@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/lib/env-encryption/key-material.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildKeyMaterial = exports.readKeyFactors = exports.newSalt = exports.CUSTOM_KEY_VAR = exports.ENV_KEY_VAR = exports.SALT_FILE = void 0;
+const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const domains_1 = require("./domains");
+const gcm_1 = require("./gcm");
+exports.SALT_FILE = 'tools/config/env-salt';
+exports.ENV_KEY_VAR = 'PSTACK_ENV_KEY';
+exports.CUSTOM_KEY_VAR = 'PSTACK_CUSTOM_KEY';
+/** A new random salt (32 bytes, base64url) for the salt file. */
+function newSalt() {
+    return `${(0, gcm_1.b64u)((0, crypto_1.randomBytes)(32))}\n`;
+}
+exports.newSalt = newSalt;
+/**
+ * Values of the selected key sources. Every other source is checked first and the salt file is
+ * created (when missing) last, so a failing check creates nothing. Never logs values.
+ */
+function readKeyFactors(repoRoot, sources, commit, vars) {
+    const values = {};
+    let created = false;
+    const need = (name, source) => {
+        const v = vars[name];
+        if (!v || !v.trim()) {
+            throw new Error(`env encryption: key source ${source} needs a non-empty ${name} (environment or .env.local).`);
+        }
+        return v;
+    };
+    for (const s of sources) {
+        if (s === 'salt')
+            continue;
+        if (s === 'commit') {
+            if (!commit || commit === 'unknown') {
+                throw new Error('env encryption: key source commit needs the build commit (git or CI).');
+            }
+            values.commit = commit;
+        }
+        else if (s === 'env') {
+            values.env = need(exports.ENV_KEY_VAR, s);
+        }
+        else {
+            values.custom = need(exports.CUSTOM_KEY_VAR, s);
+        }
+    }
+    if (sources.includes('salt')) {
+        const file = path.join(repoRoot, ...exports.SALT_FILE.split('/'));
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        if (!fs.existsSync(file))
+            created = createSaltFile(file);
+        const salt = fs.readFileSync(file, 'utf8').trim();
+        if (!salt) {
+            throw new Error(`env encryption: key source salt: ${exports.SALT_FILE} is empty (delete it to create a new salt).`);
+        }
+        values.salt = salt;
+    }
+    return { values, created };
+}
+exports.readKeyFactors = readKeyFactors;
+/** Link errors of file systems without hard links: fall back to an exclusive write. */
+const NO_HARD_LINKS = ['EPERM', 'ENOTSUP', 'EXDEV'];
+/**
+ * Writes a new salt to a temp file in the same folder, then hard-links it into place: the link
+ * either fails (another build created the salt first; its file is kept) or puts a complete file
+ * there, so a parallel build never reads a half-written salt. Without hard links, the salt is
+ * written with 'wx' (another build may then briefly see a partly written file).
+ * Returns whether this build created the salt.
+ */
+function createSaltFile(file) {
+    const salt = newSalt();
+    const temp = `${file}.${process.pid}.${(0, crypto_1.randomBytes)(6).toString('hex')}.tmp`;
+    const lost = (e) => {
+        if (e.code !== 'EEXIST')
+            throw e;
+        return false;
+    };
+    try {
+        fs.writeFileSync(temp, salt, { encoding: 'utf8', flag: 'wx' });
+        try {
+            fs.linkSync(temp, file);
+            return true;
+        }
+        catch (e) {
+            if (!NO_HARD_LINKS.includes(e.code ?? ''))
+                return lost(e);
+        }
+        try {
+            fs.writeFileSync(file, salt, { encoding: 'utf8', flag: 'wx' });
+            return true;
+        }
+        catch (e) {
+            return lost(e);
+        }
+    }
+    finally {
+        fs.rmSync(temp, { force: true });
+    }
+}
+/** A fresh per-build key: random R split into shares, factors, HKDF. */
+function buildKeyMaterial(o) {
+    const sources = o.config.keySources;
+    const factors = readKeyFactors(o.repoRoot, sources, o.commit, o.vars);
+    const time = o.now.toISOString();
+    const r = (0, crypto_1.randomBytes)(32);
+    const shares = (0, gcm_1.xorShares)(r, o.keySplit === 'meta-bundle-asset' ? 3 : 2);
+    const key = (0, gcm_1.deriveKey)(r, (0, gcm_1.factorText)(sources, factors.values), time, (0, gcm_1.keyInfo)(o.envProject, o.env));
+    const asset = shares.length === 3
+        ? {
+            name: `pstack-k.${(0, crypto_1.createHash)('sha256').update(shares[2]).digest('hex').slice(0, 8)}.bin`,
+            bytes: shares[2],
+        }
+        : undefined;
+    // The custom factor is server-side only: never written to the bundle.
