@quiltdata/benchling-webhook 0.5.4 → 0.6.1-20251104T043302Z

package/dist/lib/utils/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../lib/utils/config.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,MAAM;IAErB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IAGtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,CAAC;IAGjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,QAAQ,EAAE,MAAM,CAAC;IAGjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAerD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBnE;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C3E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EACvB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAkExE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CA0CvE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../lib/utils/config.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,MAAM;IAErB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IAIzB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IAGtB,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,CAAC;IAGjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,QAAQ,EAAE,MAAM,CAAC;IAGjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAerD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA6BlE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAY3C;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsD3E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EACvB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,OAAO,CAAC,MAAM,CAAC,CASjB;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,gBAAgB,CAkExE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CA0CvE"}

package/dist/lib/utils/config.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getQuilt3Catalog = getQuilt3Catalog;
 exports.loadDotenv = loadDotenv;
+exports.processBenchlingSecretsInput = processBenchlingSecretsInput;
+exports.maskArn = maskArn;
 exports.loadConfigSync = loadConfigSync;
 exports.mergeInferredConfig = mergeInferredConfig;
 exports.validateConfig = validateConfig;
@@ -49,6 +51,84 @@ function loadDotenv(filePath) {
     }
     return result.parsed || {};
 }
+/**
+ * Process benchling-secrets parameter, handling @file.json syntax
+ *
+ * Supports three input formats:
+ * - ARN: `arn:aws:secretsmanager:...` - passed through unchanged
+ * - JSON: `{"client_id":"...","client_secret":"...","tenant":"..."}` - passed through unchanged
+ * - File: `@secrets.json` - reads file content from path after @ symbol
+ *
+ * @param input - The benchling-secrets value (ARN, JSON, or @filepath)
+ * @returns Processed secret string (trimmed)
+ * @throws Error if file not found or not readable
+ *
+ * @example
+ * // Pass through ARN
+ * processBenchlingSecretsInput("arn:aws:secretsmanager:...")
+ * // Returns: "arn:aws:secretsmanager:..."
+ *
+ * @example
+ * // Pass through JSON
+ * processBenchlingSecretsInput('{"client_id":"...","client_secret":"...","tenant":"..."}')
+ * // Returns: '{"client_id":"...","client_secret":"...","tenant":"..."}'
+ *
+ * @example
+ * // Read from file
+ * processBenchlingSecretsInput("@secrets.json")
+ * // Returns: contents of secrets.json (trimmed)
+ */
+function processBenchlingSecretsInput(input) {
+    const trimmed = input.trim();
+    // Check for @file syntax
+    if (trimmed.startsWith("@")) {
+        const filePath = trimmed.slice(1); // Remove @ prefix
+        const resolvedPath = (0, path_1.resolve)(filePath);
+        if (!(0, fs_1.existsSync)(resolvedPath)) {
+            throw new Error(`Secrets file not found: ${filePath}\n` +
+                `  Resolved path: ${resolvedPath}\n` +
+                "  Tip: Use relative or absolute path after @ (e.g., @secrets.json or @/path/to/secrets.json)");
+        }
+        try {
+            const fileContent = (0, fs_1.readFileSync)(resolvedPath, "utf-8");
+            return fileContent.trim();
+        }
+        catch (error) {
+            throw new Error(`Failed to read secrets file: ${filePath}\n` +
+                `  Error: ${error.message}`);
+        }
+    }
+    // Return as-is for ARN or inline JSON
+    return trimmed;
+}
+/**
+ * Mask sensitive parts of ARN for display
+ *
+ * Shows region and partial secret name, masks account ID for security.
+ * Account ID is masked as ****XXXX where XXXX are the last 4 digits.
