hammerkit 1.22.0 → 1.24.0

package/dist/remote/remote-work-commands.js

@@ -0,0 +1,152 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWorkCommands = void 0;
+const commander_1 = require("commander");
+const colors_1 = __importDefault(require("colors"));
+const credentials_1 = require("./credentials");
+const collect_bundle_1 = require("./collect-bundle");
+const bundle_1 = require("./bundle");
+const server_client_1 = require("./server-client");
+const text_diff_1 = require("./text-diff");
+const PROPOSAL_NAME = /^([a-z0-9][a-z0-9._-]{0,63})@(sha256:[0-9a-f]{64})$/i;
+// A proposed version is named like `payments@sha256:...`
+function parseProposal(value) {
+    const match = PROPOSAL_NAME.exec(value);
+    return match && bundle_1.HASH_PATTERN.test(match[2]) ? { name: match[1], hash: match[2] } : undefined;
+}
+const RUN_ID = /^run_[A-Za-z0-9_-]{16}$/;
+// What a person who approves is shown of a run: everything the decision rests on.
+function describe(run) {
+    const source = run.source.type === 'ref' ? `ref ${run.source.ref}` : `snapshot ${run.source.snapshot}`;
+    const options = Object.entries(run.options)
+        .map(([key, value]) => `${key}=${Array.isArray(value) ? value.join(',') : value}`)
+        .join(' ');
+    return [
+        `${colors_1.default.bold((0, server_client_1.printable)(run.id))}  requested by ${(0, server_client_1.printable)(run.requestedBy.sub)} (${(0, server_client_1.printable)(run.requestedBy.iss)})`,
+        `  ${(0, server_client_1.printable)(run.definition.name)} ${(0, server_client_1.printable)(run.definition.hash)}`,
+        `  tasks: ${run.tasks.length > 0 ? run.tasks.map(server_client_1.printable).join(', ') : 'selected by labels'}`,
+        `  account ${run.account === null ? 'none' : (0, server_client_1.printable)(run.account)}, source ${(0, server_client_1.printable)(source)}${options ? `, ${(0, server_client_1.printable)(options)}` : ''}`,
+        `  needs the approval of an admin of ${run.account === null ? 'none' : (0, server_client_1.printable)(run.account)}`,
+        `  decide before ${(0, server_client_1.printable)(run.approval?.expiresAt ?? '-')}`,
+    ];
+}
+function registerWorkCommands(remote, context) {
+    const { environment, buildFile, getServer, guarded } = context;
+    const connect = async (name) => {
+        const chosen = await getServer(name);
+        const token = await (0, credentials_1.getAccessToken)(environment, chosen.name, chosen.server);
+        return { ...chosen, token };
+    };
+    remote
+        .command('publish <definition> [server]')
+        .description('publish the build file and the files it includes to a server, under a name runs can refer to')
+        .action(guarded('Remote publish was not successful', async (definition, name) => {
+        const bundle = await (0, collect_bundle_1.collectBundle)(buildFile, environment);
+        const { name: serverName, server, token } = await connect(name);
+        const answer = await (0, server_client_1.callServer)(server, token, 'PUT', `/v1/definitions/${encodeURIComponent(definition)}`, bundle);
+        const version = answer.body;
+        const files = Object.keys(bundle.files).length;
+        const proposed = answer.status === 202;
+        const verb = proposed ? 'proposed' : answer.status === 201 ? 'published' : 'already published';
+        environment.stdout.write(`${verb} ${definition} to ${serverName}: ${(0, server_client_1.printable)(version.hash)} (${files} ${files === 1 ? 'file' : 'files'})\n`);
+        const names = [...(version.tasks ?? []), ...(version.services ?? [])];
+        environment.stdout.write(`tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+        if (proposed) {
+            environment.stdout.write(`it can not run before somebody who may publish ${(0, server_client_1.printable)(definition)} approves it, until ${(0, server_client_1.printable)(version.expiresAt)}\n`);
+        }
+    }));
+    remote
+        .command('approvals [server]')
+        .description('list the runs on a server that wait for your approval')
+        .action(guarded('Remote approvals was not successful', async (name) => {
+        const { name: serverName, server, token } = await connect(name);
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', '/v1/approvals');
+        if (body.approvals.length === 0) {
+            environment.stdout.write(`${serverName}: no runs wait for your approval\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.approvals.length} waiting for your approval\n`);
+        for (const run of body.approvals) {
+            for (const line of describe(run)) {
+                environment.stdout.write(`${line}\n`);
+            }
+        }
+    }));
+    remote
+        .command('proposals [server]')
+        .description('list the proposed versions of build files you made or may approve')
+        .action(guarded('Remote proposals was not successful', async (name) => {
+        const { name: serverName, server, token } = await connect(name);
