@red-hat-developer-hub/e2e-test-utils 2.1.15 → 2.1.17

package/dist/secrets/gsm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gsm.d.ts","sourceRoot":"","sources":["../../src/secrets/gsm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGxE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAElD,qBAAa,gBAAiB,SAAQ,KAAK;aACb,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM;CAI/C;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,CACD,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;gBAEX,OAAO,GAAE,gBAAqB;IAcpC,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IA2BtE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUhE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA8B3C,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAWV,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAUV,MAAM,CACV,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;CASjB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,OAAO,GACrB,KAAK,CAIP"}

package/dist/secrets/gsm.js

@@ -0,0 +1,172 @@
+import { GsmWrapper } from "./gsm-wrapper.js";
+import { MAX_TIMEOUT_MS } from "./command.js";
+export class GsmNotFoundError extends Error {
+    secretPath;
+    constructor(secretPath) {
+        super(`GSM target does not exist: ${secretPath}`);
+        this.secretPath = secretPath;
+        this.name = "GsmNotFoundError";
+    }
+}
+export class GsmClient {
+    runner;
+    metadataTimeoutMs;
+    wrapperSha256;
+    constructor(options = {}) {
+        this.runner = options.runner ?? new GsmWrapper();
+        this.metadataTimeoutMs = options.metadataTimeoutMs ?? 60_000;
+        if (!Number.isSafeInteger(this.metadataTimeoutMs) ||
+            this.metadataTimeoutMs <= 0 ||
+            this.metadataTimeoutMs > MAX_TIMEOUT_MS) {
+            throw new Error(`GSM metadata timeout must be a positive integer no greater than ${MAX_TIMEOUT_MS}ms`);
+        }
+    }
+    async describe(collection, secretPath) {
+        const result = await this.runner.run(["describe", "-c", collection, secretPath], this.metadataTimeoutMs);
+        this.wrapperSha256 = result.sha256;
+        if (result.timedOut) {
+            throw new Error(`GSM metadata check timed out: ${secretPath}`);
+        }
+        if (result.status !== 0) {
+            if (isAuthenticationResult(result)) {
+                throw new Error("GSM authentication is unavailable; run `rhdh-e2e-secrets gsm-login` first");
+            }
+            if (isNotFoundResult(result))
+                throw new GsmNotFoundError(secretPath);
+            throw new Error(`GSM target does not exist or is inaccessible: ${secretPath}`);
+        }
+        const metadata = parseMetadata(result.stdout);
+        if (!metadata) {
+            throw new Error(`GSM returned invalid metadata for ${secretPath}`);
+        }
+        return metadata;
+    }
+    async exists(collection, secretPath) {
+        try {
+            await this.describe(collection, secretPath);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof GsmNotFoundError)
+                return false;
+            throw error;
+        }
+    }
+    async list(collection) {
+        const result = await this.runner.run(["list", "-c", collection, "-o", "json"], this.metadataTimeoutMs);
+        this.wrapperSha256 = result.sha256;
+        if (result.timedOut)
+            throw new Error("GSM list timed out");
+        if (result.status !== 0) {
+            if (isAuthenticationResult(result)) {
+                throw new Error("GSM authentication is unavailable; run `rhdh-e2e-secrets gsm-login` first");
+            }
+            throw new Error("GSM list failed");
+        }
+        let value;
+        try {
+            value = JSON.parse(result.stdout);
+        }
+        catch {
+            throw new Error("GSM returned invalid list output");
+        }
+        if (!Array.isArray(value) ||
+            value.some((entry) => typeof entry !== "string")) {
+            throw new Error("GSM returned invalid list output");
+        }
+        return value;
+    }
+    async ensureInteractive() {
+        await this.runner.ensureInteractive?.();
+    }
+    async create(collection, secretPath, snapshotPath, timeoutMs) {
+        validateTimeout(timeoutMs);
+        const result = await this.runner.run(["create", "-c", collection, secretPath, "--from-file", snapshotPath], timeoutMs, { stdio: "inherit", tty: true });
+        this.wrapperSha256 = result.sha256;
+        assertMutationResult("create", result, secretPath, timeoutMs);
+    }
+    async update(collection, secretPath, snapshotPath, timeoutMs) {
+        validateTimeout(timeoutMs);
+        const result = await this.runner.run(["update", "-c", collection, secretPath, "--from-file", snapshotPath], timeoutMs);
+        this.wrapperSha256 = result.sha256;
+        assertMutationResult("update", result, secretPath, timeoutMs);
+    }
+    async delete(collection, secretPath, timeoutMs) {
+        validateTimeout(timeoutMs);
+        const result = await this.runner.run(["delete", "-c", collection, secretPath], timeoutMs);
+        this.wrapperSha256 = result.sha256;
+        assertMutationResult("delete", result, secretPath, timeoutMs);
+    }
+}
+export function gsmMutationError(message, indeterminate) {
+    const error = new Error(message);
+    error.indeterminate = indeterminate;
+    return error;
+}
+function isIndeterminateResult(result) {
+    return (result.timedOut === true ||
+        (result.status === null && result.signal !== undefined));
+}
+function assertMutationResult(operation, result, secretPath, timeoutMs) {
+    if (isIndeterminateResult(result)) {
+        const reason = result.timedOut
+            ? `after ${timeoutMs}ms`
+            : `after signal ${result.signal ?? "process termination"}`;
+        throw gsmMutationError(`GSM ${operation} is indeterminate ${reason}: ${secretPath}`, true);
+    }
+    if (result.status !== 0) {
+        throw gsmMutationError(`GSM ${operation} failed: ${secretPath}`, false);
+    }
+}
+function isNotFoundResult(result) {
+    return /secret\s+['"][^'"]+['"]\s+does not exist(?:\s+in collection)?/i.test(`${result.stdout}\n${result.stderr}`);
+}
+function isAuthenticationResult(result) {
+    return /defaultcredentials?error|default credentials were not found|application-default credentials/i.test(`${result.stdout}\n${result.stderr}`);
+}
+function parseMetadata(output) {
+    try {
+        const value = JSON.parse(output);
+        if (isRecord(value)) {
+            const metadata = {};
+            for (const key of METADATA_KEYS) {
+                if (typeof value[key] === "string")
+                    metadata[key] = value[key];
+            }
+            return Object.keys(metadata).length > 0 ? metadata : undefined;
+        }
+    }
+    catch {
+        // The deployed wrapper defaults to the stable human-readable format.
+    }
+    const fields = [
+        ["create-time", /^Created:\s*(.*)$/m],
+        ["jira-project", /^JIRA project:\s*(.*)$/m],
+        ["rotation-instructions", /^Rotation instructions:\s*(.*)$/m],
+        ["request-information", /^Request information:\s*(.*)$/m],
+    ];
+    const metadata = {};
+    for (const [key, pattern] of fields) {
+        const match = output.match(pattern);
+        if (!match)
+            return undefined;
+        metadata[key] = match[1].trim();
+    }
+    return metadata;
+}
+const METADATA_KEYS = [
+    "create-time",
+    "jira-project",
+    "rotation-instructions",
+    "request-information",
+];
+function validateTimeout(timeoutMs) {
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs <= 0 ||
+        timeoutMs > MAX_TIMEOUT_MS) {
+        throw new Error(`GSM operation timeout must be a positive integer no greater than ${MAX_TIMEOUT_MS}ms`);
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/secrets/index.d.ts

