dotsec 0.1.1

package/README.md

@@ -0,0 +1,3 @@
+# dotsec
+
+Secure dot env. Check back soon.

package/bin/dotsec.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+
+require('../dist/cli');

package/dist/cli.d.ts

@@ -0,0 +1 @@
+

package/dist/cli.js

@@ -0,0 +1,384 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __reExport = (target, module2, desc4) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, { get: () => module2[key], enumerable: !(desc4 = __getOwnPropDesc(module2, key)) || desc4.enumerable });
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+};
+
+// src/cli.ts
+var import_helpers = __toModule(require("yargs/helpers"));
+var import_yargs = __toModule(require("yargs/yargs"));
+
+// src/commands/decryptSecCommand.ts
+var decryptSecCommand_exports = {};
+__export(decryptSecCommand_exports, {
+  builder: () => builder,
+  command: () => command,
+  desc: () => desc,
+  handler: () => handler
+});
+var import_client_kms = __toModule(require("@aws-sdk/client-kms"));
+var import_chalk2 = __toModule(require("chalk"));
+var import_dotenv = __toModule(require("dotenv"));
+var import_node_fs = __toModule(require("node:fs"));
+var import_node_path = __toModule(require("node:path"));
+
+// src/commonCliOptions.ts
+var commonCliOptions = {
+  awsProfile: {
+    string: true,
+    describe: "AWS profile"
+  },
+  awsRegion: {
+    string: true,
+    describe: "AWS region"
+  },
+  awsKeyAlias: {
+    string: true,
+    describe: "AWS KMS asymmetric key alias"
+  },
+  awsKey: {
+    string: true,
+    describe: "AWS KMS asymmetric key arn"
+  },
+  verbose: {
+    boolean: true,
+    describe: "Be verbose"
+  },
+  yes: {
+    boolean: true,
+    describe: "Proceeds without confirmation"
+  },
+  dryRun: {
+    boolean: true,
+    describe: "Do a dry run"
+  }
+};
+
+// src/utils/getCredentialsProfileRegion.ts
+var import_credential_providers = __toModule(require("@aws-sdk/credential-providers"));
+var import_shared_ini_file_loader = __toModule(require("@aws-sdk/shared-ini-file-loader"));
+
+// src/utils/logger.ts
+var import_chalk = __toModule(require("chalk"));
+var bold = (str) => import_chalk.default.yellowBright.bold(str);
+var underline = (str) => import_chalk.default.cyanBright.bold(str);
+
+// src/utils/getCredentialsProfileRegion.ts
+var getCredentialsProfileRegion = async ({
+  argv,
+  env
+}) => {
+  var _a, _b, _c;
+  const sharedConfigFiles = await (0, import_shared_ini_file_loader.loadSharedConfigFiles)();
+  let credentialsAndOrigin = void 0;
+  let profileAndOrigin = void 0;
+  let regionAndOrigin = void 0;
+  if (argv.profile) {
+    profileAndOrigin = { value: argv.profile, origin: `command line option: ${bold(argv.profile)}` };
+    credentialsAndOrigin = { value: await (0, import_credential_providers.fromIni)({ profile: argv.profile })(), origin: `${bold(`[${argv.profile}]`)} in credentials file` };
+  } else if (env.AWS_PROFILE) {
+    profileAndOrigin = { value: env.AWS_PROFILE, origin: `env variable ${bold("AWS_PROFILE")}: ${underline(env.AWS_PROFILE)}` };
+    credentialsAndOrigin = {
+      value: await (0, import_credential_providers.fromIni)({ profile: env.AWS_PROFILE })(),
+      origin: `env variable ${underline("AWS_PROFILE")}: ${bold(env.AWS_PROFILE)}`
+    };
+  } else if (env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) {
+    credentialsAndOrigin = {
+      value: await (0, import_credential_providers.fromEnv)()(),
+      origin: `env variables ${bold("AWS_ACCESS_KEY_ID")} and ${bold("AWS_SECRET_ACCESS_KEY")}`
+    };
+  } else if ((_a = sharedConfigFiles.credentialsFile) == null ? void 0 : _a.default) {
+    profileAndOrigin = { value: "default", origin: `${bold("[default]")} in credentials file` };
+    credentialsAndOrigin = { value: await (0, import_credential_providers.fromIni)({ profile: "default" })(), origin: `profile ${bold("[default]")}` };
+  }
+  if (argv.region) {
+    regionAndOrigin = { value: argv.region, origin: `command line option: ${bold(argv.region)}` };
+  } else if (env.AWS_REGION) {
+    regionAndOrigin = { value: env.AWS_REGION, origin: `env variable ${bold("AWS_REGION")}: ${underline(env.AWS_REGION)}` };
+  } else if (env.AWS_DEFAULT_REGION) {
+    regionAndOrigin = {
+      value: env.AWS_DEFAULT_REGION,
+      origin: `env variable ${bold("AWS_DEFAULT_REGION")}: ${underline(env.AWS_DEFAULT_REGION)}`
+    };
+  } else if (profileAndOrigin) {
+    const foundRegion = (_c = (_b = sharedConfigFiles == null ? void 0 : sharedConfigFiles.configFile) == null ? void 0 : _b[profileAndOrigin.value]) == null ? void 0 : _c.region;
+    if (foundRegion) {
+      regionAndOrigin = { value: foundRegion, origin: `${bold(`[profile ${profileAndOrigin.value}]`)} in config file` };
+    }
+  }
+  return { credentialsAndOrigin, regionAndOrigin, profileAndOrigin };
+};
+var printVerboseCredentialsProfileRegion = ({
+  credentialsAndOrigin,
+  regionAndOrigin,
+  profileAndOrigin
+}) => {
+  const out = [];
+  if (profileAndOrigin) {
+    out.push(`Got profile name from ${profileAndOrigin.origin}`);
+  }
+  if (credentialsAndOrigin) {
+    out.push(`Resolved credentials from ${credentialsAndOrigin.origin}`);
+  }
+  if (regionAndOrigin) {
+    out.push(`Resolved region from ${regionAndOrigin.origin}`);
+  }
+  return out.join("\n");
+};
+
+// src/lib/partial-commands/handleCredentialsAndRegion.ts
+var handleCredentialsAndRegion = async ({
+  argv,
+  env
+}) => {
+  const { credentialsAndOrigin, regionAndOrigin } = await getCredentialsProfileRegion({
+    argv: { region: argv.awsRegion, profile: argv.awsProfile },
+    env: __spreadValues({}, env)
+  });
+  if (argv.verbose === true) {
+    console.log(printVerboseCredentialsProfileRegion({ credentialsAndOrigin, regionAndOrigin }));
+  }
+  if (!credentialsAndOrigin || !regionAndOrigin) {
+    if (!credentialsAndOrigin) {
+      console.error("Could not find credentials");
+      throw new Error("Could not find credentials");
+    }
+    if (!regionAndOrigin) {
+      console.error("Could not find region");
+      throw new Error("Could not find region");
+    }
+  }
+  return { credentialsAndOrigin, regionAndOrigin };
+};
+
+// src/utils/io.ts
+var import_promises = __toModule(require("fs/promises"));
+var fileExists = async (source) => {
+  try {
+    await (0, import_promises.stat)(source);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// src/commands/decryptSecCommand.ts
+var command = "decrypt-sec";
+var desc = "Decrypts a dotsec file";
+var builder = {
+  "aws-profile": __spreadValues({}, commonCliOptions.awsProfile),
+  "aws-region": __spreadValues({}, commonCliOptions.awsRegion),
+  "aws-key-alias": { string: true, default: "alias/top-secret" },
+  "env-file": {
+    string: true,
+    describe: ".env file",
+    default: ".env"
+  },
+  "sec-file": {
+    string: true,
+    describe: ".sec file",
+    default: ".sec"
+  },
+  verbose: __spreadValues({}, commonCliOptions.verbose),
+  yes: __spreadValues({}, commonCliOptions.yes)
+};
+var handler = async (argv) => {
+  try {
+    const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: __spreadValues({}, argv), env: __spreadValues({}, process.env) });
+    const secSource = import_node_path.default.resolve(process.cwd(), argv.secFile);
+    if (!await fileExists(secSource)) {
+      console.error(`Could not open ${(0, import_chalk2.redBright)(secSource)}`);
+      return;
+    }
+    const parsedSec = (0, import_dotenv.parse)(import_node_fs.default.readFileSync(secSource, { encoding: "utf8" }));
+    const kmsClient = new import_client_kms.KMSClient({
+      credentials: credentialsAndOrigin.value,
+      region: regionAndOrigin.value
+    });
+    const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
+      const decryptCommand = new import_client_kms.DecryptCommand({
+        KeyId: argv.awsKeyAlias,
+        CiphertextBlob: Buffer.from(cipherText, "base64"),
+        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      });
+      const decryptionResult = await kmsClient.send(decryptCommand);
+      if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
+        throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);
+      }
+      const value = Buffer.from(decryptionResult.Plaintext).toString();
+      return [key, value];
+    }));
+    import_node_fs.default.writeFileSync(import_node_path.default.resolve(process.cwd(), argv.envFile || ".env"), envEntries.map(([key, value]) => `${key}="${value}"`).join("\n"));
+  } catch (e) {
+    console.error(e);
+  }
+};
+
+// src/commands/defaultCommand.ts
+var defaultCommand_exports = {};
+__export(defaultCommand_exports, {
+  builder: () => builder2,
+  command: () => command2,
+  desc: () => desc2,
+  handler: () => handler2
+});
+var import_client_kms2 = __toModule(require("@aws-sdk/client-kms"));
+var import_chalk3 = __toModule(require("chalk"));
+var import_cross_spawn = __toModule(require("cross-spawn"));
+var import_dotenv2 = __toModule(require("dotenv"));
+var import_node_fs2 = __toModule(require("node:fs"));
+var import_node_path2 = __toModule(require("node:path"));
+var command2 = "$0 <command>";
+var desc2 = "Decrypts a .sec file, injects the results into a separate process and runs a command";
+var builder2 = {
+  "aws-profile": __spreadValues({}, commonCliOptions.awsProfile),
+  "aws-region": __spreadValues({}, commonCliOptions.awsRegion),
