hanzio 2.2.0 → 3.1.0

package/dist/src/secrets/index.js

@@ -1,7 +1,7 @@
 import {
   HttpResponseError2,
   createApiClient2
-} from "../../index-zbj9s3s3.js";
+} from "../../index-2kz392vw.js";
 import {
   getViteDefine2,
   viteSecretSetPlugin2
@@ -19,7 +19,7 @@ import {
 } from "../../index-ktynw3vs.js";
 
 // src/secrets/infisical.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // src/secrets/infisical-cli.ts
 async function readInfisicalCliToken(options) {
@@ -102,12 +102,53 @@ function validateInfisicalOrganizationId(organizationId) {
   }
 }
 
-// src/secrets/infisical-session.ts
+// src/secrets/infisical-identity-file.ts
 import { z } from "zod";
-var sessionClaimsSchema = z.object({
-  organizationId: z.string().optional(),
-  subOrganizationId: z.string().optional(),
-  exp: z.number().finite().optional()
+var identityFileSchema = z.object({
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1),
+  siteUrl: z.string().url()
+});
+async function readInfisicalIdentityFile(env, siteUrl) {
+  const modules = await Promise.all([
+    import("node:fs/promises"),
+    import("node:os"),
+    import("node:path")
+  ]).catch(() => {
+    return;
+  });
+  if (!modules) {
+    return;
+  }
+  const [fs, os, path] = modules;
+  const file = env?.INFISICAL_UNIVERSAL_AUTH_FILE || path.join(os.homedir(), ".infisical", "universal-auth.json");
+  let text;
+  try {
+    text = await fs.readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return;
+    }
+    throw new SecretLoadError2("CONFIGURATION", `The Infisical identity file ${file} could not be read.`);
+  }
+  let identity;
+  try {
+    identity = identityFileSchema.parse(JSON.parse(text));
+  } catch {
+    throw new SecretLoadError2("CONFIGURATION", `The Infisical identity file ${file} is not valid; it needs clientId, clientSecret and siteUrl.`);
+  }
+  if (new URL(identity.siteUrl).origin !== new URL(siteUrl).origin) {
+    return;
+  }
+  return { clientId: identity.clientId, clientSecret: identity.clientSecret };
+}
+
+// src/secrets/infisical-session.ts
+import { z as z2 } from "zod";
+var sessionClaimsSchema = z2.object({
+  organizationId: z2.string().optional(),
+  subOrganizationId: z2.string().optional(),
+  exp: z2.number().finite().optional()
 });
 function parseInfisicalSessionToken(token) {
   let claims;
@@ -130,13 +171,13 @@ function parseInfisicalSessionToken(token) {
 // src/secrets/infisical.ts
 var DEFAULT_INFISICAL_SITE_URL = "https://eu.infisical.com";
 var defaultFetch = globalThis.fetch;
-var infisicalAuthResponseSchema = z2.object({ accessToken: z2.string() });
-var infisicalSecretSchema = z2.object({
-  secretKey: z2.string(),
-  secretValue: z2.string()
+var infisicalAuthResponseSchema = z3.object({ accessToken: z3.string() });
+var infisicalSecretSchema = z3.object({
+  secretKey: z3.string(),
+  secretValue: z3.string()
 });
-var infisicalSecretsResponseSchema = z2.object({
-  secrets: z2.array(infisicalSecretSchema)
+var infisicalSecretsResponseSchema = z3.object({
+  secrets: z3.array(infisicalSecretSchema)
 });
 async function fetchInfisicalSecrets(options) {
   validateInfisicalScope(options);
@@ -165,18 +206,20 @@ async function fetchInfisicalSecrets(options) {
 async function loadInfisicalSecrets(options) {
   validateInfisicalScope(options);
   const env = getProcessEnvironment();
-  const clientId = env?.[options.clientIdEnvKey];