@@ -1,5 +1,10 @@
-export { expandProfile, getCollectionMapping, parseProfile, type CollectionMapping, type EnvironmentDestination, type ExpandedSecretProfile, type ExpandedSecretSelector, type ReadableCollectionId, type SecretProfile, type SecretSelector, } from "./config.js";
-export { BitwardenClient, type BitwardenClientOptions, type BitwardenAttachment, type BitwardenSecret, } from "./bitwarden.js";
-export { executeCommand, runChild, type ChildRunner, type ExecuteCommandOptions, type SecretReader, } from "./exec.js";
-export { materializeEnvironment, removeProviderEnvironmentVariables, type EnvironmentSecret, } from "./environment.js";
+export { bitwardenPathFromGsmPath, expandProfile, getCollectionMapping, gsmPathFromBitwardenPath, parseProfile, COLLECTIONS, READABLE_COLLECTIONS, validateSecretPath, type CollectionMapping, type EnvironmentDestination, type ExpandedSecretProfile, type ExpandedSecretSelector, type ReadableCollectionId, type SecretProfile, type SecretSelector, } from "./config.js";
+export { BitwardenClient, type BitwardenClientOptions, type BitwardenAttachment, type BitwardenSecretItem, type BitwardenSecretStorage, type BitwardenSecret, } from "./bitwarden.js";
+export { executeCommand, runChild, type ChildRunner, type ChildRunnerOptions, type ExecuteCommandOptions, type SecretReader, } from "./exec.js";
+export { materializeEnvironment, materializeEnvironmentWithSecrets, removeProviderEnvironmentVariables, type EnvironmentSecret, type MaterializedEnvironment, type MaterializedSecret, } from "./environment.js";
+export { GsmClient, GsmNotFoundError, type GsmClientOptions, type GsmMetadata, type GsmRunner, type GsmRunOptions, } from "./gsm.js";
+export { GsmWrapper, defaultCacheDir, validateWrapper, type GsmWrapperMetadata, type GsmWrapperOptions, type GsmWrapperRunResult, } from "./gsm-wrapper.js";
+export { executeMutation, createPlan, type ExecuteMutationOptions, type MutationAction, type MutationBitwarden, type MutationCommand, type MutationGsm, type MutationPlan, type MutationResult, } from "./mutation.js";
+export { readSecretInput, type SecretInput, type SecretInputOptions, } from "./secret-input.js";
+export { decodeSecretStream, SECRET_STREAM_ENVIRONMENT_VARIABLE, SECRET_STREAM_FD, writeSecretStream, type SecretStreamEntry, } from "./stream.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,QAAQ,EACR,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,oBAAoB,EACpB,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,QAAQ,EACR,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,iCAAiC,EACjC,kCAAkC,EAClC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,UAAU,EACV,eAAe,EACf,eAAe,EACf,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,eAAe,EACf,UAAU,EACV,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,eAAe,EACf,KAAK,WAAW,EAChB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,kCAAkC,EAClC,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC"}

