@undefineds.co/xpod 0.3.15 → 0.3.17

package/dist/cli/commands/resource.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listCommand = exports.deleteCommand = exports.patchCommand = exports.putCommand = exports.headCommand = exports.getCommand = void 0;
+const fs_1 = require("fs");
+const auth_context_1 = require("../lib/auth-context");
+const output_1 = require("../lib/output");
+const resource_1 = require("../lib/resource");
+function resourceOptions(yargs) {
+    return yargs
+        .option('url', {
+        alias: 'u',
+        type: 'string',
+        description: 'Server base URL override',
+    })
+        .option('json', {
+        type: 'boolean',
+        default: false,
+        description: 'Output JSON envelope',
+    });
+}
+async function readCommand(argv, method) {
+    try {
+        const context = await (0, auth_context_1.requireAuthContext)(argv);
+        const target = (0, resource_1.resolveResourceTarget)(context, argv.path);
+        const headers = {};
+        if (argv.accept)
+            headers.Accept = argv.accept;
+        const response = await (0, resource_1.fetchResource)(context, target, { method, headers });
+        (0, resource_1.ensureOk)(response, response.status === 404 ? 'resource_not_found' : 'resource_read_failed', `Failed to ${method} ${argv.path}`);
+        const data = (0, resource_1.responseData)(target, response);
+        if (method === 'GET') {
+            const body = Buffer.from(await response.arrayBuffer());
+            if (argv.out) {
+                (0, fs_1.writeFileSync)(argv.out, body);
+            }
+            if (argv.json) {
+                (0, output_1.writeJsonResult)({
+                    ...data,
+                    ...(argv.out ? { out: argv.out } : { body: body.toString('utf-8') }),
+                });
+                return;
+            }
+            if (!argv.out) {
+                process.stdout.write(body);
+            }
+            return;
+        }
+        if (argv.json) {
+            (0, output_1.writeJsonResult)(data);
+            return;
+        }
+        for (const [key, value] of Object.entries(data.headers)) {
+            console.log(`${key}: ${value}`);
+        }
+    }
+    catch (error) {
+        (0, output_1.handleCliError)(error, argv.json);
+    }
+}
+async function writeCommand(argv, method) {
+    try {
+        const context = await (0, auth_context_1.requireAuthContext)(argv);
+        const target = (0, resource_1.resolveResourceTarget)(context, argv.path);
+        const file = (0, resource_1.readBodyFile)(argv.from);
+        const headers = {
+            'Content-Type': argv['content-type'] ?? file.contentType,
+        };
+        if (argv['if-match'])
+            headers['If-Match'] = argv['if-match'];
+        const response = await (0, resource_1.fetchResource)(context, target, {
+            method,
+            headers,
+            body: file.body,
+        });
+        (0, resource_1.ensureOk)(response, 'resource_write_failed', `Failed to ${method} ${argv.path}`);
+        const data = (0, resource_1.responseData)(target, response);
+        if (argv.json) {
+            (0, output_1.writeJsonResult)(data);
+            return;
+        }
+        console.log(`${method} ${data.resourceUrl} -> HTTP ${data.status}`);
+    }
+    catch (error) {
+        (0, output_1.handleCliError)(error, argv.json);
+    }
+}
+exports.getCommand = {
+    command: 'get <path>',
+    describe: 'Read a raw Pod resource',
+    builder: (yargs) => resourceOptions(yargs)
+        .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })
+        .option('accept', { type: 'string', description: 'Accept header' })
+        .option('out', { type: 'string', description: 'Write response body to file' }),
+    handler: (argv) => readCommand(argv, 'GET'),
+};
+exports.headCommand = {
+    command: 'head <path>',
+    describe: 'Read raw Pod resource metadata',
+    builder: (yargs) => resourceOptions(yargs)
+        .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })
+        .option('accept', { type: 'string', description: 'Accept header' }),
+    handler: (argv) => readCommand(argv, 'HEAD'),
+};
+exports.putCommand = {
+    command: 'put <path>',
+    describe: 'Write a raw Pod resource',
+    builder: (yargs) => resourceOptions(yargs)
+        .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })
+        .option('from', { type: 'string', demandOption: true, description: 'Local file to upload' })
+        .option('content-type', { type: 'string', description: 'Content-Type header' })
+        .option('if-match', { type: 'string', description: 'If-Match header for stale-write protection' }),
+    handler: (argv) => writeCommand(argv, 'PUT'),
+};
+exports.patchCommand = {
+    command: 'patch <path>',
+    describe: 'Patch a raw Pod resource',
+    builder: (yargs) => resourceOptions(yargs)
+        .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })
+        .option('from', { type: 'string', demandOption: true, description: 'Local patch/update file' })
+        .option('content-type', { type: 'string', description: 'Content-Type header' })
+        .option('if-match', { type: 'string', description: 'If-Match header for stale-write protection' }),
+    handler: (argv) => writeCommand(argv, 'PATCH'),
+};
+exports.deleteCommand = {
+    command: 'delete <path>',
+    describe: 'Delete a raw Pod resource',
+    builder: (yargs) => resourceOptions(yargs)
+        .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })
+        .option('if-match', { type: 'string', description: 'If-Match header for stale-write protection' }),
+    handler: async (argv) => {
+        try {
+            const context = await (0, auth_context_1.requireAuthContext)(argv);
+            const target = (0, resource_1.resolveResourceTarget)(context, argv.path);
+            const headers = {};
+            if (argv['if-match'])
+                headers['If-Match'] = argv['if-match'];
+            const response = await (0, resource_1.fetchResource)(context, target, { method: 'DELETE', headers });
+            (0, resource_1.ensureOk)(response, response.status === 404 ? 'resource_not_found' : 'resource_delete_failed', `Failed to DELETE ${argv.path}`);
+            const data = (0, resource_1.responseData)(target, response);
+            if (argv.json) {
+                (0, output_1.writeJsonResult)(data);
+                return;
+            }
+            console.log(`DELETE ${data.resourceUrl} -> HTTP ${data.status}`);
+        }
+        catch (error) {
+            (0, output_1.handleCliError)(error, argv.json);
+        }
+    },
+};
+exports.listCommand = {
+    command: 'list <path>',
