@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/lib/env-encryption/env-file.js

@@ -0,0 +1,395 @@
+"use strict";
+/**
+ * A small scanner for Angular environment files (`export const environment = { … };`): the
+ * top-level fields of the first object literal assigned to `environment`, and every quoted string
+ * in the file. Comments, template literals and regular expression literals are skipped, never
+ * rewritten.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nextCode = exports.scanStructure = exports.closingBracket = exports.isCodeAt = exports.unescapeString = exports.environmentFields = exports.appendEnvironmentField = exports.scanEnvironment = exports.environmentObjectStart = exports.quotedStrings = exports.stripComments = void 0;
+/** Characters after which a `/` starts a regular expression literal rather than a division. */
+const REGEX_PRECEDERS = new Set(['', '(', ',', '=', ':', '[', '!', '&', '|', '?', '{', '}', ';']);
+function previousCodeChar(text, i) {
+    let j = i - 1;
+    while (j >= 0 && /\s/.test(text[j]))
+        j--;
+    return j >= 0 ? text[j] : '';
+}
+/** Index after a regex literal starting at `i` (the opening `/`). */
+function endOfRegex(text, i) {
+    let inClass = false;
+    for (let j = i + 1; j < text.length; j++) {
+        const c = text[j];
+        if (c === '\\') {
+            j++;
+        }
+        else if (c === '[')
+            inClass = true;
+        else if (c === ']')
+            inClass = false;
+        else if (c === '/' && !inClass) {
+            let k = j + 1;
+            while (k < text.length && /[a-z]/i.test(text[k]))
+                k++;
+            return k;
+        }
+        else if (c === '\n')
+            return j;
+    }
+    return text.length;
+}
+/** Index after a comment, string or regex literal starting at `i`, or -1 when `i` starts none. */
+function skipNonCode(text, i) {
+    const c = text[i];
+    const n = text[i + 1];
+    if (c === '/' && n === '/') {
+        const e = text.indexOf('\n', i);
+        return e < 0 ? text.length : e;
+    }
+    if (c === '/' && n === '*') {
+        const e = text.indexOf('*/', i + 2);
+        return e < 0 ? text.length : e + 2;
+    }
+    if (c === '/' && REGEX_PRECEDERS.has(previousCodeChar(text, i)))
+        return endOfRegex(text, i);
+    if (c === "'" || c === '"' || c === '`')
+        return endOfString(text, i);
+    return -1;
+}
+/** Index after the string literal (or template literal) opening at `i`. */
+function endOfString(text, i) {
+    const q = text[i];
+    let depth = 0;
+    for (let j = i + 1; j < text.length; j++) {
+        const c = text[j];
+        if (c === '\\') {
+            j++;
+            continue;
+        }
+        if (q === '`') {
+            if (depth === 0 && c === '`')
+                return j + 1;
+            if (c === '$' && text[j + 1] === '{') {
+                depth++;
+                j++;
+            }
+            else if (c === '}' && depth > 0)
+                depth--;
+            continue;
+        }
+        if (c === q || c === '\n')
+            return j + 1;
+    }
+    return text.length;
+}
+/** `text` with comments removed (strings and regexes kept). */
+function stripComments(text) {
+    let out = '';
+    let i = 0;
+    while (i < text.length) {
+        const s = skipNonCode(text, i);
+        if (s < 0) {
+            out += text[i++];
+            continue;
+        }
+        const isComment = text[i] === '/' && (text[i + 1] === '/' || text[i + 1] === '*');
+        out += isComment ? ' ' : text.slice(i, s);
+        i = s;
+    }
+    return out;
+}
+exports.stripComments = stripComments;
+/** Every single- or double-quoted string outside comments (template literals excluded). */
+function quotedStrings(text) {
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        const skip = skipNonCode(text, i);
+        if (skip < 0) {
+            i++;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            out.push({ start: i, end: skip, quote: c, content: text.slice(i + 1, skip - 1) });
+        }
+        i = skip;
+    }
+    return out;
+}
+exports.quotedStrings = quotedStrings;
+/** Offset of the `{` of the object assigned to `environment`, or -1. */
+function environmentObjectStart(text) {
+    const re = /\benvironment\b\s*(?::[^=]*)?=\s*\{/g;
+    let m;
+    while ((m = re.exec(text))) {
+        // Skip matches inside comments or strings.