+ *
+ * @param arn - AWS Secrets Manager ARN to mask
+ * @returns Masked ARN string or original input if not valid ARN format
+ *
+ * @example
+ * maskArn("arn:aws:secretsmanager:us-east-1:123456789012:secret:name")
+ * // Returns: "arn:aws:secretsmanager:us-east-1:****9012:secret:name"
+ *
+ * @example
+ * maskArn("not-an-arn")
+ * // Returns: "not-an-arn"
+ */
+function maskArn(arn) {
+    // Pattern: arn:aws:secretsmanager:region:account:secret:name
+    const match = arn.match(/^(arn:aws:secretsmanager:[^:]+:)(\d{12})(:.+)$/);
+    if (match) {
+        const [, prefix, account, suffix] = match;
+        const maskedAccount = "****" + account.slice(-4);
+        return prefix + maskedAccount + suffix;
+    }
+    // Return as-is if pattern doesn't match
+    return arn;
+}
 /**
  * Load configuration from multiple sources with priority:
  * 1. CLI options (highest)
@@ -76,6 +156,12 @@ function loadConfigSync(options = {}) {
         benchlingClientId: options.clientId || envVars.BENCHLING_CLIENT_ID,
         benchlingClientSecret: options.clientSecret || envVars.BENCHLING_CLIENT_SECRET,
         benchlingAppDefinitionId: options.appId || envVars.BENCHLING_APP_DEFINITION_ID,
+        // Unified secrets (priority: CLI > env > .env)
+        // Process file input syntax (@file.json) if present
+        benchlingSecrets: (() => {
+            const rawSecrets = options.benchlingSecrets || envVars.BENCHLING_SECRETS;
+            return rawSecrets ? processBenchlingSecretsInput(rawSecrets) : undefined;
+        })(),
         // AWS
         cdkAccount: envVars.CDK_DEFAULT_ACCOUNT,
         cdkRegion: options.region || envVars.CDK_DEFAULT_REGION || envVars.AWS_REGION,

package/dist/lib/utils/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../lib/utils/config.ts"],"names":[],"mappings":";;AAkEA,4CAeC;AAKD,gCAmBC;AAUD,wCA+CC;AAKD,kDAYC;AAKD,wCAkEC;AAKD,wDA0CC;AAzSD,mCAAgD;AAChD,iDAAuD;AACvD,2BAAgC;AAChC,+BAA+B;AAC/B,iDAAyC;AA2DzC;;GAEG;AACH,SAAgB,gBAAgB;IAC5B,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,0BAA0B;QAC1B,IAAI,OAAO,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,GAAG,CAAC,QAAQ,CAAC;QACxB,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,yCAAyC;QACzC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,QAAgB;IACvC,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,eAAY,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,IAAA,sBAAY,EAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,UAAyB,EAAE;IACtD,oBAAoB;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAA,eAAU,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAElD,uDAAuD;IACvD,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,mDAAmD;IACnD,MAAM,MAAM,GAAoB;QAChC,QAAQ;QACJ,YAAY,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,IAAI,aAAa;QACvE,eAAe,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,iBAAiB;QAC5D,aAAa,EAAE,OAAO,CAAC,cAAc;QAErC,YAAY;QACZ,eAAe,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,gBAAgB;QAC3D,iBAAiB,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,mBAAmB;QAClE,qBAAqB,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,uBAAuB;QAC9E,wBAAwB,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,2BAA2B;QAE9E,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,mBAAmB;QACvC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,UAAU;QAC7E,UAAU,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW;QAElD,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,SAAS;QAE3B,WAAW;QACX,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,WAAW;QAC5C,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe;QAC1C,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM;QACrC,gBAAgB,EAAE,OAAO,CAAC,kBAAkB;QAC5C,yBAAyB,EAAE,OAAO,CAAC,2BAA2B,IAAI,MAAM;QACxE,mBAAmB,EAAE,OAAO,CAAC,qBAAqB;QAClD,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,IAAI,qBAAqB;QACvE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,QAAQ;KAC9D,CAAC;IAEF,0BAA0B;IAC1B,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAC/B,MAAuB,EACvB,YAAoC;IAEpC,8CAA8C;IAC9C,OAAO;QACH,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