+    describe: 'List a raw Pod container resource',
+    builder: (yargs) => resourceOptions(yargs)
+        .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative container path or absolute URL' })
+        .option('depth', { type: 'number', default: 1, description: 'List depth. Only depth=1 is currently supported.' }),
+    handler: async (argv) => {
+        try {
+            if (argv.depth !== 1) {
+                throw new Error('Only --depth 1 is currently supported.');
+            }
+            const context = await (0, auth_context_1.requireAuthContext)(argv);
+            const target = (0, resource_1.resolveResourceTarget)(context, argv.path.endsWith('/') ? argv.path : `${argv.path}/`);
+            const response = await (0, resource_1.fetchResource)(context, target, {
+                method: 'GET',
+                headers: { Accept: 'text/turtle' },
+            });
+            (0, resource_1.ensureOk)(response, response.status === 404 ? 'resource_not_found' : 'container_list_failed', `Failed to list ${argv.path}`);
+            const turtle = await response.text();
+            const resources = (0, resource_1.parseContainedResources)(turtle, target.resourceUrl).map((url) => ({
+                url,
+                path: (0, resource_1.relativeToPodRoot)(url, context.podRoot),
+            }));
+            const data = {
+                ...(0, resource_1.responseData)(target, response),
+                resources,
+            };
+            if (argv.json) {
+                (0, output_1.writeJsonResult)(data);
+                return;
+            }
+            for (const resource of resources) {
+                console.log(resource.path);
+            }
+        }
+        catch (error) {
+            (0, output_1.handleCliError)(error, argv.json);
+        }
+    },
+};
+//# sourceMappingURL=resource.js.map

package/dist/cli/commands/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","sourceRoot":"","sources":["../../../src/cli/commands/resource.ts"],"names":[],"mappings":";;;AACA,2BAAmC;AACnC,sDAAyD;AACzD,0CAAgE;AAChE,8CAQyB;AA8BzB,SAAS,eAAe,CAAI,KAAW;IACrC,OAAO,KAAK;SACT,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;KACxC,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,sBAAsB;KACpC,CAAuB,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAa,EAAE,MAAsB;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAA,mBAAQ,EAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,EAAE,aAAa,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChI,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE5C,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,IAAA,kBAAa,EAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,wBAAe,EAAC;oBACd,GAAG,IAAI;oBACP,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;iBACrE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAA,wBAAe,EAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAE,GAAG,EAAE,KAAK,CAAE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAe,EAAE,MAAuB;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,WAAW;SACzD,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,MAAM,EAAE;YACpD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,IAAA,mBAAQ,EAAC,QAAQ,EAAE,uBAAuB,EAAE,aAAa,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAA,wBAAe,EAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,WAAW,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAEY,QAAA,UAAU,GAAmC;IACxD,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAU,KAAK,CAAC;SAC5B,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;SACjH,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IAClF,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;CAC5C,CAAC;AAEW,QAAA,WAAW,GAAmC;IACzD,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,gCAAgC;IAC1C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAU,KAAK,CAAC;SAC5B,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;SACjH,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IACvE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;CAC7C,CAAC;AAEW,QAAA,UAAU,GAAqC;IAC1D,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,0BAA0B;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAY,KAAK,CAAC;SAC9B,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;SACjH,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;SAC3F,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;SAC9E,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IACtG,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC;CAC7C,CAAC;AAEW,QAAA,YAAY,GAAqC;IAC5D,OAAO,EAAE,cAAc;IACvB,QAAQ,EAAE,0BAA0B;IACpC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAY,KAAK,CAAC;SAC9B,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;SACjH,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;SAC9F,MAAM,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;SAC9E,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IACtG,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;CAC/C,CAAC;AAEW,QAAA,aAAa,GAAsC;IAC9D,OAAO,EAAE,eAAe;IACxB,QAAQ,EAAE,2BAA2B;IACrC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAa,KAAK,CAAC;SAC/B,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;SACjH,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IACtG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,UAAU,CAAC;gBAAE,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;YAE7D,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACrF,IAAA,mBAAQ,EAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/H,MAAM,IAAI,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,wBAAe,EAAC,IAAI,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,WAAW,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF,CAAC;AAEW,QAAA,WAAW,GAAoC;IAC1D,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,mCAAmC;IAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAW,KAAK,CAAC;SAC7B,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;SAC3H,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IACrH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACrG,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,MAAM,EAAE;gBACpD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;aACnC,CAAC,CAAC;YACH,IAAA,mBAAQ,EAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,EAAE,kBAAkB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5H,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,IAAA,kCAAuB,EAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAClF,GAAG;gBACH,IAAI,EAAE,IAAA,4BAAiB,EAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC;aAC9C,CAAC,CAAC,CAAC;YACJ,MAAM,IAAI,GAAG;gBACX,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC;gBACjC,SAAS;aACV,CAAC;YACF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,wBAAe,EAAC,IAAI,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF,CAAC","sourcesContent":["import