@xemahq/xema 0.13.0 → 0.15.0

package/dist/runtime/secrets/managed-local-key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-key-provider.js","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-key-provider.ts"],"names":[],"mappings":";;;AA0KA,8EAyBC;AAnMD,2DAAqD;AACrD,6CAA0C;AAC1C,yCAAsC;AAEtC,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAC1C,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,wBAAwB,GAAG,iCAAiC,CAAC;AACnE,MAAM,YAAY,GAAG,iCAAiC,CAAC;AACvD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD,IAAY,2BAGX;AAHD,WAAY,2BAA2B;IACrC,+DAAgC,CAAA;IAChC,2DAA4B,CAAA;AAC9B,CAAC,EAHW,2BAA2B,2CAA3B,2BAA2B,QAGtC;AASD,MAAa,8BAA8B;IAMtB;IACA;IAJV,IAAI,GAAG,2BAA2B,CAAC,WAAW,CAAC;IAExD,YACmB,MAAyB,OAAO,CAAC,GAAG,EACpC,WAAW,wBAAwB;QADnC,QAAG,GAAH,GAAG,CAAiC;QACpC,aAAQ,GAAR,QAAQ,CAA2B;IACnD,CAAC;IAEJ,YAAY,CAAC,eAAuB;QAClC,OAAO,eAAe,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,eAAuB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,QAAQ,uCAAuC,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,QAAQ,2CAA2C,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,cAAsB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;CACF;AAjCD,wEAiCC;AAED,MAAa,wBAAwB;IAC1B,IAAI,GAAG,2BAA2B,CAAC,aAAa,CAAC;IAE1D,YAAY,CAAC,cAAsB;QACjC,OAAO,kBAAkB,gBAAgB,IAAI,cAAc,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,cAAsB;QAClC,WAAW,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wEAAwE,cAAc,uCAAuC,CAC9H,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,cAAsB;QACzC,WAAW,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,mBAAmB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,yBAAW,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4EAA4E,cAAc,uCAAuC,CAClI,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAtCD,4DAsCC;AAED,SAAS,WAAW;IAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,cAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE;YACjD,uBAAuB;YACvB,IAAI;YACJ,IAAI;YACJ,gBAAgB;YAChB,IAAI;YACJ,cAAc;SACf,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,cAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,6CAA6C,cAAc,0CAA0C,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,cAAsB,EACtB,OAAe;IAEf,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACxD,MAAM,KAAK,GAAG,IAAA,0BAAK,EACjB,UAAU,EACV;YACE,sBAAsB;YACtB,IAAI;YACJ,gBAAgB;YAChB,IAAI;YACJ,cAAc;YACd,IAAI;SACL,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,SAAgB,iCAAiC,CAC/C,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,QAAQ,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1B,KAAK,2BAA2B,CAAC,aAAa;YAC5C,OAAO,IAAI,wBAAwB,EAAE,CAAC;QACxC,KAAK,2BAA2B,CAAC,WAAW;YAC1C,OAAO,IAAI,8BAA8B,CAAC,GAAG,CAAC,CAAC;QACjD,KAAK,SAAS;YACZ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,IAAI,wBAAwB,EAAE,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8CAA8C,YAAY,KAAK,MAAM,CAAC,MAAM,CAC1E,2BAA2B,CAC5B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAClB,CAAC;QACJ;YACE,MAAM,IAAI,KAAK,CACb,eAAe,YAAY,wBAAwB,MAAM,CAAC,MAAM,CAC9D,2BAA2B,CAC5B,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAClB,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/runtime/secrets/managed-local-secret-store.d.ts

@@ -0,0 +1,18 @@
+import { type ManagedLocalKeyProvider } from './managed-local-key-provider';
+export interface ManagedLocalSecretStoreOptions {
+    readonly installationIdentity: string;
+    readonly stateRoot?: string;
+    readonly keyProvider?: ManagedLocalKeyProvider;
+}
+export declare class ManagedLocalSecretStore {
+    readonly installationId: string;
+    readonly directory: string;
+    readonly keyProvider: ManagedLocalKeyProvider;
+    constructor(opts: ManagedLocalSecretStoreOptions);
+    keyReference(): string;
+    load(entry: string): Promise<string | undefined>;
+    verify(entry: string): Promise<boolean>;
+    create(entry: string, value: string): Promise<void>;
+    pathFor(entry: string): string;
+}
+//# sourceMappingURL=managed-local-secret-store.d.ts.map

