@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/lib/env-encryption/backup.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Env file backups and locks for the release build, kept in node_modules/.cache:
+ * - `<id>.lock`: { pid, token } while a release build uses the env file. Builds that share an env
+ *   file wait for each other; a lock whose process is gone is stale.
+ * - `<id>.json`: { file, content, written? }: the original text, and the hash of the text the
+ *   build wrote, so a killed build is repaired by the next one without overwriting later edits.
+ */
+export declare const BACKUP_DIR = "node_modules/.cache/nx-polystack/env-backup";
+export interface LockOptions {
+    /** How long to wait for another build using the same env file (default 60 minutes). */
+    timeoutMs?: number;
+    pollMs?: number;
+    /** Called once when the build starts waiting. */
+    onWait?: () => void;
+}
+/** Takes the env file's lock (waiting while another live build holds it); returns a release. */
+export declare function lockEnvFile(repoRoot: string, file: string, opts?: LockOptions): () => void;
+/**
+ * Removes a stale lock without racing another build that found it stale too: the lock is moved
+ * aside (atomic) and checked; if what was moved is not the stale lock (another build already
+ * replaced it with a live one), it is put back with a link, which never overwrites.
+ */
+export declare function removeStaleLock(lock: string, staleToken: string | undefined): void;
+export declare function backupEnvFile(repoRoot: string, file: string): void;
+/** Records the text the build wrote, so recovery can tell whether the file changed since. */
+export declare function markWritten(repoRoot: string, file: string, text: string): void;
+/** Writes the backed-up content back and removes the backup (kept when it cannot be read). */
+export declare function restoreEnvFile(repoRoot: string, file: string): void;
+export interface RecoverResult {
+    /** The file was restored from the backup of an unfinished build. */
+    restored: boolean;
+    /** The file changed after that build, so the backup was dropped and the file kept. */
+    kept: boolean;
+}
+/**
+ * Repairs the env file after a build that did not finish (call with the lock held): restores the
+ * backup when the file still holds what that build wrote; keeps the file (and drops the backup)
+ * when it was edited since. A legacy `<file>.bak` is restored the same way as before v0.25.0.
+ */
+export declare function recoverEnvFile(repoRoot: string, file: string): RecoverResult;

package/dist/src/lib/env-encryption/backup.js

@@ -0,0 +1,234 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recoverEnvFile = exports.restoreEnvFile = exports.markWritten = exports.backupEnvFile = exports.removeStaleLock = exports.lockEnvFile = exports.BACKUP_DIR = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const fs = tslib_1.__importStar(require("fs"));
+const os = tslib_1.__importStar(require("os"));
+const path = tslib_1.__importStar(require("path"));
+/**
+ * Env file backups and locks for the release build, kept in node_modules/.cache:
+ * - `<id>.lock`: { pid, token } while a release build uses the env file. Builds that share an env
+ *   file wait for each other; a lock whose process is gone is stale.
+ * - `<id>.json`: { file, content, written? }: the original text, and the hash of the text the
+ *   build wrote, so a killed build is repaired by the next one without overwriting later edits.
+ */
+exports.BACKUP_DIR = 'node_modules/.cache/nx-polystack/env-backup';
+const dirOf = (repoRoot) => path.join(repoRoot, ...exports.BACKUP_DIR.split('/'));
+const relOf = (repoRoot, file) => path.relative(repoRoot, file).split(path.sep).join('/');
+const idFor = (rel) => crypto.createHash('sha1').update(rel).digest('hex').slice(0, 16);
+const sha = (text) => crypto.createHash('sha256').update(text).digest('hex');
+const backupPath = (repoRoot, file) => path.join(dirOf(repoRoot), `${idFor(relOf(repoRoot, file))}.json`);
+const lockPath = (repoRoot, file) => path.join(dirOf(repoRoot), `${idFor(relOf(repoRoot, file))}.lock`);
+/** Writes via a temporary file and rename, so a crash never leaves a half-written backup. */
+function writeAtomic(p, text) {
+    const tmp = `${p}.${process.pid}.tmp`;
+    try {
+        fs.writeFileSync(tmp, text);
+        fs.renameSync(tmp, p);
+    }
+    catch (err) {
+        fs.rmSync(tmp, { force: true });
+        throw err;
+    }
+}
+function readBackup(p) {
+    try {
+        const b = JSON.parse(fs.readFileSync(p, 'utf8'));
+        return typeof b?.content === 'string' ? b : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/** Tokens of the locks this process holds (a lock with this pid but another token is stale). */
+const HELD = new Set();
+const HOST = os.hostname();
+const sleep = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+/** Takes the env file's lock (waiting while another live build holds it); returns a release. */
+function lockEnvFile(repoRoot, file, opts = {}) {
+    const dir = dirOf(repoRoot);
+    fs.mkdirSync(dir, { recursive: true });
+    const lock = lockPath(repoRoot, file);
+    const token = crypto.randomBytes(8).toString('hex');
+    const deadline = Date.now() + (opts.timeoutMs ?? 60 * 60000);
+    let waited = false;
+    for (;;) {
+        try {
+            fs.writeFileSync(lock, JSON.stringify({ pid: process.pid, host: HOST, token }), {
+                flag: 'wx',
+            });
+            HELD.add(token);
+            return () => {
+                HELD.delete(token);
+                try {
+                    const held = JSON.parse(fs.readFileSync(lock, 'utf8'));
+                    if (held.token === token)
+                        fs.unlinkSync(lock);
+                }
+                catch {
+                    // Already gone.