type { Argv, CommandModule } from 'yargs';\nimport { writeFileSync } from 'fs';\nimport { requireAuthContext } from '../lib/auth-context';\nimport { handleCliError, writeJsonResult } from '../lib/output';\nimport {\n  ensureOk,\n  fetchResource,\n  parseContainedResources,\n  readBodyFile,\n  relativeToPodRoot,\n  resolveResourceTarget,\n  responseData,\n} from '../lib/resource';\n\ninterface ResourceArgs {\n  url?: string;\n  json: boolean;\n}\n\ninterface GetArgs extends ResourceArgs {\n  path: string;\n  accept?: string;\n  out?: string;\n}\n\ninterface WriteArgs extends ResourceArgs {\n  path: string;\n  from: string;\n  'content-type'?: string;\n  'if-match'?: string;\n}\n\ninterface DeleteArgs extends ResourceArgs {\n  path: string;\n  'if-match'?: string;\n}\n\ninterface ListArgs extends ResourceArgs {\n  path: string;\n  depth: number;\n}\n\nfunction resourceOptions<T>(yargs: Argv): Argv<T> {\n  return yargs\n    .option('url', {\n      alias: 'u',\n      type: 'string',\n      description: 'Server base URL override',\n    })\n    .option('json', {\n      type: 'boolean',\n      default: false,\n      description: 'Output JSON envelope',\n    }) as unknown as Argv<T>;\n}\n\nasync function readCommand(argv: GetArgs, method: 'GET' | 'HEAD'): Promise<void> {\n  try {\n    const context = await requireAuthContext(argv);\n    const target = resolveResourceTarget(context, argv.path);\n    const headers: Record<string, string> = {};\n    if (argv.accept) headers.Accept = argv.accept;\n\n    const response = await fetchResource(context, target, { method, headers });\n    ensureOk(response, response.status === 404 ? 'resource_not_found' : 'resource_read_failed', `Failed to ${method} ${argv.path}`);\n    const data = responseData(target, response);\n\n    if (method === 'GET') {\n      const body = Buffer.from(await response.arrayBuffer());\n      if (argv.out) {\n        writeFileSync(argv.out, body);\n      }\n\n      if (argv.json) {\n        writeJsonResult({\n          ...data,\n          ...(argv.out ? { out: argv.out } : { body: body.toString('utf-8') }),\n        });\n        return;\n      }\n\n      if (!argv.out) {\n        process.stdout.write(body);\n      }\n      return;\n    }\n\n    if (argv.json) {\n      writeJsonResult(data);\n      return;\n    }\n\n    for (const [ key, value ] of Object.entries(data.headers)) {\n      console.log(`${key}: ${value}`);\n    }\n  } catch (error) {\n    handleCliError(error, argv.json);\n  }\n}\n\nasync function writeCommand(argv: WriteArgs, method: 'PUT' | 'PATCH'): Promise<void> {\n  try {\n    const context = await requireAuthContext(argv);\n    const target = resolveResourceTarget(context, argv.path);\n    const file = readBodyFile(argv.from);\n    const headers: Record<string, string> = {\n      'Content-Type': argv['content-type'] ?? file.contentType,\n    };\n    if (argv['if-match']) headers['If-Match'] = argv['if-match'];\n\n    const response = await fetchResource(context, target, {\n      method,\n      headers,\n      body: file.body,\n    });\n    ensureOk(response, 'resource_write_failed', `Failed to ${method} ${argv.path}`);\n    const data = responseData(target, response);\n\n    if (argv.json) {\n      writeJsonResult(data);\n      return;\n    }\n    console.log(`${method} ${data.resourceUrl} -> HTTP ${data.status}`);\n  } catch (error) {\n    handleCliError(error, argv.json);\n  }\n}\n\nexport const getCommand: CommandModule<object, GetArgs> = {\n  command: 'get <path>',\n  describe: 'Read a raw Pod resource',\n  builder: (yargs) =>\n    resourceOptions<GetArgs>(yargs)\n      .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })\n      .option('accept', { type: 'string', description: 'Accept header' })\n      .option('out', { type: 'string', description: 'Write response body to file' }),\n  handler: (argv) => readCommand(argv, 'GET'),\n};\n\nexport const headCommand: CommandModule<object, GetArgs> = {\n  command: 'head <path>',\n  describe: 'Read raw Pod resource metadata',\n  builder: (yargs) =>\n    resourceOptions<GetArgs>(yargs)\n      .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })\n      .option('accept', { type: 'string', description: 'Accept header' }),\n  handler: (argv) => readCommand(argv, 'HEAD'),\n};\n\nexport const putCommand: CommandModule<object, WriteArgs> = {\n  command: 'put <path>',\n  describe: 'Write a raw Pod resource',\n  builder: (yargs) =>\n    resourceOptions<WriteArgs>(yargs)\n      .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })\n      .option('from', { type: 'string', demandOption: true, description: 'Local file to upload' })\n      .option('content-type', { type: 'string', description: 'Content-Type header' })\n      .option('if-match', { type: 'string', description: 'If-Match header for stale-write protection' }),\n  handler: (argv) => writeCommand(argv, 'PUT'),\n};\n\nexport const patchCommand: CommandModule<object, WriteArgs> = {\n  command: 'patch <path>',\n  describe: 'Patch a raw Pod resource',\n  builder: (yargs) =>\n    resourceOptions<WriteArgs>(yargs)\n      .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })\n      .option('from', { type: 'string', demandOption: true, description: 'Local patch/update file' })\n      .option('content-type', { type: 'string', description: 'Content-Type header' })\n      .option('if-match', { type: 'string', description: 'If-Match header for stale-write protection' }),\n  handler: (argv) => writeCommand(argv, 'PATCH'),\n};\n\nexport const deleteCommand: CommandModule<object, DeleteArgs> = {\n  command: 'delete <path>',\n  describe: 'Delete a raw Pod resource',\n  builder: (yargs) =>\n    resourceOptions<DeleteArgs>(yargs)\n      .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative path or absolute URL' })\n      .option('if-match', { type: 'string', description: 'If-Match header for stale-write protection' }),\n  handler: async (argv) => {\n    try {\n      const context = await requireAuthContext(argv);\n      const target = resolveResourceTarget(context, argv.path);\n      const headers: Record<string, string> = {};\n      if (argv['if-match']) headers['If-Match'] = argv['if-match'];\n\n      const response = await fetchResource(context, target, { method: 'DELETE', headers });\n      ensureOk(response, response.status === 404 ? 