@struktoai/mirage-node 0.0.5 → 0.0.7-alpha.1

package/dist/runtime/sandbox/ssh/constants.js

@@ -0,0 +1,32 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { singleQuote } from '@struktoai/mirage-core/utils/quote';
+/**
+ * The line dressed to run on the remote host: cwd, env, then sh.
+ *
+ * SSH exec has no docker-style `-w`/`-e` (the protocol's env channel
+ * is AcceptEnv-gated server-side, so it silently drops names), so the
+ * working directory and the merged environment ride the command
+ * itself: `cd 'cwd' && env 'K=V' ... sh -c 'line'`. Every piece is
+ * sh_single_quoted, so the remote login shell reads each as one word
+ * whatever it holds; the machine only needs a POSIX-compatible shell.
+ */
+export function wrapLine(line, env, cwd) {
+    const parts = ['cd', singleQuote(cwd), '&&', 'env'];
+    for (const [key, value] of Object.entries(env))
+        parts.push(singleQuote(`${key}=${value}`));
+    parts.push('sh', '-c', singleQuote(line));
+    return parts.join(' ');
+}
+//# sourceMappingURL=constants.js.map

package/dist/runtime/sandbox/ssh/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/ssh/constants.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAA;AAEhE;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,GAA2B,EAAE,GAAW;IAC7E,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;IACnD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAA;IAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC"}

package/dist/runtime/sandbox/ssh/runtime.d.ts

@@ -0,0 +1,40 @@
+import { RemoteSandbox } from '@struktoai/mirage-core/runtime/sandbox/base';
+import type { RunResult, RuntimeOptions } from '@struktoai/mirage-core/runtime/types';
+import { type SSHRuntimeConfig } from './config.ts';
+import type * as Ssh2Mod from 'ssh2';
+export type Ssh2Sdk = typeof Ssh2Mod;
+interface SshResult {
+    stdout: Uint8Array;
+    stderr: Uint8Array;
+    code: number;
+}
+/**
+ * A machine reached over SSH as a whole-line runtime.
+ *
+ * You run the machine and its sshd yourself; mirage only connects
+ * (keys or an agent, never a password) and execs lines. One connection opens on
+ * the first captured line and is reused; each line is one exec
+ * channel with real byte stdin and separated stderr, the merged
+ * environment and session cwd dressed onto the command by wrapLine,
+ * because SSH exec has no docker-style `-w`/`-e`.
+ *
+ * This is the one provider whose machine usually IS the fileserver:
+ * mount the same host's directory over the ssh resource at a prefix
+ * equal to its remote absolute path, and captured lines read and
+ * write those files natively, with no FUSE and no mirage installed
+ * remotely. Host keys are not verified (ssh2 never does), so treat
+ * the network path as trusted.
+ */
+export declare class SSHRuntime extends RemoteSandbox<SSHRuntimeConfig> {
+    readonly name = "ssh";
+    private client;
+    constructor(options?: RuntimeOptions<SSHRuntimeConfig> | Record<string, unknown>);
+    protected loadSdk(): Promise<Ssh2Sdk>;
+    private connectOpts;
+    connect(): Promise<void>;
+    execLine(line: string, stdin: Uint8Array | null, env: Record<string, string>, cwd: string): Promise<RunResult>;
+    protected ssh(command: string, stdin: Uint8Array | null): Promise<SshResult>;
+    close(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime/sandbox/ssh/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sandbox/ssh/runtime.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAE3E,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAErF,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAG5E,OAAO,KAAK,KAAK,OAAO,MAAM,MAAM,CAAA;AAEpC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAA;AAEpC,UAAU,SAAS;IACjB,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;CACb;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,UAAW,SAAQ,aAAa,CAAC,gBAAgB,CAAC;IAC7D,QAAQ,CAAC,IAAI,SAAQ;IACrB,OAAO,CAAC,MAAM,CAAsB;gBAExB,OAAO,GAAE,cAAc,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAQpF,SAAS,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;YAOvB,WAAW;IAiBnB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAcxB,QAAQ,CACZ,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,SAAS,CAAC;IAMrB,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC;IAgCnE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAOhC"}

