@red-hat-developer-hub/e2e-test-utils 2.1.15 → 2.1.16

package/dist/secrets/cli.d.ts

@@ -1,11 +1,58 @@
 #!/usr/bin/env node
+import { type MutationPlan } from "./mutation.js";
 export interface ExecCliArguments {
     command: "exec";
     profilePath: string;
     workspaces: string[];
     executable: string;
     args: string[];
+    streamSecrets?: boolean;
 }
-export declare function parseCliArguments(argv: readonly string[]): ExecCliArguments;
+export type HelpTopic = "root" | "exec" | "create" | "update" | "delete" | "describe" | "list" | "gsm-login" | "gsm-clean";
+export interface HelpCliArguments {
+    command: "help";
+    topic: HelpTopic;
+}
+interface MutationCliBase {
+    collection: string;
+    bitwardenPath: string;
+    dryRun: boolean;
+    gsmTimeoutMs?: number;
+}
+export interface CreateCliArguments extends MutationCliBase {
+    command: "create";
+    fromFile?: string;
+    fromStdin: boolean;
+    allowEmpty: boolean;
+    force: boolean;
+}
+export interface UpdateCliArguments extends MutationCliBase {
+    command: "update";
+    fromFile?: string;
+    fromStdin: boolean;
+    allowEmpty: boolean;
+}
+export interface DeleteCliArguments extends MutationCliBase {
+    command: "delete";
+    force: boolean;
+}
+export interface DescribeCliArguments {
+    command: "describe";
+    collection: string;
+    bitwardenPath: string;
+    output: "text" | "json";
+}
+export interface ListCliArguments {
+    command: "list";
+    collection?: string;
+    output: "text" | "json";
+}
+export type CliArguments = HelpCliArguments | ExecCliArguments | CreateCliArguments | UpdateCliArguments | DeleteCliArguments | DescribeCliArguments | ListCliArguments | {
+    command: "gsm-login" | "gsm-clean";
+};
+export declare function parseCliArguments(argv: readonly string[]): CliArguments;
+export declare function getHelpText(topic: HelpTopic): string;
 export declare function main(argv?: readonly string[]): Promise<number>;
+export declare function formatMutationResult(state: "dry-run" | "applied", plan: MutationPlan): string;
+export {};
 //# sourceMappingURL=cli.d.ts.map

package/dist/secrets/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/secrets/cli.ts"],"names":[],"mappings":";AASA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAUD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAkD3E;AAED,wBAAsB,IAAI,CACxB,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,MAAM,CAAC,CAwBjB"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/secrets/cli.ts"],"names":[],"mappings":";AAeA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,MAAM,GACN,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,UAAU,eAAe;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,OAAO,EAAE,QAAQ,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,OAAO,EAAE,QAAQ,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,eAAe;IACzD,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,gBAAgB,GAChB;IAAE,OAAO,EAAE,WAAW,GAAG,WAAW,CAAA;CAAE,CAAC;AA6F3C,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAgBvE;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEpD;AA2SD,wBAAsB,IAAI,CACxB,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,MAAM,CAAC,CAoFjB;AAoBD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,IAAI,EAAE,YAAY,GACjB,MAAM,CASR"}

package/dist/secrets/cli.js

@@ -4,50 +4,177 @@ import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
 import { executeCommand } from "./exec.js";
-import { parseProfile } from "./config.js";
-const HELP = `Usage:
-  rhdh-e2e-secrets exec --profile <profile.json> [--workspace <name> ...] -- <command> [args...]
+import { getCollectionMapping, gsmPathFromBitwardenPath, parseProfile, READABLE_COLLECTIONS, } from "./config.js";
+import { GsmClient } from "./gsm.js";
+import { GsmWrapper } from "./gsm-wrapper.js";
+import { executeMutation, } from "./mutation.js";
+import { BitwardenClient } from "./bitwarden.js";
+import { MAX_TIMEOUT_MS } from "./command.js";
+const HELP_TEXT = {
+    root: `Usage:
+  rhdh-e2e-secrets exec -p <profile.json> [-w <name> ...] [--stream-secrets] -- <command> [args...]