'resource_not_found' : 'resource_delete_failed', `Failed to DELETE ${argv.path}`);\n      const data = responseData(target, response);\n      if (argv.json) {\n        writeJsonResult(data);\n        return;\n      }\n      console.log(`DELETE ${data.resourceUrl} -> HTTP ${data.status}`);\n    } catch (error) {\n      handleCliError(error, argv.json);\n    }\n  },\n};\n\nexport const listCommand: CommandModule<object, ListArgs> = {\n  command: 'list <path>',\n  describe: 'List a raw Pod container resource',\n  builder: (yargs) =>\n    resourceOptions<ListArgs>(yargs)\n      .positional('path', { type: 'string', demandOption: true, description: 'Pod-root relative container path or absolute URL' })\n      .option('depth', { type: 'number', default: 1, description: 'List depth. Only depth=1 is currently supported.' }),\n  handler: async (argv) => {\n    try {\n      if (argv.depth !== 1) {\n        throw new Error('Only --depth 1 is currently supported.');\n      }\n      const context = await requireAuthContext(argv);\n      const target = resolveResourceTarget(context, argv.path.endsWith('/') ? argv.path : `${argv.path}/`);\n      const response = await fetchResource(context, target, {\n        method: 'GET',\n        headers: { Accept: 'text/turtle' },\n      });\n      ensureOk(response, response.status === 404 ? 'resource_not_found' : 'container_list_failed', `Failed to list ${argv.path}`);\n      const turtle = await response.text();\n      const resources = parseContainedResources(turtle, target.resourceUrl).map((url) => ({\n        url,\n        path: relativeToPodRoot(url, context.podRoot),\n      }));\n      const data = {\n        ...responseData(target, response),\n        resources,\n      };\n      if (argv.json) {\n        writeJsonResult(data);\n        return;\n      }\n      for (const resource of resources) {\n        console.log(resource.path);\n      }\n    } catch (error) {\n      handleCliError(error, argv.json);\n    }\n  },\n};\n"]}

package/dist/cli/commands/secret.d.ts

@@ -0,0 +1,36 @@
+import type { CommandModule } from 'yargs';
+interface SecretArgs {
+    url?: string;
+    json: boolean;
+}
+interface SecretSelectorArgs extends SecretArgs {
+    selector?: string;
+    kind?: string;
+    provider?: string;
+    service?: string;
+}
+interface ResolvedSecretSelector extends SecretArgs {
+    kind: string;
+    provider: string;
+    service?: string;
+}
+export declare function resolveSecretSelector(input: SecretSelectorArgs): ResolvedSecretSelector;
+export interface SecretPlan {
+    schemaUri: string;
+    resourceKind: string;
+    service: string;
+    provider: string;
+    kind: string;
+    subject: string;
+    resourceUrl: string;
+    redacted: true;
+}
+export declare function buildSecretPlan(podRoot: string, input: ResolvedSecretSelector): SecretPlan;
+export declare function buildSecretUpsertSparql(plan: SecretPlan, input: {
+    value?: string;
+    label?: string;
+    status?: string;
+    revoke?: boolean;
+}): string;
+export declare const secretCommand: CommandModule<object, SecretArgs>;
+export {};

package/dist/cli/commands/secret.js

@@ -0,0 +1,285 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretCommand = void 0;
+exports.resolveSecretSelector = resolveSecretSelector;
+exports.buildSecretPlan = buildSecretPlan;
+exports.buildSecretUpsertSparql = buildSecretUpsertSparql;
+const models_1 = require("@undefineds.co/models");
+const auth_context_1 = require("../lib/auth-context");
+const output_1 = require("../lib/output");
+const resource_1 = require("../lib/resource");
+function secretOptions(yargs) {
+    return yargs
+        .option('url', {
+        alias: 'u',
+        type: 'string',
+        description: 'Server base URL override',
+    })
+        .option('json', {
+        type: 'boolean',
+        default: false,
+        description: 'Output JSON envelope',
+    });
+}
+function selectorOptions(yargs, demandFlags = true) {
+    return secretOptions(yargs)
+        .option('kind', { type: 'string', demandOption: demandFlags, description: 'Secret kind, for example api-key or tunnel-token' })
+        .option('provider', { type: 'string', demandOption: demandFlags, description: 'Provider identifier' })
+        .option('service', { type: 'string', default: 'ai', description: 'Service grouping' });
+}
+function resolveSecretSelector(input) {
+    let service = input.service ?? 'ai';
+    let provider = input.provider;
+    let kind = input.kind;
+    if (input.selector) {
+        const selector = input.selector.trim();
+        if (selector.startsWith('{')) {
+            const parsed = JSON.parse(selector);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                throw new output_1.CliCommandError('invalid_selector', 'Secret selector JSON must be an object.', 2);
+            }
+            const record = parsed;
+            if (typeof record.service === 'string')
+                service = record.service;
+            if (typeof record.provider === 'string')
+                provider = record.provider;
+            if (typeof record.kind === 'string')
+                kind = record.kind;
+        }
+        else {
+            const parts = selector.split(/[/:]/u).map((part) => part.trim()).filter(Boolean);
+            if (parts.length === 3) {
+                [service, provider, kind] = parts;
+            }
+            else if (parts.length === 2) {
+                [provider, kind] = parts;
+            }
+            else {
+                throw new output_1.CliCommandError('invalid_selector', 'Secret selector must be provider/kind, service/provider/kind, or a JSON object.', 2);
+            }
+        }
+    }
+    if (!provider || !kind) {
+        throw new output_1.CliCommandError('selector_required', 'Secret provider and kind are required.', 2);
+    }
+    return {
+        url: input.url,
+        json: input.json,
+        service,
+        provider,
+        kind,
+    };
+}
+function escapeSparqlLiteral(value) {
+    return JSON.stringify(value);
+}
+function localId(input) {
+    return [input.service ?? 'ai', input.provider, input.kind]
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .join('-')
+        .replace(/[^a-zA-Z0-9_.-]+/g, '-');
+}
+function buildSecretPlan(podRoot, input) {
+    const service = input.service ?? 'ai';
+    const storage = (0, models_1.createPodStorage)();
+    const validation = storage.validate({
+        schemaUri: models_1.credentialDescriptor.uri,
+        operation: 'upsert',
+        match: {
+            service,
+            providerId: input.provider,
+            secretType: input.kind,
+        },
+        set: {
+            status: 'active',
+        },
+    });
+    if (!validation.ok) {
+        throw new Error(validation.error.message);
+    }
+    const resourcePath = validation.plan.resourceUri.replace(/^\/+/, '');
+    const resourceUrl = new URL(resourcePath, podRoot).toString();
+    return {
+        schemaUri: models_1.credentialDescriptor.uri,