+  "aws-key-alias": { string: true, default: "alias/top-secret" },
+  "sec-file": {
+    string: true,
+    describe: ".sec file",
+    default: ".sec"
+  },
+  verbose: __spreadValues({}, commonCliOptions.verbose),
+  yes: __spreadValues({}, commonCliOptions.yes),
+  command: { string: true, required: true }
+};
+var handler2 = async (argv) => {
+  try {
+    const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: __spreadValues({}, argv), env: __spreadValues({}, process.env) });
+    const secSource = import_node_path2.default.resolve(process.cwd(), argv.secFile);
+    if (!await fileExists(secSource)) {
+      console.error(`Could not open ${(0, import_chalk3.redBright)(secSource)}`);
+      return;
+    }
+    const parsedSec = (0, import_dotenv2.parse)(import_node_fs2.default.readFileSync(secSource, { encoding: "utf8" }));
+    const kmsClient = new import_client_kms2.KMSClient({
+      credentials: credentialsAndOrigin.value,
+      region: regionAndOrigin.value
+    });
+    const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
+      const decryptCommand = new import_client_kms2.DecryptCommand({
+        KeyId: argv.awsKeyAlias,
+        CiphertextBlob: Buffer.from(cipherText, "base64"),
+        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      });
+      const decryptionResult = await kmsClient.send(decryptCommand);
+      if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
+        throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);
+      }
+      const value = Buffer.from(decryptionResult.Plaintext).toString();
+      return [key, value];
+    }));
+    const env = Object.fromEntries(envEntries);
+    const userCommandArgs = process.argv.slice(process.argv.indexOf(argv.command) + 1);
+    if (argv.command) {
+      (0, import_cross_spawn.spawn)(argv.command, [...userCommandArgs], {
+        stdio: "inherit",
+        shell: false,
+        env: __spreadValues(__spreadValues({}, process.env), env)
+      });
+    }
+  } catch (e) {
+    console.error(e);
+  }
+};
+
+// src/commands/encryptEnvCommand.ts
+var encryptEnvCommand_exports = {};
+__export(encryptEnvCommand_exports, {
+  builder: () => builder3,
+  command: () => command3,
+  desc: () => desc3,
+  handler: () => handler3
+});
+var import_client_kms3 = __toModule(require("@aws-sdk/client-kms"));
+var import_chalk4 = __toModule(require("chalk"));
+var import_dotenv3 = __toModule(require("dotenv"));
+var import_node_fs3 = __toModule(require("node:fs"));
+var import_node_path3 = __toModule(require("node:path"));
+var command3 = "encrypt-env";
+var desc3 = "Encrypts a dotenv file";
+var builder3 = {
+  "aws-profile": __spreadValues({}, commonCliOptions.awsProfile),
+  "aws-region": __spreadValues({}, commonCliOptions.awsRegion),
+  "aws-key-alias": { string: true, default: "alias/top-secret" },
+  "env-file": {
+    string: true,
+    describe: ".env file",
+    default: ".env"
+  },
+  "sec-file": {
+    string: true,
+    describe: ".sec file",
+    default: ".sec"
+  },
+  verbose: __spreadValues({}, commonCliOptions.verbose),
+  yes: __spreadValues({}, commonCliOptions.yes)
+};
+var handler3 = async (argv) => {
+  try {
+    const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: __spreadValues({}, argv), env: __spreadValues({}, process.env) });
+    const envSource = import_node_path3.default.resolve(process.cwd(), argv.envFile);
+    if (!await fileExists(envSource)) {
+      console.error(`Could not open ${(0, import_chalk4.redBright)(envSource)}`);
+      return;
+    }
+    const parsedEnv = (0, import_dotenv3.parse)(import_node_fs3.default.readFileSync(envSource, { encoding: "utf8" }));
+    const kmsClient = new import_client_kms3.KMSClient({
+      credentials: credentialsAndOrigin.value,
+      region: regionAndOrigin.value
+    });
+    const sec = (await Promise.all(Object.entries(parsedEnv).map(async ([key, value]) => {
+      const encryptCommand = new import_client_kms3.EncryptCommand({
+        KeyId: argv.awsKeyAlias,
+        Plaintext: Buffer.from(value),
+        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      });
+      const encryptionResult = await kmsClient.send(encryptCommand);
+      if (!encryptionResult.CiphertextBlob) {
+        throw new Error(`No: ${JSON.stringify({ key, value, encryptCommand })}`);
+      }
+      const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
+      return `${key}="${cipherText}"`;
+    }))).join("\n");
+    import_node_fs3.default.writeFileSync(import_node_path3.default.resolve(process.cwd(), argv.secFile), sec);
+  } catch (e) {
+    console.error(e);
+  }
+};
+
+// src/cli.ts
+void (0, import_yargs.default)((0, import_helpers.hideBin)(process.argv)).command(defaultCommand_exports).command(encryptEnvCommand_exports).command(decryptSecCommand_exports).parse();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/cli.ts", "../src/commands/decryptSecCommand.ts", "../src/commonCliOptions.ts", "../src/utils/getCredentialsProfileRegion.ts", "../src/utils/logger.ts", "../src/lib/partial-commands/handleCredentialsAndRegion.ts", "../src/utils/io.ts", "../src/commands/defaultCommand.ts", "../src/commands/encryptEnvCommand.ts"],
+  "sourcesContent": ["/* eslint-disable @typescript-eslint/no-shadow */\nimport { hideBin } from 'yargs/helpers';\nimport yargs from 'yargs/yargs';\n\n// import * as createAwsKey from './commands/createAwsKey';\nimport * as decryptSecCommand from './commands/decryptSecCommand';\nimport * as defaultCommmand from './commands/defaultCommand';\n// import * as deleteAwsKey from './commands/deleteAwsKey';\nimport * as encryptEnvCommand from './commands/encryptEnvCommand';\n\nvoid yargs(hideBin(process.argv))\n    .command(defaultCommmand)\n    .command(encryptEnvCommand)\n    .command(decryptSecCommand)\n    // .command(createAwsKey)\n    // .command(deleteAwsKey)\n    .parse();\n", "import { KMSClient, DecryptCommand } from '@aws-sdk/client-kms';\nimport { redBright } from 'chalk';\nimport { parse } from 'dotenv';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { commonCliOptions } from '../commonCliOptions';\nimport { handleCredentialsAndRegion } from '../lib/partial-commands/handleCredentialsAndRegion';\nimport { YargsHandlerParams } from '../types';\nimport { fileExists } from '../utils/io';\n\nexport const command = 'decrypt-sec';\nexport const desc = 'Decrypts a dotsec file';\n\nexport const builder = {\n    'aws-profile': {\n        ...commonCliOptions.awsProfile,\n    },\n    'aws-region': {\n        ...commonCliOptions.awsRegion,\n    },\n    'aws-key-alias': { string: true, default: 'alias/top-secret' },\n    'env-file': {\n        string: true,\n        describe: '.env file',\n        default: '.env',\n    },\n    'sec-file': {\n        string: true,\n        describe: '.sec file',\n        default: '.sec',\n    },\n    verbose: { ...commonCliOptions.verbose },\n    yes: { ...commonCliOptions.yes },\n} as const;\n\nexport const handler = async (argv: YargsHandlerParams<typeof builder>): Promise<void> => {\n    try {\n        const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: { ...argv }, env: { ...process.env } });\n\n        const secSource = path.resolve(process.cwd(), argv.secFile);\n        if (!(await fileExists(secSource))) {\n            console.error(`Could not open ${redBright(secSource)}`);\n            return;\n        }\n        const parsedSec = parse(fs.readFileSync(secSource, { encoding: 'utf8' }));\n\n        const kmsClient = new KMSClient({\n            credentials: credentialsAndOrigin.value,\n            region: regionAndOrigin.value,\n        });\n\n        const envEntries: [string, string][] = await Promise.all(\n            Object.entries(parsedSec).map(async ([key, cipherText]) => {\n                const decryptCommand = new DecryptCommand({\n                    KeyId: argv.awsKeyAlias,\n                    CiphertextBlob: Buffer.from(cipherText, 'base64'),\n                    EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n                });\n                const decryptionResult = await kmsClient.send(decryptCommand);\n\n                if (!decryptionResult?.Plaintext) {\n                    throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);\n                }\n                const value = Buffer.from(decryptionResult.Plaintext).toString();\n                return [key, value];\n            }),\n        );\n        fs.writeFileSync(path.resolve(process.cwd(), argv.envFile || '.env'), envEntries.map(([key, value]) => `${key}=\"${value}\"`).join('\\n'));\n    } catch (e) {\n        console.error(e);\n    }\n};\n", "// import regions from 'aws-regions/regions.json';\n\nexport const commonCliOptions = {\n    awsProfile: {\n        string: true,\n        describe: 'AWS profile',\n    },\n    awsRegion: {\n        string: true,\n        describe: 'AWS region',\n    },\n    awsKeyAlias: {\n        string: true,\n        describe: 'AWS KMS asymmetric key alias',\n    },\n    awsKey: {\n        string: true,\n        describe: 'AWS KMS asymmetric key arn',\n    },\n\n    verbose: {\n        boolean: true,\n        describe: 'Be verbose',\n    },\n    // regions: {\n    //     describe: 'AWS region',\n    //     array: true,\n    //     choices: regions.map(({ code }) => code),\n    // },\n    // baseRegion: {\n    //     describe: 'AWS region where to store encyption secrets. This is