@nocobase/app-plugin-releases 0.0.0-stage → 0.1.0-beta.1

package/dist/server/services/variables.d.ts

@@ -0,0 +1,132 @@
+import type { DatabaseConnection, DatabaseManager } from '@nocobase/db';
+import { type AppVariableView, type EnvironmentVariableView, type ReleaseVariable, type ReleaseVariablesManifest, type VariableGenerator, type VariableSource } from '../../shared/releases.js';
+import { type ReleasesSecrets } from './secrets.js';
+/** The configuration paths release management fills in itself when a build declares a variable for them. */
+export declare const INITIAL_ADMIN_PATHS: {
+    readonly username: "users.initialAdmin.username";
+    readonly email: "users.initialAdmin.email";
+    readonly password: "users.initialAdmin.password";
+};
+export declare const PUBLIC_ORIGIN_PATH = "app.publicOrigin";
+export declare const SAMPLE_DATA_PATH = "app.sampleData";
+/** The first administrator when the build and its configuration name none: the authentication plugin's defaults. */
+export declare const DEFAULT_INITIAL_ADMIN: {
+    readonly username: "nocobase";
+    readonly email: "admin@nocobase.com";
+};
+/**
+ * A manifest from an archive or from CI, checked: it comes from the build, which nobody vouched for. Unknown fields
+ * are dropped; names, counts and lengths are bounded.
+ */
+export declare function parseVariablesManifest(value: unknown): ReleaseVariablesManifest;
+/** A stored manifest read back; one that no longer parses counts as none. */
+export declare function decodeVariablesManifest(value: unknown): ReleaseVariablesManifest | null;
+export declare function assertVariableName(name: string): void;
+export declare function assertVariableValue(value: unknown): asserts value is string;
+/** Whether a variable named so holds a secret, judged as a configuration key would be (`SMTP_PASSWORD`, `API_KEY`). */
+export declare function isSecretName(name: string): boolean;
+/** A value for a generator: 32 random bytes, a one-key `SECRETS_KEYS` list, or 16 letters and digits. */
+export declare function generateVariable(kind: VariableGenerator): string;
+/** A password of letters and digits without look-alikes, so it survives copying. */
+export declare function randomPassword(length?: number): string;
+export interface StoredEnvironmentVariable {
+    readonly id: string;
+    readonly environmentId: string;
+    readonly name: string;
+    readonly value: string | null;
+    readonly secret: boolean;
+    readonly description: string | null;
+    readonly updatedBy: string | null;
+    readonly updatedAt: Date;
+}
+export interface StoredAppVariable {
+    readonly id: string;
+    readonly appId: string;
+    readonly name: string;
+    readonly value: string | null;
+    readonly secret: boolean;
+    readonly generated: boolean;
+}
+/** Where a sealed variable value is bound: its table, owner and name. */
+export declare function variableIdentity(kind: 'environment' | 'app', ownerId: string, name: string): readonly string[];
+export declare class VariableStore {
+    private readonly options;
+    constructor(options: {
+        readonly database: DatabaseManager;
+        readonly secrets?: ReleasesSecrets;
+    });
+    environmentVariables(environmentId: string): Promise<StoredEnvironmentVariable[]>;
+    appVariables(appId: string): Promise<StoredAppVariable[]>;
+    setEnvironmentVariable(environmentId: string, name: string, input: {
+        readonly value: string;
+        readonly secret: boolean;
+        readonly description?: string | null;
+        readonly by: string | null;
+    }): Promise<void>;
+    unsetEnvironmentVariable(environmentId: string, name: string): Promise<boolean>;
+    /** Sets the App's value. */
+    setAppVariable(appId: string, name: string, input: {
+        readonly value: string;
+        readonly secret: boolean;
+        readonly generated?: boolean;
+        readonly by: string | null;
+    }, connection?: DatabaseConnection): Promise<void>;
+    /** Removes an App's variable; answers whether it had a value. */
+    unsetAppVariable(appId: string, name: string): Promise<boolean>;
+    removeApp(appId: string, connection: DatabaseConnection): Promise<void>;
+    removeEnvironment(environmentId: string): Promise<void>;
+    seal(value: string, identity: readonly string[]): string;
+    /** A sealed value opened; one that no longer opens (another key, damaged) reads as unset. */
+    private open;
+    private query;
+}
+export declare function environmentVariableView(variable: StoredEnvironmentVariable): EnvironmentVariableView;
+export interface ResolveVariablesInput {