,YAAY,CAAC,mBAAmB;QACjE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC,kBAAkB;QAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,YAAY,CAAC,SAAS;QACnD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,cAAc;QAClE,GAAG,MAAM,EAAE,qCAAqC;KACnD,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,MAAuB;IAClD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,qDAAqD;IACrD,MAAM,kBAAkB,GAA0C;QAC9D,CAAC,cAAc,EAAE,mBAAmB,EAAE,6DAA6D,CAAC;QACpG,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,4GAA4G,CAAC;QACvJ,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,wEAAwE,CAAC;QACjH,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,yCAAyC,CAAC;QAC7F,CAAC,uBAAuB,EAAE,+BAA+B,EAAE,6CAA6C,CAAC;QACzG,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,iEAAiE;gBACzH,yDAAyD;gBACzD,2CAA2C;gBAC3C,yDAAyD,CAAC;KACjE,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,KAAe;gBACtB,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,QAAQ;aACX,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,MAAM,sBAAsB,GAAkC;QAC1D,CAAC,YAAY,EAAE,gBAAgB,CAAC;QAChC,CAAC,WAAW,EAAE,YAAY,CAAC;QAC3B,CAAC,UAAU,EAAE,eAAe,CAAC;QAC7B,CAAC,eAAe,EAAE,qBAAqB,CAAC;KAC3C,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,KAAe;gBACtB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,mFAAmF;aAChG,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,qHAAqH,CAAC,CAAC;IACzI,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,yBAAyB,KAAK,OAAO,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IAED,OAAO;QACH,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;KACX,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,MAAwB;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACjB,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACxC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACjB,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACxC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../lib/utils/config.ts"],"names":[],"mappings":";;AA2EA,4CAeC;AAKD,gCAmBC;AA6BD,oEA6BC;AAmBD,0BAYC;AAUD,wCAsDC;AAKD,kDAYC;AAKD,wCAkEC;AAKD,wDA0CC;AAlZD,mCAAgD;AAChD,iDAAuD;AACvD,2BAA8C;AAC9C,+BAA+B;AAC/B,iDAAyC;AAoEzC;;GAEG;AACH,SAAgB,gBAAgB;IAC5B,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACnG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,0BAA0B;QAC1B,IAAI,OAAO,EAAE,CAAC;YACV,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,GAAG,CAAC,QAAQ,CAAC;QACxB,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,yCAAyC;QACzC,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,QAAgB;IACvC,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,QAAQ,CAAC,CAAC;IAEvC,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,eAAY,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,+BAA+B;IAC/B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,IAAA,sBAAY,EAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,4BAA4B,CAAC,KAAa;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,yBAAyB;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;QACrD,MAAM,YAAY,GAAG,IAAA,cAAO,EAAC,QAAQ,CAAC,CAAC;QAEvC,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACX,2BAA2B,QAAQ,IAAI;gBACvC,oBAAoB,YAAY,IAAI;gBACpC,8FAA8F,CACjG,CAAC;QACN,CAAC;QAED,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,IAAA,iBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACxD,OAAO,WAAW,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACX,gCAAgC,QAAQ,IAAI;gBAC5C,YAAa,KAAe,CAAC,OAAO,EAAE,CACzC,CAAC;QACN,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,OAAO,CAAC,GAAW;IAC/B,6DAA6D;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAE1E,IAAI,KAAK,EAAE,CAAC;QACR,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;QAC1C,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,OAAO,MAAM,GAAG,aAAa,GAAG,MAAM,CAAC;IAC3C,CAAC;IAED,wCAAwC;IACxC,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,UAAyB,EAAE;IACtD,oBAAoB;IACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAA,eAAU,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElE,4BAA4B;IAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAElD,uDAAuD;IACvD,