@shibanet0/datamitsu-config 0.1.7 → 0.4.1

package/dist/s0/cmd/pulumi/decrypt-state.d.ts

@@ -0,0 +1,8 @@
+export interface DecryptOptions {
+    /**
+     * Replace plaintext state that differs from its encrypted file. The previous plaintext is kept as
+     * a backup in the user cache (see `getStateGuardDir`).
+     */
+    force?: boolean;
+}
+export declare const pulumiDecrypt: (options?: DecryptOptions) => Promise<void>;

package/dist/s0/cmd/pulumi/encrypt-state.d.ts

@@ -0,0 +1,14 @@
+export interface EncryptOptions {
+    /**
+     * Encrypt files whose last decryption was refused because the plaintext differed, declaring the
+     * local plaintext authoritative.
+     */
+    force?: boolean;
+}
+export declare const getEditorJS: (buf: Buffer) => Promise<{
+    env: {
+        [x: string]: string;
+    };
+    scriptContent: string;
+}>;
+export declare const pulumiEncrypt: (options?: EncryptOptions) => Promise<void>;

package/dist/s0/cmd/pulumi/index.d.ts

@@ -1,2 +1,4 @@
 import { Command } from "@commander-js/extra-typings";
-export declare const pulumiCommand: Command<["encrypt-all-state" | "decrypt-all-state" | "cleanup-all-state"], {}, {}>;
+export declare const pulumiCommand: Command<["encrypt-all-state" | "decrypt-all-state" | "cleanup-all-state"], {
+    force?: true;
+}, {}>;

package/dist/s0/cmd/pulumi/state-content.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Whether two serialized forms describe the same state, ignoring formatting only.
+ *
+ * SOPS re-serializes what it decrypts, so byte equality would report a difference for every file
+ * whose indentation differs from Pulumi's. YAML goes through a lossless round trip instead:
+ * integers stay exact, `.nan` and `null` stay distinct, and key order still counts, which only ever
+ * errs towards reporting a difference.
+ */
+export declare function isSameStateContent(left: Buffer | string, right: Buffer | string, fileType: "json" | "yaml"): boolean;
+/**
+ * Drops whitespace outside JSON strings and keeps every other character as is.
+ *
+ * Parsing and re-serializing would be simpler but is lossy for Pulumi state: it rounds integers
+ * beyond 2^53. Array order carries meaning in a checkpoint (dependencies must precede dependents),
+ * so two documents are only equal when their token streams are; sorting resources for comparison
+ * would let a topologically invalid encrypted file look unchanged and never be repaired.
+ *
+ * Self-contained on purpose: `encryptState` embeds it into the generated SOPS editor script via
+ * `String()`.
+ */
+export declare function stripInsignificantJsonWhitespace(text: string): string;

package/dist/s0/cmd/pulumi/state-files.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Finds state files once per physical file.
+ *
+ * In a pnpm workspace a stack package is also reachable through `node_modules` symlinks of its
+ * dependents. Visiting those aliases would run several concurrent SOPS operations on the same file,
+ * so symlinks are not followed and results are deduplicated by real path.
+ */
+export declare function findStateFiles(patterns: readonly string[], ignore?: readonly string[]): Promise<string[]>;
+/**
+ * Replaces `target` without ever leaving it truncated: the content goes to a sibling temporary file
+ * first and is renamed over the target, which is atomic on the same filesystem.
+ */
+export declare function writeFileAtomic(target: string, content: Buffer | string): Promise<void>;

package/dist/s0/cmd/pulumi/state-guard.d.ts

@@ -0,0 +1,15 @@
+export declare function backupPlaintext(plaintextFile: string, content: Buffer): Promise<string>;
+export declare function clearDecryptConflict(plaintextFile: string): Promise<void>;
+/**
+ * Backups and conflict markers live in the user cache, never next to the state: files beside
+ * `.pulumi` state are not covered by a consumer's ignore rules for plaintext, so staging everything
+ * would publish them unencrypted.
+ */
+export declare function getStateGuardDir(): string;
+export declare function hasDecryptConflict(plaintextFile: string): Promise<boolean>;
+/**
+ * Recorded when decryption refuses to replace a plaintext that differs from its encrypted file.
+ * Until it is resolved, encryption must not run for that file: the plaintext may be the older side
+ * (a pull brought a newer encrypted file), and encrypting it would overwrite the newer state.
+ */
+export declare function markDecryptConflict(plaintextFile: string): Promise<void>;