+    const bundleFactors = {};
+    for (const s of ['commit', 'salt', 'env']) {
+        if (factors.values[s] !== undefined)
+            bundleFactors[s] = factors.values[s];
+    }
+    const field = {
+        v: 2,
+        p: o.envProject,
+        e: o.env,
+        b: (0, gcm_1.b64u)(shares[1]),
+        s: sources,
+        f: bundleFactors,
+        ...(asset ? { a: asset.name } : {}),
+        ...(o.domains && o.domains.length > 0
+            ? {
+                d: {
+                    h: (0, domains_1.normalizeHosts)(o.domains),
+                    w: o.includeWww ?? true,
+                    m: o.onMismatch ?? 'block',
+                },
+            }
+            : {}),
+        ...(o.requireIntegrity ? { ri: 1 } : {}),
+    };
+    return {
+        key,
+        field: (0, gcm_1.encodePstack)(field),
+        parts: { share: (0, gcm_1.b64u)(shares[0]), time, ...(asset ? { asset } : {}) },
+        saltCreated: factors.created,
+    };
+}
+exports.buildKeyMaterial = buildKeyMaterial;
+//# sourceMappingURL=key-material.js.map

package/dist/src/lib/env-encryption/key-material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-material.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/key-material.ts"],"names":[],"mappings":";;;;AAAA,mCAAiD;AACjD,+CAAyB;AACzB,mDAA6B;AAG7B,uCAA2C;AAC3C,+BASe;AAEF,QAAA,SAAS,GAAG,uBAAuB,CAAC;AACpC,QAAA,WAAW,GAAG,gBAAgB,CAAC;AAC/B,QAAA,cAAc,GAAG,mBAAmB,CAAC;AAIlD,iEAAiE;AACjE,SAAgB,OAAO;IACrB,OAAO,GAAG,IAAA,UAAI,EAAC,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAFD,0BAEC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAC5B,QAAgB,EAChB,OAAoB,EACpB,MAAc,EACd,IAAU;IAEV,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAiB,EAAU,EAAE;QACvD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;YACnB,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,sBAAsB,IAAI,+BAA+B,CAC9F,CAAC;SACH;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE;QACvB,IAAI,CAAC,KAAK,MAAM;YAAE,SAAS;QAC3B,IAAI,CAAC,KAAK,QAAQ,EAAE;YAClB,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE;gBACnC,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;aAC1F;YACD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;SACxB;aAAM,IAAI,CAAC,KAAK,KAAK,EAAE;YACtB,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,mBAAW,EAAE,CAAC,CAAC,CAAC;SACnC;aAAM;YACL,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,sBAAc,EAAE,CAAC,CAAC,CAAC;SACzC;KACF;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,iBAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE;YACT,MAAM,IAAI,KAAK,CACb,oCAAoC,iBAAS,6CAA6C,CAC3F,CAAC;SACH;QACD,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;KACpB;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AA3CD,wCA2CC;AAED,uFAAuF;AACvF,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAEpD;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE;QAC1B,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI;QACF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,IAAI;YACF,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;SACb;QAAC,OAAO,CAAC,EAAE;YACV,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAE,CAA2B,CAAC,IAAI,IAAI,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;SACtF;QACD,IAAI;YACF,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;SACb;QAAC,OAAO,CAAC,EAAE;YACV,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;SAChB;KACF;YAAS;QACR,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;KAClC;AACH,CAAC;AAkCD,wEAAwE;AACxE,SAAgB,gBAAgB,CAAC,CAAqB;IACpD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACpC,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,CAAC,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAA,eAAS,EAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,KAAK,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAA,eAAS,EAAC,CAAC,EAAE,IAAA,gBAAU,EAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAA,aAAO,EAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClG,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,CAAC;QACjB,CAAC,CAAC;YACE,IAAI,EAAE,YAAY,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACxF,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;SACjB;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,sEAAsE;IACtE,MAAM,aAAa,GAAqB,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAU,EAAE;QAClD,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;KAC3E;IACD,MAAM,KAAK,GAAgB;QACzB,CAAC,EAAE,CAAC;QACJ,CAAC,EAAE,CAAC,CAAC,UAAU;QACf,CAAC,EAAE,CAAC,CAAC,GAAG;QACR,CAAC,EAAE,IAAA,UAAI,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,OAAO;QACV,CAAC,EAAE,aAAa;QAChB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YACnC,CAAC,CAAC;gBACE,CAAC,EAAE;oBACD,CAAC,EAAE,IAAA,wBAAc,EAAC,CAAC,CAAC,OAAO,CAAC;oBAC5B,CAAC,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;oBACvB,CAAC,EAAE,CAAC,CAAC,UAAU,IAAI,OAAO;iBAC3B;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;IACF,OAAO;QACL,GAAG;QACH,KAAK,EAAE,IAAA,kBAAY,EAAC,KAAK,CAAC;QAC1B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,UAAI,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpE,WAAW,EAAE,OAAO,CAAC,OAAO;KAC7B,CAAC;AACJ,CAAC;AA5CD,4CA4CC"}