package/dist/runtime/sandbox/ssh/runtime.js

@@ -0,0 +1,139 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { readFile } from 'node:fs/promises';
+import { homedir, userInfo } from 'node:os';
+import { resolve } from 'node:path';
+import { RemoteSandbox } from '@struktoai/mirage-core/runtime/sandbox/base';
+import { registerRuntime } from '@struktoai/mirage-core/runtime/table';
+import { loadOptionalPeer } from '@struktoai/mirage-core/utils/optional_peer';
+import { SSH_RUNTIME_CONFIG_KEYS } from "./config.js";
+import { wrapLine } from "./constants.js";
+function expandHome(p) {
+    if (p === '~')
+        return homedir();
+    if (p.startsWith('~/'))
+        return resolve(homedir(), p.slice(2));
+    return p;
+}
+/**
+ * A machine reached over SSH as a whole-line runtime.
+ *
+ * You run the machine and its sshd yourself; mirage only connects
+ * (keys or an agent, never a password) and execs lines. One connection opens on
+ * the first captured line and is reused; each line is one exec
+ * channel with real byte stdin and separated stderr, the merged
+ * environment and session cwd dressed onto the command by wrapLine,
+ * because SSH exec has no docker-style `-w`/`-e`.
+ *
+ * This is the one provider whose machine usually IS the fileserver:
+ * mount the same host's directory over the ssh resource at a prefix
+ * equal to its remote absolute path, and captured lines read and
+ * write those files natively, with no FUSE and no mirage installed
+ * remotely. Host keys are not verified (ssh2 never does), so treat
+ * the network path as trusted.
+ */
+export class SSHRuntime extends RemoteSandbox {
+    name = 'ssh';
+    client = null;
+    constructor(options = {}) {
+        super(options, SSH_RUNTIME_CONFIG_KEYS);
+        if (!this.config.host) {
+            throw new Error('ssh config needs host: the machine that runs captured lines');
+        }
+    }
+    // The SDK loader as a seam: tests substitute a fake module here.
+    loadSdk() {
+        return loadOptionalPeer(() => import('ssh2'), {
+            feature: "the 'ssh' runtime",
+            packageName: 'ssh2',
+        });
+    }
+    async connectOpts() {
+        const opts = {
+            host: this.config.hostname ?? this.config.host,
+            port: this.config.port ?? 22,
+            username: this.config.username ?? userInfo().username,
+            readyTimeout: (this.config.timeout ?? 30) * 1000,
+        };
+        if (this.config.identityFile !== undefined) {
+            opts.privateKey = await readFile(expandHome(this.config.identityFile));
+        }
+        else if (process.env.SSH_AUTH_SOCK) {
+            // The asyncssh twin's rule: a named key is used alone; with
+            // none, the ssh-agent authenticates.
+            opts.agent = process.env.SSH_AUTH_SOCK;
+        }
+        return opts;
+    }
+    async connect() {
+        const sdk = await this.loadSdk();
+        const client = new sdk.Client();
+        const opts = await this.connectOpts();
+        await new Promise((resolveFn, rejectFn) => {
+            client.on('ready', () => {
+                resolveFn();
+            });
+            client.on('error', rejectFn);
+            client.connect(opts);
+        });
+        this.client = client;
+    }
+    async execLine(line, stdin, env, cwd) {
+        const result = await this.ssh(wrapLine(line, env, cwd), stdin);
+        return { stdout: result.stdout, stderr: result.stderr, exitCode: result.code };
+    }
+    // One exec channel on the shared connection; the seam tests override.
+    ssh(command, stdin) {
+        const client = this.client;
+        if (client === null)
+            return Promise.reject(new Error('ssh runtime not connected'));
+        return new Promise((resolveFn, rejectFn) => {
+            client.exec(command, (err, stream) => {
+                if (err !== undefined) {
+                    rejectFn(err);
+                    return;
+                }
+                const out = [];
+                const errs = [];
+                let code = null;
+                stream.on('data', (chunk) => out.push(chunk));
+                stream.stderr.on('data', (chunk) => errs.push(chunk));
+                stream.on('exit', (c) => {
+                    code = c;
+                });
+                stream.on('close', () => {
+                    resolveFn({
+                        stdout: new Uint8Array(Buffer.concat(out)),
+                        stderr: new Uint8Array(Buffer.concat(errs)),
+                        code: code ?? 1,
+                    });
+                });
+                stream.on('error', rejectFn);
+                // No pipe still closes stdin, so a reader sees EOF immediately.
+                if (stdin !== null)
+                    stream.write(stdin);
+                stream.end();
+            });
+        });
+    }
+    close() {
+        if (this.client !== null) {
+            this.client.end();
+            this.client = null;
+        }
+        return Promise.resolve();
+    }
+}
+registerRuntime('ssh', SSHRuntime);
+//# sourceMappingURL=runtime.js.map