-  const clientSecret = env?.[options.clientSecretEnvKey];
   const mode = options.auth ?? "auto";
   if (!["auto", "http", "cli"].includes(mode)) {
     throw new SecretLoadError2("CONFIGURATION", "Invalid Infisical auth mode.");
   }
+  const fromEnv = Boolean(env?.[options.clientIdEnvKey] || env?.[options.clientSecretEnvKey]);
+  const file = mode === "cli" || fromEnv ? undefined : await readInfisicalIdentityFile(env, options.siteUrl);
+  const clientId = fromEnv ? env?.[options.clientIdEnvKey] : file?.clientId;
+  const clientSecret = fromEnv ? env?.[options.clientSecretEnvKey] : file?.clientSecret;
   const useHttp = mode === "http" || mode === "auto" && Boolean(clientId && clientSecret);
   if (useHttp) {
     if (!clientId || !clientSecret) {
       throw new SecretLoadError2("AUTHENTICATION", "Infisical HTTP authentication requires both client credentials.");
     }
-    options.reportSource?.("Infisical HTTP");
+    options.reportSource?.(file ? "Infisical HTTP (identity file)" : "Infisical HTTP");
     return fetchInfisicalSecrets({ ...options, clientId, clientSecret });
   }
   options.reportSource?.(`Infisical CLI session (organization=${options.organizationId} project=${options.projectId} environment=${options.environment})`);
@@ -256,23 +299,23 @@ function createInfisicalApiClient(siteUrl) {
       selectOrganization: {
         method: "POST",
         path: "/api/v3/auth/select-organization",
-        reqHeadersSchema: z2.object({
-          Authorization: z2.string(),
-          "User-Agent": z2.string()
+        reqHeadersSchema: z3.object({
+          Authorization: z3.string(),
+          "User-Agent": z3.string()
         }),
-        reqBodySchema: z2.object({ organizationId: z2.string() }),
-        resSchema: z2.object({
-          token: z2.string().min(1),
-          isMfaEnabled: z2.boolean().optional()
+        reqBodySchema: z3.object({ organizationId: z3.string() }),
+        resSchema: z3.object({
+          token: z3.string().min(1),
+          isMfaEnabled: z3.boolean().optional()
         }),
         reqBodyFormat: "json"
       },
       login: {
         method: "POST",
         path: "/api/v1/auth/universal-auth/login",
-        reqBodySchema: z2.object({
-          clientId: z2.string(),
-          clientSecret: z2.string()
+        reqBodySchema: z3.object({
+          clientId: z3.string(),
+          clientSecret: z3.string()
         }),
         resSchema: infisicalAuthResponseSchema,
         reqBodyFormat: "json"
@@ -280,16 +323,16 @@ function createInfisicalApiClient(siteUrl) {
       listSecrets: {
         method: "GET",
         path: "/api/v4/secrets",
-        reqHeadersSchema: z2.object({
-          Authorization: z2.string()
+        reqHeadersSchema: z3.object({
+          Authorization: z3.string()
         }),
-        reqQuerySchema: z2.object({
-          projectId: z2.string(),
-          environment: z2.string(),
-          secretPath: z2.string(),
-          viewSecretValue: z2.boolean(),
-          expandSecretReferences: z2.boolean(),
-          includeImports: z2.boolean()
+        reqQuerySchema: z3.object({
+          projectId: z3.string(),
+          environment: z3.string(),
+          secretPath: z3.string(),
+          viewSecretValue: z3.boolean(),
+          expandSecretReferences: z3.boolean(),
+          includeImports: z3.boolean()
         }),
         resSchema: infisicalSecretsResponseSchema
       }