+        let i = 0;
+        let inside = false;
+        while (i < m.index) {
+            const s = skipNonCode(text, i);
+            if (s < 0) {
+                i++;
+                continue;
+            }
+            if (s > m.index) {
+                inside = true;
+                break;
+            }
+            i = s;
+        }
+        if (!inside)
+            return m.index + m[0].length - 1;
+    }
+    return -1;
+}
+exports.environmentObjectStart = environmentObjectStart;
+const OTHER_LITERAL = /^(true|false|null|undefined|-?(0[xXbBoO][\da-fA-F_]+|\d[\d_.eE+-]*)|\{[\s\S]*\}|\[[\s\S]*\])$/;
+/** What may follow a value: a type assertion (`as string`, `as const`, `satisfies Foo`). */
+const TYPE_SUFFIX = /^(as|satisfies)\s+[\w$.<>[\]|&,\s'"]+$/;
+/** Index of the first character of `text` that is not whitespace or inside a comment. */
+function firstCodeIndex(text) {
+    let i = 0;
+    while (i < text.length) {
+        if (/\s/.test(text[i])) {
+            i++;
+            continue;
+        }
+        if (text[i] === '/' && (text[i + 1] === '/' || text[i + 1] === '*')) {
+            i = skipNonCode(text, i);
+            continue;
+        }
+        return i;
+    }
+    return text.length;
+}
+/**
+ * Kind of a value. For strings, `litStart`/`litLen` locate the string literal inside the value
+ * (comments before it and a type assertion or comment after it are not part of it).
+ */
+function classify(value) {
+    const at = firstCodeIndex(value);
+    const q = value[at];
+    if (q === "'" || q === '"' || q === '`') {
+        const end = endOfString(value, at);
+        const literal = value.slice(at, end);
+        const closed = literal.length >= 2 && literal.endsWith(q);
+        const rest = stripComments(value.slice(end)).trim();
+        if (closed && (q !== '`' || !/\$\{/.test(literal)) && (rest === '' || TYPE_SUFFIX.test(rest))) {
+            return { kind: 'string', text: literal.slice(1, -1), litStart: at, litLen: literal.length };
+        }
+    }
+    const bare = stripComments(value).trim();
+    const noSuffix = bare.replace(/\s+(as|satisfies)\s+[\w$.<>[\]|&,\s]+$/, '').trim();
+    return { kind: OTHER_LITERAL.test(noSuffix) ? 'other-literal' : 'expression' };
+}
+/** The `environment` object: whether it exists, its top-level fields and unkeyed entries. */
+function scanEnvironment(text) {
+    const open = environmentObjectStart(text);
+    if (open < 0)
+        return { found: false, fields: [], unkeyed: [] };
+    const fields = [];
+    const unkeyed = [];
+    let depth = 0;
+    let key;
+    let valueStart = -1;
+    let entryStart = open + 1;
+    const finish = (end) => {
+        if (key !== undefined && valueStart >= 0) {
+            const raw = text.slice(valueStart, end);
+            const lead = raw.length - raw.trimStart().length;
+            const value = raw.trim();
+            const c = classify(value);
+            const start = valueStart + lead + (c.litStart ?? 0);
+            fields.push({
+                key,
+                value,
+                kind: c.kind,
+                text: c.text,
+                start,
+                end: c.litLen !== undefined ? start + c.litLen : start + value.length,
+            });
+        }
+        else {
+            const entry = stripComments(text.slice(entryStart, end)).trim();
+            if (entry)
+                unkeyed.push(entry.slice(0, 60));
+        }
+        key = undefined;
+        valueStart = -1;
+    };
+    let i = open;
+    while (i < text.length) {
+        const skip = skipNonCode(text, i);
+        if (skip >= 0) {
+            i = skip;
+            continue;
+        }
+        const c = text[i];
+        if (c === '{' || c === '[' || c === '(')
+            depth++;
+        else if (c === '}' || c === ']' || c === ')') {
+            depth--;
+            if (depth === 0) {
+                finish(i);
+                break;
+            }
+        }
+        else if (depth === 1 && c === ',') {
+            finish(i);
+            entryStart = i + 1;
+        }
+        else if (depth === 1 && c === ':' && key === undefined) {
+            const k = stripComments(text.slice(entryStart, i))
+                .trim()
+                .replace(/^(['"])(.*)\1$/, '$2');
+            if (/^[\w$-]+$/.test(k)) {
+                key = k;
+                valueStart = i + 1;
+            }
+        }
+        i++;
+    }
+    return { found: true, fields, unkeyed };
+}
+exports.scanEnvironment = scanEnvironment;
+/**
+ * Inserts `key: '<value>'` as the last entry of the `environment = { … }` object (value must be
+ * a quote-free token such as base64url). Throws when there is no such object.
