@mp-lb/arcnet 0.1.0 → 0.2.1

package/README.md

@@ -2,13 +2,11 @@
 
 ArcNet's TypeScript CLI for installing deployment configuration and deploying projects. The package owns shared runners, validation, workflow templates and the Vercel Terraform module; projects keep configuration and application-specific Dockerfiles.
 
-**Release status:** implementation and checks are complete; the first npm publication is blocked by registry authentication. The commands below target the pending `0.1.0` release.
-
 From an existing project with Zap, GitHub, and pinned pnpm:
 
 ```sh
-pnpm dlx @mp-lb/arcnet@0.1.0 setup hello-world --dry-run
-pnpm dlx @mp-lb/arcnet@0.1.0 setup hello-world
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world --dry-run
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world
 pnpm install
 pnpm exec arcnet check
 ```
@@ -18,3 +16,38 @@ Setup pins this package in the existing root manifest. Commit the resulting lock
 [Project setup](https://github.com/mp-lb/stackforge/blob/main/arcnet/SETUP.md) · [Environment setup](https://github.com/mp-lb/stackforge/blob/main/arcnet/environment/setup.md) · [Audit](https://github.com/mp-lb/stackforge/blob/main/arcnet/AUDIT.md) · [Command reference](docs/public/commands.md)
 
 Zap Arc remains the pinned Terraform engine dependency. Environment bootstrap, health checks and teardown are not implemented by this package yet. The static Vercel adapter retains its existing static-only and explicit-project-reference limitations.
+
+## Layered secrets
+
+`arcnet secrets add` attaches an existing Forum encrypted JSON file. `arcnet secrets init` creates one. Both register a file-specific decryption key in the selected GitHub repository, save an encrypted snapshot, and generate a validation workflow. Setup prompts for your Forum encryption password locally; it never prints the password or recipient key. Use `--existing-key` when the GitHub secret already exists. The local `fm` and `gh` CLIs must be authenticated; the selected Forum parent directory must exist.
+
+Use `/projects/<project-slug>/secrets.json.enc` for project files in the company Forum store.
+
+The project keeps only `.arcnet/secrets.json`, encrypted snapshots under `.arcnet/secrets/`, and workflow references. Sources merge left to right, with later values winning. Each source names its own key environment variable. JSON must be an object; unused structured values are allowed, while selected environment values must be nonempty strings. Consumer mappings select and rename fields; an array of source names accepts aliases only when their values agree.
+
+```json
+{
+  "version": 1,
+  "repository": "example/hello-world",
+  "sources": [
+    { "name": "standard", "store": "example/company", "path": "/admin/standard.json.enc", "keyEnv": "STANDARD_SECRETS_KEY" },
+    { "name": "project", "store": "example/company", "path": "/projects/hello-world/secrets.json.enc", "keyEnv": "PROJECT_SECRETS_KEY" }
+  ],
+  "consumers": {
+    "publish": { "NODE_AUTH_TOKEN": ["NPM_TOKEN", "NODE_AUTH_TOKEN"] },
+    "deploy": { "VERCEL_TOKEN": "VERCEL_API_TOKEN" }
+  }
+}
+```
+
+`secrets sync` fetches ciphertext and adds snapshot identity, revision and checksum to this configuration. Commit config and ciphertext together. CI uses the reviewed snapshots and needs only each file's decryption key, not a Forum login. Sync after editing or rotating a source; obsolete snapshots can be removed after checking that no configuration references them. Setup/sync also wire source-key references into workflow steps that call ArcNet's env or deployment commands.
+
+For live loading, omit a snapshot or select `--live`: the installed `fm` CLI fetches each source using its local login or the source's optional `tokenEnv` access credential. A decryption recipient is **not** a Forum read token. Live CI therefore needs an installed, authenticated `fm` as well as the independent decryption keys. Generated CI intentionally uses snapshots.
+
+`arcnet env check` reports source names and selected key names, never values. `arcnet env export` explicitly emits selected plaintext JSON. `arcnet env run` gives a subprocess only the selected values and a small execution environment; it removes file keys, isolates temporary HOME/cache paths, and withholds subprocess output. Keep npm publishing mappings scoped to publishing credentials. The command reference documents the exact options.
+
+For the first local Terraform plan and deploy, GitHub's file keys cannot be read back. Run `arcnet plan --password` or `arcnet deploy --password` in your terminal: ArcNet prompts once for your Forum encryption password and decrypts the reviewed snapshots locally. `arcnet env check --password` validates them the same way. CI still uses the independent file keys and rejects password mode.
+
+When `.arcnet/secrets.json` exists, deployment commands automatically load it. The `deploy` consumer selects operator credentials; Terraform application values are selected using the existing service env lists in `zap.yaml`. No duplicated application map is required. Offline project checks remain offline. Secrets commands in GitHub Actions require the configured repository's main branch.
+
+Provisioning modifies Forum and GitHub separately. A failed GitHub upload leaves an unused Forum recipient; rerun `secrets add` to create/upload another and remove the unused recipient later. If upload succeeded but snapshot/config writing failed, attach the file with `--existing-key`. Existing sources are not silently rotated on reruns. Provision while nobody else is editing that file: the current fm write interface does not offer atomic revision-conditional writes, though ArcNet checks identity/revision before updating and refuses occupied init paths. GitHub secret names are repository-scoped; environment-level overrides take precedence in jobs that use an environment.

