@red-hat-developer-hub/e2e-test-utils 2.1.15 → 2.1.17

package/dist/secrets/exec.js

@@ -1,50 +1,330 @@
 import { spawn } from "node:child_process";
+import { Writable } from "node:stream";
 import { BitwardenClient } from "./bitwarden.js";
 import { expandProfile, } from "./config.js";
-import { materializeEnvironment } from "./environment.js";
+import { materializeEnvironmentWithSecrets, materializeStreamEnvironment, } from "./environment.js";
+import { writeSecretStream } from "./stream.js";
 export async function executeCommand(options) {
     const expanded = expandProfile(options.profile, options.workspaces);
     const client = options.client ?? new BitwardenClient({ env: options.env ?? process.env });
-    const secrets = await client.read(options.profile.collection, expanded.selectors);
-    const childEnvironment = materializeEnvironment(secrets, expanded.selectors, options.env ?? process.env);
+    const secretValues = await client.read(options.profile.collection, expanded.selectors);
+    const materialized = materializeEnvironmentWithSecrets(secretValues, expanded.selectors, options.env ?? process.env);
+    const childEnvironment = options.streamSecrets
+        ? materializeStreamEnvironment(materialized)
+        : materialized.environment;
     const childRunner = options.childRunner ?? runChild;
+    if (options.streamSecrets) {
+        return childRunner(options.command, options.args, childEnvironment, {
+            secretStream: materialized.secrets,
+        });
+    }
     return childRunner(options.command, options.args, childEnvironment);
 }
-export const runChild = (command, args, env) => new Promise((resolve, reject) => {
-    const child = spawn(command, args, { env, stdio: "inherit" });
-    let settled = false;
-    const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
-    const signalExitCodes = new Map([
-        ["SIGINT", 130],
-        ["SIGTERM", 143],
-        ["SIGHUP", 129],
-    ]);
-    const forwarders = new Map();
-    for (const signal of signals) {
-        const forwardSignal = () => child.kill(signal);
-        forwarders.set(signal, forwardSignal);
-        process.on(signal, forwardSignal);
-    }
-    const cleanup = () => {
-        for (const [signal, forwardSignal] of forwarders) {
-            process.removeListener(signal, forwardSignal);
-        }
-    };
-    child.once("error", () => {
-        if (settled)
+export const runChild = createChildRunner(spawn);
+/** Internal spawn seam used by lifecycle tests; omitted from the package barrel. */
+export function createChildRunner(spawnCommand) {
+    return (command, args, env, options) => runChildWithSpawn(spawnCommand, command, args, env, options);
+}
+async function runChildWithSpawn(spawnCommand, command, args, env, options) {
+    const secretStream = options?.secretStream;
+    if (secretStream !== undefined) {
+        try {
+            await validateSecretStream(secretStream);
+        }
+        catch {
+            throw streamError(command);
+        }
+    }
+    return new Promise((resolve, reject) => {
+        const detached = process.platform !== "win32";
+        let child;
+        try {
+            child = spawnCommand(command, args, {
+                detached,
+                env,
+                stdio: secretStream === undefined
+                    ? "inherit"
+                    : ["inherit", "inherit", "inherit", "pipe"],
+            });
+        }
+        catch (error) {
+            reject(commandStartError(command, error));
             return;
-        settled = true;
-        cleanup();
-        reject(new Error(`Unable to start command: ${command}`));
+        }
+        let settled = false;
+        let childClosed = false;
+        let forwardedSignal = false;
+        let childResult;
+        let fatalStreamError;
+        let streamFailure;
+        let secretPipe;
+        let streamWriter;
+        let writerPromise;
+        let writerSettled = secretStream === undefined;
+        let streamClosing = false;
+        let forceTermination;
+        const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+        const signalExitCodes = new Map([
+            ["SIGINT", 130],
+            ["SIGTERM", 143],
+            ["SIGHUP", 129],
+        ]);
+        const forwarders = new Map();
+        const terminate = (signal) => {
+            if (detached && child.pid !== undefined) {
+                try {
+                    process.kill(-child.pid, signal);
+                    return;
+                }
+                catch {
+                    // Fall through to the direct child signal.