+        const { body } = await (0, server_client_1.callServer)(server, token, 'GET', '/v1/proposals');
+        if (body.proposals.length === 0) {
+            environment.stdout.write(`${serverName}: no proposed versions\n`);
+            return;
+        }
+        environment.stdout.write(`${serverName}: ${body.proposals.length} proposed\n`);
+        for (const proposal of body.proposals) {
+            const who = proposal.mine ? 'you' : (0, server_client_1.printable)(proposal.proposedBy.sub);
+            const state = proposal.canDecide ? colors_1.default.bold('waits for your approval') : (0, server_client_1.printable)(proposal.state);
+            environment.stdout.write(`${colors_1.default.bold(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)}`)}  proposed by ${who}, ${state}\n`);
+            const names = [...proposal.tasks, ...proposal.services];
+            environment.stdout.write(`  tasks and services: ${names.map(server_client_1.printable).join(', ') || 'none'}\n`);
+            if (proposal.state === 'waiting') {
+                environment.stdout.write(`  decide before ${(0, server_client_1.printable)(proposal.expiresAt)}\n`);
+            }
+            else if (proposal.reason) {
+                environment.stdout.write(`  ${(0, server_client_1.printable)(proposal.state)}: ${(0, server_client_1.printable)(proposal.reason)}\n`);
+            }
+        }
+    }));
+    remote
+        .command('diff <proposal> [server]')
+        .description('show what a proposed version (name@hash) changes against the version it follows')
+        .action(guarded('Remote diff was not successful', async (target, name) => {
+        const proposal = parseProposal(target);
+        if (!proposal) {
+            throw new Error(`${(0, server_client_1.printable)(target)} is not a proposal, list them with: hammerkit remote proposals`);
+        }
+        const { name: serverName, server, token } = await connect(name);
+        const path = `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}`;
+        const view = (await (0, server_client_1.callServer)(server, token, 'GET', path)).body;
+        const proposed = (await (0, server_client_1.callServer)(server, token, 'GET', `${path}/files`)).body;
+        const base = view.base
+            ? (await (0, server_client_1.callServer)(server, token, 'GET', `/v1/definitions/${encodeURIComponent(proposal.name)}/${view.base}/files`)).body
+            : undefined;
+        environment.stdout.write(`${(0, server_client_1.printable)(proposal.name)}@${(0, server_client_1.printable)(proposal.hash)} on ${serverName}, proposed by ${(0, server_client_1.printable)(view.proposedBy.sub)} (${(0, server_client_1.printable)(view.proposedBy.iss)})\n`);
+        environment.stdout.write(base ? `compared with ${(0, server_client_1.printable)(view.base)}\n` : 'no version is published yet, everything is new\n');
+        const lines = (0, text_diff_1.diffBundles)(base, proposed);
+        environment.stdout.write(lines.length > 0 ? `${lines.join('\n')}\n` : 'the files are the same\n');
+    }));
+    for (const action of ['approve', 'reject']) {
+        remote
+            .command(`${action} <target> [server]`)
+            .description(action === 'approve'
+            ? 'let a run (run_...) or a proposed version (name@hash) that waits for your approval go ahead'
+            : 'end a run (run_...) or drop a proposed version (name@hash) that waits for your approval')
+            .addOption(new commander_1.Option('--reason <text>', 'why, shown to who asked').argParser((value) => value))
+            .action(guarded(`Remote ${action} was not successful`, async (target, name, options) => {
+            const proposal = parseProposal(target);
+            if (!proposal && !RUN_ID.test(target)) {
+                throw new Error(`${(0, server_client_1.printable)(target)} is not a run id or a proposed version, list them with: hammerkit remote approvals or remote proposals`);
+            }
+            const { name: serverName, server, token } = await connect(name);
+            const path = proposal
+                ? `/v1/proposals/${encodeURIComponent(proposal.name)}/${proposal.hash}/${action}`
+                : `/v1/approvals/${target}/${action}`;
+            const { body } = await (0, server_client_1.callServer)(server, token, 'POST', path, options.reason ? { reason: options.reason } : undefined);
+            const rejected = body.state === 'rejected';
+            environment.stdout.write(proposal
+                ? rejected
+                    ? `rejected ${target} on ${serverName}\n`
+                    : `approved ${target} on ${serverName}, it is published\n`
+                : rejected
+                    ? `rejected ${target} on ${serverName}\n`
+                    : `approved ${target} on ${serverName}, it is queued\n`);
+        }));
+    }
+}
+exports.registerWorkCommands = registerWorkCommands;
+//# sourceMappingURL=remote-work-commands.js.map

