@mp-lb/arcnet 0.0.0-stage → 0.2.0

package/dist/safePath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safePath.js","sourceRoot":"","sources":["../src/safePath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE;IACrD,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,IAAI;QACL,UAAU,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEnB,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAChC,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE/B,IACE,CAAC,GAAG;QACJ,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QACrB,GAAG;aACA,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/D,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAElC,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,GAAG,IAAI,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,IAAI,CAAC;QAET,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,IAAI,EAAE,cAAc,EAAE;YAAE,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/safeTargetPath.d.ts

@@ -0,0 +1,2 @@
+export declare const safeTargetPath: (root: string, name: string) => string;
+//# sourceMappingURL=safeTargetPath.d.ts.map

package/dist/safeTargetPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeTargetPath.d.ts","sourceRoot":"","sources":["../src/safeTargetPath.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,WA2BxD,CAAC"}

package/dist/safeTargetPath.js

@@ -0,0 +1,29 @@
+import { lstatSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { fail } from "./fail.js";
+export const safeTargetPath = (root, name) => {
+    const target = resolve(root, name);
+    if (!name ||
+        isAbsolute(name) ||
+        relative(root, target) === ".." ||
+        relative(root, target).startsWith("../"))
+        fail(`Path must stay within the project: ${name}`);
+    let at = root;
+    for (const part of relative(root, target).split("/")) {
+        at = join(at, part);
+        let stat;
+        try {
+            stat = lstatSync(at);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        if (stat?.isSymbolicLink())
+            fail(`Refusing symlink: ${name}`);
+        if (stat && at !== target && !stat.isDirectory())
+            fail(`Parent path is not a directory: ${name}`);
+    }
+    return target;
+};
+//# sourceMappingURL=safeTargetPath.js.map

package/dist/safeTargetPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeTargetPath.js","sourceRoot":"","sources":["../src/safeTargetPath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE;IAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IACE,CAAC,IAAI;QACL,UAAU,CAAC,IAAI,CAAC;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC;QAExC,IAAI,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,EAAE,GAAG,IAAI,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,IAAI,CAAC;QAET,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,EAAE,cAAc,EAAE;YAAE,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAC9C,IAAI,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/schemas.d.ts

