@xemahq/xema 0.12.0 → 0.14.0

package/dist/runtime/secrets/managed-local-store.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedLocalCredentialStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const STORE_VERSION = 1;
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+const CREDENTIAL_FILE = 'managed-local-credentials.json';
+class ManagedLocalCredentialStore {
+    installationId;
+    directory;
+    path;
+    constructor(opts) {
+        const identity = opts.installationIdentity.trim();
+        if (identity.length === 0) {
+            throw new Error('Managed-local credential installation identity must not be empty.');
+        }
+        this.installationId = (0, node_crypto_1.createHash)('sha256').update(identity).digest('hex');
+        const root = opts.stateRoot ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'installations');
+        this.directory = (0, node_path_1.join)(root, this.installationId);
+        this.path = (0, node_path_1.join)(this.directory, CREDENTIAL_FILE);
+    }
+    async load() {
+        let directoryStat;
+        try {
+            directoryStat = await (0, promises_1.lstat)(this.directory);
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT') {
+                return undefined;
+            }
+            throw new Error(`Managed-local credential directory could not be inspected at ${this.directory}.`);
+        }
+        if (!directoryStat.isDirectory() ||
+            (directoryStat.mode & 0o077) !== 0 ||
+            !ownedByCurrentUser(directoryStat.uid)) {
+            throw new Error(`Managed-local credential directory is unsafe at ${this.directory}; expected an installer-owned directory with mode 0700.`);
+        }
+        let handle;
+        try {
+            handle = await (0, promises_1.open)(this.path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT') {
+                return undefined;
+            }
+            throw new Error(`Managed-local credential store could not be inspected at ${this.path}.`);
+        }
+        try {
+            const fileStat = await handle.stat();
+            if (!fileStat.isFile() || !ownedByCurrentUser(fileStat.uid)) {
+                throw new Error(`Managed-local credential store path is not a regular file: ${this.path}.`);
+            }
+            if ((fileStat.mode & 0o077) !== 0) {
+                throw new Error(`Managed-local credential store permissions are unsafe at ${this.path}; expected mode 0600.`);
+            }
+            let raw;
+            try {
+                raw = await handle.readFile('utf8');
+            }
+            catch {
+                throw new Error(`Managed-local credential store could not be read at ${this.path}.`);
+            }
+            return parsePersisted(raw, this.installationId, this.path);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async getOrCreate() {
+        const existing = await this.load();
+        if (existing !== undefined) {
+            return existing;
+        }
+        await (0, promises_1.mkdir)(this.directory, {
+            recursive: true,
+            mode: PRIVATE_DIRECTORY_MODE,
+        });
+        await (0, promises_1.chmod)(this.directory, PRIVATE_DIRECTORY_MODE);
+        const persisted = {
+            version: STORE_VERSION,
+            installationId: this.installationId,
+            postgres: {
+                username: 'xema',
+                password: strongSecret(48),
+            },
+            objectStore: {
+                username: strongSecret(24),
+                password: strongSecret(48),
+            },
+        };
+        const candidatePath = (0, node_path_1.join)(this.directory, `.${CREDENTIAL_FILE}.${String(process.pid)}.${strongSecret(12)}.tmp`);
+        const handle = await (0, promises_1.open)(candidatePath, 'wx', PRIVATE_FILE_MODE);
+        try {
+            await handle.writeFile(`${JSON.stringify(persisted)}\n`, 'utf8');
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        try {
+            await (0, promises_1.link)(candidatePath, this.path);
+        }
+        catch (error) {
+            if (errorCode(error) !== 'EEXIST') {
+                throw new Error(`Managed-local credential store could not be created at ${this.path}.`);
+            }
+        }
+        finally {
+            await (0, promises_1.unlink)(candidatePath).catch((error) => {
+                if (errorCode(error) !== 'ENOENT') {
+                    throw error;
+                }
+            });
+        }
+        const installed = await this.load();
+        if (installed === undefined) {
+            throw new Error(`Managed-local credential store was not installed at ${this.path}.`);
+        }
+        return installed;
+    }
+    async purge() {
+        if ((await this.load()) === undefined) {
+            return false;
+        }
+        try {
+            await (0, promises_1.unlink)(this.path);
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT') {
+                return false;
+            }
+            throw new Error(`Managed-local credential store could not be removed at ${this.path}.`);
+        }
+        await (0, promises_1.rmdir)(this.directory).catch((error) => {
+            if (errorCode(error) !== 'ENOTEMPTY' && errorCode(error) !== 'ENOENT') {
+                throw error;
+            }
+        });
+        return true;
+    }
+}
+exports.ManagedLocalCredentialStore = ManagedLocalCredentialStore;
+function parsePersisted(raw, installationId, path) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Managed-local credential store is invalid JSON at ${path}.`);
+    }
+    if (!isRecord(value)) {
+        throw invalidStore(path);
+    }
+    if (value.version !== STORE_VERSION ||
+        value.installationId !== installationId) {
+        throw invalidStore(path);
+    }
+    if (!isCredentialPair(value.postgres) ||
+        !isCredentialPair(value.objectStore)) {
+        throw invalidStore(path);
+    }
+    return {
+        postgres: {
+            username: value.postgres.username,
+            password: value.postgres.password,
+        },
+        objectStore: {
+            username: value.objectStore.username,
+            password: value.objectStore.password,
+        },
+    };
+}
+function isCredentialPair(value) {
+    return (isRecord(value) &&
+        typeof value.username === 'string' &&
+        value.username.length > 0 &&
+        typeof value.password === 'string' &&
+        value.password.length >= 32);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function invalidStore(path) {
+    return new Error(`Managed-local credential store has an unsupported or incomplete format at ${path}.`);
+}
+function strongSecret(bytes) {
+    return (0, node_crypto_1.randomBytes)(bytes).toString('base64url');
+}
+function errorCode(error) {
+    return isRecord(error) && typeof error.code === 'string'
+        ? error.code
+        : undefined;
+}
+function ownedByCurrentUser(uid) {
+    return typeof process.getuid !== 'function' || process.getuid() === uid;
+}
+//# sourceMappingURL=managed-local-store.js.map