package/dist/src/sitemap/index.js

@@ -3,7 +3,7 @@ import {
 } from "../../index-pwt0dz63.js";
 import {
   escapeRegExp2
-} from "../../index-kj1phgrx.js";
+} from "../../index-29mmh343.js";
 import {
   normalizeDomain2
 } from "../../index-mnkcfyx8.js";

package/dist/src/storage/index.js

@@ -1,119 +1,10 @@
-// src/storage/index.ts
-function createMemoryStorage() {
-  const map = new Map;
-  return {
-    getItem: (key) => map.get(key) ?? null,
-    setItem: (key, value) => {
-      map.set(key, String(value));
-    },
-    removeItem: (key) => {
-      map.delete(key);
-    }
-  };
-}
-var sharedMemoryStorage;
-function defaultStorage() {
-  try {
-    const storage = globalThis.localStorage;
-    if (storage)
-      return storage;
-  } catch {}
-  sharedMemoryStorage ??= createMemoryStorage();
-  return sharedMemoryStorage;
-}
-function createCodec(options) {
-  const {
-    fallback,
-    parse = (raw) => raw,
-    serialize = JSON.stringify,
-    deserialize = JSON.parse
-  } = options;
-  return {
-    serialize,
-    decode(raw) {
-      if (raw === null)
-        return fallback;
-      try {
-        return parse(deserialize(raw));
-      } catch {
-        return fallback;
-      }
-    }
-  };
-}
-function createStorageItem(options) {
-  const { key, fallback, storage = defaultStorage() } = options;
-  const { serialize, decode } = createCodec(options);
-  let mirror;
-  const write = (value, action) => {
-    try {
-      action();
-      mirror = undefined;
-    } catch {
-      mirror = { value };
-    }
-  };
-  const get = () => {
-    if (mirror)
-      return mirror.value;
-    try {
-      return decode(storage.getItem(key));
-    } catch {
-      return fallback;
-    }
-  };
-  return {
-    key,
-    get,
-    set: (value) => write(value, () => storage.setItem(key, serialize(value))),
-    remove: () => write(fallback, () => storage.removeItem(key)),
-    subscribe(listener) {
-      const target = globalThis;
-      if (!target.addEventListener || !target.removeEventListener) {
-        return () => {};
-      }
-      const onStorage = (event) => {
-        if (event.storageArea !== storage)
-          return;
-        if (event.key !== key && event.key !== null)
-          return;
-        mirror = undefined;
-        listener(get());
-      };
-      target.addEventListener("storage", onStorage);
-      return () => target.removeEventListener?.("storage", onStorage);
-    }
-  };
-}
-function createAsyncStorageItem(options) {
-  const { key, fallback, storage } = options;
-  const { serialize, decode } = createCodec(options);
-  let mirror;
-  const write = async (value, action) => {
-    try {
-      await action();
-      mirror = undefined;
-    } catch {
-      mirror = { value };
-    }
-  };
-  return {
-    key,
-    async get() {
-      if (mirror)
-        return mirror.value;
-      try {
-        return decode(await storage.getItem(key));
-      } catch {
-        return fallback;
-      }
-    },
-    set: (value) => write(value, () => storage.setItem(key, serialize(value))),
-    remove: () => write(fallback, () => storage.removeItem(key))
-  };
-}
+import {
+  createMemoryStorage2,
+  createStorageItem2,
+  createAsyncStorageItem2
+} from "../../index-mq2qgc20.js";
 export {
-  createAsyncStorageItem,
-  createMemoryStorage,
-  createStorageItem
+  createAsyncStorageItem2 as createAsyncStorageItem,
+  createMemoryStorage2 as createMemoryStorage,
+  createStorageItem2 as createStorageItem
 };