package/dist/src/lib/env-encryption/placeholders.d.ts

@@ -0,0 +1,15 @@
+/// <reference types="node" />
+/** Names of the `${NAME}` placeholders in the file's quoted strings, in order, deduplicated. */
+export declare function placeholderNames(text: string): string[];
+export interface FillResult {
+    text: string;
+    filled: string[];
+    missing: string[];
+}
+/** Replaces `${NAME}` in quoted strings with `vars[NAME]`; template literals are not touched. */
+export declare function fillPlaceholders(text: string, vars: Record<string, string | undefined>): FillResult;
+/** `NAME=value` lines (`#` comments, optional `export `, optional matching quotes). */
+export declare function parseDotEnv(text: string): Record<string, string>;
+export declare const DOT_ENV_LOCAL = ".env.local";
+/** process.env first, then `.env.local` at the workspace root. */
+export declare function placeholderVars(repoRoot: string, env?: NodeJS.ProcessEnv): Record<string, string | undefined>;

package/dist/src/lib/env-encryption/placeholders.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.placeholderVars = exports.DOT_ENV_LOCAL = exports.parseDotEnv = exports.fillPlaceholders = exports.placeholderNames = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const env_file_1 = require("./env-file");
+/** `${NAME}` inside a quoted string (NAME: letters, digits, underscores; not starting with a digit). */
+const PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/** Names of the `${NAME}` placeholders in the file's quoted strings, in order, deduplicated. */
+function placeholderNames(text) {
+    const names = new Set();
+    for (const s of (0, env_file_1.quotedStrings)(text)) {
+        for (const m of s.content.matchAll(PLACEHOLDER))
+            names.add(m[1]);
+    }
+    return [...names];
+}
+exports.placeholderNames = placeholderNames;
+const PROXIES = new WeakSet();
+const isProxy = (o) => PROXIES.has(o);
+/** Escapes a value for a string literal with the given quote. */
+function escapeFor(value, quote) {
+    return value
+        .replace(/\\/g, '\\\\')
+        .replace(new RegExp(quote, 'g'), `\\${quote}`)
+        .replace(/\r/g, '\\r')
+        .replace(/\n/g, '\\n');
+}
+/** Replaces `${NAME}` in quoted strings with `vars[NAME]`; template literals are not touched. */
+function fillPlaceholders(text, vars) {
+    const filled = new Set();
+    const missing = new Set();
+    let out = '';
+    let last = 0;
+    for (const s of (0, env_file_1.quotedStrings)(text)) {
+        if (!s.content.includes('${'))
+            continue;
+        const content = s.content.replace(PLACEHOLDER, (whole, name) => {
+            const v = Object.prototype.hasOwnProperty.call(vars, name) || isProxy(vars) ? vars[name] : undefined;
+            if (typeof v !== 'string') {
+                missing.add(name);
+                return whole;
+            }
+            filled.add(name);
+            return escapeFor(v, s.quote);
+        });
+        out += text.slice(last, s.start + 1) + content;
+        last = s.end - 1;
+    }
+    out += text.slice(last);
+    return { text: out, filled: [...filled], missing: [...missing] };
+}
+exports.fillPlaceholders = fillPlaceholders;
+/** `NAME=value` lines (`#` comments, optional `export `, optional matching quotes). */
+function parseDotEnv(text) {
+    const out = {};
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const m = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+        if (!m)
+            continue;
+        let v = m[2].trim();
+        const q = v[0];
+        if ((q === '"' || q === "'") && v.length >= 2 && v.endsWith(q)) {
+            v = v.slice(1, -1);
+            if (q === '"')
+                v = v.replace(/\\n/g, '\n').replace(/\\"/g, '"').replace(/\\\\/g, '\\');
+        }
+        else {
+            v = v.replace(/\s+#.*$/, '');
+        }
+        out[m[1]] = v;
+    }
+    return out;
+}
+exports.parseDotEnv = parseDotEnv;
+exports.DOT_ENV_LOCAL = '.env.local';
+/** process.env first, then `.env.local` at the workspace root. */