also the same region where *you* should deploy the Top Secret! stack.',\n    //     choices: regions.map(({ code }) => code),\n    // },\n    yes: {\n        boolean: true,\n        describe: 'Proceeds without confirmation',\n    },\n    dryRun: {\n        boolean: true,\n        describe: 'Do a dry run',\n    },\n} as const;\n", "import { fromEnv, fromIni } from '@aws-sdk/credential-providers';\nimport { loadSharedConfigFiles } from '@aws-sdk/shared-ini-file-loader';\n\nimport { CredentialsAndOrigin, ProfileAndOrigin, RegionAndOrigin } from '../types';\nimport { bold, underline } from './logger';\n\nexport const getCredentialsProfileRegion = async ({\n    argv,\n    env,\n}: {\n    argv: { profile?: string; region?: string };\n    env: {\n        AWS_PROFILE?: string;\n        AWS_ACCESS_KEY_ID?: string;\n        AWS_SECRET_ACCESS_KEY?: string;\n        AWS_REGION?: string;\n        AWS_DEFAULT_REGION?: string;\n        TZ?: string;\n    };\n}) => {\n    const sharedConfigFiles = await loadSharedConfigFiles();\n    let credentialsAndOrigin: CredentialsAndOrigin | undefined = undefined;\n    let profileAndOrigin: ProfileAndOrigin | undefined = undefined;\n    let regionAndOrigin: RegionAndOrigin | undefined = undefined;\n\n    if (argv.profile) {\n        profileAndOrigin = { value: argv.profile, origin: `command line option: ${bold(argv.profile)}` };\n        credentialsAndOrigin = { value: await fromIni({ profile: argv.profile })(), origin: `${bold(`[${argv.profile}]`)} in credentials file` };\n    } else if (env.AWS_PROFILE) {\n        profileAndOrigin = { value: env.AWS_PROFILE, origin: `env variable ${bold('AWS_PROFILE')}: ${underline(env.AWS_PROFILE)}` };\n        credentialsAndOrigin = {\n            value: await fromIni({ profile: env.AWS_PROFILE })(),\n            origin: `env variable ${underline('AWS_PROFILE')}: ${bold(env.AWS_PROFILE)}`,\n        };\n    } else if (env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) {\n        credentialsAndOrigin = {\n            value: await fromEnv()(),\n            origin: `env variables ${bold('AWS_ACCESS_KEY_ID')} and ${bold('AWS_SECRET_ACCESS_KEY')}`,\n        };\n    } else if (sharedConfigFiles.credentialsFile?.default) {\n        profileAndOrigin = { value: 'default', origin: `${bold('[default]')} in credentials file` };\n        credentialsAndOrigin = { value: await fromIni({ profile: 'default' })(), origin: `profile ${bold('[default]')}` };\n    }\n\n    if (argv.region) {\n        regionAndOrigin = { value: argv.region, origin: `command line option: ${bold(argv.region)}` };\n    } else if (env.AWS_REGION) {\n        regionAndOrigin = { value: env.AWS_REGION, origin: `env variable ${bold('AWS_REGION')}: ${underline(env.AWS_REGION)}` };\n    } else if (env.AWS_DEFAULT_REGION) {\n        regionAndOrigin = {\n            value: env.AWS_DEFAULT_REGION,\n            origin: `env variable ${bold('AWS_DEFAULT_REGION')}: ${underline(env.AWS_DEFAULT_REGION)}`,\n        };\n    } else if (profileAndOrigin) {\n        const foundRegion = sharedConfigFiles?.configFile?.[profileAndOrigin.value]?.region;\n\n        if (foundRegion) {\n            regionAndOrigin = { value: foundRegion, origin: `${bold(`[profile ${profileAndOrigin.value}]`)} in config file` };\n        }\n    }\n\n    return { credentialsAndOrigin, regionAndOrigin, profileAndOrigin };\n};\n\nexport const printVerboseCredentialsProfileRegion = ({\n    credentialsAndOrigin,\n    regionAndOrigin,\n    profileAndOrigin,\n}: {\n    credentialsAndOrigin?: CredentialsAndOrigin;\n    regionAndOrigin?: RegionAndOrigin;\n    profileAndOrigin?: ProfileAndOrigin;\n}): string => {\n    const out: string[] = [];\n    if (profileAndOrigin) {\n        out.push(`Got profile name from ${profileAndOrigin.origin}`);\n    }\n    if (credentialsAndOrigin) {\n        out.push(`Resolved credentials from ${credentialsAndOrigin.origin}`);\n    }\n    if (regionAndOrigin) {\n        out.push(`Resolved region from ${regionAndOrigin.origin}`);\n    }\n    return out.join('\\n');\n};\n", "import chalk from 'chalk';\n// eslint-disable-next-line @typescript-eslint/naming-convention\nlet _logger: Pick<Console, 'info' | 'error'>;\n\nexport const getLogger = () => {\n    if (!_logger) {\n        return console;\n    }\n\n    return _logger;\n};\n\nexport const bold = (str: string): string => chalk.yellowBright.bold(str);\nexport const underline = (str: string): string => chalk.cyanBright.bold(str);\n", "import { getCredentialsProfileRegion, printVerboseCredentialsProfileRegion } from '../../utils/getCredentialsProfileRegion';\n\nexport const handleCredentialsAndRegion = async ({\n    argv,\n    env,\n}: {\n    argv: { awsRegion?: string; awsProfile?: string; verbose?: boolean };\n    env: {\n        AWS_PROFILE?: string | undefined;\n        AWS_ACCESS_KEY_ID?: string | undefined;\n        AWS_SECRET_ACCESS_KEY?: string | undefined;\n        AWS_REGION?: string | undefined;\n        AWS_DEFAULT_REGION?: string | undefined;\n        TZ?: string;\n    };\n}) => {\n    const { credentialsAndOrigin, regionAndOrigin } = await getCredentialsProfileRegion({\n        argv: { region: argv.awsRegion, profile: argv.awsProfile },\n        env: {\n            ...env,\n        },\n    });\n\n    if (argv.verbose === true) {\n        console.log(printVerboseCredentialsProfileRegion({ credentialsAndOrigin, regionAndOrigin }));\n    }\n\n    if (!credentialsAndOrigin || !regionAndOrigin) {\n        if (!credentialsAndOrigin) {\n            console.error('Could not find credentials');\n            throw new Error('Could not find credentials');\n        }\n        if (!regionAndOrigin) {\n            console.error('Could not find region');\n            throw new Error('Could not find region');\n        }\n    }\n\n    return { credentialsAndOrigin, regionAndOrigin };\n};\n", "import { stat } from 'fs/promises';\n\nexport const fileExists = async (source: string): Promise<boolean> => {\n    try {\n        await stat(source);\n        return true;\n    } catch {\n        return false;\n    }\n};\n", "import { KMSClient, DecryptCommand } from '@aws-sdk/client-kms';\nimport { redBright } from 'chalk';\nimport { spawn } from 'cross-spawn';\nimport { parse } from 'dotenv';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { commonCliOptions } from '../commonCliOptions';\nimport { handleCredentialsAndRegion } from '../lib/partial-commands/handleCredentialsAndRegion';\nimport { YargsHandlerParams } from '../types';\nimport { fileExists } from '../utils/io';\n\nexport const command = '$0 <command>';\nexport const desc = 'Decrypts a .sec file, injects the results into a separate process and runs a command';\n\nexport const builder = {\n    'aws-profile': {\n        ...commonCliOptions.awsProfile,\n    },\n    'aws-region': {\n        ...commonCliOptions.awsRegion,\n    },\n    'aws-key-alias': { string: true, default: 'alias/top-secret' },\n    'sec-file': {\n        string: true,\n        describe: '.sec file',\n        default: '.sec',\n    },\n    verbose: { ...commonCliOptions.verbose },\n    yes: { ...commonCliOptions.yes },\n    command: { string: true, required: true },\n} as const;\n\nexport const handler = async (argv: YargsHandlerParams<typeof builder>): Promise<void> => {\n    try {\n        const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: { ...argv }, env: { ...process.env } });\n\n        const secSource = path.resolve(process.cwd(), argv.secFile);\n        if (!(await fileExists(secSource))) {\n            console.error(`Could not open ${redBright(secSource)}`);\n            return;\n        }\n        const parsedSec = parse(fs.readFileSync(secSource, { encoding: 'utf8' }));\n\n        const kmsClient = new KMSClient({\n            credentials: credentialsAndOrigin.value,\n            region: regionAndOrigin.value,\n        });\n\n        const envEntries: [string, string][] = await Promise.all(\n            Object.entries(parsedSec).map(async ([key, cipherText]) => {\n                const decryptCommand = new DecryptCommand({\n                    KeyId: argv.awsKeyAlias,\n                    CiphertextBlob: Buffer.from(cipherText, 'base64'),\n                    EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n                });\n                const decryptionResult = await kmsClient.send(decryptCommand);\n\n                if (!decryptionResult?.Plaintext) {\n                    throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);\n                }\n                const value = Buffer.from(decryptionResult.Plaintext).toString();\n                return [key, value];\n            }),\n        );\n        const env = Object.fromEntries(envEntries);\n        // console.log(env);\n\n        const userCommandArgs = process.argv.slice(process.argv.indexOf(argv.command) + 1);\n        // console.info({ userCommandArgs });\n\n        // console.info(argv.command);\n        if (argv.command) {\n            spawn(argv.command, [...userCommandArgs], {\n                stdio: 'inherit',\n                shell: false,\n                env: { ...process.env, ...env },\n            });\n        }\n    } catch (e) {\n        console.error(e);\n    }\n};\n", "import { KMSClient, EncryptCommand } from '@aws-sdk/client-kms';\nimport { redBright } from 'chalk';\nimport { parse } from 'dotenv';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { commonCliOptions } from '../commonCliOptions';\nimport { handleCredentialsAndRegion } from '../lib/partial-commands/handleCredentialsAndRegion';\nimport { YargsHandlerParams } from '../types';\nimport { fileExists } from '../utils/io';\n\nexport const command = 'encrypt-env';\nexport const desc = 'Encrypts a dotenv file';\n\nexport const builder = {\n    'aws-profile': {\n        ...commonCliOptions.awsProfile,\n    },\n    'aws-region': {\n        ...commonCliOptions.awsRegion,\n    },\n    'aws-key-alias': { string: true, default: 'alias/top-secret' },\n    'env-file': {\n        string: true,\n        describe: '.env file',\n        default: '.env',\n    },\n    'sec-file': {\n        string: true,\n        describe: '.sec file',\n        default: '.sec',\n    },\n    verbose: { ...commonCliOptions.verbose },\n    yes: { ...commonCliOptions.yes },\n} as const;\n\nexport const handler = async (argv: YargsHandlerParams<typeof builder>): Promise<void> => {\n    try {\n        const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: { ...argv }, env: { ...process.env } });\n\n        const envSource = path.resolve(process.cwd(), argv.envFile);\n        if (!