package/dist/runtime/secrets/managed-local-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-store.js","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-store.ts"],"names":[],"mappings":";;;AAAA,6CAAsD;AACtD,qCAAoC;AACpC,+CAQ0B;AAC1B,qCAAkC;AAClC,yCAAiC;AAEjC,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAwCzD,MAAa,2BAA2B;IAC7B,cAAc,CAAS;IACvB,SAAS,CAAS;IAClB,IAAI,CAAS;IAEtB,YAAY,IAAwC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;IAGD,KAAK,CAAC,IAAI;QACR,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gEAAgE,IAAI,CAAC,SAAS,GAAG,CAClF,CAAC;QACJ,CAAC;QACD,IACE,CAAC,aAAa,CAAC,WAAW,EAAE;YAC5B,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAClC,CAAC,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,CAAC,SAAS,yDAAyD,CAC3H,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAA,eAAI,EACjB,IAAI,CAAC,IAAI,EACT,mBAAS,CAAC,QAAQ,GAAG,CAAC,mBAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,CAAC,IAAI,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,8DAA8D,IAAI,CAAC,IAAI,GAAG,CAC3E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,CAAC,IAAI,uBAAuB,CAC7F,CAAC;YACJ,CAAC;YACD,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,uDAAuD,IAAI,CAAC,IAAI,GAAG,CACpE,CAAC;YACJ,CAAC;YACD,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAOD,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,sBAAsB;SAC7B,CAAC,CAAC;QACH,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QAEpD,MAAM,SAAS,GAAqC;YAClD,OAAO,EAAE,aAAa;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE;gBACR,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC1B,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;SACF,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,gBAAI,EACxB,IAAI,CAAC,SAAS,EACd,IAAI,eAAe,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,MAAM,CACrE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAI,EAAC,aAAa,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAA,eAAI,EAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,0DAA0D,IAAI,CAAC,IAAI,GAAG,CACvE,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,IAAA,iBAAM,EAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,uDAAuD,IAAI,CAAC,IAAI,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAMD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAA,iBAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0DAA0D,IAAI,CAAC,IAAI,GAAG,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA5KD,kEA4KC;AAED,SAAS,cAAc,CACrB,GAAW,EACX,cAAsB,EACtB,IAAY;IAEZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qDAAqD,IAAI,GAAG,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IACE,KAAK,CAAC,OAAO,KAAK,aAAa;QAC/B,KAAK,CAAC,cAAc,KAAK,cAAc,EACvC,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EACpC,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;SAClC;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;YACpC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAItC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,KAAK,CACd,6EAA6E,IAAI,GAAG,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC;AAC1E,CAAC"}