+function placeholderVars(repoRoot, env = process.env) {
+    const file = path.join(repoRoot, exports.DOT_ENV_LOCAL);
+    const local = fs.existsSync(file) ? parseDotEnv(fs.readFileSync(file, 'utf8')) : {};
+    const own = (o, k) => Object.prototype.hasOwnProperty.call(o, k) ? o[k] : undefined;
+    const proxy = new Proxy({}, {
+        get: (_t, name) => own(env, name) ?? own(local, name),
+    });
+    PROXIES.add(proxy);
+    return proxy;
+}
+exports.placeholderVars = placeholderVars;
+//# sourceMappingURL=placeholders.js.map

package/dist/src/lib/env-encryption/placeholders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholders.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/placeholders.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,yCAA2C;AAE3C,wGAAwG;AACxG,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD,gGAAgG;AAChG,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAA,wBAAa,EAAC,IAAI,CAAC,EAAE;QACnC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAClE;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAND,4CAMC;AAED,MAAM,OAAO,GAAG,IAAI,OAAO,EAAU,CAAC;AACtC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE9C,iEAAiE;AACjE,SAAS,SAAS,CAAC,KAAa,EAAE,KAAa;IAC7C,OAAO,KAAK;SACT,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;SAC7C,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAQD,iGAAiG;AACjG,SAAgB,gBAAgB,CAC9B,IAAY,EACZ,IAAwC;IAExC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,IAAA,wBAAa,EAAC,IAAI,CAAC,EAAE;QACnC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACrE,MAAM,CAAC,GACL,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE;gBACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClB,OAAO,KAAK,CAAC;aACd;YACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;QAC/C,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;KAClB;IACD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;AACnE,CAAC;AAzBD,4CAyBC;AAED,uFAAuF;AACvF,SAAgB,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,qDAAqD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YAC9D,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,KAAK,GAAG;gBAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SACxF;aAAM;YACL,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;SAC9B;QACD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;KACf;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAlBD,kCAkBC;AAEY,QAAA,aAAa,GAAG,YAAY,CAAC;AAE1C,kEAAkE;AAClE,SAAgB,eAAe,CAC7B,QAAgB,EAChB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAa,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,GAAG,GAAG,CAAC,CAAqC,EAAE,CAAS,EAAE,EAAE,CAC/D,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAwC,EAAE;QAChE,GAAG,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC;KAC9D,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAbD,0CAaC"}

package/dist/src/lib/env-encryption/prepare.d.ts

@@ -0,0 +1,43 @@
+import { LockOptions } from './backup';
+import { EnvEncryptionConfig } from './config';
+import { KeySplit } from './gcm';
+import { KeyParts } from './key-material';
+import { Secret } from '../hardening/leak-check';
+export interface PrepareEnvOptions {
+    repoRoot: string;
+    envProject: string;
+    /** DEV, UAT, PROD or a custom env. */
+    env: string;
+    envFile: string;
+    commit: string;
+    branch: string;
+    /** For tests. */
+    now?: Date;
+    vars?: Record<string, string | undefined>;
+    log?: (msg: string) => void;
+    /** Lock wait settings (tests). */
+    lock?: Omit<LockOptions, 'onWait'>;
+    /** aes-gcm: where the random key's shares go (default meta-bundle). */
+    keySplit?: KeySplit;
+    /** aes-gcm: hosts this build may run on (none: no lock). */
+    domains?: string[];
+    includeWww?: boolean;
+    onMismatch?: 'block' | 'warn';
+    /** aes-gcm: the runtime refuses to decrypt when a script has no integrity attribute (SRI). */
+    requireIntegrity?: boolean;
+}
+export interface PreparedEnv {
+    config: EnvEncryptionConfig;
+    /** aes-gcm: meta share, time and optional asset for the executor. */
+    keyParts?: KeyParts;
+    /** Plaintexts encrypted in this build with their keys, for the leak check. Memory only. */
+    secrets: Secret[];
+    /** Restores the env file; a no-op when nothing was changed. */
+    restore: () => void;
+}
+/**
+ * Release-build preparation of an env file. DEV: checks there are no placeholders, changes
+ * nothing. Other envs: recovers a crashed build, backs the file up, fills `${VAR}` placeholders,
+ * stamps the build time and branch, encrypts; `restore()` puts the original back.