package/dist/createCli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createCli.d.ts","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,eAAO,MAAM,SAAS,eAyGrB,CAAC"}
+{"version":3,"file":"createCli.d.ts","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,eAAO,MAAM,SAAS,eA4HrB,CAAC"}

package/dist/createCli.js

@@ -9,6 +9,8 @@ import { renderResult } from "./renderResult.js";
 import { runTerraform } from "./runTerraform.js";
 import { runVercel } from "./runVercel.js";
 import { setup } from "./setup.js";
+import { createSecretsCommands } from "./secrets/createSecretsCommands.js";
+import { withDeploymentSecrets } from "./secrets/withDeploymentSecrets.js";
 export const createCli = () => {
     const cli = new Command("arcnet")
         .description("Install and deploy ArcNet projects.")
@@ -24,6 +26,7 @@ export const createCli = () => {
     const output = (result) => {
         process.stdout.write(renderResult(result, cli.opts()) + "\n");
     };
+    createSecretsCommands(cli, output);
     cli
         .command("version")
         .description("Show the installed package version.")
@@ -50,6 +53,8 @@ export const createCli = () => {
         create: "Create one explicitly approved Vercel project.",
     })) {
         const command = cli.command(name).description(description);
+        if (name === "plan" || name === "deploy")
+            command.option("--password", "Prompt for the Forum encryption password locally instead of using file keys");
         if (name === "create")
             command.argument("<site>", "Configured site name");
         command.action(async (site) => {
@@ -58,12 +63,16 @@ export const createCli = () => {
                 .object({ mode: z.string().optional() })
                 .parse(JSON.parse(readFileSync(join(root, ".arcnet/project.json"), "utf8"))).mode;
             const machine = Boolean(cli.opts().json || cli.opts().jsonl);
-            if (mode === "vercel")
-                output(await runVercel(name, root, typeof site === "string" ? site : undefined, machine));
-            else if (name === "check" || name === "plan" || name === "deploy")
-                output(runTerraform(name, root, machine));
-            else
+            const execute = async () => {
+                if (mode === "vercel")
+                    return runVercel(name, root, typeof site === "string" ? site : undefined, machine);
+                if (name === "check" || name === "plan" || name === "deploy")
+                    return runTerraform(name, root, machine);
                 throw new Error(`${name} is only supported for static Vercel references.`);
+            };
+            output(await (name === "check" || (name === "plan" && mode === "vercel")
+                ? execute()
+                : withDeploymentSecrets(root, mode, execute, Boolean(command.opts().password), Boolean(cli.opts().noninteractive))));
         });
     }
     cli