package/dist/runtime/sandbox/ssh/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../../src/runtime/sandbox/ssh/runtime.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,6CAA6C,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAA;AAC7E,OAAO,EAAE,uBAAuB,EAAyB,MAAM,aAAa,CAAA;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAYzC,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAA;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,UAAW,SAAQ,aAA+B;IACpD,IAAI,GAAG,KAAK,CAAA;IACb,MAAM,GAAkB,IAAI,CAAA;IAEpC,YAAY,UAAsE,EAAE;QAClF,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;QAChF,CAAC;IACH,CAAC;IAED,iEAAiE;IACvD,OAAO;QACf,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;YAC5C,OAAO,EAAE,mBAAmB;YAC5B,WAAW,EAAE,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,MAAM,IAAI,GAAkB;YAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI;YAC9C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE;YAC5B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,QAAQ;YACrD,YAAY,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI;SACjD,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;QACxE,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YACrC,4DAA4D;YAC5D,qCAAqC;YACrC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;QACxC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;QAChC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACrC,MAAM,IAAI,OAAO,CAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;YAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,SAAS,EAAE,CAAA;YACb,CAAC,CAAC,CAAA;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,IAAY,EACZ,KAAwB,EACxB,GAA2B,EAC3B,GAAW;QAEX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;QAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IAChF,CAAC;IAED,sEAAsE;IAC5D,GAAG,CAAC,OAAe,EAAE,KAAwB;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAA;QAClF,OAAO,IAAI,OAAO,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAsB,EAAE,MAAqB,EAAE,EAAE;gBACrE,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;oBACtB,QAAQ,CAAC,GAAG,CAAC,CAAA;oBACb,OAAM;gBACR,CAAC;gBACD,MAAM,GAAG,GAAa,EAAE,CAAA;gBACxB,MAAM,IAAI,GAAa,EAAE,CAAA;gBACzB,IAAI,IAAI,GAAkB,IAAI,CAAA;gBAC9B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBACrD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC7D,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAgB,EAAE,EAAE;oBACrC,IAAI,GAAG,CAAC,CAAA;gBACV,CAAC,CAAC,CAAA;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,SAAS,CAAC;wBACR,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;wBAC1C,MAAM,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBAC3C,IAAI,EAAE,IAAI,IAAI,CAAC;qBAChB,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;gBACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;gBAC5B,gEAAgE;gBAChE,IAAI,KAAK,KAAK,IAAI;oBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBACvC,MAAM,CAAC,GAAG,EAAE,CAAA;YACd,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAEQ,KAAK;QACZ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;YACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QACpB,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;IAC1B,CAAC;CACF;AAED,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA"}

package/dist/secrets/aws.d.ts

@@ -0,0 +1,22 @@
+import type { ResolvedSecret } from '@struktoai/mirage-core/secrets/types';
+import type { AWSSMConfig } from './config.ts';
+/**
+ * Shape one `SecretString` into secret fields.
+ *
+ * A JSON object with all-string values is the fields as-is (the common
+ * Secrets Manager layout); anything else -- a plain string, a JSON
+ * list, an object with non-string values -- is the whole text under
+ * `value`.
+ */
+export declare function fieldsFromSecretString(text: string): Record<string, string>;
+/**
+ * Fetch one secret from AWS Secrets Manager.
+ *
+ * `ref` is the `SecretId` -- a secret name or full ARN. The SDK loads
+ * on first use (the lazy-module trick Python spells as an import
+ * path), and an absent explicit credential falls to the SDK's default
+ * provider chain, so an empty config reads the ambient AWS settings.
+ * A binary secret is refused: v1 reads `SecretString` only.
+ */
+export declare function fetchAwsSm(config: AWSSMConfig, ref: string): Promise<ResolvedSecret>;
+//# sourceMappingURL=aws.d.ts.map

package/dist/secrets/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/secrets/aws.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAE1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgB3E;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA+B1F"}