package/dist/remote/server-client.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printable = exports.ServerError = void 0;
+const discovery_1 = require("../server/discovery");
+const TIMEOUT_MS = 10000;
+const WRITE_TIMEOUT_MS = 30000;
+class ServerError extends Error {
+}
+exports.ServerError = ServerError;
+// Text from the server or the identity provider is shown to the user: no
+// control characters, so it can't rewrite the terminal.
+function printable(value) {
+    return String(value)
+        .replace(/\p{Cc}/gu, '?')
+        .slice(0, 300);
+}
+exports.printable = printable;
+async function getJson(url, token) {
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: token ? { authorization: `Bearer ${token}` } : {},
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new ServerError(`unable to reach ${url}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (response.status === 401) {
+        throw new ServerError(`${url} did not accept the token`);
+    }
+    if (!response.ok) {
+        throw new ServerError(`${url} answered ${response.status}`);
+    }
+    return response.json();
+}
+// What the server says it is. The issuer registered with `remote add` has to be
+// one it accepts, otherwise a login would send the user to an identity provider
+// the server does not trust.
+async function getDiscovery(server) {
+    const document = (await getJson(`${server.url}${discovery_1.DISCOVERY_PATH}`));
+    if (document?.name !== 'hammerkit' || !Array.isArray(document.issuers)) {
+        throw new ServerError(`${server.url} is not a hammerkit server`);
+    }
+    return document;
+}
+exports.getDiscovery = getDiscovery;
+async function getMe(server, token) {
+    return (await getJson(`${server.url}/v1/me`, token));
+}
+exports.getMe = getMe;
+// A call that changes something, or whose answer the caller tells apart by status.
+// Anything but 2xx is an error carrying what the server said about it.
+async function callServer(server, token, method, path, body) {
+    const url = `${server.url}${path}`;
+    let response;
+    try {
+        response = await fetch(url, {
+            method,
+            headers: {
+                authorization: `Bearer ${token}`,
+                ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(method === 'GET' ? TIMEOUT_MS : WRITE_TIMEOUT_MS),
+        });
+    }
+    catch (e) {
+        throw new ServerError(`unable to reach ${url}: ${printable(e instanceof Error ? e.message : e)}`);
+    }
+    let answer;
+    try {
+        answer = await response.json();
+    }
+    catch {
+        answer = undefined;
+    }
+    if (response.status === 401) {
+        throw new ServerError(`${server.url} did not accept the token`);
+    }
+    if (!response.ok) {
+        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        throw new ServerError(`${server.url} answered ${response.status}${said}`);
+    }
+    return { status: response.status, body: answer };
+}
+exports.callServer = callServer;
+//# sourceMappingURL=server-client.js.map