+        resourceKind: models_1.credentialDescriptor.resourceKind,
+        service,
+        provider: input.provider,
+        kind: input.kind,
+        subject: resourceUrl,
+        resourceUrl: resourceUrl.replace(/#.*$/u, ''),
+        redacted: true,
+    };
+}
+function buildSecretUpsertSparql(plan, input) {
+    const subject = `<${plan.subject}>`;
+    const fields = models_1.credentialDescriptor.fields;
+    const values = {
+        service: plan.service,
+        providerId: plan.provider,
+        secretType: plan.kind,
+        status: input.status ?? (input.revoke ? 'revoked' : 'active'),
+    };
+    if (input.label)
+        values.label = input.label;
+    if (input.value !== undefined && !input.revoke)
+        values.apiKey = input.value;
+    const deleteTriples = [
+        `${subject} <${fields.label.predicate}> ?oldLabel .`,
+        `${subject} <${fields.apiKey.predicate}> ?oldApiKey .`,
+        `${subject} <${fields.status.predicate}> ?oldStatus .`,
+    ];
+    const optionals = [
+        `OPTIONAL { ${subject} <${fields.label.predicate}> ?oldLabel }`,
+        `OPTIONAL { ${subject} <${fields.apiKey.predicate}> ?oldApiKey }`,
+        `OPTIONAL { ${subject} <${fields.status.predicate}> ?oldStatus }`,
+    ];
+    const insertTriples = [
+        `${subject} a <${models_1.credentialDescriptor.class}>`,
+        `${subject} <${fields.service.predicate}> ${escapeSparqlLiteral(values.service)}`,
+        `${subject} <${fields.providerId.predicate}> ${escapeSparqlLiteral(values.providerId)}`,
+        `${subject} <${fields.secretType.predicate}> ${escapeSparqlLiteral(values.secretType)}`,
+        `${subject} <${fields.status.predicate}> ${escapeSparqlLiteral(values.status)}`,
+    ];
+    if (values.label) {
+        insertTriples.push(`${subject} <${fields.label.predicate}> ${escapeSparqlLiteral(values.label)}`);
+    }
+    if (values.apiKey !== undefined) {
+        insertTriples.push(`${subject} <${fields.apiKey.predicate}> ${escapeSparqlLiteral(values.apiKey)}`);
+    }
+    return `DELETE {\n  ${deleteTriples.join('\n  ')}\n}\nINSERT {\n  ${insertTriples.join(' .\n  ')} .\n}\nWHERE {\n  ${optionals.join('\n  ')}\n}`;
+}
+async function readSecretFromStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+    }
+    return Buffer.concat(chunks).toString('utf-8').replace(/\r?\n$/u, '');
+}
+function printSecretPlan(plan) {
+    console.log(`subject: ${plan.subject}`);
+    console.log(`resource: ${plan.resourceUrl}`);
+    console.log(`schema: ${plan.schemaUri}`);
+    console.log('value: [redacted]');
+}
+const planCommand = {
+    command: 'plan',
+    describe: 'Plan a descriptor-backed secret write',
+    builder: (yargs) => selectorOptions(yargs)
+        .option('label', { type: 'string', description: 'Secret label metadata' }),
+    handler: async (argv) => {
+        try {
+            const context = await (0, auth_context_1.requireAuthContext)(argv);
+            const plan = buildSecretPlan(context.podRoot, argv);
+            if (argv.json) {
+                (0, output_1.writeJsonResult)({ plan }, 'plan_ready');
+                return;
+            }
+            printSecretPlan(plan);
+        }
+        catch (error) {
+            (0, output_1.handleCliError)(error, argv.json);
+        }
+    },
+};
+const setCommand = {
+    command: 'set',
+    describe: 'Set a descriptor-backed secret from stdin',
+    builder: (yargs) => selectorOptions(yargs)
+        .option('from-stdin', { type: 'boolean', demandOption: true, description: 'Read secret value from stdin' })
+        .option('label', { type: 'string', description: 'Secret label metadata' }),
+    handler: async (argv) => {
+        try {
+            if (!argv['from-stdin']) {
+                throw new Error('Secret values must be provided with --from-stdin.');
+            }
+            const value = await readSecretFromStdin();
+            const context = await (0, auth_context_1.requireAuthContext)(argv);
+            const plan = buildSecretPlan(context.podRoot, argv);
+            const target = (0, resource_1.resolveResourceTarget)(context, plan.resourceUrl);
+            const sparql = buildSecretUpsertSparql(plan, { value, label: argv.label });
+            const response = await (0, resource_1.fetchResource)(context, target, {
+                method: 'PATCH',
+                headers: { 'Content-Type': 'application/sparql-update' },
+                body: sparql,
+            });
+            (0, resource_1.ensureOk)(response, 'secret_set_failed', `Failed to set secret ${plan.subject}`);
+            const data = { ...(0, resource_1.responseData)(target, response), plan };
+            if (argv.json) {
+                (0, output_1.writeJsonResult)(data);
+                return;
+            }
+            console.log(`Secret saved: ${plan.subject}`);
+            console.log('value: [redacted]');
+        }
+        catch (error) {
+            (0, output_1.handleCliError)(error, argv.json);
+        }
+    },
+};
+const metadataCommand = {
+    command: 'get-metadata [selector]',
+    describe: 'Show descriptor-backed secret metadata without revealing the value',
+    builder: (yargs) => selectorOptions(yargs.positional('selector', {
+        type: 'string',
+        description: 'provider/kind, service/provider/kind, or selector JSON',
+    }), false),
+    handler: async (argv) => {
+        try {
+            const context = await (0, auth_context_1.requireAuthContext)(argv);
+            const plan = buildSecretPlan(context.podRoot, resolveSecretSelector(argv));
+            if (argv.json) {
+                (0, output_1.writeJsonResult)({ ...plan, value: '[redacted]' });
+                return;
+            }
+            printSecretPlan(plan);
+        }
+        catch (error) {
+            (0, output_1.handleCliError)(error, argv.json);
+        }
+    },
+};
+const revokeCommand = {
+    command: 'revoke [selector]',
+    describe: 'Revoke a descriptor-backed secret without printing its value',
+    builder: (yargs) => selectorOptions(yargs.positional('selector', {
+        type: 'string',
+        description: 'provider/kind, service/provider/kind, or selector JSON',
+    }), false),
+    handler: async (argv) => {
+        try {
+            const context = await (0, auth_context_1.requireAuthContext)(argv);
+            const plan = buildSecretPlan(context.podRoot, resolveSecretSelector(argv));
+            const target = (0, resource_1.resolveResourceTarget)(context, plan.resourceUrl);
+            const sparql = buildSecretUpsertSparql(plan, { revoke: true });
+            const response = await (0, resource_1.fetchResource)(context, target, {
+                method: 'PATCH',
