@mp-lb/arcnet 0.0.0-stage → 0.2.0

package/dist/secrets/provisionSource.d.ts

@@ -0,0 +1,25 @@
+export interface ProvisionOptions {
+    name: string;
+    store: string;
+    path: string;
+    keyEnv: string;
+    repository: string;
+    existingKey?: boolean;
+    input?: string;
+    noninteractive?: boolean;
+}
+export declare const provisionSource: (mode: "add" | "init", options: ProvisionOptions, root: string, configFile: string) => Promise<{
+    operation: string;
+    status: string;
+    message: string;
+} | {
+    operation: string;
+    githubSecret: string;
+    sources: {
+        name: string;
+        revision: number;
+    }[];
+    message: string;
+    status?: undefined;
+}>;
+//# sourceMappingURL=provisionSource.d.ts.map

package/dist/secrets/provisionSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisionSource.d.ts","sourceRoot":"","sources":["../../src/secrets/provisionSource.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,eAAe,GAC1B,MAAM,KAAK,GAAG,MAAM,EACpB,SAAS,gBAAgB,EACzB,MAAM,MAAM,EACZ,YAAY,MAAM;;;;;;;;;;;;;EAuMnB,CAAC"}

package/dist/secrets/provisionSource.js

@@ -0,0 +1,141 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { safeTargetPath } from "../safeTargetPath.js";
+import { readSecretsConfig, secretsConfigSchema, sourceSchema, } from "./config.js";
+import { promptPassword } from "./promptPassword.js";
+import { secretCommand } from "./secretCommand.js";
+import { readRemoteSource } from "./readRemoteSource.js";
+import { syncSecrets } from "./syncSecrets.js";
+import { writeSecretsWorkflow } from "./writeSecretsWorkflow.js";
+import { assertNewSource } from "./assertNewSource.js";
+export const provisionSource = async (mode, options, root, configFile) => {
+    if (configFile !== ".arcnet/secrets.json")
+        throw new Error("Provisioning uses .arcnet/secrets.json so generated CI has a fixed entry point.");
+    if (process.env.GITHUB_ACTIONS === "true")
+        throw new Error("Provision secrets from an authorized local terminal, not CI.");
+    const source = sourceSchema.parse({
+        name: options.name,
+        store: options.store,
+        path: options.path.startsWith("/") ? options.path : `/${options.path}`,
+        keyEnv: options.keyEnv,
+    });
+    const configPath = safeTargetPath(root, configFile);
+    const config = existsSync(configPath)
+        ? readSecretsConfig(root, configFile)
+        : {
+            version: 1,
+            repository: options.repository,
+            sources: [],
+            consumers: {},
+        };
+    if (config.repository !== options.repository)
+        throw new Error("Repository differs from secrets configuration.");
+    const prior = config.sources.find((entry) => entry.name === source.name);
+    if (prior) {
+        if (prior.store !== source.store ||
+            prior.path !== source.path ||
+            prior.keyEnv !== source.keyEnv)
+            throw new Error("Source name already has different settings.");
+        return {
+            operation: `secrets.${mode}`,
+            status: "unchanged",
+            message: "Source is already configured; use secrets sync to refresh snapshots.",
+        };
+    }
+    const next = secretsConfigSchema.parse({
+        ...config,
+        sources: [...config.sources, source],
+    });
+    const known = JSON.parse(secretCommand("gh", ["secret", "list", "--repo", config.repository, "--json", "name"], root));
+    if (options.existingKey &&
+        !known.some((entry) => entry.name === source.keyEnv))
+        throw new Error("The named GitHub repository secret does not exist.");
+    if (!options.existingKey &&
+        known.some((entry) => entry.name === source.keyEnv))
+        throw new Error("GitHub secret already exists; use --existing-key to reuse it without overwriting.");
+    if (mode === "init" && options.existingKey)
+        throw new Error("A new encrypted file needs a new recipient; omit --existing-key.");
+    const original = mode === "add" ? readRemoteSource(source, root) : undefined;
+    if (mode === "init")
+        assertNewSource(source, root);
+    const temporary = mkdtempSync(join(tmpdir(), "arcnet-secrets-"));
+    try {
+        if (!options.existingKey) {
+            const password = await promptPassword(options.noninteractive);
+            const env = { ...process.env, DOCTRINE_ENCRYPTION_PASSWORD: password };
+            const ciphertext = join(temporary, "source.json.enc");
+            if (mode === "init") {
+                const plaintext = options.input
+                    ? readFileSync(options.input, "utf8")
+                    : "{}";
+                try {
+                    const data = JSON.parse(plaintext);
+                    if (!data || Array.isArray(data) || typeof data !== "object")
+                        throw new Error();
+                }
+                catch {
+                    throw new Error("Initial secrets must be a JSON object (values omitted).");
+                }
+                const input = join(temporary, "input.json");
+                writeFileSync(input, plaintext, { mode: 0o600 });
+                writeFileSync(ciphertext, secretCommand("fm", ["encrypt", "--file", input], root, undefined, env), { mode: 0o600 });
+            }
+            else
+                writeFileSync(ciphertext, original.text, { mode: 0o600 });
+            const recipientText = secretCommand("fm", [
+                "encrypt-add-recipient",
+                "--file",
+                ciphertext,
+                "--name",
+                `arcnet-${config.repository.replace("/", "-")}-${source.name}-${randomUUID()}`,
+                "--json",
+            ], root, undefined, env);
+            let recipient;
+            try {
+                recipient = JSON.parse(recipientText);
+            }
+            catch {
+                throw new Error("Forum returned an invalid recipient response (value omitted).");
+            }
+            if (typeof recipient.secret !== "string" ||
+                !recipient.secret.startsWith("doctrine-recipient-v1_"))
+                throw new Error("Forum did not return a valid recipient key.");
+            if (original) {
+                const current = readRemoteSource(source, root);
+                if (current.fileId !== original.fileId ||
+                    current.revision !== original.revision)
+                    throw new Error("Forum source changed during setup; retry before writing.");
+            }
+            if (mode === "init")
+                assertNewSource(source, root);
+            secretCommand("fm", [
+                "file",
+                "write",
+                source.path,
+                "--store",
+                source.store,
+                "--file",
+                ciphertext,
+            ], root, undefined, env);
+            try {
+                secretCommand("gh", ["secret", "set", source.keyEnv, "--repo", config.repository], root, recipient.secret);
+            }
+            catch {
+                throw new Error("Forum recipient was saved, but GitHub secret upload failed. Rerun setup to issue another recipient; remove the unused recipient in Forum later.");
+            }
+        }
+        const result = syncSecrets(next, root, configFile);
+        writeSecretsWorkflow(readSecretsConfig(root, configFile), root, configFile);
+        return {
+            ...result,
+            operation: `secrets.${mode}`,
+            githubSecret: source.keyEnv,
+        };
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+};
+//# sourceMappingURL=provisionSource.js.map