package/dist/runtime/secrets/resolver.d.ts

@@ -0,0 +1,23 @@
+import { Substrate, type XemaConfig } from '../config/schema';
+export type ResolvedSecrets = ReadonlyMap<string, string>;
+export interface SecretResolverOptions {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly cwd?: string;
+    readonly prompt?: (name: string) => Promise<string>;
+}
+export declare class SecretResolver {
+    private readonly env;
+    private readonly cwd;
+    private readonly prompt;
+    constructor(opts?: SecretResolverOptions);
+    resolve(config: XemaConfig): Promise<ResolvedSecrets>;
+    private resolveOne;
+}
+export declare function secretEnvironment(resolved: ResolvedSecrets): Readonly<Record<string, string>>;
+export declare function assertSecretMaterializationSupported(config: XemaConfig, substrate: Substrate): void;
+export interface PostgresCredentials {
+    readonly username: string;
+    readonly password: string;
+}
+export declare function externalPostgresCredentials(config: XemaConfig, resolved: ResolvedSecrets): PostgresCredentials | undefined;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/runtime/secrets/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,SAAS,EAGT,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAEjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE/C,IAAI,GAAE,qBAA0B;IAWtC,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;YAkB7C,UAAU;CAqCzB;AAOD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQlC;AAQD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,GACnB,IAAI,CAYN;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,eAAe,GACxB,mBAAmB,GAAG,SAAS,CA+BjC"}