+    /** The release's manifest; without one nothing is required and only values someone set reach the App. */
+    readonly manifest: ReleaseVariablesManifest | null;
+    readonly environment: readonly StoredEnvironmentVariable[];
+    readonly app: readonly StoredAppVariable[];
+    /** The configuration the App runs with, parsed. */
+    readonly configFile: unknown;
+    /** Values release management makes for this deployment (the public origin, sample data, the first password). */
+    readonly generated?: Readonly<Record<string, string>>;
+    /** Variables release management would generate if they were deployed now; shown as `generated`, never missing. */
+    readonly generatable?: ReadonlySet<string>;
+    /** What the running deployment got, to say what changed. */
+    readonly running?: Readonly<Record<string, string>> | null;
+}
+export interface ResolvedVariable {
+    readonly name: string;
+    readonly declaration: ReleaseVariable | null;
+    readonly source: VariableSource;
+    readonly secret: boolean;
+    readonly firstStartOnly: boolean;
+    readonly required: boolean;
+    /** What the App gets, when a variable gives it one. */
+    readonly value: string | undefined;
+    readonly missing: boolean;
+    readonly changed: boolean;
+    readonly app: StoredAppVariable | null;
+    readonly environment: StoredEnvironmentVariable | null;
+}
+export interface ResolvedVariables {
+    /** What the App's environment holds. */
+    readonly env: Record<string, string>;
+    readonly variables: readonly ResolvedVariable[];
+    readonly missing: readonly ReleaseVariable[];
+    /** Of `env` without what is read only on the first start: what tells a later change. */
+    readonly fingerprint: string;
+    /** Some variable that counts differs from `running`. */
+    readonly changed: boolean;
+}
+/** Resolves the variables of one deployment; nothing here reads or writes the database. */
+export declare function resolveVariables(input: ResolveVariablesInput): ResolvedVariables;
+/** The fingerprint of what a deployment's variables give, leaving out what is read only on the first start. */
+export declare function fingerprintOf(env: Readonly<Record<string, string>>, manifest: ReleaseVariablesManifest | null): string;
+/** How the App variables page shows a resolved variable. */
+export declare function appVariableView(variable: ResolvedVariable): AppVariableView;
+/** The value at a dotted path of a parsed configuration. */
+export declare function configValueAt(config: unknown, path: string): unknown;
+/** Whether the configuration holds a value at the path that is not an example's placeholder. */
+export declare function hasRealValue(config: unknown, path: string): boolean;
+//# sourceMappingURL=variables.d.ts.map

package/dist/server/services/variables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variables.d.ts","sourceRoot":"","sources":["../../../server/services/variables.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAO,MAAM,cAAc,CAAC;AAG7E,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EAEpB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAA4B,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAE9E,4GAA4G;AAC5G,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AACX,eAAO,MAAM,kBAAkB,qBAAqB,CAAC;AACrD,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,oHAAoH;AACpH,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AA6BX;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,GACb,wBAAwB,CAiE1B;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,GACb,wBAAwB,GAAG,IAAI,CASjC;AAID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAarD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAa3E;AAED,uHAAuH;AACvH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAShE;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAK1D;AAID,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,aAAa,GAAG,KAAK,EAC3B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,SAAS,MAAM,EAAE,CAEnB;AAED,qBAAa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE;QACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;KACpC;IAGU,oBAAoB,CAC/B,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,yBAAyB,EAAE,CAAC;IA0B1B,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAoBzD,sBAAsB,CACjC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GACA,OAAO,CAAC,IAAI,CAAC;IA4CH,wBAAwB,CACnC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IASnB,4BAA4B;IACf,cAAc,CACzB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;QACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,EACD,UAAU,CAAC,EAAE,kBAAkB,GAC9B,OAAO,CAAC,IAAI,CAAC;IAwChB,iEAAiE;IACpD,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAe/D,SAAS,CACpB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,kBAAkB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAOH,iBAAiB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7D,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM;IAI/D,6FAA6F;IAC7F,OAAO,CAAC,IAAI;IASZ,OAAO,CAAC,KAAK;CAGd;AAED,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,yBAAyB,GAClC,uBAAuB,CASzB;AAQD,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,GAAG,IAAI,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3C,mDAAmD;IACnD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,gHAAgH;IAChH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,kHAAkH;IAClH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,eAAe,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACxD;AAED,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,qBAAqB,GAC3B,iBAAiB,CAsFnB;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAC3B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACrC,QAAQ,EAAE,wBAAwB,GAAG,IAAI,GACxC,MAAM,CAUR;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,eAAe,CA2B3E;AAID,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOpE;AAED,gGAAgG;AAChG,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKnE"}

package/dist/server/services/variables.js

@@ -0,0 +1,501 @@
+/**
+ * Deployment variables: the environment variables an App runs with. A build declares the ones it reads in its manifest
+ * (`dist/variables.json`, stored on the release); values are set per environment and per App, sealed with the
+ * secrets service whether they are secrets or not, and resolved for each deployment, strongest first:
+ *
+ * | source        | what                                                                                          |
+ * | ------------- | --------------------------------------------------------------------------------------------- |
+ * | `app`         | the App's own value                                                                          |
+ * | `environment` | the environment's value                                                                      |
+ * | `configFile`  | nothing above, and the App's `config.yml` holds a real value at the variable's path           |
+ * | `generated`   | release management made one: a secret kept as an App value, the public origin, sample data |
+ * | `default`     | the build's code defaults give the path a value                                              |
+ * | `unset`       | nothing: a required variable is then missing, and a deployment is refused                    |
+ *
+ * Only `app`, `environment` and `generated` reach the App; the runtime reads them over `config.yml`.
+ */
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { isExamplePlaceholder, isSecretPath, } from '@nocobase/app-server/config';
+import { generateSecretKey } from '@nocobase/secrets';
+import { MAX_MANIFEST_VARIABLES, MAX_VARIABLE_VALUE_BYTES, RESERVED_VARIABLE_NAMES, VARIABLE_NAME_PATTERN, } from '../../shared/releases.js';
+import { ReleasesError } from '../errors.js';
+import { decodeDate, isRecord, nullableString } from './codec.js';
+import { decryptText, encryptText } from './secrets.js';
+/** The configuration paths release management fills in itself when a build declares a variable for them. */
+export const INITIAL_ADMIN_PATHS = {
+    username: 'users.initialAdmin.username',
+    email: 'users.initialAdmin.email',
+    password: 'users.initialAdmin.password',
+};
+export const PUBLIC_ORIGIN_PATH = 'app.publicOrigin';
+export const SAMPLE_DATA_PATH = 'app.sampleData';
+/** The first administrator when the build and its configuration name none: the authentication plugin's defaults. */
+export const DEFAULT_INITIAL_ADMIN = {
+    username: 'nocobase',
+    email: 'admin@nocobase.com',
+};
+// --- Manifest ---------------------------------------------------------------------------------------------------
+const GENERATORS = [
+    'secret',
+    'secretKeys',
+    'password',
+];
+function invalidManifest(message) {
+    return new ReleasesError(`Invalid variables manifest: ${message}`, 'INVALID_VARIABLES_MANIFEST', 'INVALID_ARGUMENT');
+}
+function optionalText(value, max, what) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'string' || value.length > max)
+        throw invalidManifest(`${what} must be text of at most ${max} characters.`);
+    return value;
+}
+/**
+ * A manifest from an archive or from CI, checked: it comes from the build, which nobody vouched for. Unknown fields
+ * are dropped; names, counts and lengths are bounded.