package/dist/secrets/aws.js

@@ -0,0 +1,80 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { SecretsError } from '@struktoai/mirage-core/secrets/errors';
+/**
+ * Shape one `SecretString` into secret fields.
+ *
+ * A JSON object with all-string values is the fields as-is (the common
+ * Secrets Manager layout); anything else -- a plain string, a JSON
+ * list, an object with non-string values -- is the whole text under
+ * `value`.
+ */
+export function fieldsFromSecretString(text) {
+    let decoded;
+    try {
+        decoded = JSON.parse(text);
+    }
+    catch {
+        return { value: text };
+    }
+    if (decoded !== null &&
+        typeof decoded === 'object' &&
+        !Array.isArray(decoded) &&
+        Object.values(decoded).every((value) => typeof value === 'string')) {
+        return decoded;
+    }
+    return { value: text };
+}
+/**
+ * Fetch one secret from AWS Secrets Manager.
+ *
+ * `ref` is the `SecretId` -- a secret name or full ARN. The SDK loads
+ * on first use (the lazy-module trick Python spells as an import
+ * path), and an absent explicit credential falls to the SDK's default
+ * provider chain, so an empty config reads the ambient AWS settings.
+ * A binary secret is refused: v1 reads `SecretString` only.
+ */
+export async function fetchAwsSm(config, ref) {
+    if (ref === '') {
+        throw new SecretsError("the 'aws-sm' source needs a ref: the SecretId (name or ARN)");
+    }
+    const { SecretsManagerClient, GetSecretValueCommand } = await import('@aws-sdk/client-secrets-manager');
+    const client = new SecretsManagerClient({
+        ...(config.region !== undefined ? { region: config.region } : {}),
+        ...(config.awsProfile !== undefined ? { profile: config.awsProfile } : {}),
+        ...(config.awsAccessKeyId !== undefined && config.awsSecretAccessKey !== undefined
+            ? {
+                credentials: {
+                    accessKeyId: config.awsAccessKeyId,
+                    secretAccessKey: config.awsSecretAccessKey,
+                    ...(config.awsSessionToken !== undefined
+                        ? { sessionToken: config.awsSessionToken }
+                        : {}),
+                },
+            }
+            : {}),
+    });
+    try {
+        const response = await client.send(new GetSecretValueCommand({ SecretId: ref }));
+        const text = response.SecretString;
+        if (text === undefined) {
+            throw new SecretsError(`secret '${ref}' is binary (SecretBinary); v1 reads SecretString only`);
+        }
+        return { fields: fieldsFromSecretString(text) };
+    }
+    finally {
+        client.destroy();
+    }
+}
+//# sourceMappingURL=aws.js.map

package/dist/secrets/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/secrets/aws.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAA;AAKpE;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,OAAgB,CAAA;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACxB,CAAC;IACD,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACvB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAClE,CAAC;QACD,OAAO,OAAiC,CAAA;IAC1C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAmB,EAAE,GAAW;IAC/D,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,6DAA6D,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,GACnD,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;YAChF,CAAC,CAAC;gBACE,WAAW,EAAE;oBACX,WAAW,EAAE,MAAM,CAAC,cAAc;oBAClC,eAAe,EAAE,MAAM,CAAC,kBAAkB;oBAC1C,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS;wBACtC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,eAAe,EAAE;wBAC1C,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;IACF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QAChF,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAA;QAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CAAC,WAAW,GAAG,wDAAwD,CAAC,CAAA;QAChG,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAA;IACjD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/secrets/config.d.ts