package/dist/secrets/index.js

@@ -1,4 +1,9 @@
-export { expandProfile, getCollectionMapping, parseProfile, } from "./config.js";
+export { bitwardenPathFromGsmPath, expandProfile, getCollectionMapping, gsmPathFromBitwardenPath, parseProfile, COLLECTIONS, READABLE_COLLECTIONS, validateSecretPath, } from "./config.js";
 export { BitwardenClient, } from "./bitwarden.js";
 export { executeCommand, runChild, } from "./exec.js";
-export { materializeEnvironment, removeProviderEnvironmentVariables, } from "./environment.js";
+export { materializeEnvironment, materializeEnvironmentWithSecrets, removeProviderEnvironmentVariables, } from "./environment.js";
+export { GsmClient, GsmNotFoundError, } from "./gsm.js";
+export { GsmWrapper, defaultCacheDir, validateWrapper, } from "./gsm-wrapper.js";
+export { executeMutation, createPlan, } from "./mutation.js";
+export { readSecretInput, } from "./secret-input.js";
+export { decodeSecretStream, SECRET_STREAM_ENVIRONMENT_VARIABLE, SECRET_STREAM_FD, writeSecretStream, } from "./stream.js";

package/dist/secrets/lock.d.ts

@@ -0,0 +1,3 @@
+export declare function withSecretLock<T>(key: string, stateDir: string, operation: () => Promise<T>): Promise<T>;
+export declare function defaultLockDir(env?: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=lock.d.ts.map

package/dist/secrets/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../src/secrets/lock.ts"],"names":[],"mappings":"AAMA,wBAAsB,cAAc,CAAC,CAAC,EACpC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAED,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAO3E"}