+  rhdh-e2e-secrets create -c <collection> <secret-path> (-f <file> | -i) [--allow-empty] [--force] [--dry-run]
+  rhdh-e2e-secrets update -c <collection> <secret-path> (-f <file> | -i) [--allow-empty] [--dry-run]
+  rhdh-e2e-secrets delete -c <collection> <secret-path> [--force] [--dry-run]
+  rhdh-e2e-secrets describe -c <collection> <secret-path> [-o text|json]
+  rhdh-e2e-secrets list [-c <collection>] [-o text|json]
+  rhdh-e2e-secrets gsm-login
+  rhdh-e2e-secrets gsm-clean
 
 Requirements:
-  BW_SESSION must contain an already unlocked Bitwarden CLI session.
-  The bw CLI must be installed and available on PATH.
-`;
+  BW_SESSION must contain an already unlocked Bitwarden CLI session for exec and create, update, and delete.
+  GSM commands use a cached copy of openshift/release hack/secret-manager.sh and require local gcloud authentication.
+`,
+    exec: `Usage:
+  rhdh-e2e-secrets exec -p <profile.json> [-w <name> ...] [--stream-secrets] -- <command> [args...]
+
+Options:
+  -p, --profile <file>       Secret profile JSON file (required)
+  -w, --workspace <name>     Limit execution to a workspace; repeatable
+       --stream-secrets       Stream selected values to child file descriptor 3
+  -h, --help                 Show this help
+`,
+    create: `Usage:
+  rhdh-e2e-secrets create -c <collection> <secret-path> (-f <file> | -i) [options]
+
+Options:
+  -c, --collection <name>    Paired secret collection (required)
+  -f, --from-file <file>    Read an attachment-backed secret from a file
+  -i, --from-stdin          Read a note-backed secret from stdin
+      --allow-empty         Allow an empty secret value
+      --force               Reconcile an existing or partial target
+      --dry-run             Validate and print the plan without writing
+      --gsm-timeout-seconds <n>
+                            GSM operation timeout
+  -h, --help                 Show this help
+`,
+    update: `Usage:
+  rhdh-e2e-secrets update -c <collection> <secret-path> (-f <file> | -i) [options]
+
+Options:
+  -c, --collection <name>    Paired secret collection (required)
+  -f, --from-file <file>    Read an attachment-backed secret from a file
+  -i, --from-stdin          Read a note-backed secret from stdin
+      --allow-empty         Allow an empty secret value
+      --dry-run             Validate and print the plan without writing
+      --gsm-timeout-seconds <n>
+                            GSM operation timeout
+  -h, --help                 Show this help
+`,
+    delete: `Usage:
+  rhdh-e2e-secrets delete -c <collection> <secret-path> [options]
+
+Options:
+  -c, --collection <name>    Paired secret collection (required)
+      --force               Reconcile an already partial target
+      --dry-run             Validate and print the plan without writing
+      --gsm-timeout-seconds <n>
+                            GSM operation timeout
+  -h, --help                 Show this help
+`,
+    describe: `Usage:
+  rhdh-e2e-secrets describe -c <collection> <secret-path> [-o text|json]
+
+Options:
+  -c, --collection <name>    Paired secret collection (required)
+  -o, --output <text|json>   Output format (default: text)
+  -h, --help                 Show this help
+`,
+    list: `Usage:
+  rhdh-e2e-secrets list [-c <collection>] [-o text|json]
+
+Options:
+  -c, --collection <name>    List paths in one paired collection
+  -o, --output <text|json>   Output format (default: text)
+  -h, --help                 Show this help
+`,
+    ["gsm-login"]: `Usage:
+  rhdh-e2e-secrets gsm-login
+
+Authenticate the cached GSM wrapper.
+`,
+    ["gsm-clean"]: `Usage:
+  rhdh-e2e-secrets gsm-clean
+
+Remove cached GSM authentication.