package/dist/runtime/secrets/managed-local-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-secret-store.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-secret-store.ts"],"names":[],"mappings":"AAaA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AAKtC,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAUD,qBAAa,uBAAuB;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;gBAElC,IAAI,EAAE,8BAA8B;IAchD,YAAY,IAAI,MAAM;IAIhB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAgChD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIvC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4BzD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAK/B"}

package/dist/runtime/secrets/managed-local-secret-store.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedLocalSecretStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const managed_local_cipher_1 = require("./managed-local-cipher");
+const managed_local_files_1 = require("./managed-local-files");
+const managed_local_key_provider_1 = require("./managed-local-key-provider");
+const ENTRY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+const ENTRY_LABEL = 'Managed-local secret entry';
+class ManagedLocalSecretStore {
+    installationId;
+    directory;
+    keyProvider;
+    constructor(opts) {
+        this.installationId = (0, managed_local_cipher_1.managedLocalInstallationId)(opts.installationIdentity);
+        const root = opts.stateRoot ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'installations');
+        this.directory = (0, node_path_1.join)(root, this.installationId, 'managed-local-secrets');
+        this.keyProvider =
+            opts.keyProvider ?? (0, managed_local_key_provider_1.configuredManagedLocalKeyProvider)(process.env);
+    }
+    keyReference() {
+        return this.keyProvider.keyReference(this.installationId);
+    }
+    async load(entry) {
+        assertEntry(entry);
+        const path = this.pathFor(entry);
+        const raw = await (0, managed_local_files_1.readManagedLocalFile)(this.directory, path, ENTRY_LABEL);
+        if (raw === undefined) {
+            return undefined;
+        }
+        const payload = await (0, managed_local_cipher_1.decryptManagedLocalRecord)(raw, this.installationId, entryContext(entry), path, this.keyProvider);
+        if (!isRecord(payload) ||
+            payload.entry !== entry ||
+            typeof payload.value !== 'string' ||
+            payload.value.length === 0 ||
+            payload.value.includes('\0')) {
+            throw new Error(`Managed-local secret entry has an unsupported payload at ${path}.`);
+        }
+        return payload.value;
+    }
+    async verify(entry) {
+        return (await this.load(entry)) !== undefined;
+    }
+    async create(entry, value) {
+        assertEntry(entry);
+        if (value.length === 0 || value.includes('\0')) {
+            throw new Error('Managed-local secret entry value must be non-empty and contain no NUL byte.');
+        }
+        if ((await this.load(entry)) !== undefined) {
+            throw immutableEntry(entry);
+        }
+        const path = this.pathFor(entry);
+        const encrypted = await (0, managed_local_cipher_1.encryptManagedLocalRecord)({ entry, value }, this.installationId, entryContext(entry), this.keyProvider);
+        const created = await (0, managed_local_files_1.createManagedLocalFile)(this.directory, path, `${JSON.stringify(encrypted)}\n`, ENTRY_LABEL);
+        if (!created) {
+            throw immutableEntry(entry);
+        }
+    }
+    pathFor(entry) {
+        assertEntry(entry);
+        const digest = (0, node_crypto_1.createHash)('sha256').update(entry).digest('hex');
+        return (0, node_path_1.join)(this.directory, `${digest}.json`);
+    }
+}
+exports.ManagedLocalSecretStore = ManagedLocalSecretStore;
+function assertEntry(entry) {
+    if (!ENTRY_PATTERN.test(entry)) {
+        throw new Error('Managed-local secret entry name must be a non-empty identifier.');
+    }
+}
+function entryContext(entry) {
+    return `secret-entry:${entry}`;
+}
+function immutableEntry(entry) {
+    return new Error(`Managed-local secret entry "${entry}" already exists and is immutable; rotate by creating a new entry name.`);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=managed-local-secret-store.js.map