+ */
+export function parseVariablesManifest(value) {
+    if (!isRecord(value))
+        throw invalidManifest('expected a JSON object.');
+    if (value.schemaVersion !== 1)
+        throw invalidManifest('schemaVersion must be 1.');
+    if (!Array.isArray(value.variables))
+        throw invalidManifest('variables must be a list.');
+    if (value.variables.length > MAX_MANIFEST_VARIABLES)
+        throw invalidManifest(`it may declare at most ${MAX_MANIFEST_VARIABLES} variables.`);
+    const seen = new Set();
+    const variables = value.variables.map((entry) => {
+        if (!isRecord(entry))
+            throw invalidManifest('each variable is an object.');
+        const name = entry.name;
+        if (typeof name !== 'string' || !VARIABLE_NAME_PATTERN.test(name))
+            throw invalidManifest(`${JSON.stringify(name)} is not a variable name (upper-case letters, digits and underscores).`);
+        if (seen.has(name))
+            throw invalidManifest(`${name} is declared twice.`);
+        seen.add(name);
+        const generate = entry.generate ?? null;
+        if (generate !== null &&
+            !GENERATORS.includes(generate))
+            throw invalidManifest(`${name}: unknown generator.`);
+        const path = optionalText(entry.path, 255, `${name}: path`);
+        const type = optionalText(entry.type, 32, `${name}: type`);
+        const description = optionalText(entry.description, 1000, `${name}: description`);
+        return {
+            name,
+            ...(path === undefined ? {} : { path }),
+            ...(type === undefined ? {} : { type }),
+            ...(description === undefined ? {} : { description }),
+            secret: entry.secret === true,
+            required: entry.required === true,
+            ...(entry.hasDefault === true ? { hasDefault: true } : {}),
+            ...(entry.exampleProvided === true ? { exampleProvided: true } : {}),
+            firstStartOnly: entry.firstStartOnly === true,
+            generate: generate,
+            ...(entry.runtime === true ? { runtime: true } : {}),
+        };
+    });
+    const app = isRecord(value.app)
+        ? {
+            ...(typeof value.app.name === 'string'
+                ? { name: value.app.name.slice(0, 214) }
+                : {}),
+            ...(typeof value.app.version === 'string'
+                ? { version: value.app.version.slice(0, 255) }
+                : {}),
+        }
+        : undefined;
+    return {
+        schemaVersion: 1,
+        ...(app ? { app } : {}),
+        ...(typeof value.generatedAt === 'string'
+            ? { generatedAt: value.generatedAt.slice(0, 64) }
+            : {}),
+        variables,
+    };
+}
+/** A stored manifest read back; one that no longer parses counts as none. */
+export function decodeVariablesManifest(value) {
+    if (value === null || value === undefined)
+        return null;
+    try {
+        return parseVariablesManifest(typeof value === 'string' ? JSON.parse(value) : value);
+    }
+    catch {
+        return null;
+    }
+}
+// --- Names and values -------------------------------------------------------------------------------------------
+export function assertVariableName(name) {
+    if (!VARIABLE_NAME_PATTERN.test(name))
+        throw new ReleasesError('A variable name is an upper-case letter followed by upper-case letters, digits and underscores.', 'INVALID_VARIABLE_NAME', 'INVALID_ARGUMENT');
+    if (RESERVED_VARIABLE_NAMES.includes(name))
+        throw new ReleasesError(`${name} is set by the runtime and cannot be a variable.`, 'VARIABLE_RESERVED', 'INVALID_ARGUMENT');
+}
+export function assertVariableValue(value) {
+    if (typeof value !== 'string')
+        throw new ReleasesError('A variable value is text.', 'INVALID_VARIABLE_VALUE', 'INVALID_ARGUMENT');
+    if (Buffer.byteLength(value) > MAX_VARIABLE_VALUE_BYTES)
+        throw new ReleasesError('A variable value is at most 64 KiB.', 'INVALID_VARIABLE_VALUE', 'INVALID_ARGUMENT');
+}
+/** Whether a variable named so holds a secret, judged as a configuration key would be (`SMTP_PASSWORD`, `API_KEY`). */
+export function isSecretName(name) {
+    return isSecretPath(name);
+}
+/** A value for a generator: 32 random bytes, a one-key `SECRETS_KEYS` list, or 16 letters and digits. */
+export function generateVariable(kind) {
+    switch (kind) {
+        case 'secretKeys':
+            return `1:${generateSecretKey()}`;