package/dist/runtime/secrets/resolver.js

@@ -0,0 +1,265 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretResolver = void 0;
+exports.secretEnvironment = secretEnvironment;
+exports.assertSecretMaterializationSupported = assertSecretMaterializationSupported;
+exports.externalPostgresCredentials = externalPostgresCredentials;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const schema_1 = require("../config/schema");
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+class SecretResolver {
+    env;
+    cwd;
+    prompt;
+    constructor(opts = {}) {
+        this.env = opts.env ?? process.env;
+        this.cwd = opts.cwd ?? process.cwd();
+        this.prompt = opts.prompt ?? promptHidden;
+    }
+    async resolve(config) {
+        const resolved = new Map();
+        for (const [name, declaration] of Object.entries(config.secrets)) {
+            const value = await this.resolveOne(name, declaration);
+            if (value.length === 0) {
+                throw new Error(`Secret "${name}" resolved to an empty value.`);
+            }
+            if (value.includes('\0')) {
+                throw new Error(`Secret "${name}" contains a NUL byte.`);
+            }
+            resolved.set(name, value);
+        }
+        validateInfraReferences(config, resolved);
+        validateExternalPostgres(config, resolved);
+        return new SecretSnapshot(resolved);
+    }
+    async resolveOne(name, declaration) {
+        switch (declaration.from) {
+            case schema_1.SecretSource.Env: {
+                const envName = declaration.env ?? name;
+                if (!ENV_NAME.test(envName)) {
+                    throw new Error(`Secret "${name}" has invalid env source "${envName}". Use a valid environment variable name.`);
+                }
+                const value = this.env[envName];
+                if (value === undefined || value.length === 0) {
+                    throw new Error(`Secret "${name}" requires environment variable ${envName}, but it is unset or empty.`);
+                }
+                return value;
+            }
+            case schema_1.SecretSource.File: {
+                if (declaration.path === undefined) {
+                    throw new Error(`Secret "${name}" uses a file source but has no path.`);
+                }
+                const path = (0, node_path_1.isAbsolute)(declaration.path)
+                    ? declaration.path
+                    : (0, node_path_1.resolve)(this.cwd, declaration.path);
+                return readSecretFile(name, path);
+            }
+            case schema_1.SecretSource.Prompt:
+                return this.prompt(name);
+        }
+    }
+}
+exports.SecretResolver = SecretResolver;
+function secretEnvironment(resolved) {
+    const env = {};
+    for (const [name, value] of resolved) {
+        if (ENV_NAME.test(name)) {
+            env[name] = value;
+        }
+    }
+    return env;
+}
+function assertSecretMaterializationSupported(config, substrate) {
+    if (substrate !== schema_1.Substrate.Helm) {
+        return;
+    }
+    const hasDeclarations = Object.keys(config.secrets).length > 0;
+    const usesExternalPostgres = config.infra[schema_1.InfraComponent.Postgres]?.mode === schema_1.InfraMode.External;
+    if (hasDeclarations || usesExternalPostgres) {
+        throw new Error('The Helm substrate does not materialize launcher secrets or external PostgreSQL credentials. Configure Kubernetes Secrets through the service charts instead.');
+    }
+}
+function externalPostgresCredentials(config, resolved) {
+    const postgres = config.infra[schema_1.InfraComponent.Postgres];
+    if (postgres?.mode !== schema_1.InfraMode.External) {
+        return undefined;
+    }
+    const url = parsePostgresUrl(postgres);
+    const username = decodeURIComponent(url.username);
+    const inlinePassword = decodeURIComponent(url.password);
+    if (inlinePassword.length > 0) {
+        throw new Error('infra.postgres external URL must not contain a password; reference a declared secret with secretRef.');
+    }
+    if (username.length === 0) {
+        throw new Error('infra.postgres external URL must include an explicit username.');
+    }
+    if (postgres.secretRef === undefined) {
+        throw new Error('infra.postgres external configuration requires secretRef.');
+    }
+    const password = resolved.get(postgres.secretRef);
+    if (password === undefined || password.length === 0) {
+        throw new Error(`infra.postgres secretRef "${postgres.secretRef}" is unresolved.`);
+    }
+    return { username, password };
+}
+function validateInfraReferences(config, resolved) {
+    for (const [component, componentConfig] of Object.entries(config.infra)) {
+        if (componentConfig === undefined) {
+            continue;
+        }
+        const reference = componentConfig.secretRef;
+        if (reference === undefined) {
+            continue;
+        }
+        if (component !== schema_1.InfraComponent.Postgres) {
+            throw new Error(`infra.${component}.secretRef is unsupported; only external PostgreSQL passwords accept an infra secretRef.`);
+        }
+        if (!resolved.has(reference)) {
+            throw new Error(`infra.${component}.secretRef references undeclared or unresolved secret "${reference}".`);
+        }
+    }
+}
+function validateExternalPostgres(config, resolved) {
+    externalPostgresCredentials(config, resolved);
+}
+function parsePostgresUrl(config) {
+    if (config.url === undefined) {
+        throw new Error('infra.postgres external configuration has no URL.');
+    }
+    let url;
+    try {
+        url = new URL(config.url);
+    }
+    catch {
+        throw new Error('infra.postgres external URL is invalid.');
+    }
+    if (url.protocol !== 'postgres:' && url.protocol !== 'postgresql:') {
+        throw new Error('infra.postgres external URL must use the postgres or postgresql scheme.');
+    }
+    return url;
+}
+async function promptHidden(name) {
+    const input = process.stdin;
+    const output = process.stderr;
+    if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== 'function') {
+        throw new Error(`Secret "${name}" requires an interactive terminal. Use an env or file source for unattended launches.`);
+    }
+    output.write(`Secret ${name}: `);
+    return new Promise((resolvePromise, rejectPromise) => {
+        const bytes = [];
+        const wasRaw = input.isRaw;
+        let settled = false;
+        const cleanup = () => {