+ */
+function appendEnvironmentField(text, key, value) {
+    const open = environmentObjectStart(text);
+    const close = open < 0 ? -1 : closingBracket(text, open);
+    if (close < 0) {
+        throw new Error('env encryption: aes-gcm needs `export const environment = { … }` in the env file.');
+    }
+    const body = stripComments(text.slice(open + 1, close)).trim();
+    const head = text.slice(0, close).trimEnd();
+    // A comment ends `head` (comments become spaces): start a new line so `// …` cannot swallow it.
+    const lead = stripComments(head).endsWith(' ') ? '\n' : '';
+    const sep = body === '' || body.endsWith(',') ? ' ' : ' , ';
+    return `${head}${lead}${sep}${key}: '${value}' ${text.slice(close)}`;
+}
+exports.appendEnvironmentField = appendEnvironmentField;
+/** Top-level fields of the `environment` object (empty when there is none). */
+function environmentFields(text) {
+    return scanEnvironment(text).fields;
+}
+exports.environmentFields = environmentFields;
+/** The value of a JS string literal's content (escapes resolved). */
+function unescapeString(content) {
+    return content.replace(/\\(u\{[\da-fA-F]+\}|u[\da-fA-F]{4}|x[\da-fA-F]{2}|\r\n|[\s\S])/g, (_, e) => {
+        if (e[0] === 'u' && e[1] === '{')
+            return String.fromCodePoint(parseInt(e.slice(2, -1), 16));
+        if (e[0] === 'u' || e[0] === 'x')
+            return String.fromCharCode(parseInt(e.slice(1), 16));
+        const map = {
+            n: '\n',
+            r: '\r',
+            t: '\t',
+            b: '\b',
+            f: '\f',
+            v: '\v',
+            '0': '\0',
+            '\n': '',
+            '\r\n': '',
+        };
+        return map[e] ?? e;
+    });
+}
+exports.unescapeString = unescapeString;
+/** True when offset `index` of `text` is code (not inside a comment, string or regex literal). */
+function isCodeAt(text, index) {
+    let i = 0;
+    while (i < index) {
+        const s = skipNonCode(text, i);
+        if (s < 0) {
+            i++;
+            continue;
+        }
+        if (s > index)
+            return false;
+        i = s;
+    }
+    return true;
+}
+exports.isCodeAt = isCodeAt;
+/** Offset of the bracket closing the one at `open` (`[`, `{` or `(`), skipping non-code; -1 if none. */
+function closingBracket(text, open) {
+    let depth = 0;
+    let i = open;
+    while (i < text.length) {
+        const s = skipNonCode(text, i);
+        if (s >= 0) {
+            i = s;
+            continue;
+        }
+        const c = text[i];
+        if (c === '[' || c === '{' || c === '(')
+            depth++;
+        else if (c === ']' || c === '}' || c === ')') {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+        i++;
+    }
+    return -1;
+}
+exports.closingBracket = closingBracket;
+/** Strings and brackets with their nesting (one pass; comments, templates, regexes skipped). */
+function scanStructure(text) {
+    const strings = [];
+    const brackets = new Map();
+    const stack = [];
+    const top = () => (stack.length > 0 ? stack[stack.length - 1] : -1);
+    let i = 0;
+    while (i < text.length) {
+        const c = text[i];
+        const skip = skipNonCode(text, i);
+        if (skip >= 0) {
+            if (c === "'" || c === '"') {
+                strings.push({
+                    start: i,
+                    end: skip,
+                    quote: c,
+                    content: text.slice(i + 1, skip - 1),
+                    parent: top(),
+                });
+            }
+            i = skip;
+            continue;
+        }
+        if (c === '{' || c === '[' || c === '(') {
+            brackets.set(i, { char: c, parent: top(), close: text.length });
+            stack.push(i);
+        }
+        else if (c === '}' || c === ']' || c === ')') {
+            const open = stack.pop();
+            const b = open !== undefined ? brackets.get(open) : undefined;
+            if (b)