package/dist/secrets/provisionSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisionSource.js","sourceRoot":"","sources":["../../src/secrets/provisionSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAavD,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAoB,EACpB,OAAyB,EACzB,IAAY,EACZ,UAAkB,EAClB,EAAE;IACF,IAAI,UAAU,KAAK,sBAAsB;QACvC,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;QACvC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;IAEJ,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE;QACtE,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC;QACrC,CAAC,CAAC;YACE,OAAO,EAAE,CAAU;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,EAAE;SACd,CAAC;IAEN,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QAC1C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IAEzE,IAAI,KAAK,EAAE,CAAC;QACV,IACE,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;YAC5B,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAC1B,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAE9B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,OAAO;YACL,SAAS,EAAE,WAAW,IAAI,EAAE;YAC5B,MAAM,EAAE,WAAW;YACnB,OAAO,EACL,sEAAsE;SACzE,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC;QACrC,GAAG,MAAM;QACT,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;KACrC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,aAAa,CACX,IAAI,EACJ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EACjE,IAAI,CACL,CACoB,CAAC;IAExB,IACE,OAAO,CAAC,WAAW;QACnB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;QAEpD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,IACE,CAAC,OAAO,CAAC,WAAW;QACpB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;QAEnD,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,WAAW;QACxC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,MAAM,QAAQ,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,IAAI,IAAI,KAAK,MAAM;QAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC;YACvE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK;oBAC7B,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC;gBAET,IAAI,CAAC;oBACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC5C,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAC1D,MAAM,IAAI,KAAK,EAAE,CAAC;gBACtB,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;gBAC5C,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjD,aAAa,CACX,UAAU,EACV,aAAa,CACX,IAAI,EACJ,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,EAC5B,IAAI,EACJ,SAAS,EACT,GAAG,CACJ,EACD,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;YACJ,CAAC;;gBAAM,aAAa,CAAC,UAAU,EAAE,QAAS,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAElE,MAAM,aAAa,GAAG,aAAa,CACjC,IAAI,EACJ;gBACE,uBAAuB;gBACvB,QAAQ;gBACR,UAAU;gBACV,QAAQ;gBACR,UAAU,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,UAAU,EAAE,EAAE;gBAC9E,QAAQ;aACT,EACD,IAAI,EACJ,SAAS,EACT,GAAG,CACJ,CAAC;YAEF,IAAI,SAA6B,CAAC;YAElC,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAuB,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;YACJ,CAAC;YAED,IACE,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ;gBACpC,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,wBAAwB,CAAC;gBAEtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAEjE,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC/C,IACE,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAClC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;oBAEtC,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAC;YACN,CAAC;YAED,IAAI,IAAI,KAAK,MAAM;gBAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnD,aAAa,CACX,IAAI,EACJ;gBACE,MAAM;gBACN,OAAO;gBACP,MAAM,CAAC,IAAI;gBACX,SAAS;gBACT,MAAM,CAAC,KAAK;gBACZ,QAAQ;gBACR,UAAU;aACX,EACD,IAAI,EACJ,SAAS,EACT,GAAG,CACJ,CAAC;YAEF,IAAI,CAAC;gBACH,aAAa,CACX,IAAI,EACJ,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAC7D,IAAI,EACJ,SAAS,CAAC,MAAM,CACjB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,iJAAiJ,CAClJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACnD,oBAAoB,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC5E,OAAO;YACL,GAAG,MAAM;YACT,SAAS,EAAE,WAAW,IAAI,EAAE;YAC5B,YAAY,EAAE,MAAM,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC"}