@@ -0,0 +1,106 @@
+import { z } from "zod";
+declare const accountSchema: z.ZodObject<{
+    type: z.ZodEnum<{
+        team: "team";
+        personal: "personal";
+    }>;
+    id: z.ZodString;
+}, z.core.$strict>;
+declare const siteSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        existing: "existing";
+        new: "new";
+    }>;
+    projectId: z.ZodOptional<z.ZodString>;
+    projectName: z.ZodString;
+    creationApproved: z.ZodOptional<z.ZodBoolean>;
+    build: z.ZodArray<z.ZodString>;
+    output: z.ZodString;
+    outputConfig: z.ZodObject<{
+        version: z.ZodLiteral<3>;
+        routes: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+        overrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const vercelInputSchema: z.ZodObject<{
+    repository: z.ZodString;
+    account: z.ZodObject<{
+        type: z.ZodEnum<{
+            team: "team";
+            personal: "personal";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        mode: z.ZodEnum<{
+            existing: "existing";
+            new: "new";
+        }>;
+        projectId: z.ZodOptional<z.ZodString>;
+        projectName: z.ZodString;
+        creationApproved: z.ZodOptional<z.ZodBoolean>;
+        build: z.ZodArray<z.ZodString>;
+        output: z.ZodString;
+        outputConfig: z.ZodObject<{
+            version: z.ZodLiteral<3>;
+            routes: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+            overrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const vercelConfigSchema: z.ZodObject<{
+    repository: z.ZodString;
+    account: z.ZodObject<{
+        type: z.ZodEnum<{
+            team: "team";
+            personal: "personal";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        mode: z.ZodEnum<{
+            existing: "existing";
+            new: "new";
+        }>;
+        projectId: z.ZodOptional<z.ZodString>;
+        projectName: z.ZodString;
+        creationApproved: z.ZodOptional<z.ZodBoolean>;
+        build: z.ZodArray<z.ZodString>;
+        output: z.ZodString;
+        outputConfig: z.ZodObject<{
+            version: z.ZodLiteral<3>;
+            routes: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+            overrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    version: z.ZodLiteral<1>;
+    mode: z.ZodLiteral<"vercel">;
+    slug: z.ZodString;
+    approved: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const vercelResponseSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    accountId: z.ZodOptional<z.ZodString>;
+    user: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type VercelConfig = z.infer<typeof vercelConfigSchema>;
+export type VercelSite = z.infer<typeof siteSchema>;
+export type VercelAccount = z.infer<typeof accountSchema>;
+export type VercelResponse = z.infer<typeof vercelResponseSchema>;
+export type VercelRequest = (method: string, path: string, account: VercelAccount, body?: unknown) => Promise<VercelResponse | null>;
+export type RunProcess = (command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv) => void | Promise<void>;
+export declare const terraformConfigSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    slug: z.ZodString;
+    repository: z.ZodString;
+    approved: z.ZodBoolean;
+    services: z.ZodArray<z.ZodString>;
+    workloadIdentityProvider: z.ZodString;
+    serviceAccount: z.ZodString;
+}, z.core.$strip>;
+export declare const envPoolSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+export {};
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,QAAA,MAAM,aAAa;;;;;;kBAYhB,CAAC;AAEJ,QAAA,MAAM,UAAU;;;;;;;;;;;;;;;kBAyCb,CAAC;AAYJ,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;kBAQnB,CAAC;AACZ,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAOpB,CAAC;AACZ,eAAO,MAAM,oBAAoB;;;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACpD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,aAAa,GAAG,CAC1B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa,EACtB,IAAI,CAAC,EAAE,OAAO,KACX,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;AACpC,MAAM,MAAM,UAAU,GAAG,CACvB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAC1B,eAAO,MAAM,qBAAqB;;;;;;;;iBAQhC,CAAC;AACH,eAAO,MAAM,aAAa,uCAGzB,CAAC"}