@@ -0,0 +1,39 @@
+import { z } from '@struktoai/mirage-core/resource/secrets';
+export declare const AWSSMConfig: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
+    region: z.ZodOptional<z.ZodString>;
+    awsAccessKeyId: z.ZodOptional<z.ZodString>;
+    awsSecretAccessKey: z.ZodOptional<z.ZodString>;
+    awsSessionToken: z.ZodOptional<z.ZodString>;
+    awsProfile: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>>;
+export type AWSSMConfig = z.infer<typeof AWSSMConfig>;
+/**
+ * Dotenv source config: `path` is the default file when a managed
+ * entry's `ref` is empty; a non-empty `ref` is itself the host
+ * filesystem path.
+ */
+export declare const DotenvConfig: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+}, z.core.$strict>;
+export type DotenvConfig = z.infer<typeof DotenvConfig>;
+/**
+ * Process-environment source config: there is nothing to say. The host
+ * process env has no sub-address, so a managed entry using this source
+ * must leave `ref` empty.
+ */
+export declare const EnvConfig: z.ZodObject<{}, z.core.$strict>;
+export type EnvConfig = z.infer<typeof EnvConfig>;
+/**
+ * 1Password source config: the service account token.
+ *
+ * Absent, the token falls back to `OP_SERVICE_ACCOUNT_TOKEN` in the
+ * host process env, the variable 1Password's own CLI and SDKs read, so
+ * a deployment with one account needs no config at all -- the same
+ * shape `aws-sm` has, where an empty config reads the ambient AWS
+ * settings.
+ */
+export declare const OnePasswordConfig: z.ZodObject<{
+    token: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type OnePasswordConfig = z.infer<typeof OnePasswordConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/secrets/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,CAAC,EAAE,MAAM,yCAAyC,CAAA;AA4C3D,eAAO,MAAM,WAAW;;;;;;mBASvB,CAAA;AACD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,YAAY;;kBAEvB,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAA;AAEvD;;;;GAIG;AACH,eAAO,MAAM,SAAS,iCAAqB,CAAA;AAC3C,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAA;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;kBAE5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA"}

package/dist/secrets/config.js

@@ -0,0 +1,95 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Through core's re-export, never a direct 'zod' import: a second zod
+// instance makes every ZodObject here structurally unrelated to core's
+// (see resource/secrets.ts), which still type-checks but takes minutes
+// and defeats the registry's nominal ZodType pairing.
+import { z } from '@struktoai/mirage-core/resource/secrets';
+/**
+ * AWS Secrets Manager source config: the five AWS credential fields
+ * every AWS-speaking config shares, nothing else. Python factors them
+ * into an `AWSAuth` base its `S3Config` also extends; here the s3
+ * config owns its snake_case normalizer, so the shape serves this
+ * source alone. The `ref` of a managed entry is the SecretId; it rides
+ * the fetch call, not this config.
+ */
+const AWS_SM_KEYS = {
+    aws_access_key_id: 'awsAccessKeyId',
+    aws_secret_access_key: 'awsSecretAccessKey',
+    aws_session_token: 'awsSessionToken',
+    aws_profile: 'awsProfile',
+};
+/**
+ * Accept the snake_case spellings a `secrets:` block arrives in.
+ *
+ * A source's config keys travel raw out of yaml, spelled python's way
+ * like a mount's are, so the four prefixed AWS keys reach this schema
+ * as `aws_profile` and friends. The rename lives here rather than in
+ * the config door because the door would impose it on every source's
+ * model, a custom one included; this one is the only builtin whose
+ * fields are more than a single word. Camel keys pass through, so a
+ * TS caller building the config directly is unaffected.
+ */
+function normalizeAwsSmKeys(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        return input;
+    const out = {};
+    for (const [key, value] of Object.entries(input)) {
+        const camel = AWS_SM_KEYS[key];
+        // A config carrying both spellings of one field is refused rather
+        // than settled by insertion order: the snake key is left in place
+        // and the strict object reports it as unrecognized. Python refuses
+        // the same config from the other side, its camel key being the
+        // extra one there.
+        if (camel === undefined || Object.hasOwn(input, camel))
+            out[key] = value;
+        else
+            out[camel] = value;
+    }
+    return out;
+}
+export const AWSSMConfig = z.preprocess(normalizeAwsSmKeys, z.strictObject({
+    region: z.string().optional(),
+    awsAccessKeyId: z.string().optional(),
+    awsSecretAccessKey: z.string().optional(),
+    awsSessionToken: z.string().optional(),
+    awsProfile: z.string().optional(),
+}));
+/**
+ * Dotenv source config: `path` is the default file when a managed
+ * entry's `ref` is empty; a non-empty `ref` is itself the host
+ * filesystem path.
+ */
+export const DotenvConfig = z.strictObject({
+    path: z.string().default('.env'),
+});
+/**
+ * Process-environment source config: there is nothing to say. The host
+ * process env has no sub-address, so a managed entry using this source
+ * must leave `ref` empty.
+ */
+export const EnvConfig = z.strictObject({});
+/**
+ * 1Password source config: the service account token.
+ *
+ * Absent, the token falls back to `OP_SERVICE_ACCOUNT_TOKEN` in the
+ * host process env, the variable 1Password's own CLI and SDKs read, so
+ * a deployment with one account needs no config at all -- the same
+ * shape `aws-sm` has, where an empty config reads the ambient AWS
+ * settings.
+ */
+export const OnePasswordConfig = z.strictObject({
+    token: z.string().optional(),
+});
+//# sourceMappingURL=config.js.map