package/dist/secrets/lock.js

@@ -0,0 +1,28 @@
+import { createHash } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import lockfile from "proper-lockfile";
+export async function withSecretLock(key, stateDir, operation) {
+    const lockDir = path.join(stateDir, ".locks");
+    await mkdir(lockDir, { recursive: true, mode: 0o700 });
+    const target = path.join(lockDir, `${createHash("sha256").update(key).digest("hex")}.lock`);
+    await writeFile(target, "", { flag: "a", mode: 0o600 });
+    const release = await lockfile.lock(target, {
+        retries: 0,
+        stale: 300_000,
+    });
+    try {
+        return await operation();
+    }
+    finally {
+        await release();
+    }
+}
+export function defaultLockDir(env = process.env) {
+    const configuredRoot = env.XDG_STATE_HOME;
+    const stateRoot = configuredRoot && path.isAbsolute(configuredRoot)
+        ? configuredRoot
+        : path.join(os.homedir(), ".local", "state");
+    return path.join(stateRoot, "rhdh-e2e-secrets");
+}

package/dist/secrets/mutation.d.ts

@@ -0,0 +1,71 @@
+import { type BitwardenSecretItem, type BitwardenSecretStorage } from "./bitwarden.js";
+import { type ReadableCollectionId } from "./config.js";
+import { type SecretInput } from "./secret-input.js";
+export type MutationCommand = "create" | "update" | "delete";
+export type MutationAction = "create" | "update" | "delete" | "skip";
+export interface MutationBitwarden {
+    findItem(collection: ReadableCollectionId, name: string): Promise<BitwardenSecretItem | undefined>;
+    createItem(collection: ReadableCollectionId, name: string, value: string, storage: BitwardenSecretStorage): Promise<BitwardenSecretItem>;
+    updateItem(item: BitwardenSecretItem, value: string, storage?: BitwardenSecretStorage): Promise<BitwardenSecretItem>;
+    deleteItem(item: BitwardenSecretItem): Promise<void>;
+}
+export interface MutationGsm {
+    wrapperSha256?: string;
+    exists(collection: string, path: string): Promise<boolean>;
+    create(collection: string, path: string, snapshotPath: string, timeoutMs: number): Promise<void>;
+    update(collection: string, path: string, snapshotPath: string, timeoutMs: number): Promise<void>;
+    delete(collection: string, path: string, timeoutMs: number): Promise<void>;
+    ensureInteractive?: () => Promise<void>;
+}
+export interface MutationPlan {
+    command: MutationCommand;
+    collection: ReadableCollectionId;
+    bitwardenCollection: string;
+    gsmCollection: string;
+    bitwardenPath: string;
+    gsmPath: string;
+    byteLength?: number;
+    storage?: BitwardenSecretStorage;
+    existingStorage?: BitwardenSecretStorage;
+    bitwardenAction: MutationAction;
+    gsmAction: MutationAction;
+}
+export interface ExecuteMutationOptions {
+    command: MutationCommand;
+    collection: string;
+    bitwardenPath: string;
+    fromFile?: string;
+    fromStdin?: boolean;
+    stdin?: Iterable<Buffer | string> | AsyncIterable<Buffer | string>;
+    allowEmpty?: boolean;
+    force?: boolean;
+    dryRun?: boolean;
+    gsmTimeoutMs?: number;
+    lockDirectory?: string;
+    readFile?: (path: string) => Promise<Buffer>;
+    bitwarden?: MutationBitwarden;
+    gsm?: MutationGsm;
+}
+export type MutationResult = {
+    state: "dry-run";
+    plan: MutationPlan;
+} | {
+    state: "applied";
+    plan: MutationPlan;
+};
+export declare function executeMutation(options: ExecuteMutationOptions): Promise<MutationResult>;
+interface PlanInput {
+    command: MutationCommand;
+    collection: ReadableCollectionId;
+    bitwardenCollection: string;
+    gsmCollection: string;
+    bitwardenPath: string;
+    gsmPath: string;
+    input?: SecretInput;
+    existingBitwarden?: BitwardenSecretItem;
+    existingGsm: boolean;
+    force: boolean;
+}
+export declare function createPlan(input: PlanInput): MutationPlan;
+export {};
+//# sourceMappingURL=mutation.d.ts.map