package/dist/src/testing/index.js

@@ -0,0 +1,348 @@
+// src/testing/connection-auth-contract.ts
+var cloneResponse = (response) => response.clone();
+async function connectionAuthContract(input) {
+  const { beforeEach, describe, expect, test } = await import("bun:test");
+  describe("shared authentication contract", () => {
+    beforeEach(input.reset);
+    function provider(respond) {
+      let exchanges = 0;
+      const usedTokens = [];
+      const fetchImpl = async (url, init) => {
+        const login = input.isLogin(String(url));
+        if (login)
+          exchanges += 1;
+        else
+          usedTokens.push(new Headers(init?.headers).get(input.tokenHeader));
+        return respond(login, init ?? {});
+      };
+      return { fetchImpl, usedTokens, exchanges: () => exchanges };
+    }
+    test.each(input.identityChanges)("%s changes authentication identity", async (variant) => {
+      const fake = provider((login) => login ? input.loginResponse(`token-${fake.exchanges()}`) : input.readResponse());
+      await input.create(fake.fetchImpl).read();
+      await input.create(fake.fetchImpl, variant).read();
+      expect(fake.exchanges()).toBe(2);
+      expect(fake.usedTokens[1]).not.toBe(fake.usedTokens[0]);
+    });
+    test("non-auth settings reuse completed authentication across instances", async () => {
+      const fake = provider((login) => login ? input.loginResponse("same") : input.readResponse());
+      await input.create(fake.fetchImpl).read();
+      await input.create(fake.fetchImpl, "settings").read();
+      expect(fake.exchanges()).toBe(1);
+    });
+    test("unrelated connections proceed while another login is blocked", async () => {
+      const pending = Promise.withResolvers();
+      const fake = provider((login) => {
+        if (!login)
+          return input.readResponse();
+        return fake.exchanges() === 1 ? pending.promise : input.loginResponse("independent");
+      });
+      const blocked = input.create(fake.fetchImpl).read();
+      await input.create(fake.fetchImpl, "connection").read();
+      expect(fake.exchanges()).toBe(2);
+      pending.resolve(input.loginResponse("blocked"));
+      await blocked;
+    });
+    test("failed shared refresh is evicted and a later attempt recovers", async () => {
+      const pending = Promise.withResolvers();
+      const fake = provider((login) => login ? pending.promise.then(cloneResponse) : input.readResponse());
+      const results = Promise.allSettled(Array.from({ length: 3 }, () => input.create(fake.fetchImpl).read()));
+      pending.reject(new Error("provider unavailable"));
+      expect((await results).map((result) => result.status)).toEqual([
+        "rejected",
+        "rejected",
+        "rejected"
+      ]);
+      expect(fake.exchanges()).toBe(1);
+      const recovered = provider((login) => login ? input.loginResponse("recovered") : input.readResponse());
+      await input.create(recovered.fetchImpl).read();
+      expect(recovered.exchanges()).toBe(1);
+    });
+    test("simultaneous 401s share one refresh, and a delayed 401 cannot evict it", async () => {
+      const rejected = Array.from({ length: 3 }, () => Promise.withResolvers());
+      const requestsStarted = Promise.withResolvers();
+      const refresh = Promise.withResolvers();
+      let oldRequests = 0;
+      const fake = provider((login, init) => {
+        if (login)
+          return fake.exchanges() === 1 ? input.loginResponse("A") : refresh.promise.then(cloneResponse);
+        const header = new Headers(init.headers).get(input.tokenHeader);
+        if (header === (input.tokenHeader === "authorization" ? "Bearer A" : "A")) {
+          const response = rejected[oldRequests++];
+          if (oldRequests === 3)
+            requestsStarted.resolve();
+          return response.promise;
+        }
+        return input.readResponse();
+      });
+      await input.create(fake.fetchImpl).login();
+      const reads = Array.from({ length: 3 }, () => input.create(fake.fetchImpl).read());
+      await requestsStarted.promise;
+      rejected[0].resolve(new Response("", { status: 401 }));
+      rejected[1].resolve(new Response("", { status: 401 }));
+      refresh.resolve(input.loginResponse("B"));
+      await Promise.all(reads.slice(0, 2));
+      rejected[2].resolve(new Response("", { status: 401 }));
+      await reads[2];
+      expect(fake.exchanges()).toBe(2);
+      expect(fake.usedTokens).toHaveLength(6);
+      expect(fake.usedTokens.slice(3)).toEqual(Array(3).fill(input.tokenHeader === "authorization" ? "Bearer B" : "B"));
+    });
+    test("a delayed 401 cannot evict a new generation with identical token bytes", async () => {
+      const rejected = Promise.withResolvers();
+      const started = Promise.withResolvers();
+      let reads = 0;
+      const fake = provider((login) => {
+        if (login)
+          return input.loginResponse("same");
+        reads += 1;
+        if (reads === 1) {
+          started.resolve();
+          return rejected.promise;
+        }
+        return input.readResponse();
+      });
+      await input.create(fake.fetchImpl).login();
+      const oldRead = input.create(fake.fetchImpl).read();
+      await started.promise;
+      await input.create(fake.fetchImpl).login();
+      rejected.resolve(new Response("", { status: 401 }));
+      await oldRead;
+      expect(fake.exchanges()).toBe(2);
+      expect(reads).toBe(2);
+    });
+    test("failed fresh authentication cannot fall back to the previous completed token", async () => {