package/dist/secrets/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/secrets/config.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,sDAAsD;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,yCAAyC,CAAA;AAE3D;;;;;;;GAOG;AACH,MAAM,WAAW,GAAqC;IACpD,iBAAiB,EAAE,gBAAgB;IACnC,qBAAqB,EAAE,oBAAoB;IAC3C,iBAAiB,EAAE,iBAAiB;IACpC,WAAW,EAAE,YAAY;CAC1B,CAAA;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrF,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC9B,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,+DAA+D;QAC/D,mBAAmB;QACnB,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;;YACnE,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;IACzB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CACrC,kBAAkB,EAClB,CAAC,CAAC,YAAY,CAAC;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CACH,CAAA;AAGD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACjC,CAAC,CAAA;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;AAG3C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAA"}

package/dist/secrets/constants.d.ts

@@ -0,0 +1,3 @@
+/** The builtin source names this module registers, sorted. */
+export declare const BUILTIN_SOURCE_NAMES: readonly ["1password", "aws-sm", "dotenv", "env"];
+//# sourceMappingURL=constants.d.ts.map

package/dist/secrets/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/secrets/constants.ts"],"names":[],"mappings":"AA4CA,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,mDAAoD,CAAA"}

package/dist/secrets/constants.js

@@ -0,0 +1,58 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { createRequire } from 'node:module';
+import { SecretsError } from '@struktoai/mirage-core/secrets/errors';
+import { registerSecrets } from '@struktoai/mirage-core/secrets/registry';
+import { AWSSMConfig, DotenvConfig, EnvConfig, OnePasswordConfig } from "./config.js";
+// Resolution only, never a load: this answers whether an optional
+// peer is installed without pulling it in. `import.meta.resolve` would
+// be the obvious tool and is unusable -- vitest's SSR transform leaves
+// it undefined, so the probe would report every peer missing under
+// test and in any bundler that does the same.
+const resolvePeer = createRequire(import.meta.url).resolve;
+/**
+ * Refuse a source whose optional peer dependency is not installed.
+ *
+ * Synchronous, so it answers where the workspace is built rather than
+ * on the first line that reads a secret.
+ */
+function requirePeer(source, peer) {
+    try {
+        resolvePeer(peer);
+    }
+    catch {
+        throw new SecretsError(`the '${source}' source needs its optional dependency (${peer}): npm install ${peer}`);
+    }
+}
+/** The builtin source names this module registers, sorted. */
+export const BUILTIN_SOURCE_NAMES = ['1password', 'aws-sm', 'dotenv', 'env'];
+// Builtin fetchers load lazily: each registered fetch dynamically
+// imports its module on first use, so a source's SDK loads only when a
+// workspace actually uses it (Python spells the same table as import
+// paths beside its core registry). Registration itself runs at import
+// time -- the compression-codec pattern -- because core's registry
+// cannot name node modules; the node Workspace and the config door both
+// import this module, so either entry point arms the builtins.
+registerSecrets('env', EnvConfig, async (config, ref) => (await import("./env.js")).fetchEnv(config, ref));
+registerSecrets('dotenv', DotenvConfig, async (config, ref) => (await import("./dotenv.js")).fetchDotenv(config, ref));
+registerSecrets('aws-sm', AWSSMConfig, async (config, ref) => (await import("./aws.js")).fetchAwsSm(config, ref));
+registerSecrets('1password', OnePasswordConfig, async (config, ref) => (await import("./onepassword.js")).fetchOnePassword(config, ref), 
+// The SDK still loads lazily; this only asks the resolver whether it
+// is installed, so a workspace that declares the source learns at
+// construction and one that does not pays nothing. Python's own
+// check is its `source_for` resolving an import path.
+() => {
+    requirePeer('1password', '@1password/sdk');
+});
+//# sourceMappingURL=constants.js.map