+ */
+export declare function prepareEnvFile(opts: PrepareEnvOptions): PreparedEnv;

package/dist/src/lib/env-encryption/prepare.js

@@ -0,0 +1,245 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prepareEnvFile = void 0;
+const tslib_1 = require("tslib");
+const fs = tslib_1.__importStar(require("fs"));
+const path = tslib_1.__importStar(require("path"));
+const backup_1 = require("./backup");
+const config_1 = require("./config");
+const encrypt_1 = require("./encrypt");
+const env_file_1 = require("./env-file");
+const domains_1 = require("./domains");
+const gcm_1 = require("./gcm");
+const key_material_1 = require("./key-material");
+const placeholders_1 = require("./placeholders");
+const sensitive_1 = require("./sensitive");
+const stamp_1 = require("./stamp");
+const rel = (root, file) => path.relative(root, file).split(path.sep).join('/');
+/**
+ * Release-build preparation of an env file. DEV: checks there are no placeholders, changes
+ * nothing. Other envs: recovers a crashed build, backs the file up, fills `${VAR}` placeholders,
+ * stamps the build time and branch, encrypts; `restore()` puts the original back.
+ */
+function prepareEnvFile(opts) {
+    const log = opts.log ?? ((m) => console.log(m));
+    // One instant for the stamp, the aes-gcm key (HKDF salt) and the meta tag.
+    const now = opts.now ?? new Date();
+    const { config, source } = (0, config_1.loadEnvEncryptionConfig)(opts.repoRoot);
+    if (source === 'legacy') {
+        log(`⚠ env encryption: reading ${config_1.LEGACY_KEYS_FILE}; run "pstack update" to move the settings ` +
+            'into nx.json (pstack.envEncryption).');
+    }
+    const file = opts.envFile;
+    const shown = rel(opts.repoRoot, file);
+    const noop = { config, secrets: [], restore: () => undefined };
+    const profilePaths = [
+        ...new Set(config.profileFiles.map((p) => path.join(path.dirname(file), ...p.split('/')))),
+    ].filter((p) => path.resolve(p) !== path.resolve(file));
+    let profiles = profilePaths.filter((p) => fs.existsSync(p));
+    if (opts.env === 'DEV') {
+        for (const f of [file, ...profiles]) {
+            if (!fs.existsSync(f))
+                continue;
+            const names = (0, placeholders_1.placeholderNames)(fs.readFileSync(f, 'utf8'));
+            if (names.length > 0) {
+                throw new Error(`env encryption: ${rel(opts.repoRoot, f)} has placeholders (${names
+                    .map((n) => `\${${n}}`)
+                    .join(', ')}). ` +
+                    'Dev env files must hold literal values because "nx serve" does not fill ' +
+                    'placeholders; keep them in the UAT/PROD files only.');
+            }
+        }
+        return noop;
+    }
+    // One release build at a time per file; others using the same files wait. Sorted, so two builds
+    // never take the same locks in a different order.
+    const files = [file, ...profilePaths].sort();
+    const releases = [];
+    let keyParts;
+    let secrets = [];
+    const releaseAll = () => releases
+        .splice(0)
+        .reverse()
+        .forEach((r) => r());
+    try {
+        for (const f of files) {
+            releases.push((0, backup_1.lockEnvFile)(opts.repoRoot, f, {
+                ...opts.lock,
+                onWait: () => log(`⏳ env encryption: waiting for another release build using ${rel(opts.repoRoot, f)}…`),
+            }));
+        }
+        for (const f of files) {
+            const recovered = (0, backup_1.recoverEnvFile)(opts.repoRoot, f);
+            const fs_ = rel(opts.repoRoot, f);
+            if (recovered.restored) {
+                log(`⚠ env encryption: restored ${fs_}, left encrypted by a build that did not finish.`);
+            }
+            else if (recovered.kept) {
+                log(`⚠ env encryption: ${fs_} changed after a build that did not finish; kept it as it is ` +
+                    "and dropped that build's backup.");
+            }
+        }
+        // After recovery: a file a killed build left behind exists again.
+        if (!fs.existsSync(file)) {
+            releaseAll();
+            return noop;
+        }
+        profiles = profilePaths.filter((p) => fs.existsSync(p));
+        // Everything that can fail on the input is checked before any file is touched.