package/dist/secrets/readRemoteSource.d.ts

@@ -0,0 +1,7 @@
+import type { SecretSource } from "./config.js";
+export declare const readRemoteSource: (source: SecretSource, root: string, environment?: NodeJS.ProcessEnv) => {
+    text: string;
+    fileId: string;
+    revision: number;
+};
+//# sourceMappingURL=readRemoteSource.d.ts.map

package/dist/secrets/readRemoteSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readRemoteSource.d.ts","sourceRoot":"","sources":["../../src/secrets/readRemoteSource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAUhD,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,YAAY,EACpB,MAAM,MAAM,EACZ,+BAAyB;;;;CA0D1B,CAAC"}

package/dist/secrets/readRemoteSource.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+import { secretCommand } from "./secretCommand.js";
+const infoSchema = z.object({
+    id: z.string(),
+    revisionNumber: z.number().int(),
+    path: z.string(),
+    type: z.literal("text"),
+});
+export const readRemoteSource = (source, root, environment = process.env) => {
+    const env = { ...environment };
+    if (source.tokenEnv) {
+        if (!env[source.tokenEnv])
+            throw new Error(`Missing Forum access credential: ${source.tokenEnv}.`);
+        env.DOCTRINE_TOKEN = env[source.tokenEnv];
+    }
+    const args = [source.path, "--store", source.store];
+    try {
+        const before = infoSchema.parse(JSON.parse(secretCommand("fm", ["file", "info", ...args, "--json"], root, undefined, env)));
+        const text = secretCommand("fm", ["file", "read", ...args], root, undefined, env);
+        const after = infoSchema.parse(JSON.parse(secretCommand("fm", ["file", "info", ...args, "--json"], root, undefined, env)));
+        if (before.id !== after.id ||
+            before.revisionNumber !== after.revisionNumber ||
+            after.path !== source.path ||
+            (source.snapshot && after.id !== source.snapshot.fileId))
+            throw new Error("Source changed");
+        return { text, fileId: after.id, revision: after.revisionNumber };
+    }
+    catch {
+        throw new Error(`Cannot read stable Forum source ${source.name}; check access, identity and concurrent edits.`);
+    }
+};
+//# sourceMappingURL=readRemoteSource.js.map