package/dist/remote/source-manifest.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedSourcePath = exports.hashSource = exports.sourceManifestSchema = exports.DIGEST_PATTERN = exports.MAX_MANIFEST_BODY_BYTES = exports.MAX_SOURCE_BYTES = exports.MAX_SOURCE_FILE_BYTES = exports.MAX_SOURCE_FILES = void 0;
+const crypto_1 = require("crypto");
+const zod_1 = require("zod");
+const bundle_1 = require("./bundle");
+exports.MAX_SOURCE_FILES = 20000;
+exports.MAX_SOURCE_FILE_BYTES = 32 * 1024 * 1024;
+exports.MAX_SOURCE_BYTES = 1024 * 1024 * 1024;
+// a manifest is about 200 bytes per file
+exports.MAX_MANIFEST_BODY_BYTES = 8 * 1024 * 1024;
+exports.DIGEST_PATTERN = /^[0-9a-f]{64}$/;
+const sourceFileSchema = zod_1.z
+    .object({
+    path: zod_1.z.string(),
+    sha256: zod_1.z.string().regex(exports.DIGEST_PATTERN, 'expected 64 lowercase hex digits'),
+    size: zod_1.z.number().int().min(0).max(exports.MAX_SOURCE_FILE_BYTES),
+    mode: zod_1.z.enum(['file', 'exec']).default('file'),
+})
+    .strict();
+exports.sourceManifestSchema = zod_1.z
+    .object({ files: zod_1.z.array(sourceFileSchema).min(1).max(exports.MAX_SOURCE_FILES) })
+    .strict()
+    .superRefine((manifest, ctx) => {
+    const seen = new Set();
+    let bytes = 0;
+    manifest.files.forEach((file, index) => {
+        if (!(0, bundle_1.isBundlePath)(file.path)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['files', index, 'path'],
+                message: `"${file.path}" is not a path inside the project`,
+            });
+        }
+        if (seen.has(file.path)) {
+            ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files', index, 'path'], message: `${file.path} twice` });
+        }
+        seen.add(file.path);
+        bytes += file.size;
+    });
+    if (bytes > exports.MAX_SOURCE_BYTES) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files'], message: `more than ${exports.MAX_SOURCE_BYTES} bytes` });
+    }
+});
+// The name of a tree: the sha-256 of the JSON `[[path, sha-256, mode], ...]` in
+// path order. The same files have the same name wherever it is computed, and the
+// size is not part of it because the content digest already decides it.
+function hashSource(manifest) {
+    const files = [...manifest.files]
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))
+        .map((file) => [file.path, file.sha256, file.mode]);
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(JSON.stringify(files)).digest('hex')}`;
+}
+exports.hashSource = hashSource;
+const DENIED_DIRECTORIES = ['.git', '.ssh', '.aws', '.gnupg', '.kube'];
+const DENIED_NAMES = [
+    /^\.env$/i,
+    /^\.env\.(?!example$|sample$|template$|dist$)/i,
+    /^\.(npmrc|netrc|pypirc|dockercfg|git-credentials)$/i,
+    /^id_(rsa|dsa|ecdsa|ed25519)$/i,
+    /\.(pem|p12|pfx)$/i,
+];
+// Files that hold credentials are not sent to a server even when a `src` pattern
+// reaches them: a secret belongs in a secret provider, and a glob such as `**`
+// must not be what decides that a key leaves the machine.
+function deniedSourcePath(path) {
+    const parts = path.split('/');
+    const directory = parts.slice(0, -1).find((part) => DENIED_DIRECTORIES.includes(part));
+    if (directory !== undefined) {
+        return `${directory}/ holds credentials or history`;
+    }
+    const name = parts[parts.length - 1];
+    if (DENIED_NAMES.some((pattern) => pattern.test(name))) {
+        return `${name} looks like a credential file`;
+    }
+    return null;
+}
+exports.deniedSourcePath = deniedSourcePath;
+//# sourceMappingURL=source-manifest.js.map