package/dist/secrets/mutation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutation.d.ts","sourceRoot":"","sources":["../../src/secrets/mutation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAMtE,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAC7D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAGrE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CACN,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAC5C,UAAU,CACR,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,UAAU,CACR,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,UAAU,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CACJ,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,oBAAoB,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IACzC,eAAe,EAAE,cAAc,CAAC;IAChC,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACnE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,SAAS,CAAC,EAAE,iBAAiB,CAAC;IAC9B,GAAG,CAAC,EAAE,WAAW,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GACxC;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,CAAC;AAI7C,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,cAAc,CAAC,CA4HzB;AAED,UAAU,SAAS;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,oBAAoB,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,YAAY,CAmDzD"}

package/dist/secrets/mutation.js

@@ -0,0 +1,210 @@
+import { BitwardenClient, } from "./bitwarden.js";
+import { bitwardenPathFromGsmPath, getCollectionMapping, gsmPathFromBitwardenPath, } from "./config.js";
+import { GsmClient } from "./gsm.js";
+import { MAX_TIMEOUT_MS } from "./command.js";
+import { defaultLockDir, withSecretLock } from "./lock.js";
+import { readSecretInput } from "./secret-input.js";
+import { createTemporarySecretFile, } from "./temporary-secret.js";
+const DEFAULT_GSM_TIMEOUT_MS = 600_000;
+export async function executeMutation(options) {
+    const bitwardenPath = bitwardenPathFromGsmPath(options.bitwardenPath);
+    const mapping = getCollectionMapping(options.collection);
+    const gsmPath = gsmPathFromBitwardenPath(bitwardenPath);
+    const timeoutMs = options.gsmTimeoutMs ?? DEFAULT_GSM_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs <= 0 ||
+        timeoutMs > MAX_TIMEOUT_MS) {
+        throw new Error(`GSM timeout must be a positive integer no greater than ${MAX_TIMEOUT_MS}ms`);
+    }
+    if (options.command === "update" && options.force) {
+        throw new Error("--force is not supported for update");
+    }
+    if (options.command === "delete" &&
+        (options.fromFile !== undefined ||
+            options.fromStdin === true ||
+            options.allowEmpty === true)) {
+        throw new Error("delete does not accept input options");
+    }
+    const bitwarden = options.bitwarden ?? new BitwardenClient({ env: process.env });
+    const gsm = options.gsm ?? new GsmClient();
+    const input = options.command === "delete"
+        ? undefined
+        : await readSecretInput({
+            fromFile: options.fromFile,
+            fromStdin: options.fromStdin,
+            allowEmpty: options.allowEmpty,
+            stdin: options.stdin,
+            readFile: options.readFile,
+        });
+    return withSecretLock(`${mapping.id}:${gsmPath}`, options.lockDirectory ?? defaultLockDir(), async () => {
+        const [existingBitwarden, existingGsm] = await Promise.all([
+            bitwarden.findItem(mapping.id, bitwardenPath),
+            gsm.exists(mapping.gsmCollection, gsmPath),
+        ]);
+        const plan = createPlan({
+            command: options.command,
+            collection: mapping.id,
+            bitwardenCollection: mapping.bitwardenCollection,
+            gsmCollection: mapping.gsmCollection,
+            bitwardenPath,
+            gsmPath,
+            input,
+            existingBitwarden,
+            existingGsm,
+            force: options.force === true,
+        });
+        if (options.dryRun === true)
+            return { state: "dry-run", plan };
+        if (plan.gsmAction === "create") {
+            await gsm.ensureInteractive?.();
+        }
+        const snapshot = input !== undefined &&
+            (plan.gsmAction === "create" || plan.gsmAction === "update")
+            ? await createSnapshot(input.value)
+            : undefined;
+        let bitwardenState = "not-started";
+        let operationError;
+        try {
+            if (plan.bitwardenAction !== "skip") {
+                bitwardenState = "attempted";
+                await executeBitwardenAction(plan, existingBitwarden, input, bitwarden);
+                bitwardenState = "confirmed";
+            }
+            await executeGsmAction(plan, snapshot, timeoutMs, gsm);
+        }
+        catch (error) {
+            operationError = error;
+        }
+        let cleanupError;
+        if (snapshot !== undefined) {
+            try {
+                await removeSnapshot(snapshot);
+            }
+            catch (error) {
+                cleanupError = error;
+            }
+        }
+        if (operationError !== undefined) {