+                }
+            }
+            child.kill(signal);
+        };
+        const removeForwarders = () => {
+            for (const [signal, forwardSignal] of forwarders) {
+                process.removeListener(signal, forwardSignal);
+            }
+            forwarders.clear();
+        };
+        const clearForceTermination = () => {
+            if (forceTermination !== undefined)
+                clearTimeout(forceTermination);
+            forceTermination = undefined;
+        };
+        const onStreamError = (error) => {
+            streamFailure = error;
+        };
+        const onStreamClose = () => {
+            if (streamClosing && writerSettled)
+                removeStreamListeners();
+        };
+        const removeStreamListeners = () => {
+            if (secretPipe) {
+                secretPipe.removeListener("error", onStreamError);
+                secretPipe.removeListener("close", onStreamClose);
+            }
+            streamWriter?.removeListener("error", onStreamError);
+        };
+        const adoptSecretPipe = () => {
+            if (!secretPipe && child.stdio[3] instanceof Writable) {
+                secretPipe = child.stdio[3];
+            }
+        };
+        const settleUnstartedWriter = () => {
+            if (secretStream !== undefined && !streamWriter)
+                writerSettled = true;
+        };
+        const closeSecretStream = (reason) => {
+            adoptSecretPipe();
+            if (streamClosing)
+                return;
+            streamClosing = true;
+            if (streamWriter && !streamWriter.destroyed) {
+                streamWriter.destroy(reason);
+            }
+            else if (secretPipe && !secretPipe.destroyed) {
+                secretPipe.destroy();
+            }
+        };
+        const finish = () => {
+            if (settled || !childClosed || !writerSettled)
+                return;
+            settled = true;
+            clearForceTermination();
+            removeForwarders();
+            if (fatalStreamError)
+                reject(fatalStreamError);
+            else
+                resolve(childResult ?? 1);
+        };
+        const rejectStreamFailure = () => {
+            if (settled ||
+                childClosed ||
+                forwardedSignal ||
+                isBrokenPipe(streamFailure)) {
+                finish();
+                return;
+            }
+            fatalStreamError ??= streamError(command);
+            removeForwarders();
+            closeSecretStream();
+            terminate("SIGTERM");
+            forceTermination = setTimeout(() => {
+                forceTermination = undefined;
+                if (!childClosed)
+                    terminate("SIGKILL");
+            }, 1_000);
+            finish();
+        };
+        const startStream = () => {
+            const candidate = child.stdio[3];
+            if (!(candidate instanceof Writable) || !candidate.writable) {
+                writerSettled = true;
+                rejectStreamFailure();
+                return;
+            }
+            secretPipe = candidate;
+            secretPipe.on("error", onStreamError);
+            secretPipe.once("close", onStreamClose);
+            streamWriter = new SecretStreamWriter(secretPipe, onStreamError);
+            streamWriter.on("error", onStreamError);
+            writerPromise = writeSecretStream(streamWriter, secretStream).then(() => {
+                writerSettled = true;
+                removeStreamListeners();
+                finish();
+            }, () => {
+                writerSettled = true;
+                rejectStreamFailure();
+                removeStreamListeners();
+                finish();
+            });
+            void writerPromise.catch(() => undefined);
+        };
+        for (const signal of signals) {
+            const forwardSignal = () => {
+                if (settled)
+                    return;
+                forwardedSignal = true;
+                removeForwarders();
+                settleUnstartedWriter();
+                closeSecretStream(writerPromise && !writerSettled
+                    ? new Error("secret stream closed")
+                    : undefined);
+                terminate(signal);
+            };
+            forwarders.set(signal, forwardSignal);
+            process.on(signal, forwardSignal);