package/dist/remote/text-diff.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffBundles = exports.diffLines = exports.visible = void 0;
+// Text from a proposal is shown to somebody who decides on it, so nothing in it may
+// rewrite the terminal or hide what it says: control and format characters (which
+// include the ones that reorder text) are shown as `?`. Long lines are not cut,
+// what is hidden behind a cut is what a reviewer needs to see.
+function visible(line) {
+    return line.replace(/\t/g, '  ').replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu, '?');
+}
+exports.visible = visible;
+// Beyond this many comparisons a file is shown whole instead of compared.
+const MAX_CELLS = 4000000;
+// The lines that differ, with `context` lines around each change.
+function diffLines(before, after, context = 2) {
+    if ((before.length + 1) * (after.length + 1) > MAX_CELLS) {
+        return undefined;
+    }
+    const n = before.length;
+    const m = after.length;
+    // lengths of the longest common suffixes
+    const table = Array.from({ length: n + 1 }, () => new Uint32Array(m + 1));
+    for (let i = n - 1; i >= 0; i--) {
+        for (let j = m - 1; j >= 0; j--) {
+            table[i][j] = before[i] === after[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+        }
+    }
+    const all = [];
+    let i = 0;
+    let j = 0;
+    while (i < n && j < m) {
+        if (before[i] === after[j]) {
+            all.push({ type: ' ', text: before[i] });
+            i++;
+            j++;
+        }
+        else if (table[i + 1][j] >= table[i][j + 1]) {
+            all.push({ type: '-', text: before[i++] });
+        }
+        else {
+            all.push({ type: '+', text: after[j++] });
+        }
+    }
+    while (i < n)
+        all.push({ type: '-', text: before[i++] });
+    while (j < m)
+        all.push({ type: '+', text: after[j++] });
+    const keep = new Array(all.length).fill(false);
+    all.forEach((line, index) => {
+        if (line.type !== ' ') {
+            for (let k = Math.max(0, index - context); k <= Math.min(all.length - 1, index + context); k++) {
+                keep[k] = true;
+            }
+        }
+    });
+    return all.filter((_, index) => keep[index]);
+}
+exports.diffLines = diffLines;
+const lines = (text) => (text === '' ? [] : text.replace(/\n$/, '').split('\n'));
+// What a proposal changes against the version it follows, file by file.
+function diffBundles(base, proposed) {
+    const out = [];
+    const before = base?.files ?? {};
+    const paths = [...new Set([...Object.keys(before), ...Object.keys(proposed.files)])].sort();
+    for (const path of paths) {
+        const old = before[path];
+        const next = proposed.files[path];
+        if (old === next) {
+            continue;
+        }
+        const status = old === undefined ? 'added' : next === undefined ? 'removed' : 'changed';
+        out.push(`--- ${visible(path)} (${status})`);
+        const compared = old !== undefined && next !== undefined ? diffLines(lines(old), lines(next)) : undefined;
+        if (compared) {
+            compared.forEach((line) => out.push(`${line.type} ${visible(line.text)}`));
+        }
+        else {
+            // added, removed or too large to compare: all of the old, then all of the new
+            lines(old ?? '').forEach((line) => out.push(`- ${visible(line)}`));
+            lines(next ?? '').forEach((line) => out.push(`+ ${visible(line)}`));
+        }
+    }
+    if (base && base.entry !== proposed.entry) {
+        out.unshift(`entry file: ${visible(base.entry)} -> ${visible(proposed.entry)}`);
+    }
+    return out;
+}
+exports.diffBundles = diffBundles;
+//# sourceMappingURL=text-diff.js.map

package/dist/schema/build-file-base-task-schema.js

@@ -11,6 +11,7 @@ const build_file_volume_schema_1 = require("./build-file-volume-schema");
 const duration_schema_1 = require("./duration-schema");
 const build_file_secret_schema_1 = require("./build-file-secret-schema");
 const resources_schema_1 = require("./resources-schema");
+const runner_schema_1 = require("./runner-schema");
 // what `extend` adds to (the rest, e.g. `image` or `shell`, the task just overrides)
 exports.RESET_PROPERTIES = ['deps', 'needs', 'src', 'generates', 'cmds', 'mounts', 'envs', 'labels'];
 exports.buildFileBaseTaskSchema = (0, zod_1.object)({
@@ -34,7 +35,12 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     // runs longer. Does not affect the cache key (ADR-0002).
     timeout: duration_schema_1.durationSchema.optional(),
     secrets: (0, zod_1.array)(build_file_secret_schema_1.buildFileSecretSchema).optional(),
+    // the service account its provider secrets are read as, unless a secret names one
+    account: (0, zod_1.string)().optional(),
     // CPU and memory limits of the container; a local task is not limited
     resources: resources_schema_1.resourcesSchema.optional(),
+    // Name of the server (see `hammerkit remote`) the task has to run on; defaults
+    // to the build file's `runner`. Never a local fallback when it is unknown.
+    runner: runner_schema_1.runnerSchema.optional(),
 });
 //# sourceMappingURL=build-file-base-task-schema.js.map

package/dist/schema/build-file-container-service-schema.js

@@ -36,6 +36,8 @@ exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     // passed; the service counts as ready for dependents only after it succeeded
     init: (0, zod_1.string)().describe('task run once the service is healthy, before dependents start').optional(),
     secrets: (0, zod_1.array)(build_file_secret_schema_1.buildFileSecretSchema).optional(),
+    // the service account its provider secrets are read as, unless a secret names one
+    account: (0, zod_1.string)().optional(),
     resources: resources_schema_1.resourcesSchema.optional(),
 })
     .strict()