+            input.off('data', onData);
+            input.off('end', onEnd);
+            input.off('error', onError);
+            input.setRawMode(wasRaw);
+            input.pause();
+            output.write('\n');
+        };
+        const finish = (operation) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            operation();
+        };
+        const onEnd = () => {
+            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" ended before a value was read.`)));
+        };
+        const onError = () => {
+            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" failed.`)));
+        };
+        const onData = (chunk) => {
+            for (const byte of chunk) {
+                if (byte === 3) {
+                    finish(() => rejectPromise(new Error(`Secret prompt for "${name}" was cancelled.`)));
+                    return;
+                }
+                if (byte === 10 || byte === 13) {
+                    finish(() => resolvePromise(Buffer.concat(bytes).toString('utf8')));
+                    return;
+                }
+                if (byte === 8 || byte === 127) {
+                    const current = Buffer.concat(bytes);
+                    bytes.length = 0;
+                    if (current.length > 0) {
+                        bytes.push(current.subarray(0, current.length - 1));
+                    }
+                    continue;
+                }
+                bytes.push(Buffer.from([byte]));
+            }
+        };
+        input.setRawMode(true);
+        input.resume();
+        input.on('data', onData);
+        input.once('end', onEnd);
+        input.once('error', onError);
+    });
+}
+function readSecretFile(name, path) {
+    let descriptor;
+    try {
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const metadata = (0, node_fs_1.fstatSync)(descriptor);
+        if (!metadata.isFile()) {
+            throw new Error('source is not a regular file');
+        }
+        if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
+            throw new Error(`source permissions are ${modeString(metadata.mode)}; expected no group or other access (0600 or stricter)`);
+        }
+        return (0, node_fs_1.readFileSync)(descriptor, 'utf8');
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Secret "${name}" could not be read from ${path}: ${reason}`);
+    }
+    finally {
+        if (descriptor !== undefined) {
+            (0, node_fs_1.closeSync)(descriptor);
+        }
+    }
+}
+function modeString(mode) {
+    return (mode & 0o777).toString(8).padStart(4, '0');
+}
+class SecretSnapshot {
+    #values;
+    constructor(values) {
+        this.#values = new Map(values);
+        Object.freeze(this);
+    }
+    get size() {
+        return this.#values.size;
+    }
+    get(key) {
+        return this.#values.get(key);
+    }
+    has(key) {
+        return this.#values.has(key);
+    }
+    entries() {
+        return this.#values.entries();
+    }
+    keys() {
+        return this.#values.keys();
+    }
+    values() {
+        return this.#values.values();
+    }
+    forEach(callbackfn, thisArg) {
+        this.#values.forEach((value, key) => {
+            callbackfn.call(thisArg, value, key, this);
+        });
+    }
+    [Symbol.iterator]() {
+        return this.entries();
+    }
+    get [Symbol.toStringTag]() {
+        return 'SecretSnapshot';
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/dist/runtime/secrets/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":";;;AAiHA,8CAUC;AAQD,oFAeC;AAWD,kEAkCC;AA/LD,qCAMiB;AACjB,yCAAgD;AAEhD,6CAQ0B;AAgB1B,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAE5C,MAAa,cAAc;IACR,GAAG,CAAoB;IACvB,GAAG,CAAS;IACZ,MAAM,CAAoC;IAE3D,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC5C,CAAC;IAOD,KAAK,CAAC,OAAO,CAAC,MAAkB;QAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC;YAC3D,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,WAAyB;QAEzB,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,qBAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,6BAA6B,OAAO,2CAA2C,CAC/F,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,mCAAmC,OAAO,6BAA6B,CACvF,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,qBAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAGnC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,uCAAuC,CACvD,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,IAAA,sBAAU,EAAC,WAAW,CAAC,IAAI,CAAC;oBACvC,CAAC,CAAC,WAAW,CAAC,IAAI;oBAClB,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,qBAAY,CAAC,MAAM;gBACtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF;AAvED,wCAuEC;AAOD,SAAgB,iBAAiB,CAC/B,QAAyB;IAEzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,SAAoB;IAEpB,IAAI,SAAS,KAAK,kBAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,oBAAoB,GACxB,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,CAAC;IACrE,IAAI,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,+JAA+J,CAChK,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,SAAgB,2BAA2B,CACzC,MAAkB,EAClB,QAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,SAAS,kBAAkB,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAkB,EAClB,QAAyB;IAEzB,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,uBAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0FAA0F,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0DAA0D,SAAS,IAAI,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAkB,EAClB,QAAyB;IAEzB,2BAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IACpD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wFAAwF,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,SAAqB,EAAQ,EAAE;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CACP,sBAAsB,IAAI,kCAAkC,CAC7D,CACF,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CAAC,IAAI,KAAK,CAAC,sBAAsB,IAAI,WAAW,CAAC,CAAC,CAChE,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CAAC,sBAAsB,IAAI,kBAAkB,CAAC,CACxD,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACrC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;oBACjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBACtD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,kBAAQ,EACnB,IAAI,EACJ,mBAAS,CAAC,QAAQ,GAAG,CAAC,mBAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CACjD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,4BAA4B,IAAI,KAAK,MAAM,EAAE,CAC7D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,cAAc;IACT,OAAO,CAA8B;IAE9C,YAAY,MAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,CACL,UAIS,EACT,OAAiB;QAEjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}