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;IAEzC,mDAAmD;IACnD,MAAM,MAAM,GAAoB;QAChC,QAAQ;QACJ,YAAY,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,IAAI,aAAa;QACvE,eAAe,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,iBAAiB;QAC5D,aAAa,EAAE,OAAO,CAAC,cAAc;QAErC,YAAY;QACZ,eAAe,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,gBAAgB;QAC3D,iBAAiB,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,mBAAmB;QAClE,qBAAqB,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,uBAAuB;QAC9E,wBAAwB,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,2BAA2B;QAE9E,+CAA+C;QAC/C,oDAAoD;QACpD,gBAAgB,EAAE,CAAC,GAAuB,EAAE;YACxC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,iBAAiB,CAAC;YACzE,OAAO,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,CAAC,CAAC,EAAE;QAEJ,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,mBAAmB;QACvC,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,UAAU;QAC7E,UAAU,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW;QAElD,MAAM;QACN,QAAQ,EAAE,OAAO,CAAC,SAAS;QAE3B,WAAW;QACX,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,WAAW;QAC5C,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe;QAC1C,QAAQ,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM;QACrC,gBAAgB,EAAE,OAAO,CAAC,kBAAkB;QAC5C,yBAAyB,EAAE,OAAO,CAAC,2BAA2B,IAAI,MAAM;QACxE,mBAAmB,EAAE,OAAO,CAAC,qBAAqB;QAClD,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,IAAI,qBAAqB;QACvE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,IAAI,QAAQ;KAC9D,CAAC;IAEF,0BAA0B;IAC1B,OAAO,MAAM,CAAC,WAAW,CACrB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CACzC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAC/B,MAAuB,EACvB,YAAoC;IAEpC,8CAA8C;IAC9C,OAAO;QACH,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,YAAY,CAAC,mBAAmB;QACjE,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,YAAY,CAAC,kBAAkB;QAC9D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,YAAY,CAAC,SAAS;QACnD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,YAAY,CAAC,cAAc;QAClE,GAAG,MAAM,EAAE,qCAAqC;KACnD,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,MAAuB;IAClD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,qDAAqD;IACrD,MAAM,kBAAkB,GAA0C;QAC9D,CAAC,cAAc,EAAE,mBAAmB,EAAE,6DAA6D,CAAC;QACpG,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,4GAA4G,CAAC;QACvJ,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,wEAAwE,CAAC;QACjH,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,yCAAyC,CAAC;QAC7F,CAAC,uBAAuB,EAAE,+BAA+B,EAAE,6CAA6C,CAAC;QACzG,CAAC,0BAA0B,EAAE,6BAA6B,EAAE,iEAAiE;gBACzH,yDAAyD;gBACzD,2CAA2C;gBAC3C,yDAAyD,CAAC;KACjE,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,kBAAkB,EAAE,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,KAAe;gBACtB,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,QAAQ;aACX,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,MAAM,sBAAsB,GAAkC;QAC1D,CAAC,YAAY,EAAE,gBAAgB,CAAC;QAChC,CAAC,WAAW,EAAE,YAAY,CAAC;QAC3B,CAAC,UAAU,EAAE,eAAe,CAAC;QAC7B,CAAC,eAAe,EAAE,qBAAqB,CAAC;KAC3C,CAAC;IAEF,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,KAAe;gBACtB,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,mFAAmF;aAChG,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChF,QAAQ,CAAC,IAAI,CAAC,qHAAqH,CAAC,CAAC;IACzI,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,oBAAoB;IACpB,IAAI,MAAM,CAAC,yBAAyB,KAAK,OAAO,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IAED,OAAO;QACH,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM;QACN,QAAQ;KACX,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,MAAwB;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEf,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACjB,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACxC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBACjB,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACxC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/lib/utils/secrets.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Benchling Secrets Management
+ *
+ * This module provides types, validation, and utilities for managing
+ * Benchling API credentials in AWS Secrets Manager.