+        const vars = opts.vars ?? (0, placeholders_1.placeholderVars)(opts.repoRoot);
+        const fill = (f) => {
+            const filled = (0, placeholders_1.fillPlaceholders)(fs.readFileSync(f, 'utf8'), vars);
+            if (filled.missing.length > 0) {
+                throw new Error(`env encryption: ${rel(opts.repoRoot, f)} needs ${filled.missing.join(', ')}; set ` +
+                    `${filled.missing.length > 1 ? 'them' : 'it'} in the environment or in ` +
+                    `${placeholders_1.DOT_ENV_LOCAL} at the workspace root.`);
+            }
+            return filled;
+        };
+        const filled = fill(file);
+        const profileFills = profiles.map((p) => ({ p, pf: fill(p) }));
+        let text = filled.text;
+        const stamped = [];
+        const values = {};
+        if (config.stamp) {
+            const s = { ...config_1.DEFAULT_STAMP, ...config.stamp };
+            if (s.timeField) {
+                values[s.timeField] = (0, stamp_1.formatStamp)(now, s.timezone, s.format, config.stamp.timezoneLabel);
+            }
+            if (s.branchField)
+                values[s.branchField] = opts.branch;
+            const r = (0, encrypt_1.setStringFields)(text, values);
+            text = r.text;
+            stamped.push(...r.set);
+        }
+        let secret = opts.commit;
+        let pstackField;
+        if (config.cipher === 'aes-gcm') {
+            // Checked before the key material, which may create the salt file.
+            const keySplit = opts.keySplit ?? 'meta-bundle';
+            if (!gcm_1.KEY_SPLITS.includes(keySplit)) {
+                throw new Error(`env encryption: keySplit "${keySplit}" is not one of ${gcm_1.KEY_SPLITS.join(', ')}.`);
+            }
+            if (opts.domains)
+                (0, domains_1.normalizeHosts)(opts.domains);
+            const material = (0, key_material_1.buildKeyMaterial)({
+                repoRoot: opts.repoRoot,
+                config,
+                envProject: opts.envProject,
+                env: opts.env,
+                commit: opts.commit,
+                now,
+                vars,
+                keySplit,
+                domains: opts.domains,
+                includeWww: opts.includeWww,
+                onMismatch: opts.onMismatch,
+                requireIntegrity: opts.requireIntegrity,
+            });
+            if (material.saltCreated)
+                log(`🔑 env encryption: created ${key_material_1.SALT_FILE}; commit it.`);
+            secret = material.key;
+            keyParts = material.parts;
+            pstackField = material.field;
+        }
+        const enc = (0, encrypt_1.encryptEnvText)(text, config, opts.envProject, secret, shown);
+        if (pstackField)
+            enc.text = (0, env_file_1.appendEnvironmentField)(enc.text, gcm_1.PSTACK_FIELD, pstackField);
+        if (enc.skipped.length > 0) {
+            log(`⚠ env encryption: ${shown}: ${enc.skipped.join(', ')} not encrypted (the value is not a ` +
+                'plain string).');
+        }
+        // Stamp values (branch name, build time) are not secrets: a profile value equal to one (e.g.
+        // `channel: 'develop'`) is not encrypted for it.
+        const stampValues = new Set(stamped.map((k) => values[k]));
+        const secretValues = new Set(enc.values.filter((v) => !stampValues.has(v)));
+        const envPairs = enc.pairs.filter((p) => !stampValues.has(p.value));
+        const profilePairs = [];
+        const writes = [
+            {
+                file,
+                text: enc.text,
+                summary: [
+                    filled.filled.length > 0 ? `filled ${filled.filled.join(', ')}` : '',
+                    stamped.length > 0 ? `stamped ${stamped.join(', ')}` : '',
+                    `encrypted ${enc.encrypted.length > 0 ? enc.encrypted.join(', ') : 'nothing'} (mode ${config.mode})`,
+                    config.cipher === 'aes-gcm' ? 'aes-gcm' : '',
+                ]
+                    .filter(Boolean)
+                    .join('; '),
+            },
+        ];
+        for (const { p, pf } of profileFills) {
+            const pe = (0, encrypt_1.encryptProfileText)(pf.text, config, secret, secretValues, rel(opts.repoRoot, p));
+            profilePairs.push(...pe.pairs);
+            if (pe.skipped.length > 0) {
+                log(`⚠ env encryption: ${rel(opts.repoRoot, p)}: ${pe.skipped.join(', ')} look sensitive but ` + 'are not plain strings, so they were not encrypted.');
+            }
+            writes.push({
+                file: p,
+                text: pe.text,
+                summary: [
+                    pf.filled.length > 0 ? `filled ${pf.filled.join(', ')}` : '',