package/dist/schemas.js

@@ -0,0 +1,85 @@
+import { z } from "zod";
+const projectName = z
+    .string()
+    .regex(/^[a-z0-9][a-z0-9-]{0,99}$/)
+    .refine((v) => !/REPLACE/i.test(v));
+const accountSchema = z
+    .object({
+    type: z.enum(["team", "personal"]),
+    id: z
+        .string()
+        .regex(/^[A-Za-z0-9_]{3,128}$/)
+        .refine((v) => !/REPLACE/i.test(v)),
+})
+    .strict()
+    .refine((a) => a.type !== "team" || a.id.startsWith("team_"), "Supply the exact Vercel account ID and type.");
+const siteSchema = z
+    .object({
+    mode: z.enum(["existing", "new"]),
+    projectId: z
+        .string()
+        .regex(/^prj_[A-Za-z0-9]+$/)
+        .refine((v) => !/REPLACE/i.test(v))
+        .optional(),
+    projectName,
+    creationApproved: z.boolean().optional(),
+    build: z
+        .array(z
+        .string()
+        .min(1)
+        .refine((v) => !/myshop|[\n\r\0]/i.test(v), "MyShop must remain local-only."))
+        .min(1)
+        .refine((v) => v[0] === "pnpm", "Build must be an explicit pnpm argument array."),
+    output: z.string(),
+    outputConfig: z
+        .object({
+        version: z.literal(3),
+        routes: z.array(z.unknown()).optional(),
+        overrides: z.record(z.string(), z.unknown()).optional(),
+    })
+        .strict(),
+})
+    .strict()
+    .refine((s) => s.mode === "existing"
+    ? Boolean(s.projectId) && s.creationApproved === undefined
+    : s.projectId === undefined && typeof s.creationApproved === "boolean", "Existing sites require projectId; new sites require creationApproved.");
+const sitesSchema = z
+    .record(z
+    .string()
+    .regex(/^[a-z][a-z0-9-]*$/)
+    .refine((v) => !/myshop/i.test(v), "MyShop is local-only."), siteSchema)
+    .refine((v) => Object.keys(v).length > 0, "Select at least one static site.");
+export const vercelInputSchema = z
+    .object({
+    repository: z
+        .string()
+        .regex(/^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/),
+    account: accountSchema,
+    sites: sitesSchema,
+})
+    .strict();
+export const vercelConfigSchema = vercelInputSchema
+    .extend({
+    version: z.literal(1),
+    mode: z.literal("vercel"),
+    slug: z.string().regex(/^[a-z][a-z0-9-]{0,22}$/),
+    approved: z.boolean(),
+})
+    .strict();
+export const vercelResponseSchema = z.object({
+    id: z.string().optional(),
+    name: z.string().optional(),
+    accountId: z.string().optional(),
+    user: z.object({ id: z.string() }).optional(),
+});
+export const terraformConfigSchema = z.object({
+    version: z.literal(1),
+    slug: z.string(),
+    repository: z.string(),
+    approved: z.boolean(),
+    services: z.array(z.string()),
+    workloadIdentityProvider: z.string(),
+    serviceAccount: z.string(),
+});
+export const envPoolSchema = z.record(z.string().regex(/^[A-Z_][A-Z0-9_]*$/), z.string());