(await fileExists(envSource))) {\n            console.error(`Could not open ${redBright(envSource)}`);\n            return;\n        }\n        const parsedEnv = parse(fs.readFileSync(envSource, { encoding: 'utf8' }));\n\n        const kmsClient = new KMSClient({\n            credentials: credentialsAndOrigin.value,\n            region: regionAndOrigin.value,\n        });\n\n        const sec = (\n            await Promise.all(\n                Object.entries(parsedEnv).map(async ([key, value]) => {\n                    const encryptCommand = new EncryptCommand({\n                        KeyId: argv.awsKeyAlias,\n                        Plaintext: Buffer.from(value),\n                        EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n                    });\n                    const encryptionResult = await kmsClient.send(encryptCommand);\n\n                    if (!encryptionResult.CiphertextBlob) {\n                        throw new Error(`No: ${JSON.stringify({ key, value, encryptCommand })}`);\n                    }\n\n                    const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString('base64');\n                    return `${key}=\"${cipherText}\"`;\n                }),\n            )\n        ).join('\\n');\n\n        // console.log(sec);\n\n        fs.writeFileSync(path.resolve(process.cwd(), argv.secFile), sec);\n    } catch (e) {\n        console.error(e);\n    }\n};\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,qBAAwB;AACxB,mBAAkB;;;ACFlB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAA0C;AAC1C,oBAA0B;AAC1B,oBAAsB;AACtB,qBAAe;AACf,uBAAiB;;;ACFV,IAAM,mBAAmB;AAAA,EAC5B,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAEd,WAAW;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAEd,aAAa;AAAA,IACT,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAEd,QAAQ;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAGd,SAAS;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA;AAAA,EAWd,KAAK;AAAA,IACD,SAAS;AAAA,IACT,UAAU;AAAA;AAAA,EAEd,QAAQ;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA;AAAA;;;ACvClB,kCAAiC;AACjC,oCAAsC;;;ACDtC,mBAAkB;AAYX,IAAM,OAAO,CAAC,QAAwB,qBAAM,aAAa,KAAK;AAC9D,IAAM,YAAY,CAAC,QAAwB,qBAAM,WAAW,KAAK;;;ADPjE,IAAM,8BAA8B,OAAO;AAAA,EAC9C;AAAA,EACA;AAAA,MAWE;AAnBN;AAoBI,QAAM,oBAAoB,MAAM;AAChC,MAAI,uBAAyD;AAC7D,MAAI,mBAAiD;AACrD,MAAI,kBAA+C;AAEnD,MAAI,KAAK,SAAS;AACd,uBAAmB,EAAE,OAAO,KAAK,SAAS,QAAQ,wBAAwB,KAAK,KAAK;AACpF,2BAAuB,EAAE,OAAO,MAAM,yCAAQ,EAAE,SAAS,KAAK,cAAc,QAAQ,GAAG,KAAK,IAAI,KAAK;AAAA,aAC9F,IAAI,aAAa;AACxB,uBAAmB,EAAE,OAAO,IAAI,aAAa,QAAQ,gBAAgB,KAAK,mBAAmB,UAAU,IAAI;AAC3G,2BAAuB;AAAA,MACnB,OAAO,MAAM,yCAAQ,EAAE,SAAS,IAAI;AAAA,MACpC,QAAQ,gBAAgB,UAAU,mBAAmB,KAAK,IAAI;AAAA;AAAA,aAE3D,IAAI,qBAAqB,IAAI,uBAAuB;AAC3D,2BAAuB;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,QAAQ,iBAAiB,KAAK,4BAA4B,KAAK;AAAA;AAAA,aAE5D,wBAAkB,oBAAlB,mBAAmC,SAAS;AACnD,uBAAmB,EAAE,OAAO,WAAW,QAAQ,GAAG,KAAK;AACvD,2BAAuB,EAAE,OAAO,MAAM,yCAAQ,EAAE,SAAS,gBAAgB,QAAQ,WAAW,KAAK;AAAA;AAGrG,MAAI,KAAK,QAAQ;AACb,sBAAkB,EAAE,OAAO,KAAK,QAAQ,QAAQ,wBAAwB,KAAK,KAAK;AAAA,aAC3E,IAAI,YAAY;AACvB,sBAAkB,EAAE,OAAO,IAAI,YAAY,QAAQ,gBAAgB,KAAK,kBAAkB,UAAU,IAAI;AAAA,aACjG,IAAI,oBAAoB;AAC/B,sBAAkB;AAAA,MACd,OAAO,IAAI;AAAA,MACX,QAAQ,gBAAgB,KAAK,0BAA0B,UAAU,IAAI;AAAA;AAAA,aAElE,kBAAkB;AACzB,UAAM,cAAc,mEAAmB,eAAnB,mBAAgC,iBAAiB,WAAjD,mBAAyD;AAE7E,QAAI,aAAa;AACb,wBAAkB,EAAE,OAAO,aAAa,QAAQ,GAAG,KAAK,YAAY,iBAAiB;AAAA;AAAA;AAI7F,SAAO,EAAE,sBAAsB,iBAAiB;AAAA;AAG7C,IAAM,uCAAuC,CAAC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,MAKU;AACV,QAAM,MAAgB;AACtB,MAAI,kBAAkB;AAClB,QAAI,KAAK,yBAAyB,iBAAiB;AAAA;AAEvD,MAAI,sBAAsB;AACtB,QAAI,KAAK,6BAA6B,qBAAqB;AAAA;AAE/D,MAAI,iBAAiB;AACjB,QAAI,KAAK,wBAAwB,gBAAgB;AAAA;AAErD,SAAO,IAAI,KAAK;AAAA;;;AEjFb,IAAM,6BAA6B,OAAO;AAAA,EAC7C;AAAA,EACA;AAAA,MAWE;AACF,QAAM,EAAE,sBAAsB,oBAAoB,MAAM,4BAA4B;AAAA,IAChF,MAAM,EAAE,QAAQ,KAAK,WAAW,SAAS,KAAK;AAAA,IAC9C,KAAK,mBACE;AAAA;AAIX,MAAI,KAAK,YAAY,MAAM;AACvB,YAAQ,IAAI,qCAAqC,EAAE,sBAAsB;AAAA;AAG7E,MAAI,CAAC,wBAAwB,CAAC,iBAAiB;AAC3C,QAAI,CAAC,sBAAsB;AACvB,cAAQ,MAAM;AACd,YAAM,IAAI,MAAM;AAAA;AAEpB,QAAI,CAAC,iBAAiB;AAClB,cAAQ,MAAM;AACd,YAAM,IAAI,MAAM;AAAA;AAAA;AAIxB,SAAO,EAAE,sBAAsB;AAAA;;;ACtCnC,sBAAqB;AAEd,IAAM,aAAa,OAAO,WAAqC;AAClE,MAAI;AACA,UAAM,0BAAK;AACX,WAAO;AAAA,UACT;AACE,WAAO;AAAA;AAAA;;;ALIR,IAAM,UAAU;AAChB,IAAM,OAAO;AAEb,IAAM,UAAU;AAAA,EACnB,eAAe,mBACR,iBAAiB;AAAA,EAExB,cAAc,mBACP,iBAAiB;AAAA,EAExB,iBAAiB,EAAE,QAAQ,MAAM,SAAS;AAAA,EAC1C,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,SAAS,mBAAK,iBAAiB;AAAA,EAC/B,KAAK,mBAAK,iBAAiB;AAAA;AAGxB,IAAM,UAAU,OAAO,SAA4D;AACtF,MAAI;AACA,UAAM,EAAE,sBAAsB,oBAAoB,MAAM,2BAA2B,EAAE,MAAM,mBAAK,OAAQ,KAAK,mBAAK,QAAQ;AAE1H,UAAM,YAAY,yBAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,QAAI,CAAE,MAAM,WAAW,YAAa;AAChC,cAAQ,MAAM,kBAAkB,6BAAU;AAC1C;AAAA;AAEJ,UAAM,YAAY,yBAAM,uBAAG,aAAa,WAAW,EAAE,UAAU;AAE/D,UAAM,YAAY,IAAI,4BAAU;AAAA,MAC5B,aAAa,qBAAqB;AAAA,MAClC,QAAQ,gBAAgB;AAAA;AAG5B,UAAM,aAAiC,MAAM,QAAQ,IACjD,OAAO,QAAQ,WAAW,IAAI,OAAO,CAAC,KAAK,gBAAgB;AACvD,YAAM,iBAAiB,IAAI,iCAAe;AAAA,QACtC,OAAO,KAAK;AAAA,QACZ,gBAAgB,OAAO,KAAK,YAAY;AAAA,QACxC,qBAAqB;AAAA;AAEzB,YAAM,mBAAmB,MAAM,UAAU,KAAK;AAE9C,UAAI,CAAC,sDAAkB,YAAW;AAC9B,cAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,KAAK,YAAY;AAAA;AAE7D,YAAM,QAAQ,OAAO,KAAK,iBAAiB,WAAW;AACtD,aAAO,CAAC,KAAK;AAAA;AAGrB,2BAAG,cAAc,yBAAK,QAAQ,QAAQ,OAAO,KAAK,WAAW,SAAS,WAAW,IAAI,CAAC,CAAC,KAAK,WAAW,GAAG,QAAQ,UAAU,KAAK;AAAA,WAC5H,GAAP;AACE,YAAQ,MAAM;AAAA;AAAA;;;AMtEtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA0C;AAC1C,oBAA0B;AAC1B,yBAAsB;AACtB,qBAAsB;AACtB,sBAAe;AACf,wBAAiB;AAOV,IAAM,WAAU;AAChB,IAAM,QAAO;AAEb,IAAM,WAAU;AAAA,EACnB,eAAe,mBACR,iBAAiB;AAAA,EAExB,cAAc,mBACP,iBAAiB;AAAA,EAExB,iBAAiB,EAAE,QAAQ,MAAM,SAAS;AAAA,EAC1C,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,SAAS,mBAAK,iBAAiB;AAAA,EAC/B,KAAK,mBAAK,iBAAiB;AAAA,EAC3B,SAAS,EAAE,QAAQ,MAAM,UAAU;AAAA;AAGhC,IAAM,WAAU,OAAO,SAA4D;AACtF,MAAI;AACA,UAAM,EAAE,sBAAsB,oBAAoB,MAAM,2BAA2B,EAAE,MAAM,mBAAK,OAAQ,KAAK,mBAAK,QAAQ;AAE1H,UAAM,YAAY,0BAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,QAAI,CAAE,MAAM,WAAW,YAAa;AAChC,cAAQ,MAAM,kBAAkB,6BAAU;AAC1C;AAAA;AAEJ,UAAM,YAAY,0BAAM,wBAAG,aAAa,WAAW,EAAE,UAAU;AAE/D,UAAM,YAAY,IAAI,6BAAU;AAAA,MAC5B,aAAa,qBAAqB;AAAA,MAClC,QAAQ,gBAAgB;AAAA;AAG5B,UAAM,aAAiC,MAAM,QAAQ,IACjD,OAAO,QAAQ,WAAW,IAAI,OAAO,CAAC,KAAK,gBAAgB;AACvD,YAAM,iBAAiB,IAAI,kCAAe;AAAA,QACtC,OAAO,KAAK;AAAA,QACZ,gBAAgB,OAAO,KAAK,YAAY;AAAA,QACxC,qBAAqB;AAAA;AAEzB,YAAM,mBAAmB,MAAM,UAAU,KAAK;AAE9C,UAAI,CAAC,sDAAkB,YAAW;AAC9B,cAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,KAAK,YAAY;AAAA;AAE7D,YAAM,QAAQ,OAAO,KAAK,iBAAiB,WAAW;AACtD,aAAO,CAAC,KAAK;AAAA;AAGrB,UAAM,MAAM,OAAO,YAAY;AAG/B,UAAM,kBAAkB,QAAQ,KAAK,MAAM,QAAQ,KAAK,QAAQ,KAAK,WAAW;AAIhF,QAAI,KAAK,SAAS;AACd,oCAAM,KAAK,SAAS,CAAC,GAAG,kBAAkB;AAAA,QACtC,OAAO;AAAA,QACP,OAAO;AAAA,QACP,KAAK,kCAAK,QAAQ,MAAQ;AAAA;AAAA;AAAA,WAG7B,GAAP;AACE,YAAQ,MAAM;AAAA;AAAA;;;AChFtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA0C;AAC1C,oBAA0B;AAC1B,qBAAsB;AACtB,sBAAe;AACf,wBAAiB;AAOV,IAAM,WAAU;AAChB,IAAM,QAAO;AAEb,IAAM,WAAU;AAAA,EACnB,eAAe,mBACR,iBAAiB;AAAA,EAExB,cAAc,mBACP,iBAAiB;AAAA,EAExB,iBAAiB,EAAE,QAAQ,MAAM,SAAS;AAAA,EAC1C,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,SAAS,mBAAK,iBAAiB;AAAA,EAC/B,KAAK,mBAAK,iBAAiB;AAAA;AAGxB,IAAM,WAAU,OAAO,SAA4D;AACtF,MAAI;AACA,UAAM,EAAE,sBAAsB,oBAAoB,MAAM,2BAA2B,EAAE,MAAM,mBAAK,OAAQ,KAAK,mBAAK,QAAQ;AAE1H,UAAM,YAAY,0BAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,QAAI,CAAE,MAAM,WAAW,YAAa;AAChC,cAAQ,MAAM,kBAAkB,6BAAU;AAC1C;AAAA;AAEJ,UAAM,YAAY,0BAAM,wBAAG,aAAa,WAAW,EAAE,UAAU;AAE/D,UAAM,YAAY,IAAI,6BAAU;AAAA,MAC5B,aAAa,qBAAqB;AAAA,MAClC,QAAQ,gBAAgB;AAAA;AAG5B,UAAM,MACF,OAAM,QAAQ,IACV,OAAO,QAAQ,WAAW,IAAI,OAAO,CAAC,KAAK,WAAW;AAClD,YAAM,iBAAiB,IAAI,kCAAe;AAAA,QACtC,OAAO,KAAK;AAAA,QACZ,WAAW,OAAO,KAAK;AAAA,QACvB,qBAAqB;AAAA;AAEzB,YAAM,mBAAmB,MAAM,UAAU,KAAK;AAE9C,UAAI,CAAC,iBAAiB,gBAAgB;AAClC,cAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,KAAK,OAAO;AAAA;AAGxD,YAAM,aAAa,OAAO,KAAK,iBAAiB,gBAAgB,SAAS;AACzE,aAAO,GAAG,QAAQ;AAAA,SAG5B,KAAK;AAIP,4BAAG,cAAc,0BAAK,QAAQ,QAAQ,OAAO,KAAK,UAAU;AAAA,WACvD,GAAP;AACE,YAAQ,MAAM;AAAA;AAAA;;;ARlEtB,KAAK,0BAAM,4BAAQ,QAAQ,OACtB,QAAQ,wBACR,QAAQ,2BACR,QAAQ,2BAGR;",
+  "names": []
+}

