surface) {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_UNKNOWN_SURFACE",
+            message: `Unknown Lucern Infisical runtime surface: ${options.surfaceId}.`,
+        });
     }
-  }
-  if (missingRequired.length > 0) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_REQUIRED_SECRETS_MISSING",
-      message: `Missing required Infisical runtime secrets: ${missingRequired.join(", ")}.`
-    });
-  }
-  return {
-    status: "hydrated",
-    surfaceId: options.surfaceId,
-    environment: bootstrap.environment,
-    values,
-    sourcePaths: [...sourcePaths]
-  };
+    const fallbackDelivery = surface.fallback;
+    if (surface.delivery !== "runtime_fetch" &&
+        fallbackDelivery !== "runtime_fetch") {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_UNSUPPORTED_SURFACE_DELIVERY",
+            message: `${surface.id} uses ${surface.delivery}; runtime fetch is only valid for runtime_fetch surfaces or surfaces with a runtime_fetch fallback.`,
+        });
+    }
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_FETCH_UNAVAILABLE",
+            message: "No fetch implementation is available for Infisical runtime hydration.",
+        });
+    }
+    const token = await loginWithUniversalAuth(bootstrap, fetchImpl);
+    const values = {};
+    const missingRequired = [];
+    const sourcePaths = new Set();
+    const variables = options.includeGeneratedSurfaceVariables
+        ? generatedSurfaceVariables(options.surfaceId)
+        : contractSurfaceVariables(surface.sourcePathIds);
+    for (const runtimeVariable of variables) {
+        sourcePaths.add(runtimeVariable.secretPath);
+        const secretValue = await readVariableSecret({
+            bootstrap,
+            fetchImpl,
+            token,
+            secretPath: runtimeVariable.secretPath,
+            variable: runtimeVariable,
+        });
+        if (!secretValue) {
+            if (runtimeVariable.required) {
+                missingRequired.push(runtimeVariable.name);
+            }
+            continue;
+        }
+        values[runtimeVariable.name] = secretValue.value;
+        for (const alias of runtimeVariable.aliases ?? []) {
+            values[alias] = secretValue.value;
+        }
+    }
+    if (missingRequired.length > 0) {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_REQUIRED_SECRETS_MISSING",
+            message: `Missing required Infisical runtime secrets: ${missingRequired.join(", ")}.`,
+        });
+    }
+    return {
+        status: "hydrated",
+        surfaceId: options.surfaceId,
+        environment: bootstrap.environment,
+        values,
+        sourcePaths: [...sourcePaths],
+    };
 }
-function applyInfisicalRuntimeEnv(result, targetEnv, options = {}) {
-  for (const [key, value] of Object.entries(result.values)) {
-    if (options.overrideExisting || !targetEnv[key]) {
-      targetEnv[key] = value;
+export function applyInfisicalRuntimeEnv(result, targetEnv, options = {}) {
+    for (const [key, value] of Object.entries(result.values)) {
+        if (options.overrideExisting || !targetEnv[key]) {
+            targetEnv[key] = value;
+        }
     }
-  }
 }
 function normalizeInfisicalEnvironment(value) {
-  if (value === "dev" || value === "staging" || value === "prod") {
-    return value;
-  }
-  if (value === "development") {
-    return "dev";
-  }
-  if (value === "production") {
+    if (value === "dev" || value === "staging" || value === "prod") {
+        return value;
+    }
+    if (value === "development") {
+        return "dev";
+    }
+    if (value === "production") {
+        return "prod";
+    }
     return "prod";
-  }
-  return "prod";
 }
 async function loginWithUniversalAuth(bootstrap, fetchImpl) {
-  const response = await fetchImpl(
-    `${trimTrailingSlash(bootstrap.apiUrl)}/api/v1/auth/universal-auth/login`,
-    {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify({
-        clientId: bootstrap.clientId,
-        clientSecret: bootstrap.clientSecret,
-        ...bootstrap.organizationSlug ? { organizationSlug: bootstrap.organizationSlug } : {}
-      })
-    }
-  );
-  const body = await readJson(response);
-  if (!response.ok) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNIVERSAL_AUTH_FAILED",
-      status: response.status,
-      message: `Infisical Universal Auth failed with HTTP ${response.status}: ${messageFromBody(body)}`
+    const response = await fetchImpl(`${trimTrailingSlash(bootstrap.apiUrl)}/api/v1/auth/universal-auth/login`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            clientId: bootstrap.clientId,
+            clientSecret: bootstrap.clientSecret,
+            ...(bootstrap.organizationSlug
+                ? { organizationSlug: bootstrap.organizationSlug }
+                : {}),
+        }),
     });
-  }
-  const accessToken = readNestedString(body, ["accessToken"]);
-  if (!accessToken) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNIVERSAL_AUTH_INVALID_RESPONSE",
-      message: "Infisical Universal Auth response did not include accessToken."