package/dist/runtime/secrets/managed-local-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-secret-store.js","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-secret-store.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,qCAAkC;AAClC,yCAAiC;AAEjC,iEAIgC;AAChC,+DAG+B;AAC/B,6EAGsC;AAEtC,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAgBjD,MAAa,uBAAuB;IACzB,cAAc,CAAS;IACvB,SAAS,CAAS;IAClB,WAAW,CAA0B;IAE9C,YAAY,IAAoC;QAC9C,IAAI,CAAC,cAAc,GAAG,IAAA,iDAA0B,EAC9C,IAAI,CAAC,oBAAoB,CAC1B,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAA,gBAAI,EACnB,IAAI,EACJ,IAAI,CAAC,cAAc,EACnB,uBAAuB,CACxB,CAAC;QACF,IAAI,CAAC,WAAW;YACd,IAAI,CAAC,WAAW,IAAI,IAAA,8DAAiC,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa;QACtB,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAA,0CAAoB,EACpC,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,WAAW,CACZ,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAA,gDAAyB,EAC7C,GAAG,EACH,IAAI,CAAC,cAAc,EACnB,YAAY,CAAC,KAAK,CAAC,EACnB,IAAI,EACJ,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IACE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClB,OAAO,CAAC,KAAK,KAAK,KAAK;YACvB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAa;QACvC,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC3C,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,IAAA,gDAAyB,EAC/C,EAAE,KAAK,EAAE,KAAK,EAAE,EAChB,IAAI,CAAC,cAAc,EACnB,YAAY,CAAC,KAAK,CAAC,EACnB,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAA,4CAAsB,EAC1C,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAChC,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChE,OAAO,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IAChD,CAAC;CACF;AA5FD,0DA4FC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,gBAAgB,KAAK,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,IAAI,KAAK,CACd,+BAA+B,KAAK,yEAAyE,CAC9G,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/runtime/secrets/managed-local-store.d.ts

@@ -0,0 +1,33 @@
+import { type ManagedLocalKeyProvider } from './managed-local-key-provider';
+export interface InfrastructureCredentialPair {
+    readonly username: string;
+    readonly password: string;
+}
+export interface LocalInfrastructureCredentials {
+    readonly postgres?: InfrastructureCredentialPair;
+    readonly objectStore?: InfrastructureCredentialPair;
+    readonly keycloakAdmin?: InfrastructureCredentialPair;
+    readonly keycloakClient?: InfrastructureCredentialPair;
+}
+export interface ManagedLocalCredentials extends LocalInfrastructureCredentials {
+    readonly postgres: InfrastructureCredentialPair;
+    readonly objectStore: InfrastructureCredentialPair;
+    readonly keycloakAdmin: InfrastructureCredentialPair;
+    readonly keycloakClient: InfrastructureCredentialPair;
+}
+export interface ManagedLocalCredentialStoreOptions {
+    readonly installationIdentity: string;
+    readonly stateRoot?: string;
+    readonly keyProvider?: ManagedLocalKeyProvider;
+}
+export declare class ManagedLocalCredentialStore {
+    readonly installationId: string;
+    readonly directory: string;
+    readonly path: string;
+    readonly keyProvider: ManagedLocalKeyProvider;
+    constructor(opts: ManagedLocalCredentialStoreOptions);
+    load(): Promise<ManagedLocalCredentials | undefined>;
+    getOrCreate(): Promise<ManagedLocalCredentials>;
+    purge(): Promise<boolean>;
+}
+//# sourceMappingURL=managed-local-store.d.ts.map

package/dist/runtime/secrets/managed-local-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-store.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-store.ts"],"names":[],"mappings":"AAcA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,4BAA4B,CAAC;IAMpD,QAAQ,CAAC,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAOtD,QAAQ,CAAC,cAAc,CAAC,EAAE,4BAA4B,CAAC;CACxD;AAGD,MAAM,WAAW,uBACf,SAAQ,8BAA8B;IACtC,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,4BAA4B,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAC;IACrD,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;CACvD;AAED,MAAM,WAAW,kCAAkC;IAEjD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAcD,qBAAa,2BAA2B;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAC;gBAElC,IAAI,EAAE,kCAAkC;IAY9C,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAwBpD,WAAW,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAkD/C,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;CAUhC"}