+                headers: { 'Content-Type': 'application/sparql-update' },
+                body: sparql,
+            });
+            (0, resource_1.ensureOk)(response, 'secret_revoke_failed', `Failed to revoke secret ${plan.subject}`);
+            const data = { ...(0, resource_1.responseData)(target, response), plan, status: 'revoked' };
+            if (argv.json) {
+                (0, output_1.writeJsonResult)(data);
+                return;
+            }
+            console.log(`Secret revoked: ${plan.subject}`);
+            console.log('value: [redacted]');
+        }
+        catch (error) {
+            (0, output_1.handleCliError)(error, argv.json);
+        }
+    },
+};
+exports.secretCommand = {
+    command: 'secret',
+    describe: 'Secret-safe descriptor-backed credential operations',
+    builder: (yargs) => yargs
+        .command(planCommand)
+        .command(setCommand)
+        .command(metadataCommand)
+        .command(revokeCommand)
+        .demandCommand(1, 'Please specify a secret subcommand'),
+    handler: () => { },
+};
+//# sourceMappingURL=secret.js.map

package/dist/cli/commands/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../../src/cli/commands/secret.ts"],"names":[],"mappings":";;;AA0DA,sDAsCC;AAyBD,0CA+BC;AAED,0DA0CC;AAnMD,kDAA+E;AAC/E,sDAAyD;AACzD,0CAAiF;AACjF,8CAKyB;AA4BzB,SAAS,aAAa,CAAI,KAAW;IACnC,OAAO,KAAK;SACT,MAAM,CAAC,KAAK,EAAE;QACb,KAAK,EAAE,GAAG;QACV,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0BAA0B;KACxC,CAAC;SACD,MAAM,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,sBAAsB;KACpC,CAAuB,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAA+B,KAAW,EAAE,WAAW,GAAG,IAAI;IACpF,OAAO,aAAa,CAAI,KAAK,CAAC;SAC3B,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;SAC9H,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;SACrG,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAuB,CAAC;AACjH,CAAC;AAED,SAAgB,qBAAqB,CAAC,KAAyB;IAC7D,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACpC,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAEtB,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC;YAC/C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,EAAE,yCAAyC,EAAE,CAAC,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,MAAM,GAAG,MAAiC,CAAC;YACjD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACjE,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAAE,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACpE,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,CAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAE,GAAG,KAAK,CAAC;YACtC,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,CAAE,QAAQ,EAAE,IAAI,CAAE,GAAG,KAAK,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,wBAAe,CAAC,kBAAkB,EAAE,iFAAiF,EAAE,CAAC,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAe,CAAC,mBAAmB,EAAE,wCAAwC,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,QAAQ;QACR,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,KAA6B;IAC5C,OAAO,CAAE,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAE;SACzD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC;SACT,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AAaD,SAAgB,eAAe,CAAC,OAAe,EAAE,KAA6B;IAC5E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,IAAA,yBAAgB,GAAE,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,SAAS,EAAE,6BAAoB,CAAC,GAAG;QACnC,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE;YACL,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,UAAU,EAAE,KAAK,CAAC,IAAI;SACvB;QACD,GAAG,EAAE;YACH,MAAM,EAAE,QAAQ;SACjB;KACF,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9D,OAAO;QACL,SAAS,EAAE,6BAAoB,CAAC,GAAG;QACnC,YAAY,EAAE,6BAAoB,CAAC,YAAY;QAC/C,OAAO;QACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,WAAW;QACpB,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,IAAgB,EAAE,KAKzD;IACC,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,6BAAoB,CAAC,MAAM,CAAC;IAC3C,MAAM,MAAM,GAA2B;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,QAAQ;QACzB,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;KAC9D,CAAC;IACF,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;IAE5E,MAAM,aAAa,GAAG;QACpB,GAAG,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,eAAe;QACpD,GAAG,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,gBAAgB;QACtD,GAAG,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,gBAAgB;KACvD,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,cAAc,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,eAAe;QAC/D,cAAc,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,gBAAgB;QACjE,cAAc,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,gBAAgB;KAClE,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,GAAG,OAAO,OAAO,6BAAoB,CAAC,KAAK,GAAG;QAC9C,GAAG,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACjF,GAAG,OAAO,KAAK,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QACvF,GAAG,OAAO,KAAK,MAAM,CAAC,UAAU,CAAC,SAAS,KAAK,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;QACvF,GAAG,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;KAChF,CAAC;IACF,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS,KAAK,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,eAAe,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;AACnJ,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACvC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,WAAW,GAA0C;IACzD,OAAO,EAAE,MAAM;IACf,QAAQ,EAAE,uCAAuC;IACjD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAiB,KAAK,CAAC;SACnC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,wBAAe,EAAC,EAAE,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,eAAe,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,UAAU,GAAyC;IACvD,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,2CAA2C;IACrD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAgB,KAAK,CAAC;SAClC,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;SAC1G,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IAC9E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,MAAM,EAAE;gBACpD,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;gBACxD,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,IAAA,mBAAQ,EAAC,QAAQ,EAAE,mBAAmB,EAAE,wBAAwB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,EAAE,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,wBAAe,EAAC,IAAI,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAA8C;IACjE,OAAO,EAAE,yBAAyB;IAClC,QAAQ,EAAE,oEAAoE;IAC9E,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAqB,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE;QAC/D,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,wDAAwD;KACtE,CAAC,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,wBAAe,EAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,eAAe,