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,KAAK,CAAC,2BAA2B,CAAC;KAClC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,KAAK,CAAC,uBAAuB,CAAC;SAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;CACtC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EACpD,8CAA8C,CAC/C,CAAC;AAEJ,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjC,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,KAAK,CAAC,oBAAoB,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAClC,QAAQ,EAAE;IACb,WAAW;IACX,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAClC,gCAAgC,CACjC,CACJ;SACA,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,EACtB,gDAAgD,CACjD;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACrB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QACvC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxD,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,UAAU;IACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS;IAC1D,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,SAAS,EAC1E,uEAAuE,CACxE,CAAC;AAEJ,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CACL,CAAC;KACE,MAAM,EAAE;KACR,KAAK,CAAC,mBAAmB,CAAC;KAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAAC,EAC7D,UAAU,CACX;KACA,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,kCAAkC,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,KAAK,CAAC,wDAAwD,CAAC;IAClE,OAAO,EAAE,aAAa;IACtB,KAAK,EAAE,WAAW;CACnB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,iBAAiB;KAChD,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAChD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAiBH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CACnC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,EACtC,CAAC,CAAC,MAAM,EAAE,CACX,CAAC"}

package/dist/secrets/assertNewSource.d.ts

@@ -0,0 +1,3 @@
+import type { SecretSource } from "./config.js";
+export declare const assertNewSource: (source: SecretSource, root: string) => void;
+//# sourceMappingURL=assertNewSource.d.ts.map

package/dist/secrets/assertNewSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertNewSource.d.ts","sourceRoot":"","sources":["../../src/secrets/assertNewSource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,eAAO,MAAM,eAAe,GAAI,QAAQ,YAAY,EAAE,MAAM,MAAM,SAkCjE,CAAC"}

package/dist/secrets/assertNewSource.js

@@ -0,0 +1,32 @@
+import { posix } from "node:path";
+import { secretCommand } from "./secretCommand.js";
+// fm's write API can overwrite without --force, so its default is not create-only.
+export const assertNewSource = (source, root) => {
+    const listing = secretCommand("fm", [
+        "file",
+        "ls",
+        posix.dirname(source.path),
+        "--store",
+        source.store,
+        "--json",
+    ], root);
+    let names;
+    try {
+        names = listing
+            .trim()
+            .split("\n")
+            .filter(Boolean)
+            .map((line) => {
+            const entry = JSON.parse(line);
+            if (typeof entry.message !== "string")
+                throw new Error();
+            return entry.message;
+        });
+    }
+    catch {
+        throw new Error("Cannot verify that the new Forum path is unused.");
+    }
+    if (names.includes(posix.basename(source.path)))
+        throw new Error("Forum file already exists; use secrets add to attach it without replacing its contents.");
+};
+//# sourceMappingURL=assertNewSource.js.map