package/dist/createCli.js.map

@@ -1 +1 @@
-{"version":3,"file":"createCli.js","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;SAC9B,WAAW,CAAC,qCAAqC,CAAC;SAClD,OAAO,CAAC,cAAc,CAAC;SACvB,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAClE,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CAAC,SAAS,EAAE,qCAAqC,CAAC;SACxD,MAAM,CACL,kBAAkB,EAClB,uDAAuD,CACxD,CAAC;IAEJ,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK;YACrC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAAe,EAAE,EAAE;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC;QACL,GAAG,KAAK,CACN,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,KAAK;gBAAE,OAAO,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAY,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,KAAK,KAAK,IAAI;gBACnB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC;gBAChB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CACH,EACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAC9B;KACF,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAExB,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAC/C,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,8EAA8E;QACpF,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,mDAAmD;QAC5D,MAAM,EAAE,gDAAgD;KACzD,CAAC,EAAE,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAE3C,MAAM,IAAI,GAAG,CAAC;iBACX,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;iBACvC,KAAK,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,CACrE,CAAC,IAAI,CAAC;YAET,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,IAAI,KAAK,QAAQ;gBACnB,MAAM,CACJ,MAAM,SAAS,CACb,IAAI,EACJ,IAAI,EACJ,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC3C,OAAO,CACR,CACF,CAAC;iBACC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ;gBAC/D,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;;gBAE1C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kDAAkD,CAC1D,CAAC;QACN,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG;SACA,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CACV,gEAAgE,CACjE;SACA,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;YAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,cAAc,CACZ,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;aACpB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC;aAC1C,IAAI,CAAC,EAAE,CAAC,CACZ,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,OAAO,GAAG,CAAC;AACb,CAAC,CAAC"}
+{"version":3,"file":"createCli.js","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;SAC9B,WAAW,CAAC,qCAAqC,CAAC;SAClD,OAAO,CAAC,cAAc,CAAC;SACvB,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAClE,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CAAC,SAAS,EAAE,qCAAqC,CAAC;SACxD,MAAM,CACL,kBAAkB,EAClB,uDAAuD,CACxD,CAAC;IAEJ,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK;YACrC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAAe,EAAE,EAAE;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEnC,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC;QACL,GAAG,KAAK,CACN,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,KAAK;gBAAE,OAAO,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAY,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,KAAK,KAAK,IAAI;gBACnB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC;gBAChB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CACH,EACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAC9B;KACF,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAExB,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAC/C,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,8EAA8E;QACpF,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,mDAAmD;QAC5D,MAAM,EAAE,gDAAgD;KACzD,CAAC,EAAE,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ;YACtC,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,6EAA6E,CAC9E,CAAC;QACJ,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAE3C,MAAM,IAAI,GAAG,CAAC;iBACX,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;iBACvC,KAAK,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,CACrE,CAAC,IAAI,CAAC;YAET,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE7D,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;gBACzB,IAAI,IAAI,KAAK,QAAQ;oBACnB,OAAO,SAAS,CACd,IAAI,EACJ,IAAI,EACJ,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC3C,OAAO,CACR,CAAC;gBACJ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ;oBAC1D,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kDAAkD,CAC1D,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,CACJ,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC;gBAC/D,CAAC,CAAC,OAAO,EAAE;gBACX,CAAC,CAAC,qBAAqB,CACnB,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAChC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CACnC,CAAC,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG;SACA,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CACV,gEAAgE,CACjE;SACA,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;YAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,cAAc,CACZ,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;aACpB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC;aAC1C,IAAI,CAAC,EAAE,CAAC,CACZ,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,OAAO,GAAG,CAAC;AACb,CAAC,CAAC"}

package/dist/secrets/assertNewSource.d.ts

@@ -0,0 +1,3 @@
+import type { SecretSource } from "./config.js";
+export declare const assertNewSource: (source: SecretSource, root: string) => void;
+//# sourceMappingURL=assertNewSource.d.ts.map

package/dist/secrets/assertNewSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertNewSource.d.ts","sourceRoot":"","sources":["../../src/secrets/assertNewSource.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIhD,eAAO,MAAM,eAAe,GAAI,QAAQ,YAAY,EAAE,MAAM,MAAM,SAkCjE,CAAC"}

package/dist/secrets/assertNewSource.js

@@ -0,0 +1,32 @@
+import { posix } from "node:path";
+import { secretCommand } from "./secretCommand.js";
+// fm's write API can overwrite without --force, so its default is not create-only.
+export const assertNewSource = (source, root) => {
+    const listing = secretCommand("fm", [
+        "file",
+        "ls",
+        posix.dirname(source.path),
+        "--store",
+        source.store,
+        "--json",
+    ], root);
+    let names;
+    try {
+        names = listing
+            .trim()
+            .split("\n")
+            .filter(Boolean)
+            .map((line) => {
+            const entry = JSON.parse(line);
+            if (typeof entry.message !== "string")
+                throw new Error();
+            return entry.message;
+        });
+    }
+    catch {
+        throw new Error("Cannot verify that the new Forum path is unused.");
+    }
+    if (names.includes(posix.basename(source.path)))
+        throw new Error("Forum file already exists; use secrets add to attach it without replacing its contents.");
+};
+//# sourceMappingURL=assertNewSource.js.map

package/dist/secrets/assertNewSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertNewSource.js","sourceRoot":"","sources":["../../src/secrets/assertNewSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAE,EAAE;IACpE,MAAM,OAAO,GAAG,aAAa,CAC3B,IAAI,EACJ;QACE,MAAM;QACN,IAAI;QACJ,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1B,SAAS;QACT,MAAM,CAAC,KAAK;QACZ,QAAQ;KACT,EACD,IAAI,CACL,CAAC;IAEF,IAAI,KAAe,CAAC;IAEpB,IAAI,CAAC;QACH,KAAK,GAAG,OAAO;aACZ,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,OAAO,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;YACxD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;IACP,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;AACN,CAAC,CAAC"}