+                }
+            };
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+        }
+        let holder = {};
+        let readable = true;
+        try {
+            holder = JSON.parse(fs.readFileSync(lock, 'utf8'));
+        }
+        catch {
+            readable = false;
+        }
+        const shown = relOf(repoRoot, file);
+        const lockShown = relOf(repoRoot, lock);
+        let stale;
+        if (!readable || typeof holder.pid !== 'number') {
+            // Being written right now, or left empty by a crash: stale once it is a few seconds old.
+            let age = 0;
+            try {
+                age = Date.now() - fs.statSync(lock).mtimeMs;
+            }
+            catch {
+                continue;
+            }
+            stale = age > 5000;
+        }
+        else if (holder.host !== undefined && holder.host !== HOST) {
+            // Written on another machine or container (e.g. an aborted CI job): its process is gone.
+            stale = true;
+        }
+        else if (holder.pid === process.pid) {
+            if (holder.token !== undefined && HELD.has(holder.token)) {
+                throw new Error(`env encryption: another release build in this process is using ${shown}; run release ` +
+                    `builds that share an env folder one at a time (lock: ${lockShown}).`);
+            }
+            stale = true;
+        }
+        else {
+            stale = !processAlive(holder.pid);
+        }
+        if (stale) {
+            removeStaleLock(lock, readable ? holder.token : undefined);
+            continue;
+        }
+        if (Date.now() > deadline) {
+            throw new Error(`env encryption: another release build (pid ${holder.pid ?? '?'}) is still using ${shown}. ` + `If none is running, delete ${lockShown}.`);
+        }
+        if (!waited) {
+            waited = true;
+            opts.onWait?.();
+        }
+        sleep(opts.pollMs ?? 500);
+    }
+}
+exports.lockEnvFile = lockEnvFile;
+/**
+ * Removes a stale lock without racing another build that found it stale too: the lock is moved
+ * aside (atomic) and checked; if what was moved is not the stale lock (another build already
+ * replaced it with a live one), it is put back with a link, which never overwrites.
+ */
+function removeStaleLock(lock, staleToken) {
+    const aside = `${lock}.stale.${process.pid}.${crypto.randomBytes(4).toString('hex')}`;
+    try {
+        fs.renameSync(lock, aside);
+    }
+    catch {
+        return; // Already moved or removed by another build.
+    }
+    let moved = {};
+    try {
+        moved = JSON.parse(fs.readFileSync(aside, 'utf8'));
+    }
+    catch {
+        // Empty or corrupt: it was the stale one.
+    }
+    if (moved.token !== undefined && moved.token !== staleToken) {
+        try {
+            fs.linkSync(aside, lock);
+        }
+        catch {
+            // A newer lock exists already; the moved one's build keeps running without its file.
+        }
+    }
+    fs.rmSync(aside, { force: true });
+}
+exports.removeStaleLock = removeStaleLock;
+function backupEnvFile(repoRoot, file) {
+    fs.mkdirSync(dirOf(repoRoot), { recursive: true });
+    const b = { file: relOf(repoRoot, file), content: fs.readFileSync(file, 'utf8') };
+    writeAtomic(backupPath(repoRoot, file), JSON.stringify(b));
+}
+exports.backupEnvFile = backupEnvFile;
+/** Records the text the build wrote, so recovery can tell whether the file changed since. */
+function markWritten(repoRoot, file, text) {
+    const p = backupPath(repoRoot, file);
+    const b = readBackup(p);
+    if (b)
+        writeAtomic(p, JSON.stringify({ ...b, written: sha(text) }));
+}
+exports.markWritten = markWritten;
+/** Writes the backed-up content back and removes the backup (kept when it cannot be read). */
+function restoreEnvFile(repoRoot, file) {
+    const p = backupPath(repoRoot, file);
+    if (!fs.existsSync(p))
+        return;
+    const b = readBackup(p);
+    if (!b) {
+        throw new Error(`env encryption: the backup of ${relOf(repoRoot, file)} (${relOf(repoRoot, p)}) cannot be ` +
+            'read; check the env file against git before building again.');
+    }
+    fs.writeFileSync(file, b.content);
+    fs.unlinkSync(p);
+}
+exports.restoreEnvFile = restoreEnvFile;
+/**
+ * Repairs the env file after a build that did not finish (call with the lock held): restores the
+ * backup when the file still holds what that build wrote; keeps the file (and drops the backup)
+ * when it was edited since. A legacy `<file>.bak` is restored the same way as before v0.25.0.