package/dist/secrets/assertNewSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertNewSource.js","sourceRoot":"","sources":["../../src/secrets/assertNewSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAE,EAAE;IACpE,MAAM,OAAO,GAAG,aAAa,CAC3B,IAAI,EACJ;QACE,MAAM;QACN,IAAI;QACJ,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,SAAS;QACT,MAAM,CAAC,KAAK;QACZ,QAAQ;KACT,EACD,IAAI,CACL,CAAC;IAEF,IAAI,KAAe,CAAC;IAEpB,IAAI,CAAC;QACH,KAAK,GAAG,OAAO;aACZ,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;YACxD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;AACN,CAAC,CAAC"}

package/dist/secrets/config.d.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+export declare const envName: z.ZodString;
+export declare const sourceSchema: z.ZodObject<{
+    name: z.ZodString;
+    store: z.ZodString;
+    path: z.ZodString;
+    keyEnv: z.ZodString;
+    tokenEnv: z.ZodOptional<z.ZodString>;
+    snapshot: z.ZodOptional<z.ZodObject<{
+        file: z.ZodString;
+        fileId: z.ZodString;
+        revision: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const secretsConfigSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    repository: z.ZodString;
+    sources: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        store: z.ZodString;
+        path: z.ZodString;
+        keyEnv: z.ZodString;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        snapshot: z.ZodOptional<z.ZodObject<{
+            file: z.ZodString;
+            fileId: z.ZodString;
+            revision: z.ZodNumber;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    consumers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>>;
+}, z.core.$strict>;
+export type SecretsConfig = z.infer<typeof secretsConfigSchema>;
+export type SecretSource = z.infer<typeof sourceSchema>;
+export declare const readSecretsConfig: (root: string, file?: string) => SecretsConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/secrets/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,OAAO,aAAyC,CAAC;AAC9D,eAAO,MAAM,YAAY;;;;;;;;;;;;kBA4Bd,CAAC;AACZ,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;kBAuC5B,CAAC;AACL,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,aAA6B,KAC5B,aAUF,CAAC"}

package/dist/secrets/config.js

@@ -0,0 +1,67 @@
+import { readFileSync } from "node:fs";
+import { z } from "zod";
+import { safeTargetPath } from "../safeTargetPath.js";
+export const envName = z.string().regex(/^[A-Z_][A-Z0-9_]*$/);
+export const sourceSchema = z
+    .object({
+    name: z.string().regex(/^[a-z][a-z0-9-]*$/),
+    store: z.string().regex(/^[\w-]+\/[\w-]+$/),
+    path: z
+        .string()
+        .startsWith("/")
+        .endsWith(".enc")
+        .refine((path) => !/[\r\n\0]/.test(path) &&
+        path
+            .split("/")
+            .slice(1)
+            .every((part) => part && part !== "." && part !== "..")),
+    keyEnv: envName,
+    tokenEnv: envName.optional(),
+    snapshot: z
+        .object({
+        file: z.string(),
+        fileId: z.string().min(1),
+        revision: z.number().int().nonnegative(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+export const secretsConfigSchema = z
+    .object({
+    version: z.literal(1),
+    repository: z.string().regex(/^[\w.-]+\/[\w.-]+$/),
+    sources: z.array(sourceSchema).min(1),
+    consumers: z
+        .record(z.string(), z.record(z.string().min(1), z.union([envName, z.array(envName).min(1)])))
+        .default({}),
+})
+    .strict()
+    .superRefine((config, ctx) => {
+    if (new Set(config.sources.map((s) => s.name)).size !== config.sources.length)
+        ctx.addIssue({ code: "custom", message: "Source names must be unique." });
+    if (new Set(config.sources.map((s) => s.keyEnv)).size !==
+        config.sources.length)
+        ctx.addIssue({
+            code: "custom",
+            message: "Each source needs its own key environment name.",
+        });
+    for (const mapping of Object.values(config.consumers))
+        for (const name of Object.keys(mapping))
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+                name !== "pnpm_config_//registry.npmjs.org/:_authToken")
+                ctx.addIssue({
+                    code: "custom",
+                    message: "Invalid output environment name.",
+                });
+});
+export const readSecretsConfig = (root, file = ".arcnet/secrets.json") => {
+    try {
+        return secretsConfigSchema.parse(JSON.parse(readFileSync(safeTargetPath(root, file), "utf8")));
+    }
+    catch {
+        throw new Error("Missing or invalid secrets configuration (values omitted).");
+    }
+};
+//# sourceMappingURL=config.js.map