package/dist/secrets/config.d.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+export declare const envName: z.ZodString;
+export declare const sourceSchema: z.ZodObject<{
+    name: z.ZodString;
+    store: z.ZodString;
+    path: z.ZodString;
+    keyEnv: z.ZodString;
+    tokenEnv: z.ZodOptional<z.ZodString>;
+    snapshot: z.ZodOptional<z.ZodObject<{
+        file: z.ZodString;
+        fileId: z.ZodString;
+        revision: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const secretsConfigSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    repository: z.ZodString;
+    sources: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        store: z.ZodString;
+        path: z.ZodString;
+        keyEnv: z.ZodString;
+        tokenEnv: z.ZodOptional<z.ZodString>;
+        snapshot: z.ZodOptional<z.ZodObject<{
+            file: z.ZodString;
+            fileId: z.ZodString;
+            revision: z.ZodNumber;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    consumers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>>;
+}, z.core.$strict>;
+export type SecretsConfig = z.infer<typeof secretsConfigSchema>;
+export type SecretSource = z.infer<typeof sourceSchema>;
+export declare const readSecretsConfig: (root: string, file?: string) => SecretsConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/secrets/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,OAAO,aAAyC,CAAC;AAC9D,eAAO,MAAM,YAAY;;;;;;;;;;;;kBA4Bd,CAAC;AACZ,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;kBAuC5B,CAAC;AACL,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,aAA6B,KAC5B,aAUF,CAAC"}

package/dist/secrets/config.js

@@ -0,0 +1,67 @@
+import { readFileSync } from "node:fs";
+import { z } from "zod";
+import { safeTargetPath } from "../safeTargetPath.js";
+export const envName = z.string().regex(/^[A-Z_][A-Z0-9_]*$/);
+export const sourceSchema = z
+    .object({
+    name: z.string().regex(/^[a-z][a-z0-9-]*$/),
+    store: z.string().regex(/^[\w-]+\/[\w-]+$/),
+    path: z
+        .string()
+        .startsWith("/")
+        .endsWith(".enc")
+        .refine((path) => !/[\r\n\0]/.test(path) &&
+        path
+            .split("/")
+            .slice(1)
+            .every((part) => part && part !== "." && part !== "..")),
+    keyEnv: envName,
+    tokenEnv: envName.optional(),
+    snapshot: z
+        .object({
+        file: z.string(),
+        fileId: z.string().min(1),
+        revision: z.number().int().nonnegative(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    })
+        .strict()
+        .optional(),
+})
+    .strict();
+export const secretsConfigSchema = z
+    .object({
+    version: z.literal(1),
+    repository: z.string().regex(/^[\w.-]+\/[\w.-]+$/),
+    sources: z.array(sourceSchema).min(1),
+    consumers: z
+        .record(z.string(), z.record(z.string().min(1), z.union([envName, z.array(envName).min(1)])))
+        .default({}),
+})
+    .strict()
+    .superRefine((config, ctx) => {
+    if (new Set(config.sources.map((s) => s.name)).size !== config.sources.length)
+        ctx.addIssue({ code: "custom", message: "Source names must be unique." });
+    if (new Set(config.sources.map((s) => s.keyEnv)).size !==
+        config.sources.length)
+        ctx.addIssue({
+            code: "custom",
+            message: "Each source needs its own key environment name.",
+        });
+    for (const mapping of Object.values(config.consumers))
+        for (const name of Object.keys(mapping))
+            if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+                name !== "pnpm_config_//registry.npmjs.org/:_authToken")
+                ctx.addIssue({
+                    code: "custom",
+                    message: "Invalid output environment name.",
+                });
+});
+export const readSecretsConfig = (root, file = ".arcnet/secrets.json") => {
+    try {
+        return secretsConfigSchema.parse(JSON.parse(readFileSync(safeTargetPath(root, file), "utf8")));
+    }
+    catch {
+        throw new Error("Missing or invalid secrets configuration (values omitted).");
+    }
+};
+//# sourceMappingURL=config.js.map