+        }
+        child.once("spawn", () => {
+            if (secretStream !== undefined) {
+                if (forwardedSignal || settled) {
+                    settleUnstartedWriter();
+                    closeSecretStream();
+                }
+                else
+                    startStream();
+            }
+        });
+        child.once("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearForceTermination();
+            removeForwarders();
+            settleUnstartedWriter();
+            closeSecretStream();
+            reject(commandStartError(command, error));
+        });
+        child.once("close", (code, signal) => {
+            childClosed = true;
+            settleUnstartedWriter();
+            const signalExitCode = signal
+                ? signalExitCodes.get(signal)
+                : undefined;
+            childResult = code ?? signalExitCode ?? 1;
+            closeSecretStream(writerPromise && !writerSettled
+                ? new Error("secret stream closed")
+                : undefined);
+            removeForwarders();
+            finish();
+        });
     });
-    child.once("close", (code, signal) => {
-        if (settled)
-            return;
-        settled = true;
-        cleanup();
-        const signalExitCode = signal
-            ? signalExitCodes.get(signal)
-            : undefined;
-        resolve(code ?? signalExitCode ?? 1);
+}
+/* eslint-disable @typescript-eslint/naming-convention -- Node Writable hook names */
+class SecretStreamWriter extends Writable {
+    target;
+    onFailure;
+    onTargetError;
+    onTargetClose;
+    constructor(target, onFailure) {
+        super();
+        this.target = target;
+        this.onFailure = onFailure;
+        this.onTargetError = (error) => {
+            onFailure(error);
+            if (!this.destroyed)
+                this.destroy(error);
+        };
+        this.onTargetClose = () => {
+            if (this.destroyed || this.writableFinished)
+                return;
+            const error = pipeClosedError();
+            onFailure(error);
+            this.destroy(error);
+        };
+        target.on("error", this.onTargetError);
+        target.once("close", this.onTargetClose);
+    }
+    _write(chunk, _encoding, callback) {
+        try {
+            if (this.target.write(chunk))
+                callback();
+            else
+                this.target.once("drain", callback);
+        }
+        catch (error) {
+            this.onFailure(error);
+            callback(toError(error));
+        }
+    }
+    _final(callback) {
+        try {
+            this.target.end(callback);
+        }
+        catch (error) {
+            this.onFailure(error);
+            callback(toError(error));
+        }
+    }
+    _destroy(error, callback) {
+        this.target.removeListener("error", this.onTargetError);
+        this.target.removeListener("close", this.onTargetClose);
+        if (!this.target.destroyed)
+            this.target.destroy();
+        callback(error);
+    }
+}
+/* eslint-enable @typescript-eslint/naming-convention */
+async function validateSecretStream(entries) {
+    const sink = new Writable({
+        write(_chunk, _encoding, callback) {
+            callback();
+        },
+    });
+    try {
+        await writeSecretStream(sink, entries);
+    }
+    finally {
+        sink.destroy();
+    }
+}
+function isBrokenPipe(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        (error.code === "EPIPE" ||
+            error.code === "ECONNRESET" ||
+            error.code === "ERR_STREAM_DESTROYED"));
+}
+function commandStartError(command, error) {
+    const environmentHint = typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "E2BIG"
+        ? "; child environment exceeds OS limits; retry with --stream-secrets"
+        : "";
+    return new Error(`Unable to start command: ${command}${environmentHint}`);
+}
+function pipeClosedError() {
+    return Object.assign(new Error("secret stream pipe closed"), {
+        code: "ERR_STREAM_DESTROYED",
     });
-});
+}
+function streamError(command) {
+    return new Error(`Unable to write secret stream for command: ${command}`);
+}
+function toError(error) {
+    return error instanceof Error ? error : new Error("secret stream failure");
+}

package/dist/secrets/gsm-wrapper.d.ts

@@ -0,0 +1,42 @@