package/dist/runtime/secrets/managed-local-store.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedLocalCredentialStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const managed_local_cipher_1 = require("./managed-local-cipher");
+const managed_local_files_1 = require("./managed-local-files");
+const managed_local_key_provider_1 = require("./managed-local-key-provider");
+const infra_catalog_1 = require("../infra/infra-catalog");
+const CREDENTIAL_FILE = 'managed-local-credentials.json';
+const CREDENTIAL_LABEL = 'Managed-local credential store';
+class ManagedLocalCredentialStore {
+    installationId;
+    directory;
+    path;
+    keyProvider;
+    constructor(opts) {
+        this.installationId = (0, managed_local_cipher_1.managedLocalInstallationId)(opts.installationIdentity);
+        const root = opts.stateRoot ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'installations');
+        this.directory = (0, node_path_1.join)(root, this.installationId);
+        this.path = (0, node_path_1.join)(this.directory, CREDENTIAL_FILE);
+        this.keyProvider =
+            opts.keyProvider ?? (0, managed_local_key_provider_1.configuredManagedLocalKeyProvider)(process.env);
+    }
+    async load() {
+        const raw = await (0, managed_local_files_1.readManagedLocalFile)(this.directory, this.path, CREDENTIAL_LABEL);
+        if (raw === undefined) {
+            return undefined;
+        }
+        const decrypted = await (0, managed_local_cipher_1.decryptManagedLocalRecord)(raw, this.installationId, 'infrastructure-credentials', this.path, this.keyProvider);
+        return parseCredentials(decrypted, this.path);
+    }
+    async getOrCreate() {
+        const existing = await this.load();
+        if (existing !== undefined) {
+            return existing;
+        }
+        const credentials = {
+            postgres: {
+                username: 'xema',
+                password: strongSecret(48),
+            },
+            objectStore: {
+                username: strongSecret(24),
+                password: strongSecret(48),
+            },
+            keycloakAdmin: {
+                username: infra_catalog_1.KEYCLOAK_ADMIN_USERNAME,
+                password: strongSecret(32),
+            },
+            keycloakClient: {
+                username: infra_catalog_1.KEYCLOAK_ADMIN_CLIENT_ID,
+                password: strongSecret(48),
+            },
+        };
+        const persisted = await (0, managed_local_cipher_1.encryptManagedLocalRecord)(credentials, this.installationId, 'infrastructure-credentials', this.keyProvider);
+        await (0, managed_local_files_1.createManagedLocalFile)(this.directory, this.path, `${JSON.stringify(persisted)}\n`, CREDENTIAL_LABEL);
+        const installed = await this.load();
+        if (installed === undefined) {
+            throw new Error(`Managed-local credential store was not installed at ${this.path}.`);
+        }
+        return installed;
+    }
+    async purge() {
+        if ((await this.load()) === undefined) {
+            return false;
+        }
+        return (0, managed_local_files_1.deleteManagedLocalFile)(this.directory, this.path, CREDENTIAL_LABEL);
+    }
+}
+exports.ManagedLocalCredentialStore = ManagedLocalCredentialStore;
+function parseCredentials(value, path) {
+    if (!isRecord(value) ||
+        !isCredentialPair(value.postgres) ||
+        !isCredentialPair(value.objectStore) ||
+        !isCredentialPair(value.keycloakAdmin) ||
+        !isCredentialPair(value.keycloakClient)) {
+        throw invalidStore(path);
+    }
+    return {
+        postgres: {
+            username: value.postgres.username,
+            password: value.postgres.password,
+        },
+        objectStore: {
+            username: value.objectStore.username,
+            password: value.objectStore.password,
+        },
+        keycloakAdmin: {
+            username: value.keycloakAdmin.username,
+            password: value.keycloakAdmin.password,
+        },
+        keycloakClient: {
+            username: value.keycloakClient.username,
+            password: value.keycloakClient.password,
+        },
+    };
+}
+function isCredentialPair(value) {
+    return (isRecord(value) &&
+        typeof value.username === 'string' &&
+        value.username.length > 0 &&
+        typeof value.password === 'string' &&
+        value.password.length >= 32);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function invalidStore(path) {
+    return new Error(`Managed-local credential store has an unsupported or incomplete format at ${path}. ` +
+        'A store written before the managed Keycloak carried its own credentials is ' +
+        'incomplete: it can custody Postgres and the object store but not the realm the ' +
+        'platform authenticates against. There is no in-place upgrade — the affected local ' +
+        'stack never reached a working auth floor. Run `xema down --purge` to discard it and ' +
+        'launch again.');
+}
+function strongSecret(bytes) {
+    return (0, node_crypto_1.randomBytes)(bytes).toString('base64url');
+}
+//# sourceMappingURL=managed-local-store.js.map