+ */
+function recoverEnvFile(repoRoot, file) {
+    const result = { restored: false, kept: false };
+    const p = backupPath(repoRoot, file);
+    if (fs.existsSync(p)) {
+        const b = readBackup(p);
+        if (!b) {
+            throw new Error(`env encryption: the backup of ${relOf(repoRoot, file)} left by an unfinished build ` +
+                `(${relOf(repoRoot, p)}) cannot be read; check the env file against git, then delete it.`);
+        }
+        const current = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : undefined;
+        if (b.written === undefined || (current !== undefined && sha(current) === b.written)) {
+            if (current !== b.content) {
+                fs.writeFileSync(file, b.content);
+                result.restored = true;
+            }
+        }
+        else {
+            result.kept = true;
+        }
+        fs.unlinkSync(p);
+    }
+    const bak = `${file}.bak`;
+    if (fs.existsSync(bak)) {
+        if (!result.restored && !result.kept) {
+            fs.copyFileSync(bak, file);
+            result.restored = true;
+        }
+        fs.unlinkSync(bak);
+    }
+    return result;
+}
+exports.recoverEnvFile = recoverEnvFile;
+//# sourceMappingURL=backup.js.map

package/dist/src/lib/env-encryption/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/backup.ts"],"names":[],"mappings":";;;;AAAA,uDAAiC;AACjC,+CAAyB;AACzB,+CAAyB;AACzB,mDAA6B;AAE7B;;;;;;GAMG;AACU,QAAA,UAAU,GAAG,6CAA6C,CAAC;AAExE,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,kBAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAClF,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CAC/C,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1D,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChG,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrF,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CACpD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AACrE,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CAClD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AAQrE,6FAA6F;AAC7F,SAAS,WAAW,CAAC,CAAS,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACtC,IAAI;QACF,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5B,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;KACvB;IAAC,OAAO,GAAG,EAAE;QACZ,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,CAAC;KACX;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI;QACF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;KACvD;IAAC,MAAM;QACN,OAAO,SAAS,CAAC;KAClB;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI;QACF,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;KACb;IAAC,OAAO,GAAG,EAAE;QACZ,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;KACxD;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;AAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE3B,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAU/F,gGAAgG;AAChG,SAAgB,WAAW,CAAC,QAAgB,EAAE,IAAY,EAAE,OAAoB,EAAE;IAChF,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,GAAG,KAAM,CAAC,CAAC;IAC9D,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS;QACP,IAAI;YACF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;gBAC9E,IAAI,EAAE,IAAI;aACX,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO,GAAG,EAAE;gBACV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnB,IAAI;oBACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;oBACvD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;wBAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;iBAC/C;gBAAC,MAAM;oBACN,gBAAgB;iBACjB;YACH,CAAC,CAAC;SACH;QAAC,OAAO,GAAG,EAAE;YACZ,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;SACjE;QACD,IAAI,MAAM,GAAoD,EAAE,CAAC;QACjE,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI;YACF,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;SACpD;QAAC,MAAM;YACN,QAAQ,GAAG,KAAK,CAAC;SAClB;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE;YAC/C,yFAAyF;YACzF,IAAI,GAAG,GAAG,CAAC,CAAC;YACZ,IAAI;gBACF,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;aAC9C;YAAC,MAAM;gBACN,SAAS;aACV;YACD,KAAK,GAAG,GAAG,GAAG,IAAK,CAAC;SACrB;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE;YAC5D,yFAAyF;YACzF,KAAK,GAAG,IAAI,CAAC;SACd;aAAM,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE;YACrC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACxD,MAAM,IAAI,KAAK,CACb,kEAAkE,KAAK,gBAAgB;oBACrF,wDAAwD,SAAS,IAAI,CACxE,CAAC;aACH;YACD,KAAK,GAAG,IAAI,CAAC;SACd;aAAM;YACL,KAAK,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACnC;QACD,IAAI,KAAK,EAAE;YACT,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC3D,SAAS;SACV;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;YACzB,MAAM,IAAI,KAAK,CACb,8CACE,MAAM,CAAC,GAAG,IAAI,GAChB,oBAAoB,KAAK,IAAI,GAAG,8BAA8B,SAAS,GAAG,CAC3E,CAAC;SACH;QACD,IAAI,CAAC,MAAM,EAAE;YACX,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;SACjB;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;KAC3B;AACH,CAAC;AA3ED,kCA2EC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAY,EAAE,UAA8B;IAC1E,MAAM,KAAK,GAAG,GAAG,IAAI,UAAU,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACtF,IAAI;QACF,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;KAC5B;IAAC,MAAM;QACN,OAAO,CAAC,6CAA6C;KACtD;IACD,IAAI,KAAK,GAAuB,EAAE,CAAC;IACnC,IAAI;QACF,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;KACpD;IAAC,MAAM;QACN,0CAA0C;KAC3C;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE;QAC3D,IAAI;YACF,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;SAC1B;QAAC,MAAM;YACN,qFAAqF;SACtF;KACF;IACD,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AArBD,0CAqBC;AAED,SAAgB,aAAa,CAAC,QAAgB,EAAE,IAAY;IAC1D,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,GAAW,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1F,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAJD,sCAIC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAY;IACtE,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC;QAAE,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAJD,kCAIC;AAED,8FAA8F;AAC9F,SAAgB,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC3D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO;IAC9B,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC,EAAE;QACN,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc;YACzF,6DAA6D,CAChE,CAAC;KACH;IACD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAClC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAZD,wCAYC;AASD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,QAAgB,EAAE,IAAY;IAC3D,MAAM,MAAM,GAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC/D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QACpB,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE;YACN,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,+BAA+B;gBACnF,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,mEAAmE,CAC5F,CAAC;SACH;QACD,MAAM,OAAO,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE;YACpF,IAAI,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE;gBACzB,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;aACxB;SACF;aAAM;YACL,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;SACpB;QACD,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KAClB;IACD,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;YACpC,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;SACxB;QACD,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;KACpB;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AA/BD,wCA+BC"}

package/dist/src/lib/env-encryption/config.d.ts

@@ -0,0 +1,50 @@
+export type EncryptionMode = 'listed' | 'all';
+export type EncryptionFormat = 'raw' | 'enc';
+export declare const KEY_SOURCES: readonly ["commit", "salt", "env", "custom"];
+export type KeySource = (typeof KEY_SOURCES)[number];
+export declare const CIPHERS: string[];
+export interface StampConfig {
+    timeField?: string;
+    branchField?: string;
+    timezone?: string;
+    /** Overrides the `z` token (e.g. "IST"). */
+    timezoneLabel?: string;
+    format?: string;
+}
+export interface EnvEncryptionConfig {
+    mode: EncryptionMode;
+    cipher: string;
+    /** Key factors besides the internal per-build key (aes-gcm); at least one. */
+    keySources: KeySource[];
+    metaName: string;
+    /** Listed mode: env project → keys; `default` for projects not listed. */
+    keys: Record<string, string[]>;
+    /** All mode: keys kept in plain text. */
+    publicKeys: string[];
+    stamp?: StampConfig;
+    /** `raw`: ciphertext as is; `enc`: written as ENC(<ciphertext>). */
+    format: EncryptionFormat;
+    /** Files next to the env file (e.g. app.profile.ts) whose sensitive-looking fields are encrypted. */
+    profileFiles: string[];
+}
+/**
+ * Suggested keys (README examples). Not a default: before v0.25.0 a workspace without listed keys
+ * encrypted nothing, so `keys.default` defaults to an empty list.
+ */
+export declare const SUGGESTED_KEYS: string[];
+export declare const DEFAULT_PUBLIC_KEYS: string[];
+export declare const DEFAULT_STAMP: Required<Omit<StampConfig, 'timezoneLabel'>>;
+export declare const LEGACY_KEYS_FILE = "tools/config/encrypt-keys.json";
+export declare function defaultEnvEncryptionConfig(): EnvEncryptionConfig;
+/** Keys from the legacy encrypt-keys.json shape (`_default` + per project, `_doc` ignored). */
+export declare function keysFromLegacy(json: Record<string, unknown>): Record<string, string[]>;
+/** A validated config from the raw `pstack.envEncryption` value; throws on invalid settings. */
+export declare function normalizeEnvEncryption(raw: unknown): EnvEncryptionConfig;
+export interface LoadedConfig {
+    config: EnvEncryptionConfig;
+    source: 'nx.json' | 'legacy' | 'default';
+}
+/** The workspace's settings: nx.json, else the legacy keys file, else defaults. */
+export declare function loadEnvEncryptionConfig(repoRoot: string): LoadedConfig;
+/** Keys to encrypt for an env project in listed mode. */
+export declare function listedKeys(cfg: EnvEncryptionConfig, envProject: string): string[];

package/dist/src/lib/env-encryption/config.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listedKeys = exports.loadEnvEncryptionConfig = exports.normalizeEnvEncryption = exports.keysFromLegacy = exports.defaultEnvEncryptionConfig = exports.LEGACY_KEYS_FILE = exports.DEFAULT_STAMP = exports.DEFAULT_PUBLIC_KEYS = exports.SUGGESTED_KEYS = exports.CIPHERS = exports.KEY_SOURCES = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const stamp_1 = require("./stamp");
+exports.KEY_SOURCES = ['commit', 'salt', 'env', 'custom'];
+exports.CIPHERS = ['cryptojs', 'aes-gcm'];
+/**
+ * Suggested keys (README examples). Not a default: before v0.25.0 a workspace without listed keys
+ * encrypted nothing, so `keys.default` defaults to an empty list.