+import { type CommandResult, type CommandRunner } from "./command.js";
+import type { GsmRunOptions } from "./gsm.js";
+export interface GsmWrapperOptions {
+    cacheDir?: string;
+    fetchScript?: (timeoutMs?: number) => Promise<string>;
+    fetchTimeoutMs?: number;
+    commandRunner?: CommandRunner;
+    env?: NodeJS.ProcessEnv;
+    warning?: (message: string) => void;
+}
+export interface GsmWrapperMetadata {
+    scriptPath: string;
+    sha256: string;
+    fetchedAt: string;
+    usedCache: boolean;
+}
+export interface GsmWrapperRunResult extends CommandResult {
+    usedCache: boolean;
+    sha256?: string;
+}
+export declare class GsmWrapper {
+    private readonly cacheDir;
+    private readonly fetchScript;
+    private readonly commandRunner;
+    private readonly env;
+    private readonly warning;
+    private readonly fetchTimeoutMs;
+    private activeMetadata?;
+    private initialization?;
+    constructor(options?: GsmWrapperOptions);
+    run(args: readonly string[], timeoutMs?: number, options?: GsmRunOptions): Promise<GsmWrapperRunResult>;
+    login(): Promise<GsmWrapperRunResult>;
+    clean(): Promise<GsmWrapperRunResult>;
+    ensureInteractive(): Promise<void>;
+    private ensureWrapper;
+    private initializeWrapper;
+    private writeCache;
+    private readCachedMetadata;
+}
+export declare function defaultCacheDir(env?: NodeJS.ProcessEnv): string;
+export declare function validateWrapper(script: string): void;
+//# sourceMappingURL=gsm-wrapper.d.ts.map

package/dist/secrets/gsm-wrapper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gsm-wrapper.d.ts","sourceRoot":"","sources":["../../src/secrets/gsm-wrapper.ts"],"names":[],"mappings":"AAaA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,aAAa,EACnB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAU9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0C;IACtE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,cAAc,CAAC,CAAqB;IAC5C,OAAO,CAAC,cAAc,CAAC,CAA8B;gBAEzC,OAAO,GAAE,iBAAsB;IAWrC,GAAG,CACP,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,mBAAmB,CAAC;IAmBzB,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIrC,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAgBrC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI1B,aAAa;YAUb,iBAAiB;YA2BjB,UAAU;YAgCV,kBAAkB;CAkCjC;AAiBD,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAO5E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAepD"}

package/dist/secrets/gsm-wrapper.js

@@ -0,0 +1,238 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, readFile, rm, rename, stat, writeFile, } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { assertInteractiveTerminal, runCommand, } from "./command.js";
+const WRAPPER_URL = "https://raw.githubusercontent.com/openshift/release/main/hack/secret-manager.sh";
+const WRAPPER_FILE = "secret-manager.sh";
+const CACHE_METADATA_FILE = "secret-manager.json";
+const DEFAULT_FETCH_TIMEOUT_MS = 60_000;
+const TRUSTED_IMAGE_PATTERN = /^quay\.io\/openshift\/ci-public(?::[A-Za-z0-9][A-Za-z0-9._-]*|@sha256:[a-f0-9]{64})$/;
+export class GsmWrapper {
+    cacheDir;
+    fetchScript;
+    commandRunner;
+    env;
+    warning;
+    fetchTimeoutMs;
+    activeMetadata;
+    initialization;
+    constructor(options = {}) {
+        this.cacheDir = path.resolve(options.cacheDir ?? defaultCacheDir(options.env ?? process.env));
+        this.fetchScript = options.fetchScript ?? fetchCurrentWrapper;
+        this.fetchTimeoutMs = options.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
+        this.commandRunner = options.commandRunner ?? runCommand;
+        this.env = buildGsmEnvironment({ ...process.env, ...options.env });
+        this.warning = options.warning ?? console.warn;
+    }
+    async run(args, timeoutMs, options = {}) {
+        const metadata = await this.ensureWrapper();
+        const result = await this.commandRunner("bash", [metadata.scriptPath, ...args], {
+            env: this.env,
+            timeoutMs,
+            stdio: options.stdio,
+            tty: options.tty,
+        });
+        return {
+            ...result,
+            usedCache: metadata.usedCache,
+            sha256: metadata.sha256,
+        };
+    }
+    async login() {
+        return this.run(["login"], undefined, { stdio: "inherit", tty: true });
+    }
+    async clean() {
+        await rm(path.join(this.cacheDir, "gcp-secret-manager", ".secret-manager-gcloud"), { recursive: true, force: true });