package/dist/runtime/secrets/managed-local-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-store.js","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-store.ts"],"names":[],"mappings":";;;AAAA,6CAA0C;AAC1C,qCAAkC;AAClC,yCAAiC;AAEjC,iEAIgC;AAChC,+DAI+B;AAC/B,6EAGsC;AACtC,0DAGgC;AAEhC,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAwD1D,MAAa,2BAA2B;IAC7B,cAAc,CAAS;IACvB,SAAS,CAAS;IAClB,IAAI,CAAS;IACb,WAAW,CAA0B;IAE9C,YAAY,IAAwC;QAClD,IAAI,CAAC,cAAc,GAAG,IAAA,iDAA0B,EAC9C,IAAI,CAAC,oBAAoB,CAC1B,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAClD,IAAI,CAAC,WAAW;YACd,IAAI,CAAC,WAAW,IAAI,IAAA,8DAAiC,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAGD,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAA,0CAAoB,EACpC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,gBAAgB,CACjB,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAA,gDAAyB,EAC/C,GAAG,EACH,IAAI,CAAC,cAAc,EACnB,4BAA4B,EAC5B,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,OAAO,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAOD,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,WAAW,GAA4B;YAC3C,QAAQ,EAAE;gBACR,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC1B,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;YACD,aAAa,EAAE;gBACb,QAAQ,EAAE,uCAAuB;gBACjC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;YACD,cAAc,EAAE;gBACd,QAAQ,EAAE,wCAAwB;gBAClC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;SACF,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,IAAA,gDAAyB,EAC/C,WAAW,EACX,IAAI,CAAC,cAAc,EACnB,4BAA4B,EAC5B,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,MAAM,IAAA,4CAAsB,EAC1B,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAChC,gBAAgB,CACjB,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,uDAAuD,IAAI,CAAC,IAAI,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAMD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,4CAAsB,EAC3B,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,gBAAgB,CACjB,CAAC;IACJ,CAAC;CACF;AAtGD,kEAsGC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,IAAY;IAEZ,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC;QACpC,CAAC,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC;QACtC,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,EACvC,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;SAClC;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;YACpC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;SACrC;QACD,aAAa,EAAE;YACb,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;YACtC,QAAQ,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;SACvC;QACD,cAAc,EAAE;YACd,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ;YACvC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ;SACxC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAItC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,KAAK,CACd,6EAA6E,IAAI,IAAI;QACnF,6EAA6E;QAC7E,iFAAiF;QACjF,oFAAoF;QACpF,sFAAsF;QACtF,eAAe,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC"}

package/dist/runtime/secrets/resolver.d.ts

@@ -0,0 +1,23 @@
+import { Substrate, type XemaConfig } from '../config/schema';
+export type ResolvedSecrets = ReadonlyMap<string, string>;
+export interface SecretResolverOptions {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly cwd?: string;
+    readonly prompt?: (name: string) => Promise<string>;
+}
+export declare class SecretResolver {
+    private readonly env;
+    private readonly cwd;
+    private readonly prompt;
+    constructor(opts?: SecretResolverOptions);
+    resolve(config: XemaConfig): Promise<ResolvedSecrets>;
+    private resolveOne;
+}
+export declare function secretEnvironment(resolved: ResolvedSecrets): Readonly<Record<string, string>>;
+export declare function assertSecretMaterializationSupported(config: XemaConfig, substrate: Substrate): void;
+export interface PostgresCredentials {
+    readonly username: string;
+    readonly password: string;
+}
+export declare function externalPostgresCredentials(config: XemaConfig, resolved: ResolvedSecrets): PostgresCredentials | undefined;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/runtime/secrets/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,SAAS,EAGT,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAEjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE/C,IAAI,GAAE,qBAA0B;IAWtC,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;YAkB7C,UAAU;CAqCzB;AAOD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQlC;AAQD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,GACnB,IAAI,CAYN;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,eAAe,GACxB,mBAAmB,GAAG,SAAS,CA+BjC"}