package/dist/esm/cli.js

@@ -0,0 +1,369 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/cli.ts
+import { hideBin } from "yargs/helpers";
+import yargs from "yargs/yargs";
+
+// src/commands/decryptSecCommand.ts
+var decryptSecCommand_exports = {};
+__export(decryptSecCommand_exports, {
+  builder: () => builder,
+  command: () => command,
+  desc: () => desc,
+  handler: () => handler
+});
+import { KMSClient, DecryptCommand } from "@aws-sdk/client-kms";
+import { redBright } from "chalk";
+import { parse } from "dotenv";
+import fs from "node:fs";
+import path from "node:path";
+
+// src/commonCliOptions.ts
+var commonCliOptions = {
+  awsProfile: {
+    string: true,
+    describe: "AWS profile"
+  },
+  awsRegion: {
+    string: true,
+    describe: "AWS region"
+  },
+  awsKeyAlias: {
+    string: true,
+    describe: "AWS KMS asymmetric key alias"
+  },
+  awsKey: {
+    string: true,
+    describe: "AWS KMS asymmetric key arn"
+  },
+  verbose: {
+    boolean: true,
+    describe: "Be verbose"
+  },
+  yes: {
+    boolean: true,
+    describe: "Proceeds without confirmation"
+  },
+  dryRun: {
+    boolean: true,
+    describe: "Do a dry run"
+  }
+};
+
+// src/utils/getCredentialsProfileRegion.ts
+import { fromEnv, fromIni } from "@aws-sdk/credential-providers";
+import { loadSharedConfigFiles } from "@aws-sdk/shared-ini-file-loader";
+
+// src/utils/logger.ts
+import chalk from "chalk";
+var bold = (str) => chalk.yellowBright.bold(str);
+var underline = (str) => chalk.cyanBright.bold(str);
+
+// src/utils/getCredentialsProfileRegion.ts
+var getCredentialsProfileRegion = async ({
+  argv,
+  env
+}) => {
+  var _a, _b, _c;
+  const sharedConfigFiles = await loadSharedConfigFiles();
+  let credentialsAndOrigin = void 0;
+  let profileAndOrigin = void 0;
+  let regionAndOrigin = void 0;
+  if (argv.profile) {
+    profileAndOrigin = { value: argv.profile, origin: `command line option: ${bold(argv.profile)}` };
+    credentialsAndOrigin = { value: await fromIni({ profile: argv.profile })(), origin: `${bold(`[${argv.profile}]`)} in credentials file` };
+  } else if (env.AWS_PROFILE) {
+    profileAndOrigin = { value: env.AWS_PROFILE, origin: `env variable ${bold("AWS_PROFILE")}: ${underline(env.AWS_PROFILE)}` };
+    credentialsAndOrigin = {
+      value: await fromIni({ profile: env.AWS_PROFILE })(),
+      origin: `env variable ${underline("AWS_PROFILE")}: ${bold(env.AWS_PROFILE)}`
+    };
+  } else if (env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) {
+    credentialsAndOrigin = {
+      value: await fromEnv()(),
+      origin: `env variables ${bold("AWS_ACCESS_KEY_ID")} and ${bold("AWS_SECRET_ACCESS_KEY")}`
+    };
+  } else if ((_a = sharedConfigFiles.credentialsFile) == null ? void 0 : _a.default) {
+    profileAndOrigin = { value: "default", origin: `${bold("[default]")} in credentials file` };
+    credentialsAndOrigin = { value: await fromIni({ profile: "default" })(), origin: `profile ${bold("[default]")}` };
+  }
+  if (argv.region) {
+    regionAndOrigin = { value: argv.region, origin: `command line option: ${bold(argv.region)}` };
+  } else if (env.AWS_REGION) {
+    regionAndOrigin = { value: env.AWS_REGION, origin: `env variable ${bold("AWS_REGION")}: ${underline(env.AWS_REGION)}` };
+  } else if (env.AWS_DEFAULT_REGION) {
+    regionAndOrigin = {
+      value: env.AWS_DEFAULT_REGION,
+      origin: `env variable ${bold("AWS_DEFAULT_REGION")}: ${underline(env.AWS_DEFAULT_REGION)}`
+    };
+  } else if (profileAndOrigin) {
+    const foundRegion = (_c = (_b = sharedConfigFiles == null ? void 0 : sharedConfigFiles.configFile) == null ? void 0 : _b[profileAndOrigin.value]) == null ? void 0 : _c.region;
+    if (foundRegion) {
+      regionAndOrigin = { value: foundRegion, origin: `${bold(`[profile ${profileAndOrigin.value}]`)} in config file` };
+    }
+  }
+  return { credentialsAndOrigin, regionAndOrigin, profileAndOrigin };
+};
+var printVerboseCredentialsProfileRegion = ({
+  credentialsAndOrigin,
+  regionAndOrigin,
+  profileAndOrigin
+}) => {
+  const out = [];
+  if (profileAndOrigin) {
+    out.push(`Got profile name from ${profileAndOrigin.origin}`);
+  }
+  if (credentialsAndOrigin) {
+    out.push(`Resolved credentials from ${credentialsAndOrigin.origin}`);
+  }
+  if (regionAndOrigin) {
+    out.push(`Resolved region from ${regionAndOrigin.origin}`);
+  }
+  return out.join("\n");
+};
+
+// src/lib/partial-commands/handleCredentialsAndRegion.ts
+var handleCredentialsAndRegion = async ({
+  argv,
+  env
+}) => {
+  const { credentialsAndOrigin, regionAndOrigin } = await getCredentialsProfileRegion({
+    argv: { region: argv.awsRegion, profile: argv.awsProfile },
+    env: __spreadValues({}, env)
+  });
+  if (argv.verbose === true) {
+    console.log(printVerboseCredentialsProfileRegion({ credentialsAndOrigin, regionAndOrigin }));
+  }
+  if (!credentialsAndOrigin || !regionAndOrigin) {
+    if (!credentialsAndOrigin) {
+      console.error("Could not find credentials");
+      throw new Error("Could not find credentials");
+    }
+    if (!regionAndOrigin) {
+      console.error("Could not find region");
+      throw new Error("Could not find region");
+    }
+  }
+  return { credentialsAndOrigin, regionAndOrigin };
+};
+
+// src/utils/io.ts
+import { stat } from "fs/promises";
+var fileExists = async (source) => {
+  try {
+    await stat(source);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+// src/commands/decryptSecCommand.ts
+var command = "decrypt-sec";
+var desc = "Decrypts a dotsec file";
+var builder = {
+  "aws-profile": __spreadValues({}, commonCliOptions.awsProfile),
+  "aws-region": __spreadValues({}, commonCliOptions.awsRegion),
+  "aws-key-alias": { string: true, default: "alias/top-secret" },
+  "env-file": {
+    string: true,
+    describe: ".env file",
+    default: ".env"
+  },
+  "sec-file": {
+    string: true,
+    describe: ".sec file",
+    default: ".sec"
+  },
+  verbose: __spreadValues({}, commonCliOptions.verbose),
+  yes: __spreadValues({}, commonCliOptions.yes)
+};
+var handler = async (argv) => {
+  try {
+    const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: __spreadValues({}, argv), env: __spreadValues({}, process.env) });
+    const secSource = path.resolve(process.cwd(), argv.secFile);
+    if (!await fileExists(secSource)) {
+      console.error(`Could not open ${redBright(secSource)}`);
+      return;
+    }
+    const parsedSec = parse(fs.readFileSync(secSource, { encoding: "utf8" }));
+    const kmsClient = new KMSClient({
+      credentials: credentialsAndOrigin.value,
+      region: regionAndOrigin.value
+    });
+    const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
+      const decryptCommand = new DecryptCommand({
+        KeyId: argv.awsKeyAlias,
+        CiphertextBlob: Buffer.from(cipherText, "base64"),
+        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      });
+      const decryptionResult = await kmsClient.send(decryptCommand);
+      if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
+        throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);
+      }
+      const value = Buffer.from(decryptionResult.Plaintext).toString();
+      return [key, value];
+    }));
+    fs.writeFileSync(path.resolve(process.cwd(), argv.envFile || ".env"), envEntries.map(([key, value]) => `${key}="${value}"`).join("\n"));
+  } catch (e) {
+    console.error(e);
+  }
+};
+
+// src/commands/defaultCommand.ts
+var defaultCommand_exports = {};
+__export(defaultCommand_exports, {
+  builder: () => builder2,
+  command: () => command2,
+  desc: () => desc2,
+  handler: () => handler2
+});
+import { KMSClient as KMSClient2, DecryptCommand as DecryptCommand2 } from "@aws-sdk/client-kms";
+import { redBright as redBright2 } from "chalk";
+import { spawn } from "cross-spawn";
+import { parse as parse2 } from "dotenv";
+import fs2 from "node:fs";
+import path2 from "node:path";
+var command2 = "$0 <command>";
+var desc2 = "Decrypts a .sec file, injects the results into a separate process and runs a command";
+var builder2 = {
+  "aws-profile": __spreadValues({}, commonCliOptions.awsProfile),
+  "aws-region": __spreadValues({}, commonCliOptions.awsRegion),
+  "aws-key-alias": { string: true, default: "alias/top-secret" },
+  "sec-file": {
+    string: true,
+    describe: ".sec file",
+    default: ".sec"
+  },
+  verbose: __spreadValues({}, commonCliOptions.verbose),
+  yes: __spreadValues({}, commonCliOptions.yes),
+  command: { string: true, required: true }
+};
+var handler2 = async (argv) => {
+  try {
+    const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: __spreadValues({}, argv), env: __spreadValues({}, process.env) });
+    const secSource = path2.resolve(process.cwd(), argv.secFile);
+    if (!await fileExists(secSource)) {
+      console.error(`Could not open ${redBright2(secSource)}`);
+      return;
+    }
+    const parsedSec = parse2(fs2.readFileSync(secSource, { encoding: "utf8" }));
+    const kmsClient = new KMSClient2({
+      credentials: credentialsAndOrigin.value,
+      region: regionAndOrigin.value
+    });
+    const envEntries = await Promise.all(Object.entries(parsedSec).map(async ([key, cipherText]) => {
+      const decryptCommand = new DecryptCommand2({
+        KeyId: argv.awsKeyAlias,
+        CiphertextBlob: Buffer.from(cipherText, "base64"),
+        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      });
+      const decryptionResult = await kmsClient.send(decryptCommand);
+      if (!(decryptionResult == null ? void 0 : decryptionResult.Plaintext)) {
+        throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);
+      }
+      const value = Buffer.from(decryptionResult.Plaintext).toString();
+      return [key, value];
+    }));
+    const env = Object.fromEntries(envEntries);
+    const userCommandArgs = process.argv.slice(process.argv.indexOf(argv.command) + 1);
+    if (argv.command) {
+      spawn(argv.command, [...userCommandArgs], {
+        stdio: "inherit",
+        shell: false,
+        env: __spreadValues(__spreadValues({}, process.env), env)
+      });
+    }
+  } catch (e) {
+    console.error(e);
+  }
+};
+
+// src/commands/encryptEnvCommand.ts
+var encryptEnvCommand_exports = {};
+__export(encryptEnvCommand_exports, {
+  builder: () => builder3,
+  command: () => command3,
+  desc: () => desc3,
+  handler: () => handler3
+});
+import { KMSClient as KMSClient3, EncryptCommand } from "@aws-sdk/client-kms";
+import { redBright as redBright3 } from "chalk";
+import { parse as parse3 } from "dotenv";
+import fs3 from "node:fs";
+import path3 from "node:path";
+var command3 = "encrypt-env";
+var desc3 = "Encrypts a dotenv file";
+var builder3 = {
+  "aws-profile": __spreadValues({}, commonCliOptions.awsProfile),
+  "aws-region": __spreadValues({}, commonCliOptions.awsRegion),
+  "aws-key-alias": { string: true, default: "alias/top-secret" },
+  "env-file": {
+    string: true,
+    describe: ".env file",
+    default: ".env"
+  },
+  "sec-file": {
+    string: true,
+    describe: ".sec file",
+    default: ".sec"
+  },
+  verbose: __spreadValues({}, commonCliOptions.verbose),
+  yes: __spreadValues({}, commonCliOptions.yes)
+};
+var handler3 = async (argv) => {
+  try {
+    const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: __spreadValues({}, argv), env: __spreadValues({}, process.env) });
+    const envSource = path3.resolve(process.cwd(), argv.envFile);
+    if (!await fileExists(envSource)) {
+      console.error(`Could not open ${redBright3(envSource)}`);
+      return;
+    }
+    const parsedEnv = parse3(fs3.readFileSync(envSource, { encoding: "utf8" }));
+    const kmsClient = new KMSClient3({
+      credentials: credentialsAndOrigin.value,
+      region: regionAndOrigin.value
+    });
+    const sec = (await Promise.all(Object.entries(parsedEnv).map(async ([key, value]) => {
+      const encryptCommand = new EncryptCommand({
+        KeyId: argv.awsKeyAlias,
+        Plaintext: Buffer.from(value),
+        EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+      });
+      const encryptionResult = await kmsClient.send(encryptCommand);
+      if (!encryptionResult.CiphertextBlob) {
+        throw new Error(`No: ${JSON.stringify({ key, value, encryptCommand })}`);
+      }
+      const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString("base64");
+      return `${key}="${cipherText}"`;
+    }))).join("\n");
+    fs3.writeFileSync(path3.resolve(process.cwd(), argv.secFile), sec);
+  } catch (e) {
+    console.error(e);
+  }
+};
+
+// src/cli.ts
+void yargs(hideBin(process.argv)).command(defaultCommand_exports).command(encryptEnvCommand_exports).command(decryptSecCommand_exports).parse();
+//# sourceMappingURL=cli.js.map