package/dist/secrets/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC3C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,UAAU,CAAC,GAAG,CAAC;SACf,QAAQ,CAAC,MAAM,CAAC;SAChB,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI;aACD,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,CAAC;aACR,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAC5D;IACH,MAAM,EAAE,OAAO;IACf,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;KAC3C,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,SAAS,EAAE,CAAC;SACT,MAAM,CACL,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CACN,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAC5C,CACF;SACA,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IACE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM;QAEzE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAC5E,IACE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QACjD,MAAM,CAAC,OAAO,CAAC,MAAM;QAErB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAC;IACL,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACrC,IACE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;gBACtC,IAAI,KAAK,8CAA8C;gBAEvD,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,kCAAkC;iBAC5C,CAAC,CAAC;AACX,CAAC,CAAC,CAAC;AAIL,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,IAAY,EACZ,IAAI,GAAG,sBAAsB,EACd,EAAE;IACjB,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,KAAK,CAC9B,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/secrets/createSecretsCommands.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const createSecretsCommands: (cli: Command, output: (value: unknown) => void) => void;
+//# sourceMappingURL=createSecretsCommands.d.ts.map

package/dist/secrets/createSecretsCommands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSecretsCommands.d.ts","sourceRoot":"","sources":["../../src/secrets/createSecretsCommands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWpC,eAAO,MAAM,qBAAqB,GAChC,KAAK,OAAO,EACZ,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,SAgMjC,CAAC"}

package/dist/secrets/createSecretsCommands.js

@@ -0,0 +1,100 @@
+import { realpathSync } from "node:fs";
+import { readSecretsConfig } from "./config.js";
+import { loadSecrets } from "./loadSecrets.js";
+import { provisionSource } from "./provisionSource.js";
+import { runWithSecrets } from "./runWithSecrets.js";
+import { selectSecrets } from "./selectSecrets.js";
+import { syncSecrets } from "./syncSecrets.js";
+import { writeSecretsWorkflow } from "./writeSecretsWorkflow.js";
+import { promptPassword } from "./promptPassword.js";
+export const createSecretsCommands = (cli, output) => {
+    const env = cli
+        .command("env")
+        .description("Load ordered encrypted Forum sources and select environment values.");
+    for (const action of ["check", "export", "run"]) {
+        const command = env
+            .command(action)
+            .description({
+            check: "Validate decryption and mappings; report key names only.",
+            export: "Write selected plaintext JSON to stdout for an explicit pipeline.",
+            run: "Run a command with selected keys only; withhold child output.",
+        }[action])
+            .option("--config <file>", "Secrets source configuration", ".arcnet/secrets.json")
+            .option("--consumer <name>", "Named mapping in the secrets configuration")
+            .option("--live", "Fetch current ciphertext through the installed fm CLI instead of snapshots")
+            .option("--password", "Prompt for the Forum encryption password locally instead of using file keys");
+        if (action === "run")
+            command.argument("<command...>", "Executable and arguments after --");
+        command.action(async (...args) => {
+            const options = command.opts();
+            const root = realpathSync(cli.opts().root);
+            const config = readSecretsConfig(root, options.config);
+            if (process.env.GITHUB_ACTIONS === "true" &&
+                (process.env.GITHUB_REPOSITORY !== config.repository ||
+                    process.env.GITHUB_REF !== "refs/heads/main"))
+                throw new Error("Secrets commands in CI require the configured repository main branch.");
+            if (options.password && process.env.GITHUB_ACTIONS === "true")
+                throw new Error("Password decryption is local-only; CI must use file keys.");
+            if (action !== "check" && !options.consumer)
+                throw new Error("Choose --consumer to explicitly select output keys.");
+            const password = options.password
+                ? await promptPassword(Boolean(cli.opts().noninteractive))
+                : undefined;
+            const values = await loadSecrets(config, root, process.env, options.live, password);
+            const names = options.consumer
+                ? [options.consumer]
+                : Object.keys(config.consumers);
+            const selected = Object.fromEntries(names.map((name) => [name, selectSecrets(values, config, name)]));
+            if (action === "export")
+                process.stdout.write(JSON.stringify(selected[options.consumer]) + "\n");
+            else if (action === "run")
+                output(runWithSecrets(args[0], selected[options.consumer], root));
+            else
+                output({
+                    operation: "env.check",
+                    status: "passed",
+                    sources: config.sources.map((source) => source.name),
+                    consumers: Object.fromEntries(Object.entries(selected).map(([name, value]) => [
+                        name,
+                        Object.keys(value),
+                    ])),
+                    message: "Decryption, merge and required-key checks passed; provider authorization was not tested.",
+                });
+        });
+    }
+    const secrets = cli
+        .command("secrets")
+        .description("Attach Forum files, provision GitHub keys and refresh encrypted snapshots.");
+    for (const mode of ["add", "init"]) {
+        const command = secrets
+            .command(mode)
+            .description(mode === "add"
+            ? "Attach an existing Forum file and provision its CI key."
+            : "Create a Forum secrets file, prompt for your password and provision its CI key.")
+            .requiredOption("--name <name>", "Unique source name; sources merge in installation order")
+            .requiredOption("--store <workspace/store>", "Forum store")
+            .requiredOption("--path <path>", "Encrypted file path in Forum")
+            .requiredOption("--key-env <name>", "GitHub repository secret / environment variable for this file's key")
+            .requiredOption("--repository <owner/repo>", "GitHub repository receiving the key")
+            .option("--config <file>", "Secrets source configuration", ".arcnet/secrets.json");
+        if (mode === "add")
+            command.option("--existing-key", "Reuse an existing GitHub secret without creating a recipient");
+        else
+            command.option("--input <file>", "Initial plaintext JSON file; defaults to an empty object");
+        command.action(async () => output(await provisionSource(mode, {
+            ...command.opts(),
+            noninteractive: cli.opts().noninteractive,
+        }, realpathSync(cli.opts().root), command.opts().config)));
+    }
+    secrets
+        .command("sync")
+        .description("Refresh encrypted snapshots from Forum and regenerate validation CI; no decryption.")
+        .option("--config <file>", "Secrets source configuration", ".arcnet/secrets.json")
+        .action((options) => {
+        const root = realpathSync(cli.opts().root);
+        const result = syncSecrets(readSecretsConfig(root, options.config), root, options.config);
+        writeSecretsWorkflow(readSecretsConfig(root, options.config), root, options.config);
+        output(result);
+    });
+};
+//# sourceMappingURL=createSecretsCommands.js.map