+            const failure = mutationFailure(operationError, options.command, bitwardenState, options.force === true);
+            if (cleanupError !== undefined) {
+                throw new Error(`${failure.message}; temporary secret cleanup failed`, {
+                    cause: new AggregateError([failure, cleanupError]),
+                });
+            }
+            throw failure;
+        }
+        if (cleanupError !== undefined) {
+            throw new Error("Secret operation may have succeeded but temporary secret cleanup failed; inspect providers before retrying", { cause: cleanupError });
+        }
+        return { state: "applied", plan };
+    });
+}
+export function createPlan(input) {
+    const hasBitwarden = input.existingBitwarden !== undefined;
+    const hasGsm = input.existingGsm;
+    let bitwardenAction;
+    let gsmAction;
+    if (input.command === "create") {
+        if ((hasBitwarden || hasGsm) && !input.force) {
+            throw new Error("Secret already exists in one or both providers; retry with --force to reconcile it");
+        }
+        bitwardenAction = hasBitwarden ? "update" : "create";
+        gsmAction = hasGsm ? "update" : "create";
+    }
+    else if (input.command === "update") {
+        if (!hasBitwarden || !hasGsm) {
+            throw new Error("Secret is absent from one or both providers; update requires both targets");
+        }
+        bitwardenAction = "update";
+        gsmAction = "update";
+    }
+    else {
+        if ((!hasBitwarden || !hasGsm) && !input.force) {
+            throw new Error("Secret is absent from one or both providers; retry with --force to reconcile it");
+        }
+        bitwardenAction = hasBitwarden ? "delete" : "skip";
+        gsmAction = hasGsm ? "delete" : "skip";
+    }
+    return {
+        command: input.command,
+        collection: input.collection,
+        bitwardenCollection: input.bitwardenCollection,
+        gsmCollection: input.gsmCollection,
+        bitwardenPath: input.bitwardenPath,
+        gsmPath: input.gsmPath,
+        ...(input.input === undefined
+            ? {}
+            : {
+                byteLength: input.input.byteLength,
+                storage: input.input.storage,
+            }),
+        ...(input.existingBitwarden === undefined
+            ? {}
+            : { existingStorage: input.existingBitwarden.storage }),
+        bitwardenAction,
+        gsmAction,
+    };
+}
+async function executeBitwardenAction(plan, existing, input, bitwarden) {
+    if (plan.bitwardenAction === "skip")
+        return;
+    if (plan.bitwardenAction === "delete") {
+        if (!existing)
+            throw new Error("Bitwarden target disappeared before delete");
+        await bitwarden.deleteItem(existing);
+        return;
+    }
+    if (!input)
+        throw new Error("Secret input is required for this operation");
+    if (plan.bitwardenAction === "create") {
+        await bitwarden.createItem(plan.collection, plan.bitwardenPath, input.value, input.storage);
+        return;
+    }
+    if (!existing)
+        throw new Error("Bitwarden target disappeared before update");
+    await bitwarden.updateItem(existing, input.value, plan.command === "create" ? input.storage : existing.storage);
+}
+async function executeGsmAction(plan, snapshot, timeoutMs, gsm) {
+    if (plan.gsmAction === "skip")
+        return;
+    if (plan.gsmAction === "delete") {
+        await gsm.delete(plan.gsmCollection, plan.gsmPath, timeoutMs);
+        return;
+    }
+    if (!snapshot)
+        throw new Error("Secret snapshot is required for GSM update");
+    if (plan.gsmAction === "create") {
+        await gsm.create(plan.gsmCollection, plan.gsmPath, snapshot.path, timeoutMs);
+    }
+    else {
+        await gsm.update(plan.gsmCollection, plan.gsmPath, snapshot.path, timeoutMs);
+    }
+}
+function mutationFailure(error, command, bitwardenState, forceRequested) {
+    const message = error instanceof Error ? error.message : "Secret operation failed";
+    const requiresForce = command === "create" || command === "delete"
+        ? forceRequested || bitwardenState !== "not-started"
+        : false;
+    const force = requiresForce ? " with --force" : "";
+    const retry = `retry the ${command} command${force}`;
+    const bitwardenMessage = bitwardenState === "confirmed"
+        ? `Bitwarden was updated first, so ${retry}`
+        : bitwardenState === "attempted"
+            ? `Bitwarden may have been updated, so ${retry}`
+            : retry;
+    const indeterminate = isIndeterminateError(error) &&
+        "; GSM operation may be indeterminate; inspect GSM before retrying";
+    return new Error(`${message}; ${bitwardenMessage}${indeterminate}`, {
+        cause: error,
+    });
+}
+async function createSnapshot(value) {
+    return createTemporarySecretFile(value, "value");
+}
+async function removeSnapshot(snapshot) {
+    await snapshot.remove();
+}
+function isIndeterminateError(error) {
+    return (error instanceof Error &&
+        error.indeterminate === true);
+}