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAA8C;IAC/D,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,8DAA8D;IACxE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,eAAe,CAAqB,KAAK,CAAC,UAAU,CAAC,UAAU,EAAE;QAC/D,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,wDAAwD;KACtE,CAAC,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,IAAA,wBAAa,EAAC,OAAO,EAAE,MAAM,EAAE;gBACpD,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;gBACxD,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,IAAA,mBAAQ,EAAC,QAAQ,EAAE,sBAAsB,EAAE,2BAA2B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,EAAE,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAA,wBAAe,EAAC,IAAI,CAAC,CAAC;gBACtB,OAAO;YACT,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAA,uBAAc,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF,CAAC;AAEW,QAAA,aAAa,GAAsC;IAC9D,OAAO,EAAE,QAAQ;IACjB,QAAQ,EAAE,qDAAqD;IAC/D,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAChB,KAAK;SACH,OAAO,CAAC,WAAW,CAAC;SACpB,OAAO,CAAC,UAAU,CAAC;SACnB,OAAO,CAAC,eAAe,CAAC;SACxB,OAAO,CAAC,aAAa,CAAC;SACtB,aAAa,CAAC,CAAC,EAAE,oCAAoC,CAAiC;IAC3F,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;CAClB,CAAC","sourcesContent":["import type { Argv, CommandModule } from 'yargs';\nimport { createPodStorage, credentialDescriptor } from '@undefineds.co/models';\nimport { requireAuthContext } from '../lib/auth-context';\nimport { CliCommandError, handleCliError, writeJsonResult } from '../lib/output';\nimport {\n  ensureOk,\n  fetchResource,\n  resolveResourceTarget,\n  responseData,\n} from '../lib/resource';\n\ninterface SecretArgs {\n  url?: string;\n  json: boolean;\n}\n\ninterface SecretSelectorArgs extends SecretArgs {\n  selector?: string;\n  kind?: string;\n  provider?: string;\n  service?: string;\n}\n\ninterface ResolvedSecretSelector extends SecretArgs {\n  kind: string;\n  provider: string;\n  service?: string;\n}\n\ninterface SecretPlanArgs extends ResolvedSecretSelector {\n  label?: string;\n}\n\ninterface SecretSetArgs extends SecretPlanArgs {\n  'from-stdin': boolean;\n}\n\nfunction secretOptions<T>(yargs: Argv): Argv<T> {\n  return yargs\n    .option('url', {\n      alias: 'u',\n      type: 'string',\n      description: 'Server base URL override',\n    })\n    .option('json', {\n      type: 'boolean',\n      default: false,\n      description: 'Output JSON envelope',\n    }) as unknown as Argv<T>;\n}\n\nfunction selectorOptions<T extends SecretSelectorArgs>(yargs: Argv, demandFlags = true): Argv<T> {\n  return secretOptions<T>(yargs)\n    .option('kind', { type: 'string', demandOption: demandFlags, description: 'Secret kind, for example api-key or tunnel-token' })\n    .option('provider', { type: 'string', demandOption: demandFlags, description: 'Provider identifier' })\n    .option('service', { type: 'string', default: 'ai', description: 'Service grouping' }) as unknown as Argv<T>;\n}\n\nexport function resolveSecretSelector(input: SecretSelectorArgs): ResolvedSecretSelector {\n  let service = input.service ?? 'ai';\n  let provider = input.provider;\n  let kind = input.kind;\n\n  if (input.selector) {\n    const selector = input.selector.trim();\n    if (selector.startsWith('{')) {\n      const parsed = JSON.parse(selector) as unknown;\n      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n        throw new CliCommandError('invalid_selector', 'Secret selector JSON must be an object.', 2);\n      }\n      const record = parsed as Record<string, unknown>;\n      if (typeof record.service === 'string') service = record.service;\n      if (typeof record.provider === 'string') provider = record.provider;\n      if (typeof record.kind === 'string') kind = record.kind;\n    } else {\n      const parts = selector.split(/[/:]/u).map((part) => part.trim()).filter(Boolean);\n      if (parts.length === 3) {\n        [ service, provider, kind ] = parts;\n      } else if (parts.length === 2) {\n        [ provider, kind ] = parts;\n      } else {\n        throw new CliCommandError('invalid_selector', 'Secret selector must be provider/kind, service/provider/kind, or a JSON object.', 2);\n      }\n    }\n  }\n\n  if (!provider || !kind) {\n    throw new CliCommandError('selector_required', 'Secret provider and kind are required.', 2);\n  }\n  return {\n    url: input.url,\n    json: input.json,\n    service,\n    provider,\n    kind,\n  };\n}\n\nfunction escapeSparqlLiteral(value: string): string {\n  return JSON.stringify(value);\n}\n\nfunction localId(input: ResolvedSecretSelector): string {\n  return [ input.service ?? 'ai', input.provider, input.kind ]\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .join('-')\n    .replace(/[^a-zA-Z0-9_.-]+/g, '-');\n}\n\nexport interface SecretPlan {\n  schemaUri: string;\n  resourceKind: string;\n  service: string;\n  provider: string;\n  kind: string;\n  subject: string;\n  resourceUrl: string;\n  redacted: true;\n}\n\nexport function buildSecretPlan(podRoot: string, input: ResolvedSecretSelector): SecretPlan {\n  const service = input.service ?? 'ai';\n  const storage = createPodStorage();\n  const validation = storage.validate({\n    schemaUri: credentialDescriptor.uri,\n    operation: 'upsert',\n    match: {\n      service,\n      providerId: input.provider,\n      secretType: input.kind,\n    },\n    set: {\n      status: 'active',\n    },\n  });\n  if (!validation.ok) {\n    throw new Error(validation.error.message);\n  }\n\n  const resourcePath = validation.plan.resourceUri.replace(/^\\/+/, '');\n  const resourceUrl = new URL(resourcePath, podRoot).toString();\n  return {\n    schemaUri: credentialDescriptor.uri,\n    resourceKind: credentialDescriptor.resourceKind,\n    service,\n    provider: input.provider,\n    kind: input.kind,\n    subject: resourceUrl,\n    resourceUrl: resourceUrl.replace(/#.*$/u, ''),\n    redacted: true,\n  };\n}\n\nexport function buildSecretUpsertSparql(plan: SecretPlan, input: {\n  value?: string;\n  label?: string;\n  status?: string;\n  revoke?: boolean;\n}): string {\n  const subject = `<${plan.subject}>`;\n  const fields = credentialDescriptor.fields;\n  const values: Record<string, string> = {\n    service: plan.service,\n    providerId: plan.provider,\n    secretType: plan.kind,\n    status: input.status ?? (input.revoke ? 'revoked' : 'active'),\n  };\n  if (input.label) values.label = input.label;\n  if (input.value !== undefined && !input.revoke) values.apiKey = input.value;\n\n  const deleteTriples = [\n    `${subject} <${fields.label.predicate}> ?oldLabel .`,\n    `${subject} <${fields.apiKey.predicate}> ?oldApiKey .`,\n    `${subject} <${fields.status.predicate}> ?oldStatus .