+        return {
+            status: 0,
+            stdout: "",
+            stderr: "",
+            usedCache: this.activeMetadata?.usedCache ?? false,
+            ...(this.activeMetadata?.sha256
+                ? { sha256: this.activeMetadata.sha256 }
+                : {}),
+        };
+    }
+    async ensureInteractive() {
+        await assertInteractiveTerminal();
+    }
+    async ensureWrapper() {
+        if (this.activeMetadata)
+            return this.activeMetadata;
+        if (this.initialization)
+            return this.initialization;
+        this.initialization = this.initializeWrapper().catch((error) => {
+            this.initialization = undefined;
+            throw error;
+        });
+        return this.initialization;
+    }
+    async initializeWrapper() {
+        await mkdir(path.join(this.cacheDir, "gcp-secret-manager"), {
+            recursive: true,
+            mode: 0o700,
+        });
+        await chmod(this.cacheDir, 0o700);
+        try {
+            const script = await this.fetchScript(this.fetchTimeoutMs);
+            validateWrapper(script);
+            return (this.activeMetadata = await this.writeCache(script, false));
+        }
+        catch (error) {
+            const cached = await this.readCachedMetadata();
+            if (!cached) {
+                throw new Error(`Unable to download the GSM wrapper and no validated cache exists: ${error instanceof Error ? error.message : "untrusted wrapper"}`, { cause: error });
+            }
+            this.warning(`Using cached GSM wrapper from ${cached.fetchedAt} because refresh failed`);
+            return (this.activeMetadata = { ...cached, usedCache: true });
+        }
+    }
+    async writeCache(script, usedCache) {
+        const sha256 = hash(script);
+        const scriptPath = path.join(this.cacheDir, `${WRAPPER_FILE}.${sha256}`);
+        const fetchedAt = new Date().toISOString();
+        const suffix = `${process.pid}.${randomUUID()}`;
+        const temporaryPath = `${scriptPath}.${suffix}.tmp`;
+        const metadataPath = path.join(this.cacheDir, CACHE_METADATA_FILE);
+        const temporaryMetadataPath = `${metadataPath}.${suffix}.tmp`;
+        try {
+            await writeFile(temporaryPath, script, { encoding: "utf8", mode: 0o700 });
+            await chmod(temporaryPath, 0o700);
+            await rename(temporaryPath, scriptPath);
+        }
+        finally {
+            await rm(temporaryPath, { force: true }).catch(() => undefined);
+        }
+        const metadata = { scriptPath, sha256, fetchedAt };
+        try {
+            await writeFile(temporaryMetadataPath, `${JSON.stringify(metadata)}\n`, {
+                encoding: "utf8",
+                mode: 0o600,
+            });
+            await chmod(temporaryMetadataPath, 0o600);
+            await rename(temporaryMetadataPath, metadataPath);
+        }
+        finally {
+            await rm(temporaryMetadataPath, { force: true }).catch(() => undefined);
+        }
+        return { ...metadata, usedCache };
+    }
+    async readCachedMetadata() {
+        try {
+            const metadata = JSON.parse(await readFile(path.join(this.cacheDir, CACHE_METADATA_FILE), "utf8"));
+            if (!isRecord(metadata))
+                return undefined;
+            if (typeof metadata.scriptPath !== "string" ||
+                typeof metadata.sha256 !== "string" ||
+                typeof metadata.fetchedAt !== "string") {
+                return undefined;
+            }
+            const scriptPath = path.resolve(metadata.scriptPath);
+            if (!isCacheScriptPath(this.cacheDir, scriptPath)) {
+                return undefined;
+            }
+            if ((await lstat(scriptPath)).isSymbolicLink())
+                return undefined;
+            const script = await readFile(scriptPath, "utf8");
+            validateWrapper(script);
+            if (hash(script) !== metadata.sha256)
+                return undefined;
+            const details = await stat(scriptPath);
+            if ((details.mode & 0o111) === 0)
+                return undefined;
+            return {
+                scriptPath,
+                sha256: metadata.sha256,
+                fetchedAt: metadata.fetchedAt,
+            };
+        }
+        catch {
+            return undefined;
+        }
+    }
+}