+ *
+ * ## Supported Formats
+ *
+ * ### ARN Format
+ * Provide the ARN of an existing AWS Secrets Manager secret:
+ * ```
+ * arn:aws:secretsmanager:us-east-1:123456789012:secret:benchling-webhook/credentials
+ * ```
+ *
+ * ### JSON Format
+ * Provide credentials as a JSON object:
+ * ```json
+ * {
+ *   "client_id": "your-client-id",
+ *   "client_secret": "your-client-secret",
+ *   "tenant": "your-tenant",
+ *   "app_definition_id": "optional-app-id",
+ *   "api_url": "https://optional-api-url.com"
+ * }
+ * ```
+ *
+ * ## Usage
+ *
+ * ```typescript
+ * import { parseAndValidateSecrets } from './secrets';
+ *
+ * // Parse and validate ARN
+ * const arnConfig = parseAndValidateSecrets(
+ *   'arn:aws:secretsmanager:us-east-1:123456789012:secret:name'
+ * );
+ * console.log(arnConfig.format); // "arn"
+ * console.log(arnConfig.arn); // the validated ARN
+ *
+ * // Parse and validate JSON
+ * const jsonConfig = parseAndValidateSecrets(
+ *   '{"client_id":"abc","client_secret":"secret","tenant":"company"}'
+ * );
+ * console.log(jsonConfig.format); // "json"
+ * console.log(jsonConfig.data); // the validated secret data
+ *
+ * // Handle validation errors
+ * try {
+ *   parseAndValidateSecrets('invalid');
+ * } catch (error) {
+ *   if (error instanceof SecretsValidationError) {
+ *     console.error(error.formatForCLI());
+ *   }
+ * }
+ * ```
+ *
+ * @module secrets
+ */
+/**
+ * Benchling secret structure stored in AWS Secrets Manager
+ */
+export interface BenchlingSecretData {
+    /** Benchling OAuth client ID */
+    client_id: string;
+    /** Benchling OAuth client secret */
+    client_secret: string;
+    /** Benchling tenant name (e.g., "company" for company.benchling.com) */
+    tenant: string;
+    /** Benchling app definition ID (optional for backward compatibility) */
+    app_definition_id?: string;
+    /** Custom Benchling API URL (optional, defaults to https://{tenant}.benchling.com) */
+    api_url?: string;
+}
+/**
+ * Accepted formats for BENCHLING_SECRETS parameter
+ * Can be either a Secret ARN or JSON string
+ */
+export type BenchlingSecretsInput = string;
+/**
+ * Parsed and validated secret configuration
+ */
+export interface BenchlingSecretsConfig {
+    /** The input format detected */
+    format: "arn" | "json";
+    /** If format is "arn", the validated ARN */
+    arn?: string;
+    /** If format is "json", the validated secret data */
+    data?: BenchlingSecretData;
+    /** Original input value (for error messages) */
+    original: string;
+}
+/**
+ * Validation result with errors and warnings
+ */
+export interface ValidationResult {
+    valid: boolean;
+    errors: ValidationError[];
+    warnings: string[];
+}
+/**
+ * Validation error details
+ */
+export interface ValidationError {
+    field: string;
+    message: string;
+    suggestion?: string;
+}
+/**
+ * Detect whether input is an ARN or JSON string
+ *
+ * @param input - The BENCHLING_SECRETS input value
+ * @returns "arn" if input looks like an ARN, "json" otherwise
+ *
+ * @example
+ * detectSecretsFormat("arn:aws:secretsmanager:...") // returns "arn"
+ * detectSecretsFormat('{"client_id":"..."}') // returns "json"
+ */
+export declare function detectSecretsFormat(input: string): "arn" | "json";
+/**
+ * Validate AWS Secrets Manager ARN format
+ *
+ * @param arn - The ARN string to validate
+ * @returns Validation result with errors and warnings
+ *
+ * @example
+ * validateSecretArn("arn:aws:secretsmanager:us-east-1:123456789012:secret:name")
+ * // returns { valid: true, errors: [], warnings: [] }
+ */
+export declare function validateSecretArn(arn: string): ValidationResult;
+/**
+ * Validate secret data structure and field values
+ *
+ * @param data - The secret data object to validate
+ * @returns Validation result with errors and warnings
+ *
+ * @example
+ * validateSecretData({ client_id: "abc", client_secret: "secret", tenant: "company" })
+ * // returns { valid: true, errors: [], warnings: [] }
+ */
+export declare function validateSecretData(data: unknown): ValidationResult;
+/**
+ * Custom error class for secrets validation failures
+ */
+export declare class SecretsValidationError extends Error {
+    readonly errors: ValidationError[];
+    readonly warnings: string[];
+    constructor(message: string, errors: ValidationError[], warnings: string[]);
+    /**
+     * Format errors for CLI display
+     */
+    formatForCLI(): string;
+}
+/**
+ * Parse and validate BENCHLING_SECRETS input
+ *
+ * This is the main entry point for secret validation. It detects the format
+ * (ARN or JSON), performs appropriate validation, and returns a structured
+ * configuration object.