+`,
+};
+const MUTATION_COMMANDS = ["create", "update", "delete"];
 export function parseCliArguments(argv) {
-    if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
-        throw new Error(HELP);
-    }
-    if (argv[0] !== "exec") {
-        throw new Error(`Unsupported command: ${argv[0]}`);
+    if (argv.length === 0)
+        return { command: "help", topic: "root" };
+    if (argv[0] === "--help" || argv[0] === "-h")
+        return { command: "help", topic: "root" };
+    const helpTopic = findHelpTopic(argv);
+    if (helpTopic)
+        return { command: "help", topic: helpTopic };
+    if (argv[0] === "exec")
+        return parseExecArguments(argv);
+    if (isMutationCommand(argv[0]))
+        return parseMutationArguments(argv);
+    if (argv[0] === "describe")
+        return parseDescribeArguments(argv);
+    if (argv[0] === "list")
+        return parseListArguments(argv);
+    if (argv[0] === "gsm-login" || argv[0] === "gsm-clean") {
+        if (argv.length !== 1)
+            throw new Error(`${argv[0]} does not accept options`);
+        return { command: argv[0] };
     }
+    throw new Error(`Unsupported command: ${argv[0]}`);
+}
+export function getHelpText(topic) {
+    return HELP_TEXT[topic];
+}
+function findHelpTopic(argv) {
+    const command = argv[0];
+    if (!isHelpTopic(command))
+        return undefined;
+    const delimiter = command === "exec" ? argv.indexOf("--") : -1;
+    const options = argv.slice(1, delimiter === -1 ? argv.length : delimiter);
+    return options.includes("--help") || options.includes("-h")
+        ? command
+        : undefined;
+}
+function parseExecArguments(argv) {
     const delimiter = argv.indexOf("--");
-    if (delimiter === -1) {
+    if (delimiter === -1)
         throw new Error("A command after -- is required");
-    }
     const options = argv.slice(1, delimiter);
     const command = argv[delimiter + 1];
     const args = argv.slice(delimiter + 2);
     let profilePath;
     const workspaces = [];
+    let streamSecrets = false;
     for (let index = 0; index < options.length; index++) {
         const option = options[index];
-        if (option === "--profile" || option === "--workspace") {
+        if (option === "--stream-secrets") {
+            streamSecrets = true;
+            continue;
+        }
+        if (option === "--profile" ||
+            option === "-p" ||
+            option === "--workspace" ||
+            option === "-w") {
             const value = options[++index];
             if (!value)
                 throw new Error(`${option} requires a value`);
-            if (option === "--profile")
+            if (option === "--profile" || option === "-p")
                 profilePath = value;
             else
                 workspaces.push(value);
             continue;
         }
-        if (option.startsWith("--profile=")) {
-            profilePath = option.slice("--profile=".length);
+        if (option.startsWith("--profile=") || option.startsWith("-p=")) {
+            const prefix = option.startsWith("--profile=") ? "--profile=" : "-p=";
+            profilePath = option.slice(prefix.length);
             if (!profilePath)
                 throw new Error("--profile requires a value");
             continue;
         }
-        if (option.startsWith("--workspace=")) {
-            const workspace = option.slice("--workspace=".length);
+        if (option.startsWith("--workspace=") || option.startsWith("-w=")) {
+            const prefix = option.startsWith("--workspace=") ? "--workspace=" : "-w=";
+            const workspace = option.slice(prefix.length);
             if (!workspace)
                 throw new Error("--workspace requires a value");
             workspaces.push(workspace);
@@ -65,29 +192,329 @@ export function parseCliArguments(argv) {
         workspaces,