package/dist/secrets/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,CAAC;SACf,QAAQ,CAAC,MAAM,CAAC;SAChB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI;aACD,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAC5D;IACH,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;KAC3C,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,SAAS,EAAE,CAAC;SACT,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CACN,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAC5C,CACF;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IACE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM;QAEzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC5E,IACE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACjD,MAAM,CAAC,OAAO,CAAC,MAAM;QAErB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAC;IACL,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACrC,IACE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;gBACtC,IAAI,KAAK,8CAA8C;gBAEvD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,kCAAkC;iBAC5C,CAAC,CAAC;AACX,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,IAAY,EACZ,IAAI,GAAG,sBAAsB,EACd,EAAE;IACjB,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,KAAK,CAC9B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/secrets/createSecretsCommands.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const createSecretsCommands: (cli: Command, output: (value: unknown) => void) => void;
+//# sourceMappingURL=createSecretsCommands.d.ts.map

package/dist/secrets/createSecretsCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSecretsCommands.d.ts","sourceRoot":"","sources":["../../src/secrets/createSecretsCommands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,eAAO,MAAM,qBAAqB,GAChC,KAAK,OAAO,EACZ,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,SAgLjC,CAAC"}

package/dist/secrets/createSecretsCommands.js

@@ -0,0 +1,93 @@
+import { realpathSync } from "node:fs";
+import { readSecretsConfig } from "./config.js";
+import { loadSecrets } from "./loadSecrets.js";
+import { provisionSource } from "./provisionSource.js";
+import { runWithSecrets } from "./runWithSecrets.js";
+import { selectSecrets } from "./selectSecrets.js";
+import { syncSecrets } from "./syncSecrets.js";
+import { writeSecretsWorkflow } from "./writeSecretsWorkflow.js";
+export const createSecretsCommands = (cli, output) => {
+    const env = cli
+        .command("env")
+        .description("Load ordered encrypted Forum sources and select environment values.");
+    for (const action of ["check", "export", "run"]) {
+        const command = env
+            .command(action)
+            .description({
+            check: "Validate decryption and mappings; report key names only.",
+            export: "Write selected plaintext JSON to stdout for an explicit pipeline.",
+            run: "Run a command with selected keys only; withhold child output.",
+        }[action])
+            .option("--config <file>", "Secrets source configuration", ".arcnet/secrets.json")
+            .option("--consumer <name>", "Named mapping in the secrets configuration")
+            .option("--live", "Fetch current ciphertext through the installed fm CLI instead of snapshots");
+        if (action === "run")
+            command.argument("<command...>", "Executable and arguments after --");
+        command.action(async (...args) => {
+            const options = command.opts();
+            const root = realpathSync(cli.opts().root);
+            const config = readSecretsConfig(root, options.config);
+            if (process.env.GITHUB_ACTIONS === "true" &&
+                (process.env.GITHUB_REPOSITORY !== config.repository ||
+                    process.env.GITHUB_REF !== "refs/heads/main"))
+                throw new Error("Secrets commands in CI require the configured repository main branch.");
+            if (action !== "check" && !options.consumer)
+                throw new Error("Choose --consumer to explicitly select output keys.");
+            const values = await loadSecrets(config, root, process.env, options.live);
+            const names = options.consumer
+                ? [options.consumer]
+                : Object.keys(config.consumers);
+            const selected = Object.fromEntries(names.map((name) => [name, selectSecrets(values, config, name)]));
+            if (action === "export")
+                process.stdout.write(JSON.stringify(selected[options.consumer]) + "\n");
+            else if (action === "run")
+                output(runWithSecrets(args[0], selected[options.consumer], root));
+            else
+                output({
+                    operation: "env.check",
+                    status: "passed",
+                    sources: config.sources.map((source) => source.name),
+                    consumers: Object.fromEntries(Object.entries(selected).map(([name, value]) => [
+                        name,
+                        Object.keys(value),
+                    ])),
+                    message: "Decryption, merge and required-key checks passed; provider authorization was not tested.",
+                });
+        });
+    }
+    const secrets = cli
+        .command("secrets")
+        .description("Attach Forum files, provision GitHub keys and refresh encrypted snapshots.");
+    for (const mode of ["add", "init"]) {
+        const command = secrets
+            .command(mode)
+            .description(mode === "add"
+            ? "Attach an existing Forum file and provision its CI key."
+            : "Create a Forum secrets file, prompt for your password and provision its CI key.")
+            .requiredOption("--name <name>", "Unique source name; sources merge in installation order")
+            .requiredOption("--store <workspace/store>", "Forum store")
+            .requiredOption("--path <path>", "Encrypted file path in Forum")
+            .requiredOption("--key-env <name>", "GitHub repository secret / environment variable for this file's key")
+            .requiredOption("--repository <owner/repo>", "GitHub repository receiving the key")
+            .option("--config <file>", "Secrets source configuration", ".arcnet/secrets.json");
+        if (mode === "add")
+            command.option("--existing-key", "Reuse an existing GitHub secret without creating a recipient");
+        else
+            command.option("--input <file>", "Initial plaintext JSON file; defaults to an empty object");
+        command.action(async () => output(await provisionSource(mode, {
+            ...command.opts(),
+            noninteractive: cli.opts().noninteractive,
+        }, realpathSync(cli.opts().root), command.opts().config)));
+    }
+    secrets
+        .command("sync")
+        .description("Refresh encrypted snapshots from Forum and regenerate validation CI; no decryption.")
+        .option("--config <file>", "Secrets source configuration", ".arcnet/secrets.json")
+        .action((options) => {
+        const root = realpathSync(cli.opts().root);
+        const result = syncSecrets(readSecretsConfig(root, options.config), root, options.config);
+        writeSecretsWorkflow(readSecretsConfig(root, options.config), root, options.config);
+        output(result);
+    });
+};
+//# sourceMappingURL=createSecretsCommands.js.map