package/dist/secrets/readRemoteSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readRemoteSource.js","sourceRoot":"","sources":["../../src/secrets/readRemoteSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAoB,EACpB,IAAY,EACZ,WAAW,GAAG,OAAO,CAAC,GAAG,EACzB,EAAE;IACF,MAAM,GAAG,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;IAE/B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC1E,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAC7B,IAAI,CAAC,KAAK,CACR,aAAa,CACX,IAAI,EACJ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,QAAQ,CAAC,EACnC,IAAI,EACJ,SAAS,EACT,GAAG,CACJ,CACF,CACF,CAAC;QAEF,MAAM,IAAI,GAAG,aAAa,CACxB,IAAI,EACJ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,EACzB,IAAI,EACJ,SAAS,EACT,GAAG,CACJ,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAC5B,IAAI,CAAC,KAAK,CACR,aAAa,CACX,IAAI,EACJ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,QAAQ,CAAC,EACnC,IAAI,EACJ,SAAS,EACT,GAAG,CACJ,CACF,CACF,CAAC;QAEF,IACE,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;YACtB,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC9C,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAC1B,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAExD,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,IAAI,gDAAgD,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/secrets/runWithSecrets.d.ts

@@ -0,0 +1,6 @@
+export declare const runWithSecrets: (command: string[], values: Record<string, string>, root: string, environment?: NodeJS.ProcessEnv) => {
+    operation: string;
+    status: string;
+    keys: string[];
+};
+//# sourceMappingURL=runWithSecrets.d.ts.map

package/dist/secrets/runWithSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runWithSecrets.d.ts","sourceRoot":"","sources":["../../src/secrets/runWithSecrets.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,cAAc,GACzB,SAAS,MAAM,EAAE,EACjB,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,MAAM,MAAM,EACZ,+BAAyB;;;;CA6D1B,CAAC"}

package/dist/secrets/runWithSecrets.js

@@ -0,0 +1,59 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export const runWithSecrets = (command, values, root, environment = process.env) => {
+    if (!command.length)
+        throw new Error("Supply a command after --.");
+    const inherited = [
+        "PATH",
+        "SystemRoot",
+        "LANG",
+        "CI",
+        "GITHUB_ACTIONS",
+        "GITHUB_REPOSITORY",
+        "GITHUB_REF",
+        "GITHUB_SHA",
+        "NPM_CONFIG_USERCONFIG",
+        "npm_config_userconfig",
+    ];
+    const temporary = mkdtempSync(join(tmpdir(), "arcnet-env-"));
+    try {
+        const env = {
+            ...Object.fromEntries(inherited
+                .filter((key) => environment[key] !== undefined)
+                .map((key) => [key, environment[key]])),
+            ...values,
+            HOME: temporary,
+            TMPDIR: temporary,
+            TMP: temporary,
+            TEMP: temporary,
+            XDG_CACHE_HOME: join(temporary, "cache"),
+            NPM_CONFIG_CACHE: join(temporary, "npm-cache"),
+            NPM_CONFIG_LOGS_MAX: "0",
+            NO_UPDATE_NOTIFIER: "1",
+        };
+        const result = spawnSync(command[0], command.slice(1), {
+            cwd: root,
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+            maxBuffer: 16 * 1024 * 1024,
+        });
+        if (result.error || result.status !== 0)
+            throw new Error("Credential-consuming command failed; output withheld to protect secrets.");
+        return {
+            operation: "env.run",
+            status: "passed",
+            keys: Object.keys(values),
+        };
+    }
+    finally {
+        rmSync(temporary, {
+            recursive: true,
+            force: true,
+            maxRetries: 5,
+            retryDelay: 200,
+        });
+    }
+};
+//# sourceMappingURL=runWithSecrets.js.map