package/dist/runtime/secrets/resolver.js

@@ -0,0 +1,265 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretResolver = void 0;
+exports.secretEnvironment = secretEnvironment;
+exports.assertSecretMaterializationSupported = assertSecretMaterializationSupported;
+exports.externalPostgresCredentials = externalPostgresCredentials;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const schema_1 = require("../config/schema");
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+class SecretResolver {
+    env;
+    cwd;
+    prompt;
+    constructor(opts = {}) {
+        this.env = opts.env ?? process.env;
+        this.cwd = opts.cwd ?? process.cwd();
+        this.prompt = opts.prompt ?? promptHidden;
+    }
+    async resolve(config) {
+        const resolved = new Map();
+        for (const [name, declaration] of Object.entries(config.secrets)) {
+            const value = await this.resolveOne(name, declaration);
+            if (value.length === 0) {
+                throw new Error(`Secret "${name}" resolved to an empty value.`);
+            }
+            if (value.includes('\0')) {
+                throw new Error(`Secret "${name}" contains a NUL byte.`);
+            }
+            resolved.set(name, value);
+        }
+        validateInfraReferences(config, resolved);
+        validateExternalPostgres(config, resolved);
+        return new SecretSnapshot(resolved);
+    }
+    async resolveOne(name, declaration) {
+        switch (declaration.from) {
+            case schema_1.SecretSource.Env: {
+                const envName = declaration.env ?? name;
+                if (!ENV_NAME.test(envName)) {
+                    throw new Error(`Secret "${name}" has invalid env source "${envName}". Use a valid environment variable name.`);
+                }
+                const value = this.env[envName];
+                if (value === undefined || value.length === 0) {
+                    throw new Error(`Secret "${name}" requires environment variable ${envName}, but it is unset or empty.`);
+                }
+                return value;
+            }
+            case schema_1.SecretSource.File: {
+                if (declaration.path === undefined) {
+                    throw new Error(`Secret "${name}" uses a file source but has no path.`);
+                }
+                const path = (0, node_path_1.isAbsolute)(declaration.path)
+                    ? declaration.path
+                    : (0, node_path_1.resolve)(this.cwd, declaration.path);
+                return readSecretFile(name, path);
+            }
+            case schema_1.SecretSource.Prompt:
+                return this.prompt(name);
+        }
+    }
+}
+exports.SecretResolver = SecretResolver;
+function secretEnvironment(resolved) {
+    const env = {};
+    for (const [name, value] of resolved) {
+        if (ENV_NAME.test(name)) {
+            env[name] = value;
+        }
+    }
+    return env;
+}
+function assertSecretMaterializationSupported(config, substrate) {
+    if (substrate !== schema_1.Substrate.Helm) {
+        return;
+    }
+    const hasDeclarations = Object.keys(config.secrets).length > 0;
+    const usesExternalPostgres = config.infra[schema_1.InfraComponent.Postgres]?.mode === schema_1.InfraMode.External;
+    if (hasDeclarations || usesExternalPostgres) {
+        throw new Error('The Helm substrate does not materialize launcher secrets or external PostgreSQL credentials. Configure Kubernetes Secrets through the service charts instead.');
+    }
+}
+function externalPostgresCredentials(config, resolved) {
+    const postgres = config.infra[schema_1.InfraComponent.Postgres];
+    if (postgres?.mode !== schema_1.InfraMode.External) {
+        return undefined;
+    }
+    const url = parsePostgresUrl(postgres);
+    const username = decodeURIComponent(url.username);
+    const inlinePassword = decodeURIComponent(url.password);
+    if (inlinePassword.length > 0) {
+        throw new Error('infra.postgres external URL must not contain a password; reference a declared secret with secretRef.');
+    }
+    if (username.length === 0) {
+        throw new Error('infra.postgres external URL must include an explicit username.');
+    }
+    if (postgres.secretRef === undefined) {
+        throw new Error('infra.postgres external configuration requires secretRef.');
+    }
+    const password = resolved.get(postgres.secretRef);
+    if (password === undefined || password.length === 0) {
+        throw new Error(`infra.postgres secretRef "${postgres.secretRef}" is unresolved.`);
+    }
+    return { username, password };
+}
+function validateInfraReferences(config, resolved) {
+    for (const [component, componentConfig] of Object.entries(config.infra)) {
+        if (componentConfig === undefined) {
+            continue;
+        }
+        const reference = componentConfig.secretRef;
+        if (reference === undefined) {
+            continue;
+        }
+        if (component !== schema_1.InfraComponent.Postgres) {
+            throw new Error(`infra.${component}.secretRef is unsupported; only external PostgreSQL passwords accept an infra secretRef.`);
+        }
+        if (!resolved.has(reference)) {
+            throw new Error(`infra.${component}.secretRef references undeclared or unresolved secret "${reference}".`);
+        }
+    }
+}
+function validateExternalPostgres(config, resolved) {
+    externalPostgresCredentials(config, resolved);
+}
+function parsePostgresUrl(config) {
+    if (config.url === undefined) {
+        throw new Error('infra.postgres external configuration has no URL.');
+    }
+    let url;
+    try {
+        url = new URL(config.url);
+    }
+    catch {
+        throw new Error('infra.postgres external URL is invalid.');
+    }
+    if (url.protocol !== 'postgres:' && url.protocol !== 'postgresql:') {
+        throw new Error('infra.postgres external URL must use the postgres or postgresql scheme.');
+    }
+    return url;
+}
+async function promptHidden(name) {
+    const input = process.stdin;
+    const output = process.stderr;
+    if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== 'function') {
+        throw new Error(`Secret "${name}" requires an interactive terminal. Use an env or file source for unattended launches.`);
+    }
+    output.write(`Secret ${name}: `);
+    return new Promise((resolvePromise, rejectPromise) => {
+        const bytes = [];
+        const wasRaw = input.isRaw;
+        let settled = false;
+        const cleanup = () => {