package/dist/secrets/createSecretsCommands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSecretsCommands.js","sourceRoot":"","sources":["../../src/secrets/createSecretsCommands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAyB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,GAAY,EACZ,MAAgC,EAChC,EAAE;IACF,MAAM,GAAG,GAAG,GAAG;SACZ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,qEAAqE,CACtE,CAAC;IAEJ,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAU,EAAE,CAAC;QACzD,MAAM,OAAO,GAAG,GAAG;aAChB,OAAO,CAAC,MAAM,CAAC;aACf,WAAW,CACV;YACE,KAAK,EAAE,0DAA0D;YACjE,MAAM,EACJ,mEAAmE;YACrE,GAAG,EAAE,+DAA+D;SACrE,CAAC,MAAM,CAAC,CACV;aACA,MAAM,CACL,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,CACvB;aACA,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;aACzE,MAAM,CACL,QAAQ,EACR,4EAA4E,CAC7E;aACA,MAAM,CACL,YAAY,EACZ,6EAA6E,CAC9E,CAAC;QAEJ,IAAI,MAAM,KAAK,KAAK;YAClB,OAAO,CAAC,QAAQ,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAKxB,CAAC;YAEL,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvD,IACE,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;gBACrC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,UAAU;oBAClD,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,iBAAiB,CAAC;gBAE/C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;YACJ,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;gBAC3D,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ;gBACzC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ;gBAC/B,CAAC,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;gBAC1D,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,MAAM,EACN,IAAI,EACJ,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,IAAI,EACZ,QAAQ,CACT,CAAC;YAEF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ;gBAC5B,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CACjE,CAAC;YAEF,IAAI,MAAM,KAAK,QAAQ;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAS,CAAC,CAAC,GAAG,IAAI,CACnD,CAAC;iBACC,IAAI,MAAM,KAAK,KAAK;gBACvB,MAAM,CACJ,cAAc,CACZ,IAAI,CAAC,CAAC,CAAa,EACnB,QAAQ,CAAC,OAAO,CAAC,QAAS,CAAE,EAC5B,IAAI,CACL,CACF,CAAC;;gBAEF,MAAM,CAAC;oBACL,SAAS,EAAE,WAAW;oBACtB,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;oBACpD,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;wBAC9C,IAAI;wBACJ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;qBACnB,CAAC,CACH;oBACD,OAAO,EACL,0FAA0F;iBAC7F,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,4EAA4E,CAC7E,CAAC;IAEJ,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,CAAU,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO;aACpB,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CACV,IAAI,KAAK,KAAK;YACZ,CAAC,CAAC,yDAAyD;YAC3D,CAAC,CAAC,iFAAiF,CACtF;aACA,cAAc,CACb,eAAe,EACf,yDAAyD,CAC1D;aACA,cAAc,CAAC,2BAA2B,EAAE,aAAa,CAAC;aAC1D,cAAc,CAAC,eAAe,EAAE,8BAA8B,CAAC;aAC/D,cAAc,CACb,kBAAkB,EAClB,qEAAqE,CACtE;aACA,cAAc,CACb,2BAA2B,EAC3B,qCAAqC,CACtC;aACA,MAAM,CACL,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,CACvB,CAAC;QAEJ,IAAI,IAAI,KAAK,KAAK;YAChB,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,8DAA8D,CAC/D,CAAC;;YAEF,OAAO,CAAC,MAAM,CACZ,gBAAgB,EAChB,0DAA0D,CAC3D,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CACxB,MAAM,CACJ,MAAM,eAAe,CACnB,IAAI,EACJ;YACE,GAAG,OAAO,CAAC,IAAI,EAAoB;YACnC,cAAc,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,cAAc;SAC1C,EACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAC7B,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,CACtB,CACF,CACF,CAAC;IACJ,CAAC;IAED,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,qFAAqF,CACtF;SACA,MAAM,CACL,iBAAiB,EACjB,8BAA8B,EAC9B,sBAAsB,CACvB;SACA,MAAM,CAAC,CAAC,OAA2B,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,WAAW,CACxB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EACvC,IAAI,EACJ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,oBAAoB,CAClB,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EACvC,IAAI,EACJ,OAAO,CAAC,MAAM,CACf,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACP,CAAC,CAAC"}