         executable: command,
         args,
+        ...(streamSecrets ? { streamSecrets: true } : {}),
+    };
+}
+function parseMutationArguments(argv) {
+    const command = argv[0];
+    let collection;
+    let bitwardenPath;
+    let fromFile;
+    let fromStdin = false;
+    let allowEmpty = false;
+    let force = false;
+    let dryRun = false;
+    let gsmTimeoutMs;
+    let pathSeen = false;
+    const seenOptions = new Set();
+    const markOption = (name) => {
+        if (seenOptions.has(name))
+            throw new Error(`Duplicate option: ${name}`);
+        seenOptions.add(name);
+    };
+    for (let index = 1; index < argv.length; index++) {
+        const option = argv[index];
+        if (!option.startsWith("-")) {
+            if (pathSeen)
+                throw new Error("Only one secret path is allowed");
+            pathSeen = true;
+            bitwardenPath = option;
+            continue;
+        }
+        if (option === "--from-stdin" || option === "-i") {
+            markOption("--from-stdin");
+            fromStdin = true;
+            continue;
+        }
+        if (option === "--allow-empty" ||
+            option === "--force" ||
+            option === "--dry-run") {
+            markOption(option);
+            if (option === "--allow-empty")
+                allowEmpty = true;
+            else if (option === "--force")
+                force = true;
+            else
+                dryRun = true;
+            continue;
+        }
+        const valueOption = readMutationValueOption(option, argv, index);
+        if (valueOption) {
+            markOption(valueOption.name);
+            index = valueOption.nextIndex;
+            if (valueOption.name === "--collection")
+                collection = valueOption.value;
+            else if (valueOption.name === "--from-file")
+                fromFile = valueOption.value;
+            else if (valueOption.name === "--gsm-timeout-seconds") {
+                const seconds = Number(valueOption.value);
+                if (!Number.isSafeInteger(seconds) ||
+                    seconds <= 0 ||
+                    seconds * 1000 > MAX_TIMEOUT_MS) {
+                    throw new Error(`--gsm-timeout-seconds must be a positive integer no greater than ${Math.floor(MAX_TIMEOUT_MS / 1000)}`);
+                }
+                gsmTimeoutMs = seconds * 1000;
+            }
+            continue;
+        }
+        throw new Error(`Unknown option: ${option}`);
+    }
+    if (!collection)
+        throw new Error("--collection is required");
+    if (!bitwardenPath)
+        throw new Error("A secret path is required");
+    if (command === "delete") {
+        if (fromFile !== undefined || fromStdin || allowEmpty) {
+            throw new Error("delete does not accept input options");
+        }
+        return {
+            command,
+            collection,
+            bitwardenPath,
+            force,
+            dryRun,
+            gsmTimeoutMs,
+        };
+    }
+    if (force && command === "update") {
+        throw new Error("--force is not supported for update");
+    }
+    if (Number(fromFile !== undefined) + Number(fromStdin) !== 1) {
+        throw new Error("Exactly one of --from-file or --from-stdin is required");
+    }
+    return {
+        command,
+        collection,
+        bitwardenPath,
+        fromFile,
+        fromStdin,
+        allowEmpty,
+        ...(command === "create" ? { force } : {}),
+        dryRun,
+        gsmTimeoutMs,
+    };
+}
+function readMutationValueOption(option, argv, index) {
+    const aliases = new Map([
+        ["-c", "--collection"],
+        ["-f", "--from-file"],
+    ]);
+    const names = [
+        "--collection",
+        "--from-file",
+        "--gsm-timeout-seconds",
+    ];
+    const name = aliases.get(option) ??