+        case 'password':
+            return randomPassword();
+        default:
+            return randomBytes(32).toString('base64url');
+    }
+}
+/** A password of letters and digits without look-alikes, so it survives copying. */
+export function randomPassword(length = 16) {
+    const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789';
+    return [...randomBytes(length)]
+        .map((byte) => alphabet[byte % alphabet.length])
+        .join('');
+}
+/** Where a sealed variable value is bound: its table, owner and name. */
+export function variableIdentity(kind, ownerId, name) {
+    return [kind, ownerId, name];
+}
+export class VariableStore {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async environmentVariables(environmentId) {
+        const rows = await this.query()
+            .selectFrom('relEnvironmentVariables')
+            .selectAll()
+            .where('environmentId', '=', environmentId)
+            .orderBy('name', 'asc')
+            .execute();
+        return rows.map((row) => ({
+            id: String(row.id),
+            environmentId: String(row.environmentId),
+            name: String(row.name),
+            value: this.open(row.value, variableIdentity('environment', String(row.environmentId), String(row.name))),
+            secret: Boolean(row.secret),
+            description: nullableString(row.description),
+            updatedBy: nullableString(row.updatedBy),
+            updatedAt: decodeDate(row.updatedAt),
+        }));
+    }
+    async appVariables(appId) {
+        const rows = await this.query()
+            .selectFrom('relAppVariables')
+            .selectAll()
+            .where('appId', '=', appId)
+            .orderBy('name', 'asc')
+            .execute();
+        return rows.map((row) => ({
+            id: String(row.id),
+            appId: String(row.appId),
+            name: String(row.name),
+            value: this.open(row.value, variableIdentity('app', String(row.appId), String(row.name))),
+            secret: Boolean(row.secret),
+            generated: Boolean(row.generated),
+        }));
+    }
+    async setEnvironmentVariable(environmentId, name, input) {
+        const sealed = this.seal(input.value, variableIdentity('environment', environmentId, name));
+        const now = new Date();
+        const existing = await this.query()
+            .selectFrom('relEnvironmentVariables')
+            .select('id')
+            .where('environmentId', '=', environmentId)
+            .where('name', '=', name)
+            .executeTakeFirst();
+        if (existing)
+            await this.query()
+                .updateTable('relEnvironmentVariables')
+                .set({
+                value: sealed,
+                secret: input.secret,
+                ...(input.description === undefined
+                    ? {}
+                    : { description: input.description }),
+                updatedBy: input.by,
+                updatedAt: now,
+            })
+                .where('id', '=', String(existing.id))
+                .execute();
+        else
+            await this.query()
+                .insertInto('relEnvironmentVariables')
+                .values({
+                id: randomUUID(),
+                environmentId,
+                name,
+                value: sealed,
+                secret: input.secret,
+                description: input.description ?? null,
+                createdBy: input.by,
+                updatedBy: input.by,
+                createdAt: now,
+                updatedAt: now,
+            })
+                .execute();
+    }
+    async unsetEnvironmentVariable(environmentId, name) {
+        const result = await this.query()
+            .deleteFrom('relEnvironmentVariables')
+            .where('environmentId', '=', environmentId)
+            .where('name', '=', name)
+            .execute();
+        return Number(result.deletedCount ?? 0) > 0;
+    }
+    /** Sets the App's value. */
+    async setAppVariable(appId, name, input, connection) {
+        const query = connection?.query ?? this.query();
+        const sealed = this.seal(input.value, variableIdentity('app', appId, name));
+        const now = new Date();
+        const existing = await query
+            .selectFrom('relAppVariables')
+            .select('id')
+            .where('appId', '=', appId)
+            .where('name', '=', name)
+            .executeTakeFirst();