+                    `encrypted ${pe.encrypted.length > 0 ? pe.encrypted.join(', ') : 'nothing'}`,
+                ]
+                    .filter(Boolean)
+                    .join('; '),
+            });
+        }
+        secrets = buildSecrets(envPairs, profilePairs);
+        const written = [];
+        try {
+            for (const w of writes) {
+                (0, backup_1.backupEnvFile)(opts.repoRoot, w.file);
+                written.push(w.file);
+                fs.writeFileSync(w.file, w.text, 'utf8');
+                (0, backup_1.markWritten)(opts.repoRoot, w.file, w.text);
+            }
+        }
+        catch (err) {
+            for (const f of written)
+                (0, backup_1.restoreEnvFile)(opts.repoRoot, f);
+            throw err;
+        }
+        for (const w of writes)
+            log(`🔒 ${rel(opts.repoRoot, w.file)}: ${w.summary}.`);
+    }
+    catch (err) {
+        releaseAll();
+        throw err;
+    }
+    return {
+        config,
+        keyParts,
+        secrets,
+        restore: () => {
+            const failed = [];
+            try {
+                for (const f of files) {
+                    try {
+                        (0, backup_1.restoreEnvFile)(opts.repoRoot, f);
+                    }
+                    catch (err) {
+                        failed.push(err.message);
+                    }
+                }
+            }
+            finally {
+                releaseAll();
+            }
+            if (failed.length > 0)
+                throw new Error(failed.join('\n'));
+        },
+    };
+}
+exports.prepareEnvFile = prepareEnvFile;
+/**
+ * Secrets for the leak check. C7: a profile value under a non-sensitive key was encrypted only
+ * because it equals an env value, so the app's own configuration declares that value public;
+ * every holder of it is marked.
+ */
+function buildSecrets(envPairs, profilePairs) {
+    const publicValues = new Set(profilePairs.filter((p) => !(0, sensitive_1.isSensitiveKey)(p.key)).map((p) => p.value));
+    return [...envPairs, ...profilePairs].map((p) => ({ ...p, public: publicValues.has(p.value) }));
+}
+//# sourceMappingURL=prepare.js.map

package/dist/src/lib/env-encryption/prepare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare.js","sourceRoot":"","sources":["../../../../src/lib/env-encryption/prepare.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,qCAOkB;AAClB,qCAKkB;AAClB,uCAMmB;AACnB,yCAAoD;AACpD,uCAA2C;AAC3C,+BAA2D;AAC3D,iDAAuE;AACvE,iDAAoG;AACpG,2CAA6C;AAC7C,mCAAsC;AAqCtC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhG;;;;GAIG;AACH,SAAgB,cAAc,CAAC,IAAuB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,2EAA2E;IAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,gCAAuB,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,QAAQ,EAAE;QACvB,GAAG,CACD,6BAA6B,yBAAgB,6CAA6C;YACxF,sCAAsC,CACzC,CAAC;KACH;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KAC3F,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5D,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,EAAE;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,EAAE;YACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,SAAS;YAChC,MAAM,KAAK,GAAG,IAAA,+BAAgB,EAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;gBACpB,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,sBAAsB,KAAK;qBAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;qBACtB,IAAI,CAAC,IAAI,CAAC,KAAK;oBAChB,0EAA0E;oBAC1E,qDAAqD,CACxD,CAAC;aACH;SACF;QACD,OAAO,IAAI,CAAC;KACb;IACD,gGAAgG;IAChG,kDAAkD;IAClD,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,QAA8B,CAAC;IACnC,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,GAAG,EAAE,CACtB,QAAQ;SACL,MAAM,CAAC,CAAC,CAAC;SACT,OAAO,EAAE;SACT,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;YACrB,QAAQ,CAAC,IAAI,CACX,IAAA,oBAAW,EAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE;gBAC5B,GAAG,IAAI,CAAC,IAAI;gBACZ,MAAM,EAAE,GAAG,EAAE,CACX,GAAG,CACD,6DAA6D,GAAG,CAC9D,IAAI,CAAC,QAAQ,EACb,CAAC,CACF,GAAG,CACL;aACJ,CAAC,CACH,CAAC;SACH;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;YACrB,MAAM,SAAS,GAAG,IAAA,uBAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAClC,IAAI,SAAS,CAAC,QAAQ,EAAE;gBACtB,GAAG,CAAC,8BAA8B,GAAG,kDAAkD,CAAC,CAAC;aAC1F;iBAAM,IAAI,SAAS,CAAC,IAAI,EAAE;gBACzB,GAAG,CACD,qBAAqB,GAAG,+DAA+D;oBACrF,kCAAkC,CACrC,CAAC;aACH;SACF;QACD,kEAAkE;QAClE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;YACxB,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;SACb;QACD,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAExD,+EAA+E;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAA,8BAAe,EAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,IAAA,+BAAgB,EAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YAClE,