+                b.close = i;
+        }
+        i++;
+    }
+    return { strings, brackets };
+}
+exports.scanStructure = scanStructure;
+/** The first code character at or after `index` (comments and whitespace skipped). */
+function nextCode(text, index) {
+    let i = index;
+    while (i < text.length) {
+        if (/\s/.test(text[i])) {
+            i++;
+            continue;
+        }
+        if (text[i] === '/' && (text[i + 1] === '/' || text[i + 1] === '*')) {
+            i = skipNonCode(text, i);
+            continue;
+        }
+        return text.slice(i, i + 12);
+    }
+    return '';
+}
+exports.nextCode = nextCode;
+//# sourceMappingURL=env-file.js.map

package/dist/src/lib/env-encryption/env-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/env-file.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAkCH,+FAA+F;AAC/F,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAElG,SAAS,gBAAgB,CAAC,IAAY,EAAE,CAAS;IAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,CAAC,EAAE,CAAC;IACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,IAAY,EAAE,CAAS;IACzC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,EAAE;YACd,CAAC,EAAE,CAAC;SACL;aAAM,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,GAAG,IAAI,CAAC;aAChC,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,GAAG,KAAK,CAAC;aAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE;YAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACtD,OAAO,CAAC,CAAC;SACV;aAAM,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;KACjC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,IAAY,EAAE,CAAS;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;KAChC;IACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;KACpC;IACD,IAAI,CAAC,KAAK,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,2EAA2E;AAC3E,SAAS,WAAW,CAAC,IAAY,EAAE,CAAS;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,EAAE;YACd,CAAC,EAAE,CAAC;YACJ,SAAS;SACV;QACD,IAAI,CAAC,KAAK,GAAG,EAAE;YACb,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE;gBACpC,KAAK,EAAE,CAAC;gBACR,CAAC,EAAE,CAAC;aACL;iBAAM,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,EAAE,CAAC;YAC3C,SAAS;SACV;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;KACzC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED,+DAA+D;AAC/D,SAAgB,aAAa,CAAC,IAAY;IACxC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,GAAG,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;YACjB,SAAS;SACV;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAClF,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC,GAAG,CAAC,CAAC;KACP;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAdD,sCAcC;AAED,2FAA2F;AAC3F,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,GAAG,CAAC,EAAE;YACZ,CAAC,EAAE,CAAC;YACJ,SAAS;SACV;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;SACnF;QACD,CAAC,GAAG,IAAI,CAAC;KACV;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAhBD,sCAgBC;AAED,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,IAAY;IACjD,MAAM,EAAE,GAAG,sCAAsC,CAAC;IAClD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;QAC1B,2CAA2C;QAC3C,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE;YAClB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,EAAE;gBACT,CAAC,EAAE,CAAC;gBACJ,SAAS;aACV;YACD,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE;gBACf,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;aACP;YACD,CAAC,GAAG,CAAC,CAAC;SACP;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;KAC/C;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAtBD,wDAsBC;AAED,MAAM,aAAa,GACjB,+FAA+F,CAAC;AAClG,4FAA4F;AAC5F,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAE7D,yFAAyF;AACzF,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YACtB,CAAC,EAAE,CAAC;YACJ,SAAS;SACV;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE;YACnE,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACzB,SAAS;SACV;QACD,OAAO,CAAC,CAAC;KACV;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAa;IAM7B,