+ *
+ * @param input - The BENCHLING_SECRETS input string
+ * @returns Parsed and validated configuration
+ * @throws SecretsValidationError if validation fails
+ *
+ * @example
+ * // Parse ARN
+ * const config = parseAndValidateSecrets("arn:aws:secretsmanager:...")
+ * console.log(config.format) // "arn"
+ *
+ * @example
+ * // Parse JSON
+ * const config = parseAndValidateSecrets('{"client_id":"...","client_secret":"...","tenant":"..."}')
+ * console.log(config.format) // "json"
+ */
+export declare function parseAndValidateSecrets(input: string): BenchlingSecretsConfig;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/lib/utils/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../lib/utils/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAC;IAElB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;IAEtB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IAEf,wEAAwE;IACxE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE3C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,gCAAgC;IAChC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAEvB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,qDAAqD;IACrD,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAE3B,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAgBjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAoD/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,gBAAgB,CAoGlE;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC7C,SAAgB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1C,SAAgB,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAEvB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAY1E;;OAEG;IACI,YAAY,IAAI,MAAM;CAwBhC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CAyD7E"}

package/dist/lib/utils/secrets.js

@@ -0,0 +1,351 @@
+"use strict";
+/**
+ * Benchling Secrets Management
+ *
+ * This module provides types, validation, and utilities for managing
+ * Benchling API credentials in AWS Secrets Manager.
+ *
+ * ## Supported Formats
+ *
+ * ### ARN Format
+ * Provide the ARN of an existing AWS Secrets Manager secret:
+ * ```
+ * arn:aws:secretsmanager:us-east-1:123456789012:secret:benchling-webhook/credentials
+ * ```
+ *
+ * ### JSON Format
+ * Provide credentials as a JSON object:
+ * ```json
+ * {
+ *   "client_id": "your-client-id",
+ *   "client_secret": "your-client-secret",
+ *   "tenant": "your-tenant",
+ *   "app_definition_id": "optional-app-id",
+ *   "api_url": "https://optional-api-url.com"
+ * }
+ * ```
+ *
+ * ## Usage
+ *
+ * ```typescript
+ * import { parseAndValidateSecrets } from './secrets';
+ *
+ * // Parse and validate ARN
+ * const arnConfig = parseAndValidateSecrets(
+ *   'arn:aws:secretsmanager:us-east-1:123456789012:secret:name'
+ * );
+ * console.log(arnConfig.format); // "arn"
+ * console.log(arnConfig.arn); // the validated ARN
+ *
+ * // Parse and validate JSON
+ * const jsonConfig = parseAndValidateSecrets(
+ *   '{"client_id":"abc","client_secret":"secret","tenant":"company"}'
+ * );
+ * console.log(jsonConfig.format); // "json"
+ * console.log(jsonConfig.data); // the validated secret data
+ *
+ * // Handle validation errors
+ * try {
+ *   parseAndValidateSecrets('invalid');
+ * } catch (error) {
+ *   if (error instanceof SecretsValidationError) {
+ *     console.error(error.formatForCLI());
+ *   }
+ * }
+ * ```
+ *
+ * @module secrets
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsValidationError = void 0;
+exports.detectSecretsFormat = detectSecretsFormat;
+exports.validateSecretArn = validateSecretArn;
+exports.validateSecretData = validateSecretData;
+exports.parseAndValidateSecrets = parseAndValidateSecrets;
+/**
+ * Detect whether input is an ARN or JSON string
+ *
+ * @param input - The BENCHLING_SECRETS input value
+ * @returns "arn" if input looks like an ARN, "json" otherwise
+ *
+ * @example
+ * detectSecretsFormat("arn:aws:secretsmanager:...") // returns "arn"
+ * detectSecretsFormat('{"client_id":"..."}') // returns "json"
+ */
+function detectSecretsFormat(input) {
+    // Trim whitespace
+    const trimmed = input.trim();
+    // Check if starts with ARN prefix
+    if (trimmed.startsWith("arn:aws:secretsmanager:")) {
+        return "arn";
+    }
+    // Check if starts with { (JSON object)
+    if (trimmed.startsWith("{")) {
+        return "json";
+    }
+    // Default to JSON and let validation catch errors
+    return "json";
+}
+/**
+ * Validate AWS Secrets Manager ARN format