+        if (existing)
+            await query
+                .updateTable('relAppVariables')
+                .set({
+                value: sealed,
+                secret: input.secret,
+                generated: input.generated === true,
+                updatedBy: input.by,
+                updatedAt: now,
+            })
+                .where('id', '=', String(existing.id))
+                .execute();
+        else
+            await query
+                .insertInto('relAppVariables')
+                .values({
+                id: randomUUID(),
+                appId,
+                name,
+                value: sealed,
+                secret: input.secret,
+                generated: input.generated === true,
+                createdBy: input.by,
+                updatedBy: input.by,
+                createdAt: now,
+                updatedAt: now,
+            })
+                .execute();
+    }
+    /** Removes an App's variable; answers whether it had a value. */
+    async unsetAppVariable(appId, name) {
+        const row = await this.query()
+            .selectFrom('relAppVariables')
+            .select(['id', 'value'])
+            .where('appId', '=', appId)
+            .where('name', '=', name)
+            .executeTakeFirst();
+        if (!row)
+            return false;
+        await this.query()
+            .deleteFrom('relAppVariables')
+            .where('id', '=', String(row.id))
+            .execute();
+        return row.value != null;
+    }
+    async removeApp(appId, connection) {
+        await connection.query
+            .deleteFrom('relAppVariables')
+            .where('appId', '=', appId)
+            .execute();
+    }
+    async removeEnvironment(environmentId) {
+        await this.query()
+            .deleteFrom('relEnvironmentVariables')
+            .where('environmentId', '=', environmentId)
+            .execute();
+    }
+    seal(value, identity) {
+        return encryptText(value, identity, this.options.secrets, 'variables');
+    }
+    /** A sealed value opened; one that no longer opens (another key, damaged) reads as unset. */
+    open(value, identity) {
+        if (typeof value !== 'string' || value === '')
+            return null;
+        try {
+            return decryptText(value, identity, this.options.secrets, 'variables');
+        }
+        catch {
+            return null;
+        }
+    }
+    query() {
+        return this.options.database.connection().query;
+    }
+}
+export function environmentVariableView(variable) {
+    return {
+        name: variable.name,
+        secret: variable.secret,
+        description: variable.description,
+        ...valueView(variable.value, variable.secret),
+        updatedBy: variable.updatedBy,
+        updatedAt: variable.updatedAt.toISOString(),
+    };
+}
+function valueView(value, secret) {
+    return { set: value !== null, value: secret ? null : value };
+}
+/** Resolves the variables of one deployment; nothing here reads or writes the database. */
+export function resolveVariables(input) {
+    const declared = new Map();
+    for (const variable of input.manifest?.variables ?? [])
+        if (!RESERVED_VARIABLE_NAMES.includes(variable.name))
+            declared.set(variable.name, variable);
+    const environment = new Map(input.environment.map((v) => [v.name, v]));
+    const app = new Map(input.app.map((v) => [v.name, v]));
+    const generated = input.generated ?? {};
+    const names = new Set([
+        ...declared.keys(),
+        ...environment.keys(),
+        ...[...app.values()].filter((v) => v.value !== null).map((v) => v.name),
+        ...Object.keys(generated),
+    ]);
+    const variables = [];
+    const env = {};
+    for (const name of [...names].sort()) {
+        if (RESERVED_VARIABLE_NAMES.includes(name))
+            continue;
+        const declaration = declared.get(name) ?? null;
+        const own = app.get(name) ?? null;
+        const shared = environment.get(name) ?? null;
+        let source;
+        let value;
+        if (own?.value != null) {
+            source = own.generated ? 'generated' : 'app';
+            value = own.value;
+        }
+        else if (shared?.value != null) {
+            source = 'environment';
+            value = shared.value;
+        }
+        else if (declaration?.path &&
+            hasRealValue(input.configFile, declaration.path)) {
+            source = 'configFile';