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;IACpB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,IAAI,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;YAC7F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SAC7F;KACF;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;AACjF,CAAC;AAED,6FAA6F;AAC7F,SAAgB,eAAe,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAuB,CAAC;IAC5B,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,UAAU,IAAI,CAAC,EAAE;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;YACjD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,KAAK,GAAG,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG;gBACH,KAAK;gBACL,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK;gBACL,GAAG,EAAE,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM;aACtE,CAAC,CAAC;SACJ;aAAM;YACL,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,IAAI,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;SAC7C;QACD,GAAG,GAAG,SAAS,CAAC;QAChB,UAAU,GAAG,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,EAAE;YACb,CAAC,GAAG,IAAI,CAAC;YACT,SAAS;SACV;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YAC5C,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,EAAE;gBACf,MAAM,CAAC,CAAC,CAAC,CAAC;gBACV,MAAM;aACP;SACF;aAAM,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE;YACnC,MAAM,CAAC,CAAC,CAAC,CAAC;YACV,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;SACpB;aAAM,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,KAAK,SAAS,EAAE;YACxD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;iBAC/C,IAAI,EAAE;iBACN,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACvB,GAAG,GAAG,CAAC,CAAC;gBACR,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;aACpB;SACF;QACD,CAAC,EAAE,CAAC;KACL;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AA7DD,0CA6DC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,IAAY,EAAE,GAAW,EAAE,KAAa;IAC7E,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,KAAK,GAAG,CAAC,EAAE;QACb,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;KACH;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,gGAAgG;IAChG,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;AACvE,CAAC;AAdD,wDAcC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,IAAY;IAC5C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC;AAFD,8CAEC;AAED,qEAAqE;AACrE,SAAgB,cAAc,CAAC,OAAe;IAC5C,OAAO,OAAO,CAAC,OAAO,CACpB,iEAAiE,EACjE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE;QACf,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,GAA2B;YAClC,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,GAAG,EAAE,IAAI;YACT,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,EAAE;SACX,CAAC;QACF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CACF,CAAC;AACJ,CAAC;AApBD,wCAoBC;AAED,kGAAkG;AAClG,SAAgB,QAAQ,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,EAAE;QAChB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,CAAC,EAAE,CAAC;YACJ,SAAS;SACV;QACD,IAAI,CAAC,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC;QAC5B,CAAC,GAAG,CAAC,CAAC;KACP;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAZD,4BAYC;AAED,wGAAwG;AACxG,SAAgB,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,EAAE;YACV,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;SACV;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YAC5C,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;SAC3B;QACD,CAAC,EAAE,CAAC;KACL;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAlBD,wCAkBC;AAaD,gGAAgG;AAChG,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2D,CAAC;IACpF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI,IAAI,CAAC,EAAE;YACb,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;gBAC1B,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,CAAC;oBACR,GAAG,EAAE,IAAI;oBACT,KAAK,EAAE,CAAC;oBACR,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC;oBACpC,MAAM,EAAE,GAAG,EAAE;iBACd,CAAC,CAAC;aACJ;YACD,CAAC,GAAG,IAAI,CAAC;YACT,SAAS;SACV;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YACvC