package/dist/secrets/secret-input.d.ts

@@ -0,0 +1,17 @@
+export interface SecretInput {
+    value: string;
+    byteLength: number;
+    storage: "note" | "attachment";
+}
+export interface SecretInputOptions {
+    fromFile?: string;
+    fromStdin?: boolean;
+    allowEmpty?: boolean;
+    readFile?: (path: string) => Promise<Buffer>;
+    stdin?: SecretInputStream;
+}
+export type SecretInputStream = (Iterable<Buffer | string> | AsyncIterable<Buffer | string>) & {
+    isTTY?: boolean;
+};
+export declare function readSecretInput(options: SecretInputOptions): Promise<SecretInput>;
+//# sourceMappingURL=secret-input.d.ts.map

package/dist/secrets/secret-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-input.d.ts","sourceRoot":"","sources":["../../src/secrets/secret-input.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC5B,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,GACzB,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,CACjC,GAAG;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAExB,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAkCtB"}

package/dist/secrets/secret-input.js

@@ -0,0 +1,40 @@
+import { readFile as defaultReadFile } from "node:fs/promises";
+export async function readSecretInput(options) {
+    const sourceCount = Number(options.fromFile !== undefined) + Number(options.fromStdin === true);
+    if (sourceCount !== 1) {
+        throw new Error("Exactly one of --from-file or --from-stdin is required");
+    }
+    const fromFile = options.fromFile !== undefined;
+    const stdin = options.stdin ?? process.stdin;
+    if (!fromFile && stdin.isTTY === true) {
+        throw new Error("--from-stdin requires piped input; use --from-file for a file");
+    }
+    const bytes = fromFile
+        ? await (options.readFile ?? defaultReadFile)(options.fromFile)
+        : await readStdin(stdin);
+    let value;
+    try {
+        value = new TextDecoder("utf-8", {
+            fatal: true,
+            ignoreBOM: true,
+        }).decode(bytes);
+    }
+    catch {
+        throw new Error("Secret input must be valid UTF-8");
+    }
+    if (bytes.length === 0 && options.allowEmpty !== true) {
+        throw new Error("Empty secret input requires --allow-empty");
+    }
+    return {
+        value,
+        byteLength: bytes.length,
+        storage: fromFile ? "attachment" : "note",
+    };
+}
+async function readStdin(input) {
+    const chunks = [];
+    for await (const chunk of input) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf8"));
+    }
+    return Buffer.concat(chunks);
+}

package/dist/secrets/stream.d.ts

@@ -0,0 +1,9 @@
+export interface SecretStreamEntry {
+    name: string;
+    value: string;
+}
+export declare const SECRET_STREAM_ENVIRONMENT_VARIABLE = "RHDH_E2E_SECRET_FD";
+export declare const SECRET_STREAM_FD = 3;
+export declare function writeSecretStream(stream: NodeJS.WritableStream, entries: readonly SecretStreamEntry[]): Promise<void>;
+export declare function decodeSecretStream(input: Uint8Array): SecretStreamEntry[];
+//# sourceMappingURL=stream.d.ts.map

package/dist/secrets/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/secrets/stream.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,kCAAkC,uBAAuB,CAAC;AACvE,eAAO,MAAM,gBAAgB,IAAI,CAAC;AA4BlC,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,EAAE,CAuDzE"}