`,\n  ];\n  const optionals = [\n    `OPTIONAL { ${subject} <${fields.label.predicate}> ?oldLabel }`,\n    `OPTIONAL { ${subject} <${fields.apiKey.predicate}> ?oldApiKey }`,\n    `OPTIONAL { ${subject} <${fields.status.predicate}> ?oldStatus }`,\n  ];\n  const insertTriples = [\n    `${subject} a <${credentialDescriptor.class}>`,\n    `${subject} <${fields.service.predicate}> ${escapeSparqlLiteral(values.service)}`,\n    `${subject} <${fields.providerId.predicate}> ${escapeSparqlLiteral(values.providerId)}`,\n    `${subject} <${fields.secretType.predicate}> ${escapeSparqlLiteral(values.secretType)}`,\n    `${subject} <${fields.status.predicate}> ${escapeSparqlLiteral(values.status)}`,\n  ];\n  if (values.label) {\n    insertTriples.push(`${subject} <${fields.label.predicate}> ${escapeSparqlLiteral(values.label)}`);\n  }\n  if (values.apiKey !== undefined) {\n    insertTriples.push(`${subject} <${fields.apiKey.predicate}> ${escapeSparqlLiteral(values.apiKey)}`);\n  }\n\n  return `DELETE {\\n  ${deleteTriples.join('\\n  ')}\\n}\\nINSERT {\\n  ${insertTriples.join(' .\\n  ')} .\\n}\\nWHERE {\\n  ${optionals.join('\\n  ')}\\n}`;\n}\n\nasync function readSecretFromStdin(): Promise<string> {\n  const chunks: Buffer[] = [];\n  for await (const chunk of process.stdin) {\n    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));\n  }\n  return Buffer.concat(chunks).toString('utf-8').replace(/\\r?\\n$/u, '');\n}\n\nfunction printSecretPlan(plan: SecretPlan): void {\n  console.log(`subject: ${plan.subject}`);\n  console.log(`resource: ${plan.resourceUrl}`);\n  console.log(`schema: ${plan.schemaUri}`);\n  console.log('value: [redacted]');\n}\n\nconst planCommand: CommandModule<object, SecretPlanArgs> = {\n  command: 'plan',\n  describe: 'Plan a descriptor-backed secret write',\n  builder: (yargs) =>\n    selectorOptions<SecretPlanArgs>(yargs)\n      .option('label', { type: 'string', description: 'Secret label metadata' }),\n  handler: async (argv) => {\n    try {\n      const context = await requireAuthContext(argv);\n      const plan = buildSecretPlan(context.podRoot, argv);\n      if (argv.json) {\n        writeJsonResult({ plan }, 'plan_ready');\n        return;\n      }\n      printSecretPlan(plan);\n    } catch (error) {\n      handleCliError(error, argv.json);\n    }\n  },\n};\n\nconst setCommand: CommandModule<object, SecretSetArgs> = {\n  command: 'set',\n  describe: 'Set a descriptor-backed secret from stdin',\n  builder: (yargs) =>\n    selectorOptions<SecretSetArgs>(yargs)\n      .option('from-stdin', { type: 'boolean', demandOption: true, description: 'Read secret value from stdin' })\n      .option('label', { type: 'string', description: 'Secret label metadata' }),\n  handler: async (argv) => {\n    try {\n      if (!argv['from-stdin']) {\n        throw new Error('Secret values must be provided with --from-stdin.');\n      }\n      const value = await readSecretFromStdin();\n      const context = await requireAuthContext(argv);\n      const plan = buildSecretPlan(context.podRoot, argv);\n      const target = resolveResourceTarget(context, plan.resourceUrl);\n      const sparql = buildSecretUpsertSparql(plan, { value, label: argv.label });\n      const response = await fetchResource(context, target, {\n        method: 'PATCH',\n        headers: { 'Content-Type': 'application/sparql-update' },\n        body: sparql,\n      });\n      ensureOk(response, 'secret_set_failed', `Failed to set secret ${plan.subject}`);\n      const data = { ...responseData(target, response), plan };\n      if (argv.json) {\n        writeJsonResult(data);\n        return;\n      }\n      console.log(`Secret saved: ${plan.subject}`);\n      console.log('value: [redacted]');\n    } catch (error) {\n      handleCliError(error, argv.json);\n    }\n  },\n};\n\nconst metadataCommand: CommandModule<object, SecretSelectorArgs> = {\n  command: 'get-metadata [selector]',\n  describe: 'Show descriptor-backed secret metadata without revealing the value',\n  builder: (yargs) =>\n    selectorOptions<SecretSelectorArgs>(yargs.positional('selector', {\n      type: 'string',\n      description: 'provider/kind, service/provider/kind, or selector JSON',\n    }), false),\n  handler: async (argv) => {\n    try {\n      const context = await requireAuthContext(argv);\n      const plan = buildSecretPlan(context.podRoot, resolveSecretSelector(argv));\n      if (argv.json) {\n        writeJsonResult({ ...plan, value: '[redacted]' });\n        return;\n      }\n      printSecretPlan(plan);\n    } catch (error) {\n      handleCliError(error, argv.json);\n    }\n  },\n};\n\nconst revokeCommand: CommandModule<object, SecretSelectorArgs> = {\n  command: 'revoke [selector]',\n  describe: 'Revoke a descriptor-backed secret without printing its value',\n  builder: (yargs) =>\n    selectorOptions<SecretSelectorArgs>(yargs.positional('selector', {\n      type: 'string',\n      description: 'provider/kind, service/provider/kind, or selector JSON',\n    }), false),\n  handler: async (argv) => {\n    try {\n      const context = await requireAuthContext(argv);\n      const plan = buildSecretPlan(context.podRoot, resolveSecretSelector(argv));\n      const target = resolveResourceTarget(context, plan.resourceUrl);\n      const sparql = buildSecretUpsertSparql(plan, { revoke: true });\n      const response = await fetchResource(context, target, {\n        method: 'PATCH',\n        headers: { 'Content-Type': 'application/sparql-update' },\n        body: sparql,\n      });\n      ensureOk(response, 'secret_revoke_failed', `Failed to revoke secret ${plan.subject}`);\n      const data = { ...responseData(target, response), plan, status: 'revoked' };\n      if (argv.json) {\n        writeJsonResult(data);\n        return;\n      }\n      console.log(`Secret revoked: ${plan.subject}`);\n      console.log('value: [redacted]');\n    } catch (error) {\n      handleCliError(error, argv.json);\n    }\n  },\n};\n\nexport const secretCommand: CommandModule<object, SecretArgs> = {\n  command: 'secret',\n  describe: 'Secret-safe descriptor-backed credential operations',\n  builder: (yargs) =>\n    (yargs\n      .command(planCommand)\n      .command(setCommand)\n      .command(metadataCommand)\n      .command(revokeCommand)\n      .demandCommand(1, 'Please specify a secret subcommand') as unknown as Argv<SecretArgs>),\n  handler: () => {},\n};\n"]}

package/dist/cli/commands/server.d.ts

@@ -0,0 +1,11 @@
+import type { CommandModule } from 'yargs';
+interface ServerArgs {
+    json?: boolean;
+}
+interface ConfigArgs extends ServerArgs {
+    key?: string;
+    value?: string;
+}
+export declare const serverConfigCommand: CommandModule<object, ConfigArgs>;
+export declare const serverCommand: CommandModule<object, ServerArgs>;
+export {};