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACf;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE;YAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,IAAI,CAAC;gBAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;SACpB;QACD,CAAC,EAAE,CAAC;KACL;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAjCD,sCAiCC;AAED,sFAAsF;AACtF,SAAgB,QAAQ,CAAC,IAAY,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE;QACtB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE;YACtB,CAAC,EAAE,CAAC;YACJ,SAAS;SACV;QACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE;YACnE,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACzB,SAAS;SACV;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;KAC9B;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAdD,4BAcC"}

package/dist/src/lib/env-encryption/gcm.d.ts

@@ -0,0 +1,51 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { KeySource } from './config';
+/** aes-gcm values: `ENC2(<base64url iv>.<base64url ciphertext‖tag>)`. */
+export declare const ENC2_OPEN = "ENC2(";
+export declare const ENC2_CLOSE = ")";
+/** Hidden env field carrying the bundle share, bundle-side factors, asset name and domain lock. */
+export declare const PSTACK_FIELD = "__pstack";
+export type KeySplit = 'meta-bundle' | 'meta-bundle-asset';
+export declare const KEY_SPLITS: KeySplit[];
+export declare const isEnc2: (v: string) => boolean;
+export declare const b64u: (b: Buffer) => string;
+/** XOR shares of `r`: every share alone is random; all of them XORed give `r`. */
+export declare function xorShares(r: Buffer, count: 2 | 3): Buffer[];
+export declare function combineShares(shares: Buffer[]): Buffer;
+/** `<name>=<value>` lines of the selected factors, always in KEY_SOURCES order. */
+export declare function factorText(sources: KeySource[], values: Partial<Record<KeySource, string>>): string;
+export declare function keyInfo(envProject: string, env: string): string;
+/** HKDF-SHA256(r ‖ factors, salt = time, info) → 32-byte AES key (same bytes as Web Crypto). */
+export declare function deriveKey(r: Buffer, factors: string, time: string, info: string): Buffer;
+/** AES-256-GCM, fresh 12-byte IV, AAD = the name of the property holding the value. */
+export declare function encryptGcm(key: Buffer, plain: string, aad: string): string;
+/** Inverse of encryptGcm (tests and tooling); throws on a malformed value or failed authentication. */
+export declare function decryptGcm(key: Buffer, value: string, aad: string): string;
+export interface DomainLock {
+    /** Normalised hosts (`example.com`, `*.example.com`). */
+    h: string[];
+    /** Listing `example.com` also allows `www.example.com`. */
+    w: boolean;
+    /** What a mismatch does. */
+    m: 'block' | 'warn';
+}
+export interface PstackField {
+    v: 2;
+    /** Env project and env: part of the HKDF info. */
+    p: string;
+    e: string;
+    /** Bundle share of the random key (base64url). */
+    b: string;
+    /** Selected key sources. */
+    s: KeySource[];
+    /** Bundle-side factor values (commit, salt, env); custom is never written. */
+    f: Partial<Record<'commit' | 'salt' | 'env', string>>;
+    /** Asset holding the third share (meta-bundle-asset). */
+    a?: string;
+    d?: DomainLock;
+    /** 1: the runtime decrypts nothing while a script on the page has no integrity attribute. */
+    ri?: 1;
+}
+export declare const encodePstack: (p: PstackField) => string;
+export declare const decodePstack: (s: string) => PstackField;

package/dist/src/lib/env-encryption/gcm.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodePstack = exports.encodePstack = exports.decryptGcm = exports.encryptGcm = exports.deriveKey = exports.keyInfo = exports.factorText = exports.combineShares = exports.xorShares = exports.b64u = exports.isEnc2 = exports.KEY_SPLITS = exports.PSTACK_FIELD = exports.ENC2_CLOSE = exports.ENC2_OPEN = void 0;
+const crypto_1 = require("crypto");
+const config_1 = require("./config");