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;gBAC7B,MAAM,IAAI,KAAK,CACb,mBAAmB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;oBACjF,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,4BAA4B;oBACxE,GAAG,4BAAa,yBAAyB,CAC5C,CAAC;aACH;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,EAAE;YAChB,MAAM,CAAC,GAAG,EAAE,GAAG,sBAAa,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAChD,IAAI,CAAC,CAAC,SAAS,EAAE;gBACf,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,IAAA,mBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;aAC1F;YACD,IAAI,CAAC,CAAC,WAAW;gBAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;YACvD,MAAM,CAAC,GAAG,IAAA,yBAAe,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;SACxB;QACD,IAAI,MAAM,GAAc,IAAI,CAAC,MAAM,CAAC;QACpC,IAAI,WAA+B,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE;YAC/B,mEAAmE;YACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC;YAChD,IAAI,CAAC,gBAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBAClC,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,mBAAmB,gBAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;aACH;YACD,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAA,wBAAc,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,+BAAgB,EAAC;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG;gBACH,IAAI;gBACJ,QAAQ;gBACR,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;aACxC,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,WAAW;gBAAE,GAAG,CAAC,8BAA8B,wBAAS,cAAc,CAAC,CAAC;YACrF,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC;YACtB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;YAC1B,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC;SAC9B;QACD,MAAM,GAAG,GAAG,IAAA,wBAAc,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACzE,IAAI,WAAW;YAAE,GAAG,CAAC,IAAI,GAAG,IAAA,iCAAsB,EAAC,GAAG,CAAC,IAAI,EAAE,kBAAY,EAAE,WAAW,CAAC,CAAC;QACxF,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;YAC1B,GAAG,CACD,qBAAqB,KAAK,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;gBACxF,gBAAgB,CACnB,CAAC;SACH;QACD,6FAA6F;QAC7F,iDAAiD;QACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,MAAM,YAAY,GAAiB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAsD;YAChE;gBACE,IAAI;gBACJ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE;oBACP,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBACpE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBACzD,aAAa,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,UAC1E,MAAM,CAAC,IACT,GAAG;oBACH,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;iBAC7C;qBACE,MAAM,CAAC,OAAO,CAAC;qBACf,IAAI,CAAC,IAAI,CAAC;aACd;SACF,CAAC;QACF,KAAK,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,YAAY,EAAE;YACpC,MAAM,EAAE,GAAG,IAAA,4BAAkB,EAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5F,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;gBACzB,GAAG,CACD,qBAAqB,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,IAAI,CAC5D,IAAI,CACL,sBAAsB,GAAG,oDAAoD,CAC/E,CAAC;aACH;YACD,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,CAAC;gBACP,IAAI,EAAE,EAAE,CAAC,IAAI;gBACb,OAAO,EAAE;oBACP,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAC5D,aAAa,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE;iBAC7E;qBACE,MAAM,CAAC,OAAO,CAAC;qBACf,IAAI,CAAC,IAAI,CAAC;aACd,CAAC,CAAC;SACJ;QAED,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI;YACF,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE;gBACtB,IAAA,sBAAa,EAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACzC,IAAA,oBAAW,EAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;aAC5C;SACF;QAAC,OAAO,GAAG,EAAE;YACZ,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAA,uBAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,CAAC;SACX;QACD,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;KAChF;IAAC,OAAO,GAAG,EAAE;QACZ,UAAU,EAAE,CAAC;QACb,MAAM,GAAG,CAAC;KACX;IACD,OAAO;QACL,MAAM;QACN,QAAQ;QACR,OAAO;QACP,OAAO,EAAE,GAAG,EAAE;YACZ,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI;gBACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE;oBACrB,IAAI;wBACF,IAAA,uBAAc,EAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;qBAClC;oBAAC,OAAO,GAAG,EAAE;wBACZ,MAAM,CAAC,IAAI,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;qBACrC;iBACF;aACF;oBAAS;gBACR,UAAU,EAAE,CAAC;aACd;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC;AApOD,wCAoOC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAsB,EAAE,YAA0B;IACtE,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,0BAAc,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CACvE,CAAC;IACF,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/dist/src/lib/env-encryption/sensitive.d.ts

@@ -0,0 +1,2 @@
+export declare function wordsOf(name: string): string[];
+export declare function isSensitiveKey(name: string): boolean;