+ */
+exports.SUGGESTED_KEYS = ['password', 'uname', 'key', 'iv'];
+exports.DEFAULT_PUBLIC_KEYS = ['production', 'envName', 'appName', 'timeStamp'];
+exports.DEFAULT_STAMP = {
+    timeField: 'timeStamp',
+    branchField: 'branch',
+    timezone: 'UTC',
+    format: 'DD MMM YYYY hh:mm:ss A z',
+};
+exports.LEGACY_KEYS_FILE = 'tools/config/encrypt-keys.json';
+function defaultEnvEncryptionConfig() {
+    return {
+        mode: 'listed',
+        cipher: 'cryptojs',
+        keySources: ['commit'],
+        metaName: 'x-build',
+        format: 'raw',
+        profileFiles: [],
+        keys: { default: [] },
+        publicKeys: [...exports.DEFAULT_PUBLIC_KEYS],
+        stamp: { ...exports.DEFAULT_STAMP },
+    };
+}
+exports.defaultEnvEncryptionConfig = defaultEnvEncryptionConfig;
+const strings = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string') ? v : undefined;
+/** Keys from the legacy encrypt-keys.json shape (`_default` + per project, `_doc` ignored). */
+function keysFromLegacy(json) {
+    const keys = {};
+    for (const [k, v] of Object.entries(json)) {
+        const list = strings(v);
+        if (!list || k === '_doc')
+            continue;
+        keys[k === '_default' ? 'default' : k] = list;
+    }
+    if (!keys['default'])
+        keys['default'] = [];
+    return keys;
+}
+exports.keysFromLegacy = keysFromLegacy;
+/** A validated config from the raw `pstack.envEncryption` value; throws on invalid settings. */
+function normalizeEnvEncryption(raw) {
+    const base = defaultEnvEncryptionConfig();
+    if (raw === undefined)
+        return base;
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        throw new Error('nx.json pstack.envEncryption must be an object.');
+    }
+    const r = raw;
+    const cfg = {
+        mode: r['mode'] ?? base.mode,
+        cipher: r['cipher'] ?? base.cipher,
+        keySources: base.keySources,
+        metaName: r['metaName'] ?? base.metaName,
+        format: r['format'] ?? base.format,
+        profileFiles: base.profileFiles,
+        keys: base.keys,
+        publicKeys: base.publicKeys,
+        stamp: r['stamp'] === undefined ? undefined : { ...exports.DEFAULT_STAMP, ...r['stamp'] },
+    };
+    if (!['listed', 'all'].includes(cfg.mode)) {
+        throw new Error(`pstack.envEncryption.mode "${cfg.mode}" is not valid. Use listed or all.`);
+    }
+    if (!exports.CIPHERS.includes(cfg.cipher)) {
+        throw new Error(`pstack.envEncryption.cipher "${cfg.cipher}" is not valid. Use ${exports.CIPHERS.join(' or ')}.`);
+    }
+    if (r['keySource'] !== undefined && r['keySource'] !== 'commit') {
+        throw new Error('pstack.envEncryption.keySource is replaced by keySources (a list of commit, salt, env, ' +
+            'custom); run "pstack update".');
+    }
+    if (r['keySources'] !== undefined) {
+        const list = strings(r['keySources']);
+        const unknown = (list ?? []).filter((s) => !exports.KEY_SOURCES.includes(s));
+        if (!list || list.length === 0 || unknown.length > 0) {
+            throw new Error(`pstack.envEncryption.keySources must list at least one of ${exports.KEY_SOURCES.join(', ')}` +
+                (unknown.length > 0 ? ` (unknown: ${unknown.join(', ')})` : '') +
+                '.');
+        }
+        cfg.keySources = exports.KEY_SOURCES.filter((s) => list.includes(s));
+    }
+    if (typeof cfg.metaName !== 'string' || !/^[\w-]+$/.test(cfg.metaName)) {
+        throw new Error('pstack.envEncryption.metaName must be a simple name such as x-build.');
+    }
+    if (r['keys'] !== undefined) {
+        if (typeof r['keys'] !== 'object' || r['keys'] === null || Array.isArray(r['keys'])) {
+            throw new Error('pstack.envEncryption.keys must map env projects to key lists.');
+        }
+        const keys = {};
+        for (const [k, v] of Object.entries(r['keys'])) {
+            const list = strings(v);
+            if (!list)
+                throw new Error(`pstack.envEncryption.keys.${k} must be a list of key names.`);
+            keys[k] = list;
+        }
+        if (!keys['default'])
+            keys['default'] = [];
+        cfg.keys = keys;
+    }
+    if (!['raw', 'enc'].includes(cfg.format)) {
+        throw new Error(`pstack.envEncryption.format "${cfg.format}" is not valid. Use raw or enc.`);
+    }
+    if (r['profileFiles'] !== undefined) {
+        const list = strings(r['profileFiles']);
+        if (!list ||
+            list.some((f) => !/^[\w.-]+(\/[\w.-]+)*$/.test(f) || f.split('/').includes('..'))) {
+            throw new Error('pstack.envEncryption.profileFiles must list files inside the env folder (e.g. app.profile.ts).');