package/dist/secrets/runWithSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runWithSecrets.js","sourceRoot":"","sources":["../../src/secrets/runWithSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAiB,EACjB,MAA8B,EAC9B,IAAY,EACZ,WAAW,GAAG,OAAO,CAAC,GAAG,EACzB,EAAE;IACF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAEnE,MAAM,SAAS,GAAG;QAChB,MAAM;QACN,YAAY;QACZ,MAAM;QACN,IAAI;QACJ,gBAAgB;QAChB,mBAAmB;QACnB,YAAY;QACZ,YAAY;QACZ,uBAAuB;QACvB,uBAAuB;KACxB,CAAC;IAEF,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG;YACV,GAAG,MAAM,CAAC,WAAW,CACnB,SAAS;iBACN,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;iBAC/C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CACzC;YACD,GAAG,MAAM;YACT,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,SAAS;YACf,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;YACxC,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;YAC9C,mBAAmB,EAAE,GAAG;YACxB,kBAAkB,EAAE,GAAG;SACxB,CAAC;QAEF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACtD,GAAG,EAAE,IAAI;YACT,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;SAC5B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;QACJ,OAAO;YACL,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC1B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC"}

package/dist/secrets/secretCommand.d.ts

@@ -0,0 +1,2 @@
+export declare const secretCommand: (command: string, args: string[], root: string, input?: string, env?: NodeJS.ProcessEnv) => string;
+//# sourceMappingURL=secretCommand.d.ts.map

package/dist/secrets/secretCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretCommand.d.ts","sourceRoot":"","sources":["../../src/secrets/secretCommand.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,MAAM,MAAM,EAAE,EACd,MAAM,MAAM,EACZ,QAAQ,MAAM,EACd,uBAAiB,KAChB,MAgBF,CAAC"}

package/dist/secrets/secretCommand.js

@@ -0,0 +1,17 @@
+import { spawnSync } from "node:child_process";
+// Never include subprocess output in errors: it may contain plaintext or keys.
+export const secretCommand = (command, args, root, input, env = process.env) => {
+    const result = spawnSync(command, args, {
+        cwd: root,
+        env,
+        input,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+        maxBuffer: 16 * 1024 * 1024,
+        timeout: 120000,
+    });
+    if (result.error || result.status !== 0)
+        throw new Error(`${command} ${args[0] ?? ""} failed; output withheld to protect credentials. Check authentication and permissions.`);
+    return result.stdout;
+};
+//# sourceMappingURL=secretCommand.js.map

package/dist/secrets/secretCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretCommand.js","sourceRoot":"","sources":["../../src/secrets/secretCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAAe,EACf,IAAc,EACd,IAAY,EACZ,KAAc,EACd,GAAG,GAAG,OAAO,CAAC,GAAG,EACT,EAAE;IACV,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACtC,GAAG,EAAE,IAAI;QACT,GAAG;QACH,KAAK;QACL,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;QAC3B,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,wFAAwF,CACpH,CAAC;IACJ,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC,CAAC"}

package/dist/secrets/selectSecrets.d.ts

@@ -0,0 +1,3 @@
+import type { SecretsConfig } from "./config.js";
+export declare const selectSecrets: (values: Record<string, unknown>, config: SecretsConfig, consumer: string) => Record<string, string>;
+//# sourceMappingURL=selectSecrets.d.ts.map

package/dist/secrets/selectSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectSecrets.d.ts","sourceRoot":"","sources":["../../src/secrets/selectSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,eAAO,MAAM,aAAa,GACxB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,aAAa,EACrB,UAAU,MAAM,KACf,MAAM,CAAC,MAAM,EAAE,MAAM,CA0BvB,CAAC"}

package/dist/secrets/selectSecrets.js

@@ -0,0 +1,18 @@
+export const selectSecrets = (values, config, consumer) => {
+    const mapping = config.consumers[consumer];
+    if (!mapping)
+        throw new Error(`Unknown secrets consumer: ${consumer}.`);
+    return Object.fromEntries(Object.entries(mapping).map(([output, input]) => {
+        const aliases = Array.isArray(input) ? input : [input];
+        const found = aliases
+            .filter((name) => Object.hasOwn(values, name))
+            .map((name) => values[name]);
+        if (!found.length ||
+            found.some((value) => typeof value !== "string" || !value.trim() || value.includes("\0")))
+            throw new Error(`Missing or invalid required secret for ${output} (values omitted).`);
+        if (new Set(found).size !== 1)
+            throw new Error(`Conflicting aliases for ${output} (values omitted).`);
+        return [output, found[0]];
+    }));
+};
+//# sourceMappingURL=selectSecrets.js.map