+        names.find((candidate) => option === candidate || option.startsWith(`${candidate}=`));
+    if (!name)
+        return undefined;
+    const inline = option.startsWith(`${name}=`)
+        ? option.slice(name.length + 1)
+        : argv[index + 1];
+    if (!inline)
+        throw new Error(`${name} requires a value`);
+    return {
+        name,
+        value: inline,
+        nextIndex: option === name || option === "-c" || option === "-f" ? index + 1 : index,
+    };
+}
+function parseDescribeArguments(argv) {
+    const parsed = parseReadArguments(argv, true);
+    return {
+        command: "describe",
+        collection: parsed.collection,
+        bitwardenPath: parsed.bitwardenPath,
+        output: parsed.output,
+    };
+}
+function parseListArguments(argv) {
+    const parsed = parseReadArguments(argv, false);
+    return {
+        command: "list",
+        ...(parsed.collection === undefined
+            ? {}
+            : { collection: parsed.collection }),
+        output: parsed.output,
+    };
+}
+function parseReadArguments(argv, pathRequired) {
+    let collection;
+    let bitwardenPath;
+    let output = "text";
+    const seen = new Set();
+    for (let index = 1; index < argv.length; index++) {
+        const option = argv[index];
+        if (!option.startsWith("-")) {
+            if (bitwardenPath)
+                throw new Error("Only one secret path is allowed");
+            bitwardenPath = option;
+            continue;
+        }
+        const value = readReadValueOption(option, argv, index);
+        if (value) {
+            if (seen.has(value.name))
+                throw new Error(`Duplicate option: ${value.name}`);
+            seen.add(value.name);
+            index = value.nextIndex;
+            if (value.name === "--collection")
+                collection = value.value;
+            else {
+                const normalized = value.value.toLowerCase();
+                if (normalized !== "text" && normalized !== "json") {
+                    throw new Error("--output must be text or json");
+                }
+                output = normalized;
+            }
+            continue;
+        }
+        throw new Error(`Unknown option: ${option}`);
+    }
+    if (pathRequired && !bitwardenPath)
+        throw new Error("A secret path is required");
+    if (pathRequired && !collection)
+        throw new Error("--collection is required");
+    if (!pathRequired && bitwardenPath) {
+        throw new Error("list does not accept a secret path");
+    }
+    return { collection, bitwardenPath, output };
+}
+function readReadValueOption(option, argv, index) {
+    const name = option === "-c"
+        ? "--collection"
+        : option === "-o"
+            ? "--output"
+            : ["--collection", "--output"].find((candidate) => option === candidate || option.startsWith(`${candidate}=`));
+    if (!name)
+        return undefined;
+    const inline = option.startsWith(`${name}=`)
+        ? option.slice(name.length + 1)
+        : argv[index + 1];
+    if (!inline)
+        throw new Error(`${name} requires a value`);
+    return {
+        name,
+        value: inline,
+        nextIndex: option === name || option === "-c" || option === "-o" ? index + 1 : index,
     };
 }
 export async function main(argv = process.argv.slice(2)) {
     if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
-        console.log(HELP);
+        console.log(getHelpText("root"));
         return 0;
     }
     try {
         const parsed = parseCliArguments(argv);
-        const profileValue = JSON.parse(await readFile(resolve(parsed.profilePath), "utf8"));
-        const profile = parseProfile(profileValue);
-        return await executeCommand({
-            profile,
-            workspaces: parsed.workspaces,
-            command: parsed.executable,
-            args: parsed.args,
+        if (parsed.command === "help") {
+            console.log(getHelpText(parsed.topic));
+            return 0;
+        }
+        if (parsed.command === "exec") {
+            const profileValue = JSON.parse(await readFile(resolve(parsed.profilePath), "utf8"));
+            return await executeCommand({
+                profile: parseProfile(profileValue),
+                workspaces: parsed.workspaces,
+                command: parsed.executable,
+                args: parsed.args,
+                streamSecrets: parsed.streamSecrets,
+            });
+        }
+        if (parsed.command === "gsm-login" || parsed.command === "gsm-clean") {
+            const wrapper = new GsmWrapper();
+            const result = parsed.command === "gsm-login"
+                ? await wrapper.login()
+                : await wrapper.clean();
+            if (result.status !== 0)
+                throw new Error(`${parsed.command} failed`);