package/dist/secrets/createSecretsCommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSecretsCommands.js","sourceRoot":"","sources":["../../src/secrets/createSecretsCommands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAyB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,GAAY,EACZ,MAAgC,EAChC,EAAE;IACF,MAAM,GAAG,GAAG,GAAG;SACZ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,qEAAqE,CACtE,CAAC;IAEJ,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAU,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,GAAG;aAChB,OAAO,CAAC,MAAM,CAAC;aACf,WAAW,CACV;YACE,KAAK,EAAE,0DAA0D;YACjE,MAAM,EACJ,mEAAmE;YACrE,GAAG,EAAE,+DAA+D;SACrE,CAAC,MAAM,CAAC,CACV;aACA,MAAM,CACL,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,CACvB;aACA,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;aACzE,MAAM,CACL,QAAQ,EACR,4EAA4E,CAC7E,CAAC;QAEJ,IAAI,MAAM,KAAK,KAAK;YAClB,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAIxB,CAAC;YAEL,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvD,IACE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;gBACrC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,UAAU;oBAClD,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,iBAAiB,CAAC;gBAE/C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;YACJ,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACzC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAE1E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ;gBAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CACjE,CAAC;YAEF,IAAI,MAAM,KAAK,QAAQ;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC,GAAG,IAAI,CACnD,CAAC;iBACC,IAAI,MAAM,KAAK,KAAK;gBACvB,MAAM,CACJ,cAAc,CACZ,IAAI,CAAC,CAAC,CAAa,EACnB,QAAQ,CAAC,OAAO,CAAC,QAAS,CAAE,EAC5B,IAAI,CACL,CACF,CAAC;;gBAEF,MAAM,CAAC;oBACL,SAAS,EAAE,WAAW;oBACtB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;oBACpD,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;wBAC9C,IAAI;wBACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;qBACnB,CAAC,CACH;oBACD,OAAO,EACL,0FAA0F;iBAC7F,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,4EAA4E,CAC7E,CAAC;IAEJ,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,CAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO;aACpB,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CACV,IAAI,KAAK,KAAK;YACZ,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,iFAAiF,CACtF;aACA,cAAc,CACb,eAAe,EACf,yDAAyD,CAC1D;aACA,cAAc,CAAC,2BAA2B,EAAE,aAAa,CAAC;aAC1D,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC;aAC/D,cAAc,CACb,kBAAkB,EAClB,qEAAqE,CACtE;aACA,cAAc,CACb,2BAA2B,EAC3B,qCAAqC,CACtC;aACA,MAAM,CACL,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,CACvB,CAAC;QAEJ,IAAI,IAAI,KAAK,KAAK;YAChB,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,8DAA8D,CAC/D,CAAC;;YAEF,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,0DAA0D,CAC3D,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CACxB,MAAM,CACJ,MAAM,eAAe,CACnB,IAAI,EACJ;YACE,GAAG,OAAO,CAAC,IAAI,EAAoB;YACnC,cAAc,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc;SAC1C,EACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAC7B,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,CACtB,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,qFAAqF,CACtF;SACA,MAAM,CACL,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,CACvB;SACA,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,WAAW,CACxB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EACvC,IAAI,EACJ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,oBAAoB,CAClB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EACvC,IAAI,EACJ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC"}

package/dist/secrets/loadSecrets.d.ts

@@ -0,0 +1,3 @@
+import type { SecretsConfig } from "./config.js";
+export declare const loadSecrets: (config: SecretsConfig, root: string, environment?: NodeJS.ProcessEnv, live?: boolean) => Promise<Record<string, unknown>>;
+//# sourceMappingURL=loadSecrets.d.ts.map

package/dist/secrets/loadSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadSecrets.d.ts","sourceRoot":"","sources":["../../src/secrets/loadSecrets.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,eAAO,MAAM,WAAW,GACtB,QAAQ,aAAa,EACrB,MAAM,MAAM,EACZ,+BAAyB,EACzB,cAAY,qCAyCb,CAAC"}

package/dist/secrets/loadSecrets.js

@@ -0,0 +1,35 @@
+import { decryptForumEncryptedFileText } from "@mp-lb/forum-secrets";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { safeTargetPath } from "../safeTargetPath.js";
+import { readRemoteSource } from "./readRemoteSource.js";
+export const loadSecrets = async (config, root, environment = process.env, live = false) => {
+    let values = {};
+    for (const source of config.sources) {
+        const key = environment[source.keyEnv];
+        if (!key)
+            throw new Error(`Missing decryption credential: ${source.keyEnv}.`);
+        try {
+            const text = !live && source.snapshot
+                ? readFileSync(safeTargetPath(root, source.snapshot.file), "utf8")
+                : readRemoteSource(source, root, environment).text;
+            if (!live &&
+                source.snapshot &&
+                createHash("sha256").update(text).digest("hex") !==
+                    source.snapshot.sha256)
+                throw new Error("Snapshot integrity mismatch");
+            const decoded = JSON.parse(await decryptForumEncryptedFileText({
+                encryptedText: text,
+                recipientSecret: key,
+            }));
+            if (!decoded || Array.isArray(decoded) || typeof decoded !== "object")
+                throw new Error("Not an object");
+            values = { ...values, ...decoded };
+        }
+        catch {
+            throw new Error(`Source ${source.name} failed to load or decrypt; check its key and snapshot integrity (values omitted).`);
+        }
+    }
+    return values;
+};
+//# sourceMappingURL=loadSecrets.js.map