package/dist/secrets/selectSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectSecrets.js","sourceRoot":"","sources":["../../src/secrets/selectSecrets.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAA+B,EAC/B,MAAqB,EACrB,QAAgB,EACQ,EAAE;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,GAAG,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvD,MAAM,KAAK,GAAG,OAAO;aAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;aAC7C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAE/B,IACE,CAAC,KAAK,CAAC,MAAM;YACb,KAAK,CAAC,IAAI,CACR,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrE;YAED,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,oBAAoB,CACrE,CAAC;QACJ,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,oBAAoB,CAAC,CAAC;QACzE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/secrets/syncSecrets.d.ts

@@ -0,0 +1,10 @@
+import type { SecretsConfig } from "./config.js";
+export declare const syncSecrets: (config: SecretsConfig, root: string, file: string) => {
+    operation: string;
+    sources: {
+        name: string;
+        revision: number;
+    }[];
+    message: string;
+};
+//# sourceMappingURL=syncSecrets.d.ts.map

package/dist/secrets/syncSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncSecrets.d.ts","sourceRoot":"","sources":["../../src/secrets/syncSecrets.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,eAAO,MAAM,WAAW,GACtB,QAAQ,aAAa,EACrB,MAAM,MAAM,EACZ,MAAM,MAAM;;;;;;;CAgDb,CAAC"}

package/dist/secrets/syncSecrets.js

@@ -0,0 +1,43 @@
+import { parseForumEncryptedFilePayload } from "@mp-lb/forum-secrets";
+import { createHash } from "node:crypto";
+import { mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { safeTargetPath } from "../safeTargetPath.js";
+import { readRemoteSource } from "./readRemoteSource.js";
+export const syncSecrets = (config, root, file) => {
+    const sources = config.sources.map((source) => {
+        const remote = readRemoteSource(source, root);
+        try {
+            parseForumEncryptedFilePayload(remote.text);
+        }
+        catch {
+            throw new Error(`Source ${source.name} is not a supported encrypted file.`);
+        }
+        const sha256 = createHash("sha256").update(remote.text).digest("hex");
+        // Content-addressed snapshots keep the previous config valid if interrupted.
+        const snapshot = {
+            file: `.arcnet/secrets/${source.name}-${sha256.slice(0, 16)}.json.enc`,
+            fileId: remote.fileId,
+            revision: remote.revision,
+            sha256,
+        };
+        const target = safeTargetPath(root, snapshot.file);
+        mkdirSync(dirname(target), { recursive: true });
+        writeFileSync(target, remote.text, { mode: 0o600 });
+        return { ...source, snapshot };
+    });
+    const target = safeTargetPath(root, file);
+    mkdirSync(dirname(target), { recursive: true });
+    const temporary = safeTargetPath(root, `${file}.tmp`);
+    writeFileSync(temporary, JSON.stringify({ ...config, sources }, null, 2) + "\n", { mode: 0o600 });
+    renameSync(temporary, target);
+    return {
+        operation: "secrets.sync",
+        sources: sources.map((s) => ({
+            name: s.name,
+            revision: s.snapshot.revision,
+        })),
+        message: "Review and commit the encrypted snapshots and configuration together.",
+    };
+};
+//# sourceMappingURL=syncSecrets.js.map

package/dist/secrets/syncSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncSecrets.js","sourceRoot":"","sources":["../../src/secrets/syncSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,MAAqB,EACrB,IAAY,EACZ,IAAY,EACZ,EAAE;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE9C,IAAI,CAAC;YACH,8BAA8B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,IAAI,qCAAqC,CAC3D,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEtE,6EAA6E;QAC7E,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,mBAAmB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW;YACtE,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM;SACP,CAAC;QAEF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACnD,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;IACtD,aAAa,CACX,SAAS,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACtD,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9B,OAAO;QACL,SAAS,EAAE,cAAc;QACzB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ;SAC9B,CAAC,CAAC;QACH,OAAO,EACL,uEAAuE;KAC1E,CAAC;AACJ,CAAC,CAAC"}