+            return 0;
+        }
+        const gsm = new GsmClient();
+        if (parsed.command === "describe") {
+            const mapping = getCollectionMapping(parsed.collection);
+            const metadata = await gsm.describe(mapping.gsmCollection, gsmPathFromBitwardenPath(parsed.bitwardenPath));
+            printOutput(metadata, parsed.output);
+            return 0;
+        }
+        if (parsed.command === "list") {
+            if (parsed.collection === undefined) {
+                printOutput([...READABLE_COLLECTIONS], parsed.output);
+            }
+            else {
+                const mapping = getCollectionMapping(parsed.collection);
+                const paths = await gsm.list(mapping.gsmCollection);
+                printOutput(paths, parsed.output);
+            }
+            return 0;
+        }
+        if (!isMutationCommand(parsed.command)) {
+            throw new Error(`Unsupported command: ${parsed.command}`);
+        }
+        const mutation = parsed;
+        const result = await executeMutation({
+            command: mutation.command,
+            collection: mutation.collection,
+            bitwardenPath: mutation.bitwardenPath,
+            fromFile: "fromFile" in mutation ? mutation.fromFile : undefined,
+            fromStdin: "fromStdin" in mutation ? mutation.fromStdin : undefined,
+            stdin: process.stdin,
+            allowEmpty: "allowEmpty" in mutation ? mutation.allowEmpty : undefined,
+            force: "force" in mutation ? mutation.force : undefined,
+            dryRun: mutation.dryRun,
+            gsmTimeoutMs: mutation.gsmTimeoutMs,
+            bitwarden: new BitwardenClient(),
+            gsm,
         });
+        console.log(formatMutationResult(result.state, result.plan));
+        return 0;
     }
     catch (error) {
-        console.error(error instanceof Error ? error.message : "Secret execution failed");
+        console.error(error instanceof Error ? error.message : "Secret operation failed");
         return 1;
     }
 }
+function printOutput(value, output) {
+    if (output === "json") {
+        console.log(JSON.stringify(value, null, 2));
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            console.log(String(entry));
+        return;
+    }
+    if (value && typeof value === "object") {
+        for (const [key, entry] of Object.entries(value)) {
+            console.log(`${key}: ${String(entry)}`);
+        }
+        return;
+    }
+    console.log(String(value));
+}
+export function formatMutationResult(state, plan) {
+    const lines = [
+        `${state === "dry-run" ? "Dry-run" : "Applied"}: ${plan.command} ${plan.collection}/${plan.bitwardenPath}`,
+        `Bitwarden: ${plan.bitwardenAction} ${plan.bitwardenCollection}/${plan.bitwardenPath}${plan.storage ? ` (${plan.storage})` : ""}`,
+        `GSM: ${plan.gsmAction} ${plan.gsmCollection}/${plan.gsmPath}`,
+    ];
+    if (plan.byteLength !== undefined)
+        lines.push(`Input: ${plan.byteLength} bytes`);
+    return lines.join("\n");
+}
+function isMutationCommand(value) {
+    return MUTATION_COMMANDS.includes(value);
+}
+function isHelpTopic(value) {
+    return [
+        "exec",
+        "create",
+        "update",
+        "delete",
+        "describe",
+        "list",
+        "gsm-login",
+        "gsm-clean",
+    ].includes(value);
+}
 if (process.argv[1] &&
     realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
     void main().then((exitCode) => {

package/dist/secrets/command.d.ts

@@ -3,13 +3,20 @@ export interface CommandResult {
     stdout: string;
     stderr: string;
     error?: Error;
+    signal?: NodeJS.Signals;
+    timedOut?: boolean;
 }
 export interface CommandOptions {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
     input?: string;
     stdio?: "pipe" | "inherit";
+    tty?: boolean;
+    timeoutMs?: number;
 }
+export declare const MAX_TIMEOUT_MS = 2147483647;
 export type CommandRunner = (command: string, args: readonly string[], options?: CommandOptions) => Promise<CommandResult>;
+export declare function shouldDetachCommand(options?: Pick<CommandOptions, "tty">): boolean;
 export declare const runCommand: CommandRunner;
+export declare function assertInteractiveTerminal(): Promise<void>;
 //# sourceMappingURL=command.d.ts.map

package/dist/secrets/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/secrets/command.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,eAAO,MAAM,UAAU,EAAE,aA6BrB,CAAC"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/secrets/command.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,cAAc,aAAgB,CAAC;AAE5C,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAM,GACxC,OAAO,CAET;AAED,eAAO,MAAM,UAAU,EAAE,aAuGxB,CAAC;AAEF,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAE/D"}