+        }
+        if (list.some((f) => /^environment(\.[\w-]+)?\.ts$/.test(f.split('/').pop() ?? ''))) {
+            throw new Error('pstack.envEncryption.profileFiles must not list env files (environment*.ts); they are ' +
+                'encrypted already.');
+        }
+        cfg.profileFiles = [...new Set(list)];
+    }
+    if (r['publicKeys'] !== undefined) {
+        const list = strings(r['publicKeys']);
+        if (!list)
+            throw new Error('pstack.envEncryption.publicKeys must be a list of key names.');
+        cfg.publicKeys = list;
+    }
+    if (r['stamp'] !== undefined) {
+        if (typeof r['stamp'] !== 'object' || r['stamp'] === null || Array.isArray(r['stamp'])) {
+            throw new Error('pstack.envEncryption.stamp must be an object.');
+        }
+        for (const [k, v] of Object.entries(r['stamp'])) {
+            if (typeof v !== 'string') {
+                throw new Error(`pstack.envEncryption.stamp.${k} must be a string.`);
+            }
+        }
+    }
+    if (cfg.stamp?.timezone && !(0, stamp_1.isValidTimezone)(cfg.stamp.timezone)) {
+        throw new Error(`pstack.envEncryption.stamp.timezone "${cfg.stamp.timezone}" is not a known time zone.`);
+    }
+    return cfg;
+}
+exports.normalizeEnvEncryption = normalizeEnvEncryption;
+/** The workspace's settings: nx.json, else the legacy keys file, else defaults. */
+function loadEnvEncryptionConfig(repoRoot) {
+    const nxJsonPath = path.join(repoRoot, 'nx.json');
+    if (fs.existsSync(nxJsonPath)) {
+        const nx = JSON.parse(fs.readFileSync(nxJsonPath, 'utf8'));
+        const raw = nx?.pstack?.envEncryption;
+        if (raw !== undefined)
+            return { config: normalizeEnvEncryption(raw), source: 'nx.json' };
+    }
+    const legacy = path.join(repoRoot, ...exports.LEGACY_KEYS_FILE.split('/'));
+    if (fs.existsSync(legacy)) {
+        const cfg = defaultEnvEncryptionConfig();
+        cfg.keys = keysFromLegacy(JSON.parse(fs.readFileSync(legacy, 'utf8')));
+        cfg.stamp = undefined;
+        return { config: cfg, source: 'legacy' };
+    }
+    const cfg = defaultEnvEncryptionConfig();
+    cfg.stamp = undefined;
+    return { config: cfg, source: 'default' };
+}
+exports.loadEnvEncryptionConfig = loadEnvEncryptionConfig;
+/** Keys to encrypt for an env project in listed mode. */
+function listedKeys(cfg, envProject) {
+    return cfg.keys[envProject] ?? cfg.keys['default'] ?? [];
+}
+exports.listedKeys = listedKeys;
+//# sourceMappingURL=config.js.map

package/dist/src/lib/env-encryption/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/config.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,mCAA0C;AAK7B,QAAA,WAAW,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAU,CAAC;AAE3D,QAAA,OAAO,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AA4B/C;;;GAGG;AACU,QAAA,cAAc,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACpD,QAAA,mBAAmB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;AACxE,QAAA,aAAa,GAAiD;IACzE,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,0BAA0B;CACnC,CAAC;AACW,QAAA,gBAAgB,GAAG,gCAAgC,CAAC;AAEjE,SAAgB,0BAA0B;IACxC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,EAAE;QAChB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACrB,UAAU,EAAE,CAAC,GAAG,2BAAmB,CAAC;QACpC,KAAK,EAAE,EAAE,GAAG,qBAAa,EAAE;KAC5B,CAAC;AACJ,CAAC;AAZD,gEAYC;AAED,MAAM,OAAO,GAAG,CAAC,CAAU,EAAwB,EAAE,CACnD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1F,+FAA+F;AAC/F,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAA6B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,MAAM;YAAE,SAAS;QACpC,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;KAC/C;IACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;IAC3C,OAAO,IAAI,CAAC;AACd,CAAC;AATD,wCASC;AAED,gGAAgG;AAChG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,IAAI,GAAG,0BAA0B,EAAE,CAAC;IAC1C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACjE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;KACpE;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAAwB;QAC/B,IAAI,EAAG,CAAC,CAAC,MAAM,CAAoB,IAAI,IAAI,CAAC,IAAI;QAChD,MAAM,EAAG,CAAC,CAAC,QAAQ,CAAY,IAAI,IAAI,CAAC,MAAM;QAC9C,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAG,CAAC,CAAC,UAAU,CAAY,IAAI,IAAI,CAAC,QAAQ;QACpD,MAAM,EAAG,CAAC,CAAC,QAAQ,CAAsB,IAAI,IAAI,CAAC,MAAM;QACxD,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EACH,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,qBAAa,EAAE,GAAI,CAAC,CAAC,OAAO,CAAiB,EAAE;KAC9F,CAAC;IACF,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,IAAI,oCAAoC,CAAC,CAAC;KAC7F;IACD,IAAI,CAAC,eAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACjC,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,CAAC,MAAM,uBAAuB,eAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CACzF,CAAC;KACH;IACD,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE;QAC/D,MAAM,IAAI,KAAK,CACb,yFAAyF;YACvF,+BAA+B,CAClC,CAAC;KACH;IACD,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,mBAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;YACpD,MAAM,IAAI,KAAK,CACb,6DAA6D,mBAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACnF,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CACN,CAAC;SACH;QACD,GAAG,CAAC,UAAU,GAAG,mBAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;KAC9D;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QACtE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;KACzF;IACD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE;QAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE;YACnF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;SAClF;QACD,MAAM,IAAI,GAA6B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAA4B,CAAC,EAAE;YACzE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,+BAA+B,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;SAChB;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QAC3C,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;KACjB;IACD,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,iCAAiC,CAAC,CAAC;KAC9F;IACD,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,SAAS,EAAE;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,IACE,CAAC,IAAI;YACL,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EACjF;YACA,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAC;SACH;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACnF,MAAM,IAAI,KAAK,CACb,wFAAwF;gBACtF,oBAAoB,CACvB,CAAC;SACH;QACD,GAAG,CAAC,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;KACvC;IACD,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC3F,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;KACvB;IACD,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE;QAC5B,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE;YACtF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;SAClE;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAA4B,CAAC,EAAE;YAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE;gBACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,oBAAoB,CAAC,CAAC;aACtE;SACF;KACF;IACD,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,IAAA,uBAAe,EAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC/D,MAAM,IAAI,KAAK,CACb,wCAAwC,GAAG,CAAC,KAAK,CAAC,QAAQ,6BAA6B,CACxF,CAAC;KACH;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAvGD,wDAuGC;AAOD,mFAAmF;AACnF,SAAgB,uBAAuB,CAAC,QAAgB;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE;QAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;KAC1F;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,wBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;QACzB,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvE,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;KAC1C;IACD,MAAM,GAAG,GAAG,0BAA0B,EAAE,CAAC;IACzC,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAjBD,0DAiBC;AAED,yDAAyD;AACzD,SAAgB,UAAU,CAAC,GAAwB,EAAE,UAAkB;IACrE,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAFD,gCAEC"}

package/dist/src/lib/env-encryption/domains.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A host for the domain lock: lowercase, punycode, no scheme/port/path/trailing dot; `*.` prefix
+ * kept for "any subdomain". Undefined when it is not a host name. Userinfo (`@`), backslashes and
+ * percent-escapes are refused; a path, query or fragment only with an explicit scheme (a pasted URL). A wildcard
+ * needs a base with at least two labels and is not allowed on an IPv4 address.
+ */
+export declare function normalizeHost(input: string): string | undefined;
+/** Normalised, de-duplicated hosts; throws naming the first entry that is not a host. */
+export declare function normalizeHosts(list: string[]): string[];

package/dist/src/lib/env-encryption/domains.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeHosts = exports.normalizeHost = void 0;
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const IPV4 = /^\d{1,3}(?:\.\d{1,3}){3}$/;
+/**
+ * A host for the domain lock: lowercase, punycode, no scheme/port/path/trailing dot; `*.` prefix
+ * kept for "any subdomain". Undefined when it is not a host name. Userinfo (`@`), backslashes and
+ * percent-escapes are refused; a path, query or fragment only with an explicit scheme (a pasted URL). A wildcard
+ * needs a base with at least two labels and is not allowed on an IPv4 address.