+function isCacheScriptPath(cacheDir, scriptPath) {
+    const relative = path.relative(path.resolve(cacheDir), path.resolve(scriptPath));
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+        return false;
+    const baseName = path.basename(scriptPath);
+    return (baseName === WRAPPER_FILE ||
+        new RegExp(`^${WRAPPER_FILE.replace(".", "\\.")}\\.[a-f0-9]{64}$`).test(baseName));
+}
+export function defaultCacheDir(env = process.env) {
+    const configuredRoot = env.XDG_CACHE_HOME;
+    const cacheRoot = configuredRoot && path.isAbsolute(configuredRoot)
+        ? configuredRoot
+        : path.join(os.homedir(), ".cache");
+    return path.join(cacheRoot, "rhdh-e2e-secrets", "gsm");
+}
+export function validateWrapper(script) {
+    if (!script.startsWith("#!/bin/bash") ||
+        !script.includes("set -euo pipefail") ||
+        !script.includes("GCLOUD_CONFIG_PATH") ||
+        !script.includes("CONTAINER_ENGINE")) {
+        throw new Error("GSM wrapper validation failed");
+    }
+    const image = script.match(/^IMAGE="\$\{SECRET_MANAGER_IMAGE:-([^}]+)\}"$/m)?.[1];
+    if (!image || !TRUSTED_IMAGE_PATTERN.test(image)) {
+        throw new Error("GSM wrapper validation failed: trusted image is required");
+    }
+}
+async function fetchCurrentWrapper(timeoutMs = DEFAULT_FETCH_TIMEOUT_MS) {
+    const response = await fetch(WRAPPER_URL, {
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (response.url !== WRAPPER_URL) {
+        throw new Error("GSM wrapper download redirected to an unexpected URL");
+    }
+    if (!response.ok) {
+        throw new Error(`GitHub returned HTTP ${response.status}`);
+    }
+    return response.text();
+}
+function hash(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function buildGsmEnvironment(parent) {
+    if (parent.SECRET_MANAGER_IMAGE !== undefined) {
+        validateImageReference(parent.SECRET_MANAGER_IMAGE);
+    }
+    const allowed = new Set([
+        "PATH",
+        "HOME",
+        "USER",
+        "LOGNAME",
+        "SHELL",
+        "TMPDIR",
+        "XDG_RUNTIME_DIR",
+        "XDG_CONFIG_HOME",
+        "CONTAINER_ENGINE",
+        "CONTAINER_HOST",
+        "DOCKER_HOST",
+        "SECRET_MANAGER_IMAGE",
+        "REGISTRY_AUTH_FILE",
+        "CONTAINERS_AUTH_FILE",
+        "SSL_CERT_FILE",
+        "NO_COLOR",
+        "TERM",
+        "HTTP_PROXY",
+        "HTTPS_PROXY",
+        "NO_PROXY",
+    ]);
+    const result = {};
+    for (const [key, value] of Object.entries(parent)) {
+        if (value !== undefined && allowed.has(key.toUpperCase())) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+function validateImageReference(image) {
+    if (!TRUSTED_IMAGE_PATTERN.test(image)) {
+        throw new Error("SECRET_MANAGER_IMAGE must reference the trusted image repository quay.io/openshift/ci-public");
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/secrets/gsm.d.ts

@@ -0,0 +1,33 @@
+import { type GsmWrapperRunResult } from "./gsm-wrapper.js";
+export type GsmMetadata = Record<string, unknown>;
+export declare class GsmNotFoundError extends Error {
+    readonly secretPath: string;
+    constructor(secretPath: string);
+}
+export interface GsmRunOptions {
+    stdio?: "pipe" | "inherit";
+    tty?: boolean;
+}
+export interface GsmRunner {
+    run(args: readonly string[], timeoutMs?: number, options?: GsmRunOptions): Promise<GsmWrapperRunResult>;
+    ensureInteractive?: () => Promise<void>;
+}
+export interface GsmClientOptions {
+    runner?: GsmRunner;
+    metadataTimeoutMs?: number;
+}
+export declare class GsmClient {
+    private readonly runner;
+    private readonly metadataTimeoutMs;
+    wrapperSha256?: string;
+    constructor(options?: GsmClientOptions);
+    describe(collection: string, secretPath: string): Promise<GsmMetadata>;
+    exists(collection: string, secretPath: string): Promise<boolean>;
+    list(collection: string): Promise<string[]>;
+    ensureInteractive(): Promise<void>;
+    create(collection: string, secretPath: string, snapshotPath: string, timeoutMs: number): Promise<void>;
+    update(collection: string, secretPath: string, snapshotPath: string, timeoutMs: number): Promise<void>;
+    delete(collection: string, secretPath: string, timeoutMs: number): Promise<void>;
+}
+export declare function gsmMutationError(message: string, indeterminate: boolean): Error;
+//# sourceMappingURL=gsm.d.ts.map