package/dist/secrets/loadSecrets.d.ts

@@ -0,0 +1,3 @@
+import type { SecretsConfig } from "./config.js";
+export declare const loadSecrets: (config: SecretsConfig, root: string, environment?: NodeJS.ProcessEnv, live?: boolean, password?: string) => Promise<Record<string, unknown>>;
+//# sourceMappingURL=loadSecrets.d.ts.map

package/dist/secrets/loadSecrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadSecrets.d.ts","sourceRoot":"","sources":["../../src/secrets/loadSecrets.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIjD,eAAO,MAAM,WAAW,GACtB,QAAQ,aAAa,EACrB,MAAM,MAAM,EACZ,+BAAyB,EACzB,cAAY,EACZ,WAAW,MAAM,qCAqDlB,CAAC"}

package/dist/secrets/loadSecrets.js

@@ -0,0 +1,53 @@
+import { decryptForumEncryptedFileText } from "@mp-lb/forum-secrets";
+import { createHash } from "node:crypto";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { safeTargetPath } from "../safeTargetPath.js";
+import { readRemoteSource } from "./readRemoteSource.js";
+import { secretCommand } from "./secretCommand.js";
+export const loadSecrets = async (config, root, environment = process.env, live = false, password) => {
+    let values = {};
+    for (const source of config.sources) {
+        const key = environment[source.keyEnv];
+        if (!key && !password)
+            throw new Error(`Missing decryption credential: ${source.keyEnv}.`);
+        try {
+            const text = !live && source.snapshot
+                ? readFileSync(safeTargetPath(root, source.snapshot.file), "utf8")
+                : readRemoteSource(source, root, environment).text;
+            if (!live &&
+                source.snapshot &&
+                createHash("sha256").update(text).digest("hex") !==
+                    source.snapshot.sha256)
+                throw new Error("Snapshot integrity mismatch");
+            let plaintext;
+            if (password) {
+                const temporary = mkdtempSync(join(tmpdir(), "arcnet-decrypt-"));
+                try {
+                    const file = join(temporary, "source.json.enc");
+                    writeFileSync(file, text, { mode: 0o600 });
+                    plaintext = secretCommand("fm", ["decrypt", "--file", file], root, undefined, { ...environment, DOCTRINE_ENCRYPTION_PASSWORD: password });
+                }
+                finally {
+                    rmSync(temporary, { recursive: true, force: true });
+                }
+            }
+            else {
+                plaintext = await decryptForumEncryptedFileText({
+                    encryptedText: text,
+                    recipientSecret: key,
+                });
+            }
+            const decoded = JSON.parse(plaintext);
+            if (!decoded || Array.isArray(decoded) || typeof decoded !== "object")
+                throw new Error("Not an object");
+            values = { ...values, ...decoded };
+        }
+        catch {
+            throw new Error(`Source ${source.name} failed to load or decrypt; check its key and snapshot integrity (values omitted).`);
+        }
+    }
+    return values;
+};
+//# sourceMappingURL=loadSecrets.js.map