+ */
+function normalizeHost(input) {
+    let s = input.trim();
+    if (!s)
+        return undefined;
+    const wildcard = s.startsWith('*.');
+    if (wildcard)
+        s = s.slice(2);
+    if (/[*@\\%]/.test(s))
+        return undefined;
+    const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(s);
+    if (!hasScheme && /[/?#]/.test(s))
+        return undefined;
+    let host;
+    try {
+        host = new URL(hasScheme ? s : `http://${s}`).hostname;
+    }
+    catch {
+        return undefined;
+    }
+    host = host.replace(/\.$/, '');
+    if (!host || !host.split('.').every((l) => LABEL.test(l)))
+        return undefined;
+    if (wildcard && (!host.includes('.') || IPV4.test(host)))
+        return undefined;
+    return wildcard ? `*.${host}` : host;
+}
+exports.normalizeHost = normalizeHost;
+/** Normalised, de-duplicated hosts; throws naming the first entry that is not a host. */
+function normalizeHosts(list) {
+    const out = [];
+    for (const entry of list) {
+        const h = normalizeHost(entry);
+        if (!h)
+            throw new Error(`env encryption: domain "${entry}" is not a host name.`);
+        if (!out.includes(h))
+            out.push(h);
+    }
+    return out;
+}
+exports.normalizeHosts = normalizeHosts;
+//# sourceMappingURL=domains.js.map

package/dist/src/lib/env-encryption/domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/domains.ts"],"names":[],"mappings":";;;AAAA,MAAM,KAAK,GAAG,wCAAwC,CAAC;AAEvD,MAAM,IAAI,GAAG,2BAA2B,CAAC;AAEzC;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,IAAY,CAAC;IACjB,IAAI;QACF,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;KACxD;IAAC,MAAM;QACN,OAAO,SAAS,CAAC;KAClB;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,IAAI,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAlBD,sCAkBC;AAED,yFAAyF;AACzF,SAAgB,cAAc,CAAC,IAAc;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE;QACxB,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,uBAAuB,CAAC,CAAC;QACjF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KACnC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AARD,wCAQC"}

package/dist/src/lib/env-encryption/encrypt.d.ts

@@ -0,0 +1,48 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { EnvEncryptionConfig } from './config';
+/** CryptoJS AES with a passphrase (OpenSSL-compatible base64), the format apps decrypt today. */
+export declare const encryptValue: (plain: string, passphrase: string) => string;
+export interface EncryptResult {
+    text: string;
+    encrypted: string[];
+    /** Listed keys that were left as they are (their values are not plain strings). */
+    skipped: string[];
+    /** The plaintexts that were encrypted (for profile files; never printed). */
+    values: string[];
+    /** Each encrypted plaintext with the key holding it (for the leak check; never printed). */
+    pairs: SealedPair[];
+}
+export interface SealedPair {
+    key: string;
+    value: string;
+}
+export declare const ENC_OPEN = "ENC(";
+export declare const ENC_CLOSE = ")";
+/** The key: the commit passphrase (cryptojs) or the derived 32-byte key (aes-gcm). */
+export type EnvSecret = string | Buffer;
+/**
+ * Fields kept plain in `all` mode: the publicKeys. Stamp fields are not exempt: they are encrypted
+ * after stamping unless listed there (the default list has `timeStamp` but not the branch).
+ */
+export declare function plainKeys(cfg: EnvEncryptionConfig): Set<string>;
+/**
+ * Encrypts an env file's text by the workspace settings. `listed`: every `key: '<literal>'` of a
+ * listed key at any depth (the match used before v0.25.0); listed top-level keys with other
+ * values are left alone and reported in `skipped`. `all`: every top-level string literal except
+ * plain keys; anything the scanner cannot read as a field, and non-literal values of non-plain
+ * keys, fail the build.
+ */
+export declare function encryptEnvText(text: string, cfg: EnvEncryptionConfig, envProject: string, secret: EnvSecret, file?: string): EncryptResult;
+/**
+ * Encrypts a profile file (e.g. app.profile.ts): in object literals, string values of
+ * sensitive-looking keys (and items of arrays under them), and property values or array items
+ * equal to one of `secretValues` (values already encrypted from the env file). Keys, types,
+ * imports and other code are never touched; messages name keys, never values.
+ */
+export declare function encryptProfileText(text: string, cfg: EnvEncryptionConfig, secret: EnvSecret, secretValues: Set<string>, file?: string): EncryptResult;
+/** Sets declared string fields (e.g. timeStamp, branch) to the given values. */
+export declare function setStringFields(text: string, values: Record<string, string>): {
+    text: string;
+    set: string[];
+};