package/dist/esm/cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/cli.ts", "../../src/commands/decryptSecCommand.ts", "../../src/commonCliOptions.ts", "../../src/utils/getCredentialsProfileRegion.ts", "../../src/utils/logger.ts", "../../src/lib/partial-commands/handleCredentialsAndRegion.ts", "../../src/utils/io.ts", "../../src/commands/defaultCommand.ts", "../../src/commands/encryptEnvCommand.ts"],
+  "sourcesContent": ["/* eslint-disable @typescript-eslint/no-shadow */\nimport { hideBin } from 'yargs/helpers';\nimport yargs from 'yargs/yargs';\n\n// import * as createAwsKey from './commands/createAwsKey';\nimport * as decryptSecCommand from './commands/decryptSecCommand';\nimport * as defaultCommmand from './commands/defaultCommand';\n// import * as deleteAwsKey from './commands/deleteAwsKey';\nimport * as encryptEnvCommand from './commands/encryptEnvCommand';\n\nvoid yargs(hideBin(process.argv))\n    .command(defaultCommmand)\n    .command(encryptEnvCommand)\n    .command(decryptSecCommand)\n    // .command(createAwsKey)\n    // .command(deleteAwsKey)\n    .parse();\n", "import { KMSClient, DecryptCommand } from '@aws-sdk/client-kms';\nimport { redBright } from 'chalk';\nimport { parse } from 'dotenv';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { commonCliOptions } from '../commonCliOptions';\nimport { handleCredentialsAndRegion } from '../lib/partial-commands/handleCredentialsAndRegion';\nimport { YargsHandlerParams } from '../types';\nimport { fileExists } from '../utils/io';\n\nexport const command = 'decrypt-sec';\nexport const desc = 'Decrypts a dotsec file';\n\nexport const builder = {\n    'aws-profile': {\n        ...commonCliOptions.awsProfile,\n    },\n    'aws-region': {\n        ...commonCliOptions.awsRegion,\n    },\n    'aws-key-alias': { string: true, default: 'alias/top-secret' },\n    'env-file': {\n        string: true,\n        describe: '.env file',\n        default: '.env',\n    },\n    'sec-file': {\n        string: true,\n        describe: '.sec file',\n        default: '.sec',\n    },\n    verbose: { ...commonCliOptions.verbose },\n    yes: { ...commonCliOptions.yes },\n} as const;\n\nexport const handler = async (argv: YargsHandlerParams<typeof builder>): Promise<void> => {\n    try {\n        const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: { ...argv }, env: { ...process.env } });\n\n        const secSource = path.resolve(process.cwd(), argv.secFile);\n        if (!(await fileExists(secSource))) {\n            console.error(`Could not open ${redBright(secSource)}`);\n            return;\n        }\n        const parsedSec = parse(fs.readFileSync(secSource, { encoding: 'utf8' }));\n\n        const kmsClient = new KMSClient({\n            credentials: credentialsAndOrigin.value,\n            region: regionAndOrigin.value,\n        });\n\n        const envEntries: [string, string][] = await Promise.all(\n            Object.entries(parsedSec).map(async ([key, cipherText]) => {\n                const decryptCommand = new DecryptCommand({\n                    KeyId: argv.awsKeyAlias,\n                    CiphertextBlob: Buffer.from(cipherText, 'base64'),\n                    EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n                });\n                const decryptionResult = await kmsClient.send(decryptCommand);\n\n                if (!decryptionResult?.Plaintext) {\n                    throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);\n                }\n                const value = Buffer.from(decryptionResult.Plaintext).toString();\n                return [key, value];\n            }),\n        );\n        fs.writeFileSync(path.resolve(process.cwd(), argv.envFile || '.env'), envEntries.map(([key, value]) => `${key}=\"${value}\"`).join('\\n'));\n    } catch (e) {\n        console.error(e);\n    }\n};\n", "// import regions from 'aws-regions/regions.json';\n\nexport const commonCliOptions = {\n    awsProfile: {\n        string: true,\n        describe: 'AWS profile',\n    },\n    awsRegion: {\n        string: true,\n        describe: 'AWS region',\n    },\n    awsKeyAlias: {\n        string: true,\n        describe: 'AWS KMS asymmetric key alias',\n    },\n    awsKey: {\n        string: true,\n        describe: 'AWS KMS asymmetric key arn',\n    },\n\n    verbose: {\n        boolean: true,\n        describe: 'Be verbose',\n    },\n    // regions: {\n    //     describe: 'AWS region',\n    //     array: true,\n    //     choices: regions.map(({ code }) => code),\n    // },\n    // baseRegion: {\n    //     describe: 'AWS region where to store encyption secrets. This is also the same region where *you* should deploy the Top Secret! stack.',\n    //     choices: regions.map(({ code }) => code),\n    // },\n    yes: {\n        boolean: true,\n        describe: 'Proceeds without confirmation',\n    },\n    dryRun: {\n        boolean: true,\n        describe: 'Do a dry run',\n    },\n} as const;\n", "import { fromEnv, fromIni } from '@aws-sdk/credential-providers';\nimport { loadSharedConfigFiles } from '@aws-sdk/shared-ini-file-loader';\n\nimport { CredentialsAndOrigin, ProfileAndOrigin, RegionAndOrigin } from '../types';\nimport { bold, underline } from './logger';\n\nexport const getCredentialsProfileRegion = async ({\n    argv,\n    env,\n}: {\n    argv: { profile?: string; region?: string };\n    env: {\n        AWS_PROFILE?: string;\n        AWS_ACCESS_KEY_ID?: string;\n        AWS_SECRET_ACCESS_KEY?: string;\n        AWS_REGION?: string;\n        AWS_DEFAULT_REGION?: string;\n        TZ?: string;\n    };\n}) => {\n    const sharedConfigFiles = await loadSharedConfigFiles();\n    let credentialsAndOrigin: CredentialsAndOrigin | undefined = undefined;\n    let profileAndOrigin: ProfileAndOrigin | undefined = undefined;\n    let regionAndOrigin: RegionAndOrigin | undefined = undefined;\n\n    if (argv.profile) {\n        profileAndOrigin = { value: argv.profile, origin: `command line option: ${bold(argv.profile)}` };\n        credentialsAndOrigin = { value: await fromIni({ profile: argv.profile })(), origin: `${bold(`[${argv.profile}]`)} in credentials file` };\n    } else if (env.AWS_PROFILE) {\n        profileAndOrigin = { value: env.AWS_PROFILE, origin: `env variable ${bold('AWS_PROFILE')}: ${underline(env.AWS_PROFILE)}` };\n        credentialsAndOrigin = {\n            value: await fromIni({ profile: env.AWS_PROFILE })(),\n            origin: `env variable ${underline('AWS_PROFILE')}: ${bold(env.AWS_PROFILE)}`,\n        };\n    } else if (env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) {\n        credentialsAndOrigin = {\n            value: await fromEnv()(),\n            origin: `env variables ${bold('AWS_ACCESS_KEY_ID')} and ${bold('AWS_SECRET_ACCESS_KEY')}`,\n        };\n    } else if (sharedConfigFiles.credentialsFile?.default) {\n        profileAndOrigin = { value: 'default', origin: `${bold('[default]')} in credentials file` };\n        credentialsAndOrigin = { value: await fromIni({ profile: 'default' })(), origin: `profile ${bold('[default]')}` };\n    }\n\n    if (argv.region) {\n        regionAndOrigin = { value: argv.region, origin: `command line option: ${bold(argv.region)}` };\n    } else if (env.AWS_REGION) {\n        regionAndOrigin = { value: env.AWS_REGION, origin: `env variable ${bold('AWS_REGION')}: ${underline(env.AWS_REGION)}` };\n    } else if (env.AWS_DEFAULT_REGION) {\n        regionAndOrigin = {\n            value: env.AWS_DEFAULT_REGION,\n            origin: `env variable ${bold('AWS_DEFAULT_REGION')}: ${underline(env.AWS_DEFAULT_REGION)}`,\n        };\n    } else if (profileAndOrigin) {\n        const foundRegion = sharedConfigFiles?.configFile?.[profileAndOrigin.value]?.region;\n\n        if (foundRegion) {\n            regionAndOrigin = { value: foundRegion, origin: `${bold(`[profile ${profileAndOrigin.value}]`)} in config file` };\n        }\n    }\n\n    return { credentialsAndOrigin, regionAndOrigin, profileAndOrigin };\n};\n\nexport const printVerboseCredentialsProfileRegion = ({\n    credentialsAndOrigin,\n    regionAndOrigin,\n    profileAndOrigin,\n}: {\n    credentialsAndOrigin?: CredentialsAndOrigin;\n    regionAndOrigin?: RegionAndOrigin;\n    profileAndOrigin?: ProfileAndOrigin;\n}): string => {\n    const out: string[] = [];\n    if (profileAndOrigin) {\n        out.push(`Got profile name from ${profileAndOrigin.origin}`);\n    }\n    if (credentialsAndOrigin) {\n        out.push(`Resolved credentials from ${credentialsAndOrigin.origin}`);\n    }\n    if (regionAndOrigin) {\n        out.push(`Resolved region from ${regionAndOrigin.origin}`);\n    }\n    return out.join('\\n');\n};\n", "import chalk from 'chalk';\n// eslint-disable-next-line @typescript-eslint/naming-convention\nlet _logger: Pick<Console, 'info' | 'error'>;\n\nexport const getLogger = () => {\n    if (!_logger) {\n        return console;\n    }\n\n    return _logger;\n};\n\nexport const bold = (str: string): string => chalk.yellowBright.bold(str);\nexport const underline = (str: string): string => chalk.cyanBright.bold(str);\n", "import { getCredentialsProfileRegion, printVerboseCredentialsProfileRegion } from '../../utils/getCredentialsProfileRegion';\n\nexport const handleCredentialsAndRegion = async ({\n    argv,\n    env,\n}: {\n    argv: { awsRegion?: string; awsProfile?: string; verbose?: boolean };\n    env: {\n        AWS_PROFILE?: string | undefined;\n        AWS_ACCESS_KEY_ID?: string | undefined;\n        AWS_SECRET_ACCESS_KEY?: string | undefined;\n        AWS_REGION?: string | undefined;\n        AWS_DEFAULT_REGION?: string | undefined;\n        TZ?: string;\n    };\n}) => {\n    const { credentialsAndOrigin, regionAndOrigin } = await getCredentialsProfileRegion({\n        argv: { region: argv.awsRegion, profile: argv.awsProfile },\n        env: {\n            ...env,\n        },\n    });\n\n    if (argv.verbose === true) {\n        console.log(printVerboseCredentialsProfileRegion({ credentialsAndOrigin, regionAndOrigin }));\n    }\n\n    if (!credentialsAndOrigin || !regionAndOrigin) {\n        if (!credentialsAndOrigin) {\n            console.error('Could not find credentials');\n            throw new Error('Could not find credentials');\n        }\n        if (!regionAndOrigin) {\n            console.error('Could not find region');\n            throw new Error('Could not find region');\n        }\n    }\n\n    return { credentialsAndOrigin, regionAndOrigin };\n};\n", "import { stat } from 'fs/promises';\n\nexport const fileExists = async (source: string): Promise<boolean> => {\n    try {\n        await stat(source);\n        return true;\n    } catch {\n        return false;\n    }\n};\n", "import { KMSClient, DecryptCommand } from '@aws-sdk/client-kms';\nimport { redBright } from 'chalk';\nimport { spawn } from 'cross-spawn';\nimport { parse } from 'dotenv';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { commonCliOptions } from '../commonCliOptions';\nimport { handleCredentialsAndRegion } from '../lib/partial-commands/handleCredentialsAndRegion';\nimport { YargsHandlerParams } from '../types';\nimport { fileExists } from '../utils/io';\n\nexport const command = '$0 <command>';\nexport const desc = 'Decrypts a .sec file, injects the results into a separate process and runs a command';\n\nexport const builder = {\n    'aws-profile': {\n        ...commonCliOptions.awsProfile,\n    },\n    'aws-region': {\n        ...commonCliOptions.awsRegion,\n    },\n    'aws-key-alias': { string: true, default: 'alias/top-secret' },\n    'sec-file': {\n        string: true,\n        describe: '.sec file',\n        default: '.sec',\n    },\n    verbose: { ...commonCliOptions.verbose },\n    yes: { ...commonCliOptions.yes },\n    command: { string: true, required: true },\n} as const;\n\nexport const handler = async (argv: YargsHandlerParams<typeof builder>): Promise<void> => {\n    try {\n        const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: { ...argv }, env: { ...process.env } });\n\n        const secSource = path.resolve(process.cwd(), argv.secFile);\n        if (!