-    });
-  }
-  return accessToken;
+    const body = await readJson(response);
+    if (!response.ok) {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_UNIVERSAL_AUTH_FAILED",
+            status: response.status,
+            message: `Infisical Universal Auth failed with HTTP ${response.status}: ${messageFromBody(body)}`,
+        });
+    }
+    const accessToken = readNestedString(body, ["accessToken"]);
+    if (!accessToken) {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_UNIVERSAL_AUTH_INVALID_RESPONSE",
+            message: "Infisical Universal Auth response did not include accessToken.",
+        });
+    }
+    return accessToken;
 }
 async function readVariableSecret(args) {
-  const names = [args.variable.name, ...args.variable.aliases ?? []];
-  for (const name of names) {
-    const value = await readSecretValue({
-      bootstrap: args.bootstrap,
-      fetchImpl: args.fetchImpl,
-      token: args.token,
-      secretPath: args.secretPath,
-      name,
-      optional: true
-    });
-    if (value) {
-      return { name, value };
+    const names = [args.variable.name, ...(args.variable.aliases ?? [])];
+    for (const name of names) {
+        const value = await readSecretValue({
+            bootstrap: args.bootstrap,
+            fetchImpl: args.fetchImpl,
+            token: args.token,
+            secretPath: args.secretPath,
+            name,
+            optional: true,
+        });
+        if (value) {
+            return { name, value };
+        }
     }
-  }
-  return null;
+    return null;
 }
 function contractSurfaceVariables(sourcePathIds) {
-  return sourcePathIds.flatMap((pathId) => {
-    const path = findInfisicalRuntimePath(pathId);
-    if (!path) {
-      throw new InfisicalRuntimeError({
-        code: "INFISICAL_UNKNOWN_PATH",
-        message: `Unknown Lucern Infisical runtime path: ${pathId}.`
-      });
-    }
-    return path.variables.map((variable) => ({
-      ...variable,
-      secretPath: path.secretPath
-    }));
-  });
+    return sourcePathIds.flatMap((pathId) => {
+        const path = findInfisicalRuntimePath(pathId);
+        if (!path) {
+            throw new InfisicalRuntimeError({
+                code: "INFISICAL_UNKNOWN_PATH",
+                message: `Unknown Lucern Infisical runtime path: ${pathId}.`,
+            });
+        }
+        return path.variables.map((variable) => ({
+            ...variable,
+            secretPath: path.secretPath,
+        }));
+    });
 }
 function generatedSurfaceVariables(surfaceId) {
-  const surface = GENERATED_INFISICAL_RUNTIME_ENV.surfaces[surfaceId];
-  if (!surface) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_UNKNOWN_SURFACE",
-      message: `Unknown generated Lucern Infisical runtime surface: ${surfaceId}.`
-    });
-  }
-  return surface.variables.map(generatedVariableToRuntimeVariable);
+    const surface = GENERATED_INFISICAL_RUNTIME_ENV.surfaces[surfaceId];
+    if (!surface) {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_UNKNOWN_SURFACE",
+            message: `Unknown generated Lucern Infisical runtime surface: ${surfaceId}.`,
+        });
+    }
+    return surface.variables.map(generatedVariableToRuntimeVariable);
 }
 function generatedVariableToRuntimeVariable(variable) {
-  const aliases = /* @__PURE__ */ new Set([
-    ...variable.envNames.filter((name) => name !== variable.canonicalName),
-    ...variable.aliases
-  ]);
-  return {
-    name: variable.canonicalName,
-    required: variable.required,
-    secret: variable.secret,
-    public: variable.public,
-    aliases: [...aliases],
-    description: variable.description,
-    secretPath: variable.sourcePath
-  };
+    const aliases = new Set([
+        ...variable.envNames.filter((name) => name !== variable.canonicalName),
+        ...variable.aliases,
+    ]);
+    return {
+        name: variable.canonicalName,
+        required: variable.required,
+        secret: variable.secret,
+        public: variable.public,
+        aliases: [...aliases],
+        description: variable.description,
+        secretPath: variable.sourcePath,
+    };
 }
 async function readSecretValue(args) {
-  const params = new URLSearchParams({
-    projectId: args.bootstrap.projectId,
-    environment: args.bootstrap.environment,
-    secretPath: args.secretPath,
-    type: "shared",
-    viewSecretValue: "true",
-    expandSecretReferences: "true",
-    includeImports: "true"
-  });
-  const response = await args.fetchImpl(
-    `${trimTrailingSlash(args.bootstrap.apiUrl)}/api/v4/secrets/${encodeURIComponent(args.name)}?${params.toString()}`,
-    {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${args.token}`
-      }
-    }
-  );
-  const body = await readJson(response);
-  if (response.status === 404 && args.optional) {
-    return null;
-  }
-  if (!response.ok) {
-    throw new InfisicalRuntimeError({
-      code: "INFISICAL_SECRET_READ_FAILED",
-      status: response.status,
-      message: `Infisical secret ${args.name} read failed with HTTP ${response.status}: ${messageFromBody(body)}`
+    const params = new URLSearchParams({
+        projectId: args.bootstrap.projectId,