+ *
+ * @param arn - The ARN string to validate
+ * @returns Validation result with errors and warnings
+ *
+ * @example
+ * validateSecretArn("arn:aws:secretsmanager:us-east-1:123456789012:secret:name")
+ * // returns { valid: true, errors: [], warnings: [] }
+ */
+function validateSecretArn(arn) {
+    const errors = [];
+    const warnings = [];
+    // Check ARN format using regex
+    // Pattern: arn:aws:secretsmanager:region:account:secret:name
+    const arnPattern = /^arn:aws:secretsmanager:([a-z0-9-]+):(\d{12}):secret:(.+)$/;
+    const match = arn.match(arnPattern);
+    if (!match) {
+        errors.push({
+            field: "arn",
+            message: "Invalid AWS Secrets Manager ARN format",
+            suggestion: "Expected format: arn:aws:secretsmanager:region:account:secret:name",
+        });
+        return { valid: false, errors, warnings };
+    }
+    const [, region, accountId, secretName] = match;
+    // Validate region (basic check - not empty)
+    if (!region || region.length === 0) {
+        errors.push({
+            field: "region",
+            message: "ARN missing AWS region",
+            suggestion: "Ensure ARN includes a valid AWS region (e.g., us-east-1)",
+        });
+    }
+    // Validate account ID (must be exactly 12 digits)
+    if (accountId.length !== 12) {
+        errors.push({
+            field: "account",
+            message: "Invalid AWS account ID in ARN",
+            suggestion: "Account ID must be exactly 12 digits",
+        });
+    }
+    // Validate secret name (not empty)
+    if (!secretName || secretName.length === 0) {
+        errors.push({
+            field: "secret",
+            message: "ARN missing secret name",
+            suggestion: "Ensure ARN includes the secret name",
+        });
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Validate secret data structure and field values
+ *
+ * @param data - The secret data object to validate
+ * @returns Validation result with errors and warnings
+ *
+ * @example
+ * validateSecretData({ client_id: "abc", client_secret: "secret", tenant: "company" })
+ * // returns { valid: true, errors: [], warnings: [] }
+ */
+function validateSecretData(data) {
+    const errors = [];
+    const warnings = [];
+    // Check if data is an object
+    if (typeof data !== "object" || data === null || Array.isArray(data)) {
+        errors.push({
+            field: "data",
+            message: "Secret data must be a JSON object",
+            suggestion: "Expected format: {\"client_id\": \"...\", \"client_secret\": \"...\", \"tenant\": \"...\"}",
+        });
+        return { valid: false, errors, warnings };
+    }
+    const secretData = data;
+    // Required fields
+    const requiredFields = [
+        "client_id",
+        "client_secret",
+        "tenant",
+    ];
+    for (const field of requiredFields) {
+        if (!(field in secretData)) {
+            errors.push({
+                field,
+                message: `Missing required field: ${field}`,
+                suggestion: `Add "${field}" to your secret configuration`,
+            });
+        }
+        else if (typeof secretData[field] !== "string") {
+            errors.push({
+                field,
+                message: `Field ${field} must be a string`,
+                suggestion: `Change ${field} value to a string`,
+            });
+        }
+        else if (secretData[field].trim() === "") {
+            errors.push({
+                field,
+                message: `Field ${field} cannot be empty`,
+                suggestion: `Provide a non-empty value for ${field}`,
+            });
+        }
+    }
+    // Optional fields type checking
+    const optionalFields = [
+        "app_definition_id",
+        "api_url",
+    ];
+    for (const field of optionalFields) {
+        if (field in secretData && typeof secretData[field] !== "string") {
+            errors.push({
+                field,
+                message: `Field ${field} must be a string`,
+                suggestion: `Change ${field} value to a string or remove it`,
+            });
+        }
+    }
+    // Validate tenant format (alphanumeric and hyphens)
+    if (secretData.tenant && typeof secretData.tenant === "string") {
+        const tenantPattern = /^[a-z0-9-]+$/i;
+        if (!tenantPattern.test(secretData.tenant)) {
+            errors.push({