(await fileExists(secSource))) {\n            console.error(`Could not open ${redBright(secSource)}`);\n            return;\n        }\n        const parsedSec = parse(fs.readFileSync(secSource, { encoding: 'utf8' }));\n\n        const kmsClient = new KMSClient({\n            credentials: credentialsAndOrigin.value,\n            region: regionAndOrigin.value,\n        });\n\n        const envEntries: [string, string][] = await Promise.all(\n            Object.entries(parsedSec).map(async ([key, cipherText]) => {\n                const decryptCommand = new DecryptCommand({\n                    KeyId: argv.awsKeyAlias,\n                    CiphertextBlob: Buffer.from(cipherText, 'base64'),\n                    EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n                });\n                const decryptionResult = await kmsClient.send(decryptCommand);\n\n                if (!decryptionResult?.Plaintext) {\n                    throw new Error(`No: ${JSON.stringify({ key, cipherText, decryptCommand })}`);\n                }\n                const value = Buffer.from(decryptionResult.Plaintext).toString();\n                return [key, value];\n            }),\n        );\n        const env = Object.fromEntries(envEntries);\n        // console.log(env);\n\n        const userCommandArgs = process.argv.slice(process.argv.indexOf(argv.command) + 1);\n        // console.info({ userCommandArgs });\n\n        // console.info(argv.command);\n        if (argv.command) {\n            spawn(argv.command, [...userCommandArgs], {\n                stdio: 'inherit',\n                shell: false,\n                env: { ...process.env, ...env },\n            });\n        }\n    } catch (e) {\n        console.error(e);\n    }\n};\n", "import { KMSClient, EncryptCommand } from '@aws-sdk/client-kms';\nimport { redBright } from 'chalk';\nimport { parse } from 'dotenv';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { commonCliOptions } from '../commonCliOptions';\nimport { handleCredentialsAndRegion } from '../lib/partial-commands/handleCredentialsAndRegion';\nimport { YargsHandlerParams } from '../types';\nimport { fileExists } from '../utils/io';\n\nexport const command = 'encrypt-env';\nexport const desc = 'Encrypts a dotenv file';\n\nexport const builder = {\n    'aws-profile': {\n        ...commonCliOptions.awsProfile,\n    },\n    'aws-region': {\n        ...commonCliOptions.awsRegion,\n    },\n    'aws-key-alias': { string: true, default: 'alias/top-secret' },\n    'env-file': {\n        string: true,\n        describe: '.env file',\n        default: '.env',\n    },\n    'sec-file': {\n        string: true,\n        describe: '.sec file',\n        default: '.sec',\n    },\n    verbose: { ...commonCliOptions.verbose },\n    yes: { ...commonCliOptions.yes },\n} as const;\n\nexport const handler = async (argv: YargsHandlerParams<typeof builder>): Promise<void> => {\n    try {\n        const { credentialsAndOrigin, regionAndOrigin } = await handleCredentialsAndRegion({ argv: { ...argv }, env: { ...process.env } });\n\n        const envSource = path.resolve(process.cwd(), argv.envFile);\n        if (!(await fileExists(envSource))) {\n            console.error(`Could not open ${redBright(envSource)}`);\n            return;\n        }\n        const parsedEnv = parse(fs.readFileSync(envSource, { encoding: 'utf8' }));\n\n        const kmsClient = new KMSClient({\n            credentials: credentialsAndOrigin.value,\n            region: regionAndOrigin.value,\n        });\n\n        const sec = (\n            await Promise.all(\n                Object.entries(parsedEnv).map(async ([key, value]) => {\n                    const encryptCommand = new EncryptCommand({\n                        KeyId: argv.awsKeyAlias,\n                        Plaintext: Buffer.from(value),\n                        EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n                    });\n                    const encryptionResult = await kmsClient.send(encryptCommand);\n\n                    if (!encryptionResult.CiphertextBlob) {\n                        throw new Error(`No: ${JSON.stringify({ key, value, encryptCommand })}`);\n                    }\n\n                    const cipherText = Buffer.from(encryptionResult.CiphertextBlob).toString('base64');\n                    return `${key}=\"${cipherText}\"`;\n                }),\n            )\n        ).join('\\n');\n\n        // console.log(sec);\n\n        fs.writeFileSync(path.resolve(process.cwd(), argv.secFile), sec);\n    } catch (e) {\n        console.error(e);\n    }\n};\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;AACA;AACA;;;ACFA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA;AACA;AACA;AACA;;;ACFO,IAAM,mBAAmB;AAAA,EAC5B,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAEd,WAAW;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAEd,aAAa;AAAA,IACT,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAEd,QAAQ;AAAA,IACJ,QAAQ;AAAA,IACR,UAAU;AAAA;AAAA,EAGd,SAAS;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA;AAAA,EAWd,KAAK;AAAA,IACD,SAAS;AAAA,IACT,UAAU;AAAA;AAAA,EAEd,QAAQ;AAAA,IACJ,SAAS;AAAA,IACT,UAAU;AAAA;AAAA;;;ACvClB;AACA;;;ACDA;AAYO,IAAM,OAAO,CAAC,QAAwB,MAAM,aAAa,KAAK;AAC9D,IAAM,YAAY,CAAC,QAAwB,MAAM,WAAW,KAAK;;;ADPjE,IAAM,8BAA8B,OAAO;AAAA,EAC9C;AAAA,EACA;AAAA,MAWE;AAnBN;AAoBI,QAAM,oBAAoB,MAAM;AAChC,MAAI,uBAAyD;AAC7D,MAAI,mBAAiD;AACrD,MAAI,kBAA+C;AAEnD,MAAI,KAAK,SAAS;AACd,uBAAmB,EAAE,OAAO,KAAK,SAAS,QAAQ,wBAAwB,KAAK,KAAK;AACpF,2BAAuB,EAAE,OAAO,MAAM,QAAQ,EAAE,SAAS,KAAK,cAAc,QAAQ,GAAG,KAAK,IAAI,KAAK;AAAA,aAC9F,IAAI,aAAa;AACxB,uBAAmB,EAAE,OAAO,IAAI,aAAa,QAAQ,gBAAgB,KAAK,mBAAmB,UAAU,IAAI;AAC3G,2BAAuB;AAAA,MACnB,OAAO,MAAM,QAAQ,EAAE,SAAS,IAAI;AAAA,MACpC,QAAQ,gBAAgB,UAAU,mBAAmB,KAAK,IAAI;AAAA;AAAA,aAE3D,IAAI,qBAAqB,IAAI,uBAAuB;AAC3D,2BAAuB;AAAA,MACnB,OAAO,MAAM;AAAA,MACb,QAAQ,iBAAiB,KAAK,4BAA4B,KAAK;AAAA;AAAA,aAE5D,wBAAkB,oBAAlB,mBAAmC,SAAS;AACnD,uBAAmB,EAAE,OAAO,WAAW,QAAQ,GAAG,KAAK;AACvD,2BAAuB,EAAE,OAAO,MAAM,QAAQ,EAAE,SAAS,gBAAgB,QAAQ,WAAW,KAAK;AAAA;AAGrG,MAAI,KAAK,QAAQ;AACb,sBAAkB,EAAE,OAAO,KAAK,QAAQ,QAAQ,wBAAwB,KAAK,KAAK;AAAA,aAC3E,IAAI,YAAY;AACvB,sBAAkB,EAAE,OAAO,IAAI,YAAY,QAAQ,gBAAgB,KAAK,kBAAkB,UAAU,IAAI;AAAA,aACjG,IAAI,oBAAoB;AAC/B,sBAAkB;AAAA,MACd,OAAO,IAAI;AAAA,MACX,QAAQ,gBAAgB,KAAK,0BAA0B,UAAU,IAAI;AAAA;AAAA,aAElE,kBAAkB;AACzB,UAAM,cAAc,mEAAmB,eAAnB,mBAAgC,iBAAiB,WAAjD,mBAAyD;AAE7E,QAAI,aAAa;AACb,wBAAkB,EAAE,OAAO,aAAa,QAAQ,GAAG,KAAK,YAAY,iBAAiB;AAAA;AAAA;AAI7F,SAAO,EAAE,sBAAsB,iBAAiB;AAAA;AAG7C,IAAM,uCAAuC,CAAC;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,MAKU;AACV,QAAM,MAAgB;AACtB,MAAI,kBAAkB;AAClB,QAAI,KAAK,yBAAyB,iBAAiB;AAAA;AAEvD,MAAI,sBAAsB;AACtB,QAAI,KAAK,6BAA6B,qBAAqB;AAAA;AAE/D,MAAI,iBAAiB;AACjB,QAAI,KAAK,wBAAwB,gBAAgB;AAAA;AAErD,SAAO,IAAI,KAAK;AAAA;;;AEjFb,IAAM,6BAA6B,OAAO;AAAA,EAC7C;AAAA,EACA;AAAA,MAWE;AACF,QAAM,EAAE,sBAAsB,oBAAoB,MAAM,4BAA4B;AAAA,IAChF,MAAM,EAAE,QAAQ,KAAK,WAAW,SAAS,KAAK;AAAA,IAC9C,KAAK,mBACE;AAAA;AAIX,MAAI,KAAK,YAAY,MAAM;AACvB,YAAQ,IAAI,qCAAqC,EAAE,sBAAsB;AAAA;AAG7E,MAAI,CAAC,wBAAwB,CAAC,iBAAiB;AAC3C,QAAI,CAAC,sBAAsB;AACvB,cAAQ,MAAM;AACd,YAAM,IAAI,MAAM;AAAA;AAEpB,QAAI,CAAC,iBAAiB;AAClB,cAAQ,MAAM;AACd,YAAM,IAAI,MAAM;AAAA;AAAA;AAIxB,SAAO,EAAE,sBAAsB;AAAA;;;ACtCnC;AAEO,IAAM,aAAa,OAAO,WAAqC;AAClE,MAAI;AACA,UAAM,KAAK;AACX,WAAO;AAAA,UACT;AACE,WAAO;AAAA;AAAA;;;ALIR,IAAM,UAAU;AAChB,IAAM,OAAO;AAEb,IAAM,UAAU;AAAA,EACnB,eAAe,mBACR,iBAAiB;AAAA,EAExB,cAAc,mBACP,iBAAiB;AAAA,EAExB,iBAAiB,EAAE,QAAQ,MAAM,SAAS;AAAA,EAC1C,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,SAAS,mBAAK,iBAAiB;AAAA,EAC/B,KAAK,mBAAK,iBAAiB;AAAA;AAGxB,IAAM,UAAU,OAAO,SAA4D;AACtF,MAAI;AACA,UAAM,EAAE,sBAAsB,oBAAoB,MAAM,2BAA2B,EAAE,MAAM,mBAAK,OAAQ,KAAK,mBAAK,QAAQ;AAE1H,UAAM,YAAY,KAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,QAAI,CAAE,MAAM,WAAW,YAAa;AAChC,cAAQ,MAAM,kBAAkB,UAAU;AAC1C;AAAA;AAEJ,UAAM,YAAY,MAAM,GAAG,aAAa,WAAW,EAAE,UAAU;AAE/D,UAAM,YAAY,IAAI,UAAU;AAAA,MAC5B,aAAa,qBAAqB;AAAA,MAClC,QAAQ,gBAAgB;AAAA;AAG5B,UAAM,aAAiC,MAAM,QAAQ,IACjD,OAAO,QAAQ,WAAW,IAAI,OAAO,CAAC,KAAK,gBAAgB;AACvD,YAAM,iBAAiB,IAAI,eAAe;AAAA,QACtC,OAAO,KAAK;AAAA,QACZ,gBAAgB,OAAO,KAAK,YAAY;AAAA,QACxC,qBAAqB;AAAA;AAEzB,YAAM,mBAAmB,MAAM,UAAU,KAAK;AAE9C,UAAI,CAAC,sDAAkB,YAAW;AAC9B,cAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,KAAK,YAAY;AAAA;AAE7D,YAAM,QAAQ,OAAO,KAAK,iBAAiB,WAAW;AACtD,aAAO,CAAC,KAAK;AAAA;AAGrB,OAAG,cAAc,KAAK,QAAQ,QAAQ,OAAO,KAAK,WAAW,SAAS,WAAW,IAAI,CAAC,CAAC,KAAK,WAAW,GAAG,QAAQ,UAAU,KAAK;AAAA,WAC5H,GAAP;AACE,YAAQ,MAAM;AAAA;AAAA;;;AMtEtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA;AACA;AACA;AACA;AACA;AAOO,IAAM,WAAU;AAChB,IAAM,QAAO;AAEb,IAAM,WAAU;AAAA,EACnB,eAAe,mBACR,iBAAiB;AAAA,EAExB,cAAc,mBACP,iBAAiB;AAAA,EAExB,iBAAiB,EAAE,QAAQ,MAAM,SAAS;AAAA,EAC1C,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,SAAS,mBAAK,iBAAiB;AAAA,EAC/B,KAAK,mBAAK,iBAAiB;AAAA,EAC3B,SAAS,EAAE,QAAQ,MAAM,UAAU;AAAA;AAGhC,IAAM,WAAU,OAAO,SAA4D;AACtF,MAAI;AACA,UAAM,EAAE,sBAAsB,oBAAoB,MAAM,2BAA2B,EAAE,MAAM,mBAAK,OAAQ,KAAK,mBAAK,QAAQ;AAE1H,UAAM,YAAY,MAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,QAAI,CAAE,MAAM,WAAW,YAAa;AAChC,cAAQ,MAAM,kBAAkB,WAAU;AAC1C;AAAA;AAEJ,UAAM,YAAY,OAAM,IAAG,aAAa,WAAW,EAAE,UAAU;AAE/D,UAAM,YAAY,IAAI,WAAU;AAAA,MAC5B,aAAa,qBAAqB;AAAA,MAClC,QAAQ,gBAAgB;AAAA;AAG5B,UAAM,aAAiC,MAAM,QAAQ,IACjD,OAAO,QAAQ,WAAW,IAAI,OAAO,CAAC,KAAK,gBAAgB;AACvD,YAAM,iBAAiB,IAAI,gBAAe;AAAA,QACtC,OAAO,KAAK;AAAA,QACZ,gBAAgB,OAAO,KAAK,YAAY;AAAA,QACxC,qBAAqB;AAAA;AAEzB,YAAM,mBAAmB,MAAM,UAAU,KAAK;AAE9C,UAAI,CAAC,sDAAkB,YAAW;AAC9B,cAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,KAAK,YAAY;AAAA;AAE7D,YAAM,QAAQ,OAAO,KAAK,iBAAiB,WAAW;AACtD,aAAO,CAAC,KAAK;AAAA;AAGrB,UAAM,MAAM,OAAO,YAAY;AAG/B,UAAM,kBAAkB,QAAQ,KAAK,MAAM,QAAQ,KAAK,QAAQ,KAAK,WAAW;AAIhF,QAAI,KAAK,SAAS;AACd,YAAM,KAAK,SAAS,CAAC,GAAG,kBAAkB;AAAA,QACtC,OAAO;AAAA,QACP,OAAO;AAAA,QACP,KAAK,kCAAK,QAAQ,MAAQ;AAAA;AAAA;AAAA,WAG7B,GAAP;AACE,YAAQ,MAAM;AAAA;AAAA;;;AChFtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA;AACA;AACA;AACA;AAOO,IAAM,WAAU;AAChB,IAAM,QAAO;AAEb,IAAM,WAAU;AAAA,EACnB,eAAe,mBACR,iBAAiB;AAAA,EAExB,cAAc,mBACP,iBAAiB;AAAA,EAExB,iBAAiB,EAAE,QAAQ,MAAM,SAAS;AAAA,EAC1C,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,YAAY;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA;AAAA,EAEb,SAAS,mBAAK,iBAAiB;AAAA,EAC/B,KAAK,mBAAK,iBAAiB;AAAA;AAGxB,IAAM,WAAU,OAAO,SAA4D;AACtF,MAAI;AACA,UAAM,EAAE,sBAAsB,oBAAoB,MAAM,2BAA2B,EAAE,MAAM,mBAAK,OAAQ,KAAK,mBAAK,QAAQ;AAE1H,UAAM,YAAY,MAAK,QAAQ,QAAQ,OAAO,KAAK;AACnD,QAAI,CAAE,MAAM,WAAW,YAAa;AAChC,cAAQ,MAAM,kBAAkB,WAAU;AAC1C;AAAA;AAEJ,UAAM,YAAY,OAAM,IAAG,aAAa,WAAW,EAAE,UAAU;AAE/D,UAAM,YAAY,IAAI,WAAU;AAAA,MAC5B,aAAa,qBAAqB;AAAA,MAClC,QAAQ,gBAAgB;AAAA;AAG5B,UAAM,MACF,OAAM,QAAQ,IACV,OAAO,QAAQ,WAAW,IAAI,OAAO,CAAC,KAAK,WAAW;AAClD,YAAM,iBAAiB,IAAI,eAAe;AAAA,QACtC,OAAO,KAAK;AAAA,QACZ,WAAW,OAAO,KAAK;AAAA,QACvB,qBAAqB;AAAA;AAEzB,YAAM,mBAAmB,MAAM,UAAU,KAAK;AAE9C,UAAI,CAAC,iBAAiB,gBAAgB;AAClC,cAAM,IAAI,MAAM,OAAO,KAAK,UAAU,EAAE,KAAK,OAAO;AAAA;AAGxD,YAAM,aAAa,OAAO,KAAK,iBAAiB,gBAAgB,SAAS;AACzE,aAAO,GAAG,QAAQ;AAAA,SAG5B,KAAK;AAIP,QAAG,cAAc,MAAK,QAAQ,QAAQ,OAAO,KAAK,UAAU;AAAA,WACvD,GAAP;AACE,YAAQ,MAAM;AAAA;AAAA;;;ARlEtB,KAAK,MAAM,QAAQ,QAAQ,OACtB,QAAQ,wBACR,QAAQ,2BACR,QAAQ,2BAGR;",
+  "names": []
+}