package/dist/schema/build-file-schema.js

@@ -9,6 +9,8 @@ const build_file_task_schema_1 = require("./build-file-task-schema");
 const labels_schema_1 = require("./labels-schema");
 const cache_schema_1 = require("./cache-schema");
 const build_file_include_schema_1 = require("./build-file-include-schema");
+const build_file_secret_provider_schema_1 = require("./build-file-secret-provider-schema");
+const runner_schema_1 = require("./runner-schema");
 exports.buildFileSchema = (0, zod_1.object)({
     envs: envs_schema_1.envsSchema.optional(),
     tasks: (0, zod_1.record)(build_file_task_schema_1.buildFileTaskSchema).optional(),
@@ -17,7 +19,11 @@ exports.buildFileSchema = (0, zod_1.object)({
     includes: (0, zod_1.record)(build_file_include_schema_1.buildFileIncludeSchema).optional(),
     environments: (0, zod_1.record)(build_file_environment_schema_1.buildFileEnvironmentSchema).optional(),
     caches: (0, zod_1.record)(cache_schema_1.buildFileCacheSchema).optional(),
+    secretProviders: build_file_secret_provider_schema_1.buildFileSecretProvidersSchema.optional(),
+    secretAccounts: build_file_secret_provider_schema_1.buildFileSecretAccountsSchema.optional(),
     labels: labels_schema_1.labelsSchema.optional(),
+    // default `runner` of the tasks of this file
+    runner: runner_schema_1.runnerSchema.optional(),
 })
     .strict()
     .describe('Build file with support for containerization\nhttps://hammerkit.dev/docs/build-file');

package/dist/schema/build-file-secret-provider-schema.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildFileSecretAccountsSchema = exports.buildFileSecretProvidersSchema = exports.buildFileSecretAccountSchema = exports.buildFileSecretProviderSchema = exports.RESERVED_SECRET_PROVIDERS = void 0;
+const zod_1 = require("zod");
+const duration_schema_1 = require("./duration-schema");
+// `env` and `file` are the built-in sources of `from`, so a provider cannot take
+// either name.
+exports.RESERVED_SECRET_PROVIDERS = ['env', 'file'];
+const nameSchema = (0, zod_1.string)()
+    .regex(/^[A-Za-z][A-Za-z0-9_-]*$/, 'a name starts with a letter and holds letters, digits, - and _')
+    .refine((name) => !exports.RESERVED_SECRET_PROVIDERS.includes(name), 'env and file are built-in secret sources');
+// How to fetch a secret: a command that prints the value to stdout (ADR 0008).
+// The command is an argv list, never run through a shell. `{{ref}}` is replaced
+// by the text after `provider:` in a secret's `from`. It holds no credential:
+// those come from the account the secret is read as.
+exports.buildFileSecretProviderSchema = (0, zod_1.object)({
+    command: (0, zod_1.array)((0, zod_1.string)())
+        .min(1)
+        .describe('command and arguments, no shell; {{ref}} is replaced by the secret reference'),
+    env: (0, zod_1.record)((0, zod_1.string)()).optional().describe('static environment of the command, next to PATH and the account env'),
+    timeout: duration_schema_1.durationSchema.optional().describe('how long the command may run, 30s when omitted'),
+})
+    .strict()
+    .describe('secret provider, a command that prints the secret to stdout');
+// As whom a provider is read: the environment its command runs with. Values
+// are `${HOST_VARIABLE}` references to a credential the machine running
+// hammerkit holds, so a build file never carries one.
+exports.buildFileSecretAccountSchema = (0, zod_1.object)({
+    default: (0, zod_1.boolean)().optional().describe('the account for secrets and tasks that name none'),
+    providers: (0, zod_1.record)(nameSchema, (0, zod_1.object)({ env: (0, zod_1.record)((0, zod_1.string)()) }).strict()).describe('per provider, the environment that makes its command act as this account'),
+})
+    .strict()
+    .describe('service account the secret providers are read as');
+exports.buildFileSecretProvidersSchema = (0, zod_1.record)(nameSchema, exports.buildFileSecretProviderSchema);
+exports.buildFileSecretAccountsSchema = (0, zod_1.record)(nameSchema, exports.buildFileSecretAccountSchema);
+//# sourceMappingURL=build-file-secret-provider-schema.js.map