package/dist/secrets/loadSecrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadSecrets.js","sourceRoot":"","sources":["../../src/secrets/loadSecrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAqB,EACrB,IAAY,EACZ,WAAW,GAAG,OAAO,CAAC,GAAG,EACzB,IAAI,GAAG,KAAK,EACZ,QAAiB,EACjB,EAAE;IACF,IAAI,MAAM,GAA4B,EAAE,CAAC;IAEzC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;YACnB,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,IAAI,GACR,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ;gBACtB,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAClE,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC;YAEvD,IACE,CAAC,IAAI;gBACL,MAAM,CAAC,QAAQ;gBACf,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC7C,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAExB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAEjD,IAAI,SAAiB,CAAC;YACtB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;oBAChD,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC3C,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,EAC/D,SAAS,EAAE,EAAE,GAAG,WAAW,EAAE,4BAA4B,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAC3E,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG,MAAM,6BAA6B,CAAC;oBAC9C,aAAa,EAAE,IAAI;oBACnB,eAAe,EAAE,GAAI;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE/C,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ;gBACnE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YACnC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,CAAC,IAAI,oFAAoF,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/secrets/promptPassword.d.ts

@@ -0,0 +1,2 @@
+export declare const promptPassword: (noninteractive?: boolean) => Promise<string>;
+//# sourceMappingURL=promptPassword.d.ts.map

package/dist/secrets/promptPassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"promptPassword.d.ts","sourceRoot":"","sources":["../../src/secrets/promptPassword.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,GACzB,wBAAsB,KACrB,OAAO,CAAC,MAAM,CA2ChB,CAAC"}

package/dist/secrets/promptPassword.js

@@ -0,0 +1,42 @@
+export const promptPassword = async (noninteractive = false) => {
+    if (process.env.DOCTRINE_ENCRYPTION_PASSWORD)
+        return process.env.DOCTRINE_ENCRYPTION_PASSWORD;
+    if (noninteractive || !process.stdin.isTTY || !process.stderr.isTTY)
+        throw new Error("Run this command in your terminal to enter the Forum encryption password, or set DOCTRINE_ENCRYPTION_PASSWORD.");
+    return new Promise((resolve, reject) => {
+        let value = "";
+        const input = process.stdin;
+        const wasRaw = input.isRaw;
+        const finish = (cancel = false) => {
+            input.off("data", read);
+            input.setRawMode(wasRaw);
+            input.pause();
+            process.stderr.write("\n");
+            if (cancel || !value)
+                reject(new Error("Password entry cancelled."));
+            else
+                resolve(value);
+        };
+        const read = (chunk) => {
+            for (const character of chunk.toString("utf8")) {
+                if (character === "\u0003") {
+                    finish(true);
+                    return;
+                }
+                if (character === "\r" || character === "\n") {
+                    finish();
+                    return;
+                }
+                if (character === "\u007f")
+                    value = [...value].slice(0, -1).join("");
+                else
+                    value += character;
+            }
+        };
+        process.stderr.write("Forum encryption password: ");
+        input.setRawMode(true);
+        input.on("data", read);
+        input.resume();
+    });
+};
+//# sourceMappingURL=promptPassword.js.map

package/dist/secrets/promptPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"promptPassword.js","sourceRoot":"","sources":["../../src/secrets/promptPassword.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,cAAc,GAAG,KAAK,EACL,EAAE;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B;QAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAClD,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;QACjE,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAE3B,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,EAAE;YAChC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,MAAM,IAAI,CAAC,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;;gBAChE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;YAC7B,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC3B,MAAM,CAAC,IAAI,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBAC7C,MAAM,EAAE,CAAC;oBACT,OAAO;gBACT,CAAC;gBAED,IAAI,SAAS,KAAK,QAAQ;oBAAE,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;oBAChE,KAAK,IAAI,SAAS,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACpD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/secrets/provisionSource.d.ts

@@ -0,0 +1,25 @@
+export interface ProvisionOptions {
+    name: string;
+    store: string;
+    path: string;
+    keyEnv: string;
+    repository: string;
+    existingKey?: boolean;
+    input?: string;
+    noninteractive?: boolean;
+}
+export declare const provisionSource: (mode: "add" | "init", options: ProvisionOptions, root: string, configFile: string) => Promise<{
+    operation: string;
+    status: string;
+    message: string;
+} | {
+    operation: string;
+    githubSecret: string;
+    sources: {
+        name: string;
+        revision: number;
+    }[];
+    message: string;
+    status?: undefined;
+}>;
+//# sourceMappingURL=provisionSource.d.ts.map

package/dist/secrets/provisionSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisionSource.d.ts","sourceRoot":"","sources":["../../src/secrets/provisionSource.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,eAAe,GAC1B,MAAM,KAAK,GAAG,MAAM,EACpB,SAAS,gBAAgB,EACzB,MAAM,MAAM,EACZ,YAAY,MAAM;;;;;;;;;;;;;EAuMnB,CAAC"}