+            input.off('data', onData);
+            input.off('end', onEnd);
+            input.off('error', onError);
+            input.setRawMode(wasRaw);
+            input.pause();
+            output.write('\n');
+        };
+        const finish = (operation) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            operation();
+        };
+        const onEnd = () => {
+            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" ended before a value was read.`)));
+        };
+        const onError = () => {
+            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" failed.`)));
+        };
+        const onData = (chunk) => {
+            for (const byte of chunk) {
+                if (byte === 3) {
+                    finish(() => rejectPromise(new Error(`Secret prompt for "${name}" was cancelled.`)));
+                    return;
+                }
+                if (byte === 10 || byte === 13) {
+                    finish(() => resolvePromise(Buffer.concat(bytes).toString('utf8')));
+                    return;
+                }
+                if (byte === 8 || byte === 127) {
+                    const current = Buffer.concat(bytes);
+                    bytes.length = 0;
+                    if (current.length > 0) {
+                        bytes.push(current.subarray(0, current.length - 1));
+                    }
+                    continue;
+                }
+                bytes.push(Buffer.from([byte]));
+            }
+        };
+        input.setRawMode(true);
+        input.resume();
+        input.on('data', onData);
+        input.once('end', onEnd);
+        input.once('error', onError);
+    });
+}
+function readSecretFile(name, path) {
+    let descriptor;
+    try {
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const metadata = (0, node_fs_1.fstatSync)(descriptor);
+        if (!metadata.isFile()) {
+            throw new Error('source is not a regular file');
+        }
+        if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
+            throw new Error(`source permissions are ${modeString(metadata.mode)}; expected no group or other access (0600 or stricter)`);
+        }
+        return (0, node_fs_1.readFileSync)(descriptor, 'utf8');
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Secret "${name}" could not be read from ${path}: ${reason}`);
+    }
+    finally {
+        if (descriptor !== undefined) {
+            (0, node_fs_1.closeSync)(descriptor);
+        }
+    }
+}
+function modeString(mode) {
+    return (mode & 0o777).toString(8).padStart(4, '0');
+}
+class SecretSnapshot {
+    #values;
+    constructor(values) {
+        this.#values = new Map(values);
+        Object.freeze(this);
+    }
+    get size() {
+        return this.#values.size;
+    }
+    get(key) {
+        return this.#values.get(key);
+    }
+    has(key) {
+        return this.#values.has(key);
+    }
+    entries() {
+        return this.#values.entries();
+    }
+    keys() {
+        return this.#values.keys();
+    }
+    values() {
+        return this.#values.values();
+    }
+    forEach(callbackfn, thisArg) {
+        this.#values.forEach((value, key) => {
+            callbackfn.call(thisArg, value, key, this);
+        });
+    }
+    [Symbol.iterator]() {
+        return this.entries();
+    }
+    get [Symbol.toStringTag]() {
+        return 'SecretSnapshot';
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/dist/runtime/secrets/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":";;;AAiHA,8CAUC;AAQD,oFAeC;AAWD,kEAkCC;AA/LD,qCAMiB;AACjB,yCAAgD;AAEhD,6CAQ0B;AAgB1B,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAE5C,MAAa,cAAc;IACR,GAAG,CAAoB;IACvB,GAAG,CAAS;IACZ,MAAM,CAAoC;IAE3D,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC5C,CAAC;IAOD,KAAK,CAAC,OAAO,CAAC,MAAkB;QAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC;YAC3D,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,WAAyB;QAEzB,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,qBAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,6BAA6B,OAAO,2CAA2C,CAC/F,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,mCAAmC,OAAO,6BAA6B,CACvF,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,qBAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAGnC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,uCAAuC,CACvD,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,IAAA,sBAAU,EAAC,WAAW,CAAC,IAAI,CAAC;oBACvC,CAAC,CAAC,WAAW,CAAC,IAAI;oBAClB,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,qBAAY,CAAC,MAAM;gBACtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF;AAvED,wCAuEC;AAOD,SAAgB,iBAAiB,CAC/B,QAAyB;IAEzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,SAAoB;IAEpB,IAAI,SAAS,KAAK,kBAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,oBAAoB,GACxB,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,CAAC;IACrE,IAAI,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,+JAA+J,CAChK,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,SAAgB,2BAA2B,CACzC,MAAkB,EAClB,QAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,SAAS,kBAAkB,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAkB,EAClB,QAAyB;IAEzB,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,uBAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0FAA0F,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0DAA0D,SAAS,IAAI,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAkB,EAClB,QAAyB;IAEzB,2BAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IACpD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wFAAwF,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,SAAqB,EAAQ,EAAE;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CACP,sBAAsB,IAAI,kCAAkC,CAC7D,CACF,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CAAC,IAAI,KAAK,CAAC,sBAAsB,IAAI,WAAW,CAAC,CAAC,CAChE,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CAAC,sBAAsB,IAAI,kBAAkB,CAAC,CACxD,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACrC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;oBACjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBACtD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,kBAAQ,EACnB,IAAI,EACJ,mBAAS,CAAC,QAAQ,GAAG,CAAC,mBAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CACjD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,4BAA4B,IAAI,KAAK,MAAM,EAAE,CAC7D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,cAAc;IACT,OAAO,CAA8B;IAE9C,YAAY,MAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,CACL,UAIS,EACT,OAAiB;QAEjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}