+        }
+        else if (generated[name] !== undefined) {
+            source = 'generated';
+            value = generated[name];
+        }
+        else if (input.generatable?.has(name)) {
+            source = 'generated';
+        }
+        else if (declaration?.hasDefault) {
+            source = 'default';
+        }
+        else {
+            source = 'unset';
+        }
+        if (value !== undefined)
+            env[name] = value;
+        const firstStartOnly = declaration?.firstStartOnly ?? false;
+        const required = declaration?.required ?? false;
+        const missing = required && source === 'unset';
+        const changed = !firstStartOnly &&
+            input.running !== undefined &&
+            input.running !== null &&
+            input.running[name] !== value;
+        variables.push({
+            name,
+            declaration,
+            source,
+            secret: (declaration?.secret ?? false) ||
+                Boolean(own?.secret || shared?.secret),
+            firstStartOnly,
+            required,
+            value,
+            missing,
+            changed,
+            app: own,
+            environment: shared,
+        });
+    }
+    // A variable the running deployment had and nothing gives any more changed too.
+    const removed = input.running !== undefined && input.running !== null
+        ? Object.keys(input.running).some((name) => !names.has(name) && !(declared.get(name)?.firstStartOnly ?? false))
+        : false;
+    return {
+        env,
+        variables,
+        missing: variables
+            .filter((variable) => variable.missing && variable.declaration)
+            .map((variable) => variable.declaration),
+        fingerprint: fingerprintOf(env, input.manifest),
+        changed: removed || variables.some((variable) => variable.changed),
+    };
+}
+/** The fingerprint of what a deployment's variables give, leaving out what is read only on the first start. */
+export function fingerprintOf(env, manifest) {
+    const firstStartOnly = new Set((manifest?.variables ?? [])
+        .filter((variable) => variable.firstStartOnly)
+        .map((variable) => variable.name));
+    const entries = Object.entries(env)
+        .filter(([name]) => !firstStartOnly.has(name))
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return createHash('sha256').update(JSON.stringify(entries)).digest('hex');
+}
+/** How the App variables page shows a resolved variable. */
+export function appVariableView(variable) {
+    const { secret } = variable;
+    return {
+        name: variable.name,
+        declared: variable.declaration !== null,
+        description: variable.declaration?.description ??
+            variable.environment?.description ??
+            null,
+        secret,
+        required: variable.required,
+        firstStartOnly: variable.firstStartOnly,
+        generate: variable.declaration?.generate ?? null,
+        source: variable.source,
+        value: secret ? null : (variable.value ?? null),
+        missing: variable.missing,
+        changed: variable.changed,
+        app: variable.app
+            ? {
+                ...valueView(variable.app.value, secret),
+                generated: variable.app.generated,
+            }
+            : null,
+        environment: variable.environment
+            ? valueView(variable.environment.value, secret)
+            : null,
+    };
+}
+// --- Configuration file -----------------------------------------------------------------------------------------
+/** The value at a dotted path of a parsed configuration. */
+export function configValueAt(config, path) {
+    let value = config;
+    for (const segment of path.split('.')) {
+        if (!isRecord(value))
+            return undefined;
+        value = value[segment];
+    }
+    return value;
+}
+/** Whether the configuration holds a value at the path that is not an example's placeholder. */
+export function hasRealValue(config, path) {
+    const value = configValueAt(config, path);
+    if (value === undefined || value === null || value === '')
+        return false;
+    if (Array.isArray(value) && value.length === 0)
+        return false;
+    return !isExamplePlaceholder(value) && !isPlaceholderText(value);
+}
+function isPlaceholderText(value) {
+    return typeof value === 'string' && /^replace-with-/u.test(value.trim());
+}
+//# sourceMappingURL=variables.js.map