package/dist/runtime/secrets/url-security.d.ts

@@ -0,0 +1,3 @@
+export declare function isSensitiveCredentialKey(key: string): boolean;
+export declare function urlContainsCredentialMaterial(url: URL): boolean;
+//# sourceMappingURL=url-security.d.ts.map

package/dist/runtime/secrets/url-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/url-security.ts"],"names":[],"mappings":"AAGA,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAK/D"}

package/dist/runtime/secrets/url-security.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveCredentialKey = isSensitiveCredentialKey;
+exports.urlContainsCredentialMaterial = urlContainsCredentialMaterial;
+const CREDENTIAL_KEY = /(password|token|authorization|credential|private[-_]?key|secret[-_]?value)|^value$/i;
+function isSensitiveCredentialKey(key) {
+    return CREDENTIAL_KEY.test(key);
+}
+function urlContainsCredentialMaterial(url) {
+    return (url.password.length > 0 ||
+        [...url.searchParams.keys()].some(isSensitiveCredentialKey));
+}
+//# sourceMappingURL=url-security.js.map

package/dist/runtime/secrets/url-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.js","sourceRoot":"","sources":["../../../src/runtime/secrets/url-security.ts"],"names":[],"mappings":";;AAGA,4DAEC;AAED,sEAKC;AAZD,MAAM,cAAc,GAClB,qFAAqF,CAAC;AAExF,SAAgB,wBAAwB,CAAC,GAAW;IAClD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,6BAA6B,CAAC,GAAQ;IACpD,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAC5D,CAAC;AACJ,CAAC"}

package/dist/runtime/sources/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,gBAAgB,QAA8C,CAAC;AAQ5E,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAyB,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BhG;AAMD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;gBAGrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACrD,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAUzC,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAa9C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAejF,OAAO,CAAC,MAAM;CAOf"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,gBAAgB,QAA8C,CAAC;AAQ5E,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAyB,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BhG;AAMD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;gBAGrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACrD,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAUzC,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAa9C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAejF,OAAO,CAAC,MAAM;CAWf"}