package/dist/secrets/wireSecretsWorkflows.d.ts

@@ -0,0 +1,2 @@
+export declare const wireSecretsWorkflows: (folder: string, env: Record<string, string>) => void;
+//# sourceMappingURL=wireSecretsWorkflows.d.ts.map

package/dist/secrets/wireSecretsWorkflows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireSecretsWorkflows.d.ts","sourceRoot":"","sources":["../../src/secrets/wireSecretsWorkflows.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,MAAM,EACd,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAkD5B,CAAC"}

package/dist/secrets/wireSecretsWorkflows.js

@@ -0,0 +1,48 @@
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { isMap, isSeq, parseDocument } from "yaml";
+export const wireSecretsWorkflows = (folder, env) => {
+    for (const file of readdirSync(folder).filter((name) => /\.ya?ml$/.test(name))) {
+        const path = join(folder, file);
+        const document = parseDocument(readFileSync(path, "utf8"));
+        if (document.errors.length)
+            throw new Error(`Cannot update malformed workflow: ${file}.`);
+        const jobs = document.get("jobs");
+        if (!isMap(jobs))
+            continue;
+        let changed = false;
+        for (const pair of jobs.items) {
+            if (!isMap(pair.value))
+                continue;
+            const steps = pair.value.get("steps");
+            if (!isSeq(steps))
+                continue;
+            for (const step of steps.items) {
+                if (!isMap(step))
+                    continue;
+                const run = step.get("run");
+                if (typeof run !== "string" ||
+                    !/\barcnet\s+(?:env\s+(?:check|run|export)|deploy|preview|inspect|plan)\b/.test(run))
+                    continue;
+                if (step.has("env") && !isMap(step.get("env")))
+                    throw new Error(`Workflow step env must be a mapping: ${file}.`);
+                if (!step.has("env"))
+                    step.set("env", document.createNode({}));
+                const mapping = step.get("env");
+                if (!isMap(mapping))
+                    continue;
+                for (const [name, value] of Object.entries(env)) {
+                    if (mapping.has(name) && mapping.get(name) !== value)
+                        throw new Error(`Workflow has a conflicting source-key mapping: ${file} / ${name}.`);
+                    if (!mapping.has(name)) {
+                        mapping.set(name, value);
+                        changed = true;
+                    }
+                }
+            }
+        }
+        if (changed)
+            writeFileSync(path, document.toString());
+    }
+};
+//# sourceMappingURL=wireSecretsWorkflows.js.map

package/dist/secrets/wireSecretsWorkflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wireSecretsWorkflows.js","sourceRoot":"","sources":["../../src/secrets/wireSecretsWorkflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAEnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,GAA2B,EAC3B,EAAE;IACF,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CACtB,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM;YACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,SAAS;YAE5B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC5B,IACE,OAAO,GAAG,KAAK,QAAQ;oBACvB,CAAC,yEAAyE,CAAC,IAAI,CAC7E,GAAG,CACJ;oBAED,SAAS;gBACX,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAC5C,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,GAAG,CAAC,CAAC;gBACnE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,SAAS;gBAE9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK;wBAClD,MAAM,IAAI,KAAK,CACb,kDAAkD,IAAI,MAAM,IAAI,GAAG,CACpE,CAAC;oBAEJ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBACzB,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,OAAO;YAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC,CAAC"}

package/dist/secrets/withDeploymentSecrets.d.ts

@@ -0,0 +1,2 @@
+export declare const withDeploymentSecrets: <T>(root: string, mode: string | undefined, action: () => T | Promise<T>) => Promise<T>;
+//# sourceMappingURL=withDeploymentSecrets.d.ts.map

package/dist/secrets/withDeploymentSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"withDeploymentSecrets.d.ts","sourceRoot":"","sources":["../../src/secrets/withDeploymentSecrets.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,qBAAqB,GAAU,CAAC,EAC3C,MAAM,MAAM,EACZ,MAAM,MAAM,GAAG,SAAS,EACxB,QAAQ,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,KAC3B,OAAO,CAAC,CAAC,CAiEX,CAAC"}