+/** aes-gcm values: `ENC2(<base64url iv>.<base64url ciphertext‖tag>)`. */
+exports.ENC2_OPEN = 'ENC2(';
+exports.ENC2_CLOSE = ')';
+/** Hidden env field carrying the bundle share, bundle-side factors, asset name and domain lock. */
+exports.PSTACK_FIELD = '__pstack';
+exports.KEY_SPLITS = ['meta-bundle', 'meta-bundle-asset'];
+const isEnc2 = (v) => v.startsWith(exports.ENC2_OPEN) && v.endsWith(exports.ENC2_CLOSE);
+exports.isEnc2 = isEnc2;
+const b64u = (b) => b.toString('base64url');
+exports.b64u = b64u;
+/** XOR shares of `r`: every share alone is random; all of them XORed give `r`. */
+function xorShares(r, count) {
+    const shares = Array.from({ length: count - 1 }, () => (0, crypto_1.randomBytes)(r.length));
+    return [...shares, combineShares([r, ...shares])];
+}
+exports.xorShares = xorShares;
+function combineShares(shares) {
+    const out = Buffer.alloc(shares[0].length);
+    if (shares.some((s) => s.length !== out.length))
+        throw new Error('env encryption: key shares differ in length.');
+    for (const s of shares)
+        for (let i = 0; i < out.length; i++)
+            out[i] ^= s[i];
+    return out;
+}
+exports.combineShares = combineShares;
+/** `<name>=<value>` lines of the selected factors, always in KEY_SOURCES order. */
+function factorText(sources, values) {
+    return config_1.KEY_SOURCES.filter((s) => sources.includes(s))
+        .map((s) => `${s}=${values[s] ?? ''}`)
+        .join('\n');
+}
+exports.factorText = factorText;
+function keyInfo(envProject, env) {
+    if (envProject.includes('|') || env.includes('|'))
+        throw new Error(`env encryption: "|" is not allowed in the env project or env name.`);
+    return `pstack-env-v2|${envProject}|${env}`;
+}
+exports.keyInfo = keyInfo;
+/** HKDF-SHA256(r ‖ factors, salt = time, info) → 32-byte AES key (same bytes as Web Crypto). */
+function deriveKey(r, factors, time, info) {
+    return Buffer.from((0, crypto_1.hkdfSync)('sha256', Buffer.concat([r, Buffer.from(factors, 'utf8')]), Buffer.from(time, 'utf8'), Buffer.from(info, 'utf8'), 32));
+}
+exports.deriveKey = deriveKey;
+/** AES-256-GCM, fresh 12-byte IV, AAD = the name of the property holding the value. */
+function encryptGcm(key, plain, aad) {
+    const iv = (0, crypto_1.randomBytes)(12);
+    const c = (0, crypto_1.createCipheriv)('aes-256-gcm', key, iv);
+    c.setAAD(Buffer.from(aad, 'utf8'));
+    const ct = Buffer.concat([c.update(plain, 'utf8'), c.final(), c.getAuthTag()]);
+    return `${exports.ENC2_OPEN}${(0, exports.b64u)(iv)}.${(0, exports.b64u)(ct)}${exports.ENC2_CLOSE}`;
+}
+exports.encryptGcm = encryptGcm;
+/** Inverse of encryptGcm (tests and tooling); throws on a malformed value or failed authentication. */
+function decryptGcm(key, value, aad) {
+    const parts = (0, exports.isEnc2)(value) ? value.slice(exports.ENC2_OPEN.length, -exports.ENC2_CLOSE.length).split('.') : [];
+    const iv = Buffer.from(parts[0] ?? '', 'base64url');
+    const bytes = Buffer.from(parts[1] ?? '', 'base64url');
+    if (parts.length !== 2 || iv.length !== 12 || bytes.length < 16)
+        throw new Error('env encryption: malformed ENC2 value');
+    const d = (0, crypto_1.createDecipheriv)('aes-256-gcm', key, iv, { authTagLength: 16 });
+    d.setAAD(Buffer.from(aad, 'utf8'));
+    d.setAuthTag(bytes.subarray(bytes.length - 16));
+    return Buffer.concat([d.update(bytes.subarray(0, bytes.length - 16)), d.final()]).toString('utf8');
+}
+exports.decryptGcm = decryptGcm;
+const encodePstack = (p) => (0, exports.b64u)(Buffer.from(JSON.stringify(p), 'utf8'));
+exports.encodePstack = encodePstack;
+const decodePstack = (s) => JSON.parse(Buffer.from(s, 'base64url').toString('utf8'));
+exports.decodePstack = decodePstack;
+//# sourceMappingURL=gcm.js.map