package/dist/runtime/sources/credentials.js

@@ -61,7 +61,8 @@ class CredentialResolver {
         if (fromEnv !== undefined && fromEnv.length > 0) {
             return fromEnv;
         }
-        return this.fileCreds.get(name);
+        const fromFile = this.fileCreds.get(name);
+        return fromFile !== undefined && fromFile.length > 0 ? fromFile : undefined;
     }
 }
 exports.CredentialResolver = CredentialResolver;

package/dist/runtime/sources/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":";;;AA0BA,kDA2BC;AArDD,qCAAmD;AACnD,qCAAkC;AAClC,yCAAiC;AAgBpB,QAAA,gBAAgB,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAQ5E,SAAgB,mBAAmB,CAAC,OAAe,wBAAgB;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,MAAa,kBAAkB;IAIV;IAHF,SAAS,CAA8B;IAExD,YACmB,MAAyB,OAAO,CAAC,GAAG,EACrD,SAAuC;QADtB,QAAG,GAAH,GAAG,CAAiC;QAGrD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAOD,GAAG,CAAC,YAAgC;QAClC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IACjD,CAAC;IAQD,OAAO,CAAC,YAAgC,EAAE,UAAkB;QAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,4BAA4B,YAAY,mBAAmB;gBAC9E,qBAAqB,YAAY,eAAe,wBAAgB,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,MAAM,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF;AAlDD,gDAkDC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":";;;AA0BA,kDA2BC;AArDD,qCAAmD;AACnD,qCAAkC;AAClC,yCAAiC;AAgBpB,QAAA,gBAAgB,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAQ5E,SAAgB,mBAAmB,CAAC,OAAe,wBAAgB;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,MAAa,kBAAkB;IAIV;IAHF,SAAS,CAA8B;IAExD,YACmB,MAAyB,OAAO,CAAC,GAAG,EACrD,SAAuC;QADtB,QAAG,GAAH,GAAG,CAAiC;QAGrD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAOD,GAAG,CAAC,YAAgC;QAClC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IACjD,CAAC;IAQD,OAAO,CAAC,YAAgC,EAAE,UAAkB;QAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,4BAA4B,YAAY,mBAAmB;gBAC9E,qBAAqB,YAAY,eAAe,wBAAgB,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,MAAM,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QAID,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;CACF;AAtDD,gDAsDC"}

package/dist/runtime/sources/kinds/git.d.ts

@@ -1,9 +1,12 @@
 import { type LockIndex } from '../../roster';
 import type { CredentialResolver } from '../credentials';
+import type { LaunchResolveContext } from '../resolve-context';
 import type { GitSource } from '../schema';
-import type { SourceResolveContext } from '../types';
 type LogFn = (line: string) => void;
-export declare function resolveGitSource(spec: GitSource, ctx: SourceResolveContext): LockIndex | null;
-export declare function checkoutGitSource(spec: GitSource, credentials: CredentialResolver, log?: LogFn): string;
+export interface CheckoutOptions {
+    readonly offline?: boolean;
+}
+export declare function resolveGitSource(spec: GitSource, ctx: LaunchResolveContext): LockIndex | null;
+export declare function checkoutGitSource(spec: GitSource, credentials: CredentialResolver, log?: LogFn, opts?: CheckoutOptions): string;
 export {};
 //# sourceMappingURL=git.d.ts.map

package/dist/runtime/sources/kinds/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":"AAKA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAGrD,KAAK,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAmBpC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAgB7F;AAOD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,EAAE,kBAAkB,EAC/B,GAAG,CAAC,EAAE,KAAK,GACV,MAAM,CAMR"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":"AAKA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,KAAK,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAmBpC,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAoBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAwD7F;AA4BD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,EAAE,kBAAkB,EAC/B,GAAG,CAAC,EAAE,KAAK,EACX,IAAI,GAAE,eAAoB,GACzB,MAAM,CAKR"}