package/dist/secrets/withDeploymentSecrets.js

@@ -0,0 +1,58 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { readSecretsConfig } from "./config.js";
+import { loadSecrets } from "./loadSecrets.js";
+import { selectSecrets } from "./selectSecrets.js";
+export const withDeploymentSecrets = async (root, mode, action) => {
+    if (!existsSync(join(root, ".arcnet/secrets.json")))
+        return action();
+    const config = readSecretsConfig(root);
+    if (process.env.GITHUB_ACTIONS === "true" &&
+        (process.env.GITHUB_REPOSITORY !== config.repository ||
+            process.env.GITHUB_REF !== "refs/heads/main"))
+        throw new Error("Secrets commands in CI require the configured repository main branch.");
+    const pool = await loadSecrets(config, root);
+    const selected = selectSecrets(pool, config, "deploy");
+    if (mode !== "vercel") {
+        const manifest = parse(readFileSync(join(root, "zap.yaml"), "utf8"));
+        const keys = Object.values(manifest.deploy?.services ?? {})
+            .flatMap((service) => service.env ?? [])
+            .filter((key) => !key.includes("="));
+        const app = Object.fromEntries(keys
+            .filter((key) => Object.hasOwn(pool, key))
+            .map((key) => {
+            if (typeof pool[key] !== "string")
+                throw new Error(`Invalid application value for ${key} (value omitted).`);
+            return [key, pool[key]];
+        }));
+        selected.ARCNET_ENV_JSON = JSON.stringify(app);
+    }
+    const removed = config.sources
+        .flatMap((source) => [
+        source.keyEnv,
+        ...(source.tokenEnv ? [source.tokenEnv] : []),
+    ])
+        .concat([
+        "DOCTRINE_ENCRYPTION_PASSWORD",
+        "DOCTRINE_TOKEN",
+        "DOCTRINE_RECIPIENT_SECRET",
+    ]);
+    const names = new Set([...removed, ...Object.keys(selected)]);
+    const previous = Object.fromEntries([...names].map((key) => [key, process.env[key]]));
+    try {
+        for (const key of removed)
+            delete process.env[key];
+        Object.assign(process.env, selected);
+        return await action();
+    }
+    finally {
+        for (const key of names) {
+            if (previous[key] === undefined)
+                delete process.env[key];
+            else
+                process.env[key] = previous[key];
+        }
+    }
+};
+//# sourceMappingURL=withDeploymentSecrets.js.map

package/dist/secrets/withDeploymentSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"withDeploymentSecrets.js","sourceRoot":"","sources":["../../src/secrets/withDeploymentSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACxC,IAAY,EACZ,IAAwB,EACxB,MAA4B,EAChB,EAAE;IACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QAAE,OAAO,MAAM,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IACE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;QACrC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,UAAU;YAClD,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,iBAAiB,CAAC;QAE/C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAElE,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC;aACxD,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;aACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,IAAI;aACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;aACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ;gBAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,GAAG,mBAAmB,CACxD,CAAC;YACJ,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,CACL,CAAC;QAEF,QAAQ,CAAC,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO;SAC3B,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM;QACb,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;SACD,MAAM,CAAC;QACN,8BAA8B;QAC9B,gBAAgB;QAChB,2BAA2B;KAC5B,CAAC,CAAC;IAEL,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAE9D,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CACjD,CAAC;IAEF,IAAI,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,MAAM,MAAM,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;YACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;gBACpD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;AACH,CAAC,CAAC"}

package/dist/secrets/writeSecretsWorkflow.d.ts

@@ -0,0 +1,3 @@
+import type { SecretsConfig } from "./config.js";
+export declare const writeSecretsWorkflow: (config: SecretsConfig, root: string, configFile: string) => void;
+//# sourceMappingURL=writeSecretsWorkflow.d.ts.map

package/dist/secrets/writeSecretsWorkflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeSecretsWorkflow.d.ts","sourceRoot":"","sources":["../../src/secrets/writeSecretsWorkflow.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,aAAa,EACrB,MAAM,MAAM,EACZ,YAAY,MAAM,SAwEnB,CAAC"}