package/dist/esm/index.js

@@ -0,0 +1,7 @@
+// src/index.ts
+var src_default = () => {
+};
+export {
+  src_default as default
+};
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/index.ts"],
+  "sourcesContent": ["export default () => {};\n"],
+  "mappings": ";AAAA,IAAO,cAAQ,MAAM;AAAA;",
+  "names": []
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+declare const _default: () => void;
+
+export { _default as default };

package/dist/index.js

@@ -0,0 +1,17 @@
+var __defProp = Object.defineProperty;
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/index.ts
+__export(exports, {
+  default: () => src_default
+});
+var src_default = () => {
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["export default () => {};\n"],
+  "mappings": ";;;;;;;;;AAAA;AAAA;AAAA;AAAA,IAAO,cAAQ,MAAM;AAAA;",
+  "names": []
+}

package/package.json

@@ -0,0 +1,56 @@
+{
+    "name": "dotsec",
+    "version": "0.1.1",
+    "description": "",
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "module": "./dist/esm/index.js",
+    "files": [
+        "README.md",
+        "LICENSE.md",
+        "CHANGELOG.md",
+        "package.json",
+        "dist"
+    ],
+    "exports": {
+        ".": {
+            "import": "./dist/esm/index.js",
+            "require": "./dist/index.js"
+        }
+    },
+    "bin": {
+        "dotsec": "./bin/dotsec.js"
+    },
+    "repository": {
+        "type": "git",
+        "url": "git@github.com:jpwesselink/dotsec.git",
+        "directory": "packages/dotsec"
+    },
+    "author": "JP Wesselink <jpwesselink@gmail.com>",
+    "license": "MIT",
+    "scripts": {
+        "dev": "tsup --watch ./src --onSuccess \"node dist/index.js\"",
+        "build": "tsup --dts --format cjs,esm --legacy-output",
+        "test": "jest"
+    },
+    "devDependencies": {
+        "@types/jest": "~26.0.24",
+        "@types/node": "^14.14.19",
+        "@types/yargs": "^17.0.8",
+        "esbuild-jest": "^0.5.0",
+        "jest": "~27.3.1",
+        "tsup": "^4.14.0",
+        "typescript": "~4.5.5"
+    },
+    "dependencies": {
+        "@aws-sdk/client-kms": "^3.52.0",
+        "@aws-sdk/credential-providers": "^3.52.0",
+        "@aws-sdk/shared-ini-file-loader": "^3.52.0",
+        "@aws-sdk/types": "^3.52.0",
+        "chalk": "^4.1.2",
+        "cross-spawn": "^7.0.3",
+        "dotenv": "^16.0.0",
+        "yargs": "^17.3.1"
+    },
+    "gitHead": "0507e90cb6c01dd37c0fadec6f74ecf0d9d51ca8"
+}