package/dist/src/lib/env-encryption/gcm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcm.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/gcm.ts"],"names":[],"mappings":";;;AAAA,mCAAiF;AAEjF,qCAAkD;AAElD,yEAAyE;AAC5D,QAAA,SAAS,GAAG,OAAO,CAAC;AACpB,QAAA,UAAU,GAAG,GAAG,CAAC;AAC9B,mGAAmG;AACtF,QAAA,YAAY,GAAG,UAAU,CAAC;AAG1B,QAAA,UAAU,GAAe,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;AAEpE,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,kBAAU,CAAC,CAAC;AAAnF,QAAA,MAAM,UAA6E;AACzF,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAAtD,QAAA,IAAI,QAAkD;AAEnE,kFAAkF;AAClF,SAAgB,SAAS,CAAC,CAAS,EAAE,KAAY;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAHD,8BAGC;AAED,SAAgB,aAAa,CAAC,MAAgB;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC;AAND,sCAMC;AAED,mFAAmF;AACnF,SAAgB,UAAU,CACxB,OAAoB,EACpB,MAA0C;IAE1C,OAAO,oBAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAPD,gCAOC;AAED,SAAgB,OAAO,CAAC,UAAkB,EAAE,GAAW;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,OAAO,iBAAiB,UAAU,IAAI,GAAG,EAAE,CAAC;AAC9C,CAAC;AAJD,0BAIC;AAED,gGAAgG;AAChG,SAAgB,SAAS,CAAC,CAAS,EAAE,OAAe,EAAE,IAAY,EAAE,IAAY;IAC9E,OAAO,MAAM,CAAC,IAAI,CAChB,IAAA,iBAAQ,EACN,QAAQ,EACR,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAChD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EACzB,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EACzB,EAAE,CACH,CACF,CAAC;AACJ,CAAC;AAVD,8BAUC;AAED,uFAAuF;AACvF,SAAgB,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;IAChE,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO,GAAG,iBAAS,GAAG,IAAA,YAAI,EAAC,EAAE,CAAC,IAAI,IAAA,YAAI,EAAC,EAAE,CAAC,GAAG,kBAAU,EAAE,CAAC;AAC5D,CAAC;AAND,gCAMC;AAED,uGAAuG;AACvG,SAAgB,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;IAChE,MAAM,KAAK,GAAG,IAAA,cAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAS,CAAC,MAAM,EAAE,CAAC,kBAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CACxF,MAAM,CACP,CAAC;AACJ,CAAC;AAZD,gCAYC;AA6BM,MAAM,YAAY,GAAG,CAAC,CAAc,EAAU,EAAE,CACrD,IAAA,YAAI,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AADlC,QAAA,YAAY,gBACsB;AACxC,MAAM,YAAY,GAAG,CAAC,CAAS,EAAe,EAAE,CACrD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAD9C,QAAA,YAAY,gBACkC"}

package/dist/src/lib/env-encryption/key-material.d.ts

@@ -0,0 +1,53 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { EnvEncryptionConfig, KeySource } from './config';
+import { KeySplit } from './gcm';
+export declare const SALT_FILE = "tools/config/env-salt";
+export declare const ENV_KEY_VAR = "PSTACK_ENV_KEY";
+export declare const CUSTOM_KEY_VAR = "PSTACK_CUSTOM_KEY";
+type Vars = Record<string, string | undefined>;
+/** A new random salt (32 bytes, base64url) for the salt file. */
+export declare function newSalt(): string;
+/**
+ * Values of the selected key sources. Every other source is checked first and the salt file is
+ * created (when missing) last, so a failing check creates nothing. Never logs values.
+ */
+export declare function readKeyFactors(repoRoot: string, sources: KeySource[], commit: string, vars: Vars): {
+    values: Partial<Record<KeySource, string>>;
+    created: boolean;
+};
+export interface KeyParts {
+    /** Meta share (base64url). */
+    share: string;
+    /** Build time, ISO-8601 UTC: HKDF salt and the meta `timestamp_utc`. */
+    time: string;
+    asset?: {
+        name: string;
+        bytes: Buffer;
+    };
+}
+export interface KeyMaterialOptions {
+    repoRoot: string;
+    config: EnvEncryptionConfig;
+    envProject: string;
+    env: string;
+    commit: string;
+    now: Date;
+    vars: Vars;
+    keySplit: KeySplit;
+    domains?: string[];
+    includeWww?: boolean;
+    onMismatch?: 'block' | 'warn';
+    /** SRI build: the runtime refuses to decrypt when a script has no integrity attribute. */
+    requireIntegrity?: boolean;
+}
+export interface KeyMaterial {
+    key: Buffer;
+    /** Encoded `__pstack` value. */
+    field: string;
+    parts: KeyParts;
+    saltCreated: boolean;
+}
+/** A fresh per-build key: random R split into shares, factors, HKDF. */
+export declare function buildKeyMaterial(o: KeyMaterialOptions): KeyMaterial;
+export {};