+        environment: args.bootstrap.environment,
+        secretPath: args.secretPath,
+        type: "shared",
+        viewSecretValue: "true",
+        expandSecretReferences: "true",
+        includeImports: "true",
+    });
+    const response = await args.fetchImpl(`${trimTrailingSlash(args.bootstrap.apiUrl)}/api/v4/secrets/${encodeURIComponent(args.name)}?${params.toString()}`, {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${args.token}`,
+        },
     });
-  }
-  return readNestedString(body, ["secret", "secretValue"]);
+    const body = await readJson(response);
+    if (response.status === 404 && args.optional) {
+        return null;
+    }
+    if (!response.ok) {
+        throw new InfisicalRuntimeError({
+            code: "INFISICAL_SECRET_READ_FAILED",
+            status: response.status,
+            message: `Infisical secret ${args.name} read failed with HTTP ${response.status}: ${messageFromBody(body)}`,
+        });
+    }
+    return readNestedString(body, ["secret", "secretValue"]);
 }
 async function readJson(response) {
-  try {
-    return await response.json();
-  } catch (error) {
-    debugInfisicalRuntimeFallback("response.json", error);
-    return void 0;
-  }
+    try {
+        return await response.json();
+    }
+    catch (error) {
+        debugInfisicalRuntimeFallback("response.json", error);
+        return undefined;
+    }
 }
 function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+    return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readNestedString(value, path) {
-  let current = value;
-  for (const key of path) {
-    if (!isRecord(current) || !(key in current)) {
-      return null;
+    let current = value;
+    for (const key of path) {
+        if (!isRecord(current) || !(key in current)) {
+            return null;
+        }
+        current = current[key];
     }
-    current = current[key];
-  }
-  return typeof current === "string" && current.length > 0 ? current : null;
+    return typeof current === "string" && current.length > 0 ? current : null;
 }
 function messageFromBody(body) {
-  if (!isRecord(body)) {
-    return "no response body";
-  }
-  for (const key of ["message", "error", "errorMessage"]) {
-    if (typeof body[key] === "string") {
-      return body[key];
+    if (!isRecord(body)) {
+        return "no response body";
     }
-  }
-  return JSON.stringify(body);
+    for (const key of ["message", "error", "errorMessage"]) {
+        if (typeof body[key] === "string") {
+            return body[key];
+        }
+    }
+    return JSON.stringify(body);
 }
 function readFirst(env, names) {
-  for (const name of names) {
-    const value = env[name]?.trim();
-    if (value) {
-      return value;
+    for (const name of names) {
+        const value = env[name]?.trim();
+        if (value) {
+            return value;
+        }
     }
-  }
-  return void 0;
+    return undefined;
 }
 function isTruthyEnv(value) {
-  return ["1", "true", "yes", "on"].includes(value?.toLowerCase() ?? "");
+    return ["1", "true", "yes", "on"].includes(value?.toLowerCase() ?? "");
 }
 function trimTrailingSlash(value) {
-  return value.replace(/\/+$/u, "");
+    return value.replace(/\/+$/u, "");
 }
 function debugInfisicalRuntimeFallback(message, error) {
-  const env = globalThis.process?.env;
-  if (env?.LUCERN_COMPAT_FALLBACK_DEBUG !== "1" && env?.LUCERN_INFISICAL_RUNTIME_DEBUG !== "1") {
-    return;
-  }
-  console.debug(`[infisical-runtime] ${message}`, {
-    error: formatInfisicalRuntimeError(error)
-  });
+    const env = globalThis.process?.env;
+    if (env?.LUCERN_COMPAT_FALLBACK_DEBUG !== "1" &&
+        env?.LUCERN_INFISICAL_RUNTIME_DEBUG !== "1") {
+        return;
+    }
+    console.debug(`[infisical-runtime] ${message}`, {
+        error: formatInfisicalRuntimeError(error),
+    });
 }
 function formatInfisicalRuntimeError(error) {
-  if (error instanceof Error) {
-    return `${error.name}: ${error.message}`;
-  }
-  if (typeof error === "string") {
-    return error;
-  }
-  if (typeof error === "number" || typeof error === "boolean") {
-    return String(error);
-  }
-  if (error && typeof error === "object") {
-    const keys = Object.keys(error).slice(0, 5);
-    if (keys.length > 0) {
-      return `Unknown Infisical runtime error object with keys: ${keys.join(", ")}`;
+    if (error instanceof Error) {
+        return `${error.name}: ${error.message}`;
+    }
+    if (typeof error === "string") {
+        return error;
+    }
+    if (typeof error === "number" || typeof error === "boolean") {
+        return String(error);
+    }
+    if (error && typeof error === "object") {
+        const keys = Object.keys(error).slice(0, 5);
+        if (keys.length > 0) {
+            return `Unknown Infisical runtime error object with keys: ${keys.join(", ")}`;
+        }
     }
-  }
-  return "Unknown Infisical runtime error shape";
+    return "Unknown Infisical runtime error shape";
 }
-
-export { InfisicalRuntimeError, applyInfisicalRuntimeEnv, hydrateInfisicalRuntimeEnv, isInfisicalRuntimeDisabled, readInfisicalRuntimeBootstrap };
-//# sourceMappingURL=infisicalRuntime.js.map
 //# sourceMappingURL=infisicalRuntime.js.map