package/dist/secrets/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/secrets/constants.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAA;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAErF,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,mEAAmE;AACnE,8CAA8C;AAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAA;AAE1D;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAc,EAAE,IAAY;IAC/C,IAAI,CAAC;QACH,WAAW,CAAC,IAAI,CAAC,CAAA;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CACpB,QAAQ,MAAM,2CAA2C,IAAI,kBAAkB,IAAI,EAAE,CACtF,CAAA;IACH,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAA;AAErF,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,wEAAwE;AACxE,+DAA+D;AAC/D,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CACtD,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CACjD,CAAA;AACD,eAAe,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAC5D,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CACvD,CAAA;AACD,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAC3D,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CACnD,CAAA;AACD,eAAe,CACb,WAAW,EACX,iBAAiB,EACjB,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC;AACvF,qEAAqE;AACrE,kEAAkE;AAClE,gEAAgE;AAChE,sDAAsD;AACtD,GAAG,EAAE;IACH,WAAW,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAA;AAC5C,CAAC,CACF,CAAA"}

package/dist/secrets/dotenv.d.ts

@@ -0,0 +1,13 @@
+import type { ResolvedSecret } from '@struktoai/mirage-core/secrets/types';
+import type { DotenvConfig } from './config.ts';
+/**
+ * Read one dotenv file as one secret: the file's key=value pairs as
+ * fields. `ref` is the host filesystem path of the file; empty falls
+ * back to `config.path`. A missing file is a SecretsError naming the
+ * path. Values are taken verbatim: `dotenv.parse` never interpolates,
+ * and Python passes `interpolate=False` to match, so a `${NAME}` in a
+ * value stays literal in both languages instead of copying a host
+ * variable into a secret.
+ */
+export declare function fetchDotenv(config: DotenvConfig, ref: string): Promise<ResolvedSecret>;
+//# sourceMappingURL=dotenv.d.ts.map

package/dist/secrets/dotenv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.d.ts","sourceRoot":"","sources":["../../src/secrets/dotenv.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAA;AAE1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAY5F"}

package/dist/secrets/dotenv.js

@@ -0,0 +1,40 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { readFile } from 'node:fs/promises';
+import { parse } from 'dotenv';
+import { SecretsError } from '@struktoai/mirage-core/secrets/errors';
+/**
+ * Read one dotenv file as one secret: the file's key=value pairs as
+ * fields. `ref` is the host filesystem path of the file; empty falls
+ * back to `config.path`. A missing file is a SecretsError naming the
+ * path. Values are taken verbatim: `dotenv.parse` never interpolates,
+ * and Python passes `interpolate=False` to match, so a `${NAME}` in a
+ * value stays literal in both languages instead of copying a host
+ * variable into a secret.
+ */
+export async function fetchDotenv(config, ref) {
+    const path = ref !== '' ? ref : config.path;
+    let text;
+    try {
+        text = await readFile(path, 'utf-8');
+    }
+    catch (caught) {
+        if (caught.code === 'ENOENT') {
+            throw new SecretsError(`dotenv file not found: ${path}`, { cause: caught });
+        }
+        throw caught;
+    }
+    return { fields: parse(text) };
+}
+//# sourceMappingURL=dotenv.js.map

package/dist/secrets/dotenv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv.js","sourceRoot":"","sources":["../../src/secrets/dotenv.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAE9B,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAA;AAKpE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAoB,EAAE,GAAW;IACjE,MAAM,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;IAC3C,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,IAAK,MAA4B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpD,MAAM,IAAI,YAAY,CAAC,0BAA0B,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,MAAM,MAAM,CAAA;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;AAChC,CAAC"}

package/dist/secrets/env.d.ts

@@ -0,0 +1,10 @@
+import type { ResolvedSecret } from '@struktoai/mirage-core/secrets/types';
+import type { EnvConfig } from './config.ts';
+/**
+ * Read the host process environment as one secret.
+ *
+ * `ref` must be empty (the process env has no sub-address); a managed
+ * entry's `key` selects the variable to read.
+ */
+export declare function fetchEnv(_config: EnvConfig, ref: string): Promise<ResolvedSecret>;
+//# sourceMappingURL=env.d.ts.map