package/dist/runtime/secrets/url-security.d.ts

@@ -0,0 +1,3 @@
+export declare function isSensitiveCredentialKey(key: string): boolean;
+export declare function urlContainsCredentialMaterial(url: URL): boolean;
+//# sourceMappingURL=url-security.d.ts.map

package/dist/runtime/secrets/url-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/url-security.ts"],"names":[],"mappings":"AAGA,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAK/D"}

package/dist/runtime/secrets/url-security.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveCredentialKey = isSensitiveCredentialKey;
+exports.urlContainsCredentialMaterial = urlContainsCredentialMaterial;
+const CREDENTIAL_KEY = /(password|token|authorization|credential|private[-_]?key|secret[-_]?value)|^value$/i;
+function isSensitiveCredentialKey(key) {
+    return CREDENTIAL_KEY.test(key);
+}
+function urlContainsCredentialMaterial(url) {
+    return (url.password.length > 0 ||
+        [...url.searchParams.keys()].some(isSensitiveCredentialKey));
+}
+//# sourceMappingURL=url-security.js.map

package/dist/runtime/secrets/url-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.js","sourceRoot":"","sources":["../../../src/runtime/secrets/url-security.ts"],"names":[],"mappings":";;AAGA,4DAEC;AAED,sEAKC;AAZD,MAAM,cAAc,GAClB,qFAAqF,CAAC;AAExF,SAAgB,wBAAwB,CAAC,GAAW;IAClD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,6BAA6B,CAAC,GAAQ;IACpD,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAC5D,CAAC;AACJ,CAAC"}

package/dist/runtime/sources/credentials.d.ts

@@ -1,10 +1,12 @@
 export declare const CREDENTIALS_FILE: string;
 export declare function loadCredentialsFile(path?: string): ReadonlyMap<string, string>;
+export declare function writeCredential(name: string, value: string, path?: string): void;
 export declare class CredentialResolver {
     private readonly env;
     private readonly fileCreds;
     constructor(env?: NodeJS.ProcessEnv, fileCreds?: ReadonlyMap<string, string>);
     has(authTokenEnv: string | undefined): boolean;
+    read(name: string): string | undefined;
     resolve(authTokenEnv: string | undefined, sourceName: string): string | undefined;
     private lookup;
 }