package/dist/secrets/loadSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadSecrets.js","sourceRoot":"","sources":["../../src/secrets/loadSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAqB,EACrB,IAAY,EACZ,WAAW,GAAG,OAAO,CAAC,GAAG,EACzB,IAAI,GAAG,KAAK,EACZ,EAAE;IACF,IAAI,MAAM,GAA4B,EAAE,CAAC;IAEzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,IAAI,GACR,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ;gBACtB,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAClE,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC;YAEvD,IACE,CAAC,IAAI;gBACL,MAAM,CAAC,QAAQ;gBACf,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7C,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAExB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAEjD,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CACjC,MAAM,6BAA6B,CAAC;gBAClC,aAAa,EAAE,IAAI;gBACnB,eAAe,EAAE,GAAG;aACrB,CAAC,CACH,CAAC;YAEF,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ;gBACnE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,IAAI,oFAAoF,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/secrets/promptPassword.d.ts

@@ -0,0 +1,2 @@
+export declare const promptPassword: (noninteractive?: boolean) => Promise<string>;
+//# sourceMappingURL=promptPassword.d.ts.map

package/dist/secrets/promptPassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promptPassword.d.ts","sourceRoot":"","sources":["../../src/secrets/promptPassword.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,GACzB,wBAAsB,KACrB,OAAO,CAAC,MAAM,CA2ChB,CAAC"}

package/dist/secrets/promptPassword.js

@@ -0,0 +1,42 @@
+export const promptPassword = async (noninteractive = false) => {
+    if (process.env.DOCTRINE_ENCRYPTION_PASSWORD)
+        return process.env.DOCTRINE_ENCRYPTION_PASSWORD;
+    if (noninteractive || !process.stdin.isTTY || !process.stderr.isTTY)
+        throw new Error("Run this command in your terminal to enter the Forum encryption password, or set DOCTRINE_ENCRYPTION_PASSWORD.");
+    return new Promise((resolve, reject) => {
+        let value = "";
+        const input = process.stdin;
+        const wasRaw = input.isRaw;
+        const finish = (cancel = false) => {
+            input.off("data", read);
+            input.setRawMode(wasRaw);
+            input.pause();
+            process.stderr.write("\n");
+            if (cancel || !value)
+                reject(new Error("Password entry cancelled."));
+            else
+                resolve(value);
+        };
+        const read = (chunk) => {
+            for (const character of chunk.toString("utf8")) {
+                if (character === "\u0003") {
+                    finish(true);
+                    return;
+                }
+                if (character === "\r" || character === "\n") {
+                    finish();
+                    return;
+                }
+                if (character === "\u007f")
+                    value = [...value].slice(0, -1).join("");
+                else
+                    value += character;
+            }
+        };
+        process.stderr.write("Forum encryption password: ");
+        input.setRawMode(true);
+        input.on("data", read);
+        input.resume();
+    });
+};
+//# sourceMappingURL=promptPassword.js.map

package/dist/secrets/promptPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promptPassword.js","sourceRoot":"","sources":["../../src/secrets/promptPassword.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,cAAc,GAAG,KAAK,EACL,EAAE;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B;QAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAClD,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QACjE,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,EAAE;YAChC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,MAAM,IAAI,CAAC,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;;gBAChE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;YAC7B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC7C,MAAM,EAAE,CAAC;oBACT,OAAO;gBACT,CAAC;gBAED,IAAI,SAAS,KAAK,QAAQ;oBAAE,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;oBAChE,KAAK,IAAI,SAAS,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACpD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}