+                field: "tenant",
+                message: "Invalid tenant format",
+                suggestion: "Tenant must contain only letters, numbers, and hyphens",
+            });
+        }
+    }
+    // Validate api_url if provided
+    if (secretData.api_url && typeof secretData.api_url === "string") {
+        try {
+            new URL(secretData.api_url);
+        }
+        catch {
+            errors.push({
+                field: "api_url",
+                message: "Invalid URL format for api_url",
+                suggestion: "Provide a valid URL (e.g., https://company.benchling.com)",
+            });
+        }
+    }
+    // Check for unknown fields (warning only)
+    const knownFields = new Set([...requiredFields, ...optionalFields]);
+    for (const field in secretData) {
+        if (!knownFields.has(field)) {
+            warnings.push(`Unknown field "${field}" will be ignored`);
+        }
+    }
+    return {
+        valid: errors.length === 0,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Custom error class for secrets validation failures
+ */
+class SecretsValidationError extends Error {
+    constructor(message, errors, warnings) {
+        super(message);
+        this.name = "SecretsValidationError";
+        this.errors = errors;
+        this.warnings = warnings;
+        // Maintain proper stack trace (only available on V8)
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, SecretsValidationError);
+        }
+    }
+    /**
+     * Format errors for CLI display
+     */
+    formatForCLI() {
+        const lines = [this.message, ""];
+        if (this.errors.length > 0) {
+            lines.push("Errors:");
+            for (const error of this.errors) {
+                lines.push(`  × ${error.field}: ${error.message}`);
+                if (error.suggestion) {
+                    lines.push(`    → ${error.suggestion}`);
+                }
+            }
+            lines.push("");
+        }
+        if (this.warnings.length > 0) {
+            lines.push("Warnings:");
+            for (const warning of this.warnings) {
+                lines.push(`  ⚠ ${warning}`);
+            }
+            lines.push("");
+        }
+        return lines.join("\n");
+    }
+}
+exports.SecretsValidationError = SecretsValidationError;
+/**
+ * Parse and validate BENCHLING_SECRETS input
+ *
+ * This is the main entry point for secret validation. It detects the format
+ * (ARN or JSON), performs appropriate validation, and returns a structured
+ * configuration object.
+ *
+ * @param input - The BENCHLING_SECRETS input string
+ * @returns Parsed and validated configuration
+ * @throws SecretsValidationError if validation fails
+ *
+ * @example
+ * // Parse ARN
+ * const config = parseAndValidateSecrets("arn:aws:secretsmanager:...")
+ * console.log(config.format) // "arn"
+ *
+ * @example
+ * // Parse JSON
+ * const config = parseAndValidateSecrets('{"client_id":"...","client_secret":"...","tenant":"..."}')
+ * console.log(config.format) // "json"
+ */
+function parseAndValidateSecrets(input) {
+    // Detect format
+    const format = detectSecretsFormat(input);
+    if (format === "arn") {
+        // Validate ARN
+        const validation = validateSecretArn(input);
+        if (!validation.valid) {
+            throw new SecretsValidationError("Invalid secret ARN", validation.errors, validation.warnings);
+        }
+        return {
+            format: "arn",
+            arn: input.trim(),
+            original: input,
+        };
+    }
+    else {
+        // Parse JSON
+        let data;
+        try {
+            data = JSON.parse(input);
+        }
+        catch (error) {
+            throw new SecretsValidationError("Invalid JSON in secret data", [
+                {
+                    field: "json",
+                    message: `JSON parse error: ${error.message}`,
+                    suggestion: "Ensure the secret data is valid JSON",
+                },
+            ], []);
+        }
+        // Validate structure
+        const validation = validateSecretData(data);
+        if (!validation.valid) {
+            throw new SecretsValidationError("Invalid secret data structure", validation.errors, validation.warnings);
+        }
+        return {
+            format: "json",
+            data: data,
+            original: input,
+        };
+    }
+}
+//# sourceMappingURL=secrets.js.map