package/dist/schema/build-file-secret-schema.js

@@ -3,11 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildFileSecretSchema = void 0;
 const zod_1 = require("zod");
 // A credential handed to a task or service without putting it in the build
-// file, the cache or the logs: `from: env:NAME` or `from: file:path`, injected
+// file, the cache or the logs: `from: env:NAME`, `from: file:path` or
+// `from: <provider>:<ref>` (a secret provider, read as an account), injected
 // as an env variable (`env`) or a read-only file (`path`). `cache: true` makes
 // a salted digest of the value part of the task's cache key (ADR 0002).
 exports.buildFileSecretSchema = (0, zod_1.object)({
-    from: (0, zod_1.string)().regex(/^(env|file):.+$/, 'from must be env:NAME or file:path'),
+    from: (0, zod_1.string)().regex(/^[A-Za-z][A-Za-z0-9_-]*:.+$/, 'from must be env:NAME, file:path or <provider>:<ref>'),
+    // the service account a provider secret is read as, else the task's or service's, else the default
+    account: (0, zod_1.string)().optional(),
     env: (0, zod_1.string)()
         .regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
         .optional(),
@@ -18,5 +21,5 @@ exports.buildFileSecretSchema = (0, zod_1.object)({
     .refine((secret) => (secret.env === undefined) !== (secret.path === undefined), {
     message: 'a secret needs exactly one of env or path',
 })
-    .describe('secret from env:NAME or file:path, injected as env or a read-only file');
+    .describe('secret from env:NAME, file:path or <provider>:<ref>, injected as env or a read-only file');
 //# sourceMappingURL=build-file-secret-schema.js.map

package/dist/schema/reference-parser.js

@@ -9,6 +9,7 @@ const label_values_1 = require("../executer/label-values");
 const merge_environment_variables_1 = require("../environment/merge-environment-variables");
 const resolve_cache_1 = require("../cache/resolve-cache");
 const project_root_1 = require("../planner/project-root");
+const secret_catalog_1 = require("../secrets/secret-catalog");
 function combinePath(namePrefix, name) {
     return namePrefix.length > 0 ? `${namePrefix}:${name}` : name;
 }
@@ -21,6 +22,7 @@ async function parseReferences(ctx, mainScope, environment) {
         envFiles: {},
         environments: {},
         caches: {},
+        secrets: (0, secret_catalog_1.emptySecretCatalog)(),
         projectRoot: await (0, project_root_1.findProjectRoot)(mainScope.cwd, environment),
     };
     for (const file of Object.values(ctx.files)) {
@@ -90,6 +92,7 @@ async function parseReferences(ctx, mainScope, environment) {
         resolveInit(reference, service);
     }
     reference.caches = (0, resolve_cache_1.withBuiltinCaches)(declaredCaches);
+    reference.secrets = (0, secret_catalog_1.collectSecretCatalog)(Object.values(ctx.files), environment, reference);
     return reference;
 }
 exports.parseReferences = parseReferences;
@@ -118,6 +121,7 @@ function applySchemaExtension(reference, task) {
     task.schema.shell = task.schema.shell ?? extend.schema.shell;
     task.schema.cache = task.schema.cache ?? extend.schema.cache;
     task.schema.timeout = task.schema.timeout ?? extend.schema.timeout;
+    task.schema.runner = task.schema.runner ?? extend.schema.runner;
     if (!reset.has('cmds'))
         task.schema.cmds = extendArray(task.schema.cmds, extend.schema.cmds);
     if (!reset.has('src'))

package/dist/schema/runner-schema.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runnerSchema = void 0;
+const zod_1 = require("zod");
+const host_config_1 = require("../remote/host-config");
+// A server registered with `hammerkit remote add`; resolved on the machine that
+// runs the build, so the build file carries no URL.
+exports.runnerSchema = (0, zod_1.string)()
+    .min(1)
+    .refine((name) => !host_config_1.RESERVED_SERVER_NAMES.includes(name), {
+    message: 'local and auto are no servers, leave runner out to run where --on or the host config says',
+});
+//# sourceMappingURL=runner-schema.js.map