+      const fake = provider((login) => {
+        if (!login)
+          return input.readResponse();
+        if (fake.exchanges() === 2)
+          throw new Error("credentials rejected");
+        return input.loginResponse("valid");
+      });
+      await input.create(fake.fetchImpl).read();
+      await expect(input.create(fake.fetchImpl).login()).rejects.toThrow("credentials rejected");
+      await input.create(fake.fetchImpl).read();
+      expect(fake.exchanges()).toBe(3);
+    });
+    test("a late old login cannot replace rotated authentication", async () => {
+      const pending = Promise.withResolvers();
+      const fake = provider((login) => {
+        if (!login)
+          return input.readResponse();
+        return fake.exchanges() === 1 ? pending.promise : input.loginResponse("new");
+      });
+      const old = input.create(fake.fetchImpl).read();
+      await input.create(fake.fetchImpl, "secret").read();
+      pending.resolve(input.loginResponse("old"));
+      await old;
+      await input.create(fake.fetchImpl, "secret").read();
+      expect(fake.exchanges()).toBe(2);
+      expect(fake.usedTokens.at(-1)).toBe(input.tokenHeader === "authorization" ? "Bearer new" : "new");
+    });
+    test("fresh logins bypass completed tokens and coalesce identical pending checks", async () => {
+      const pending = Promise.withResolvers();
+      const fake = provider((login) => {
+        if (!login)
+          return input.readResponse();
+        return fake.exchanges() === 1 ? input.loginResponse("warm") : pending.promise.then(cloneResponse);
+      });
+      await input.create(fake.fetchImpl).read();
+      const checks = Array.from({ length: 3 }, () => input.create(fake.fetchImpl).login());
+      expect(fake.exchanges()).toBe(2);
+      pending.resolve(input.loginResponse("fresh"));
+      expect(await Promise.all(checks)).toEqual(["fresh", "fresh", "fresh"]);
+    });
+    test("aborting the initiating waiter leaves the shared refresh running", async () => {
+      const pending = Promise.withResolvers();
+      const fake = provider((login, init) => {
+        if (!login)
+          return input.readResponse();
+        expect(init.signal).toBeUndefined();
+        return pending.promise;
+      });
+      const controller = new AbortController;
+      const cancelled = input.create(fake.fetchImpl).login({ signal: controller.signal });
+      const survivor = input.create(fake.fetchImpl).read();
+      controller.abort(new Error("wait cancelled"));
+      await expect(cancelled).rejects.toThrow("wait cancelled");
+      pending.resolve(input.loginResponse("survived"));
+      await survivor;
+      await input.create(fake.fetchImpl).read();
+      expect(fake.exchanges()).toBe(1);
+    });
+    test("a pre-aborted waiter starts no exchange", async () => {
+      const fake = provider(() => {
+        throw new Error("unexpected fetch");
+      });
+      const controller = new AbortController;
+      controller.abort(new Error("already cancelled"));
+      await expect(input.create(fake.fetchImpl).login({ signal: controller.signal })).rejects.toThrow("already cancelled");
+      expect(fake.exchanges()).toBe(0);
+    });
+    test("a second 401 is surfaced without expanding the retry budget", async () => {
+      const fake = provider((login) => login ? input.loginResponse("rejected") : new Response("", { status: 401 }));
+      await expect(input.create(fake.fetchImpl).read()).rejects.toMatchObject({
+        status: 401
+      });
+      expect(fake.exchanges()).toBe(2);
+      expect(fake.usedTokens).toHaveLength(2);
+    });
+  });
+}
+// src/testing/helpers.ts
+var noop = () => {};
+var noopLogger = {
+  trace: noop,
+  debug: noop,
+  info: noop,
+  warn: noop,
+  error: noop,
+  fatal: noop,
+  bind: () => noopLogger,
+  child: () => noopLogger
+};
+function mockCallArg(fn, callIndex = 0, argIndex = 0) {
+  return fn.mock.calls[callIndex]?.[argIndex];
+}
+// src/testing/module-mocker.ts
+class ModuleMocker {
+  resolve;
+  restorers = [];
+  constructor(resolve = (specifier) => specifier) {
+    this.resolve = resolve;
+  }
+  async mock(specifier, renderMocks) {
+    const { mock } = await import("bun:test");
+    const resolved = this.resolve(specifier);
+    const original = { ...await import(resolved) };
+    const merged = { ...original, ...renderMocks() };
+    mock.module(resolved, () => merged);
+    this.restorers.push(() => {
+      mock.module(resolved, () => original);
+    });
+  }
+  clear() {
+    for (const restore of this.restorers)
+      restore();
+    this.restorers = [];
+  }
+}
+// src/testing/prisma.ts
+function createPrismaMock(createMock) {
+  const created = [];
+  const reset = () => {
+    for (const method of created)
+      method.mockReset();
+  };
+  const methodsOf = (methods, key) => {
+    let method = methods.get(key);
+    if (!method) {
+      method = createMock();
+      created.push(method);
+      methods.set(key, method);
+    }
+    return method;
+  };
+  const delegates = new Map;
+  const rootMethods = new Map;
+  const delegateFor = (model) => {
+    let delegate = delegates.get(model);
+    if (!delegate) {
+      const methods = new Map;
+      delegate = new Proxy({}, {
+        get: (_target, method) => typeof method === "symbol" ? undefined : methodsOf(methods, method)
+      });
+      delegates.set(model, delegate);
+    }
+    return delegate;
+  };
+  return new Proxy({}, {
+    get(_target, property) {
+      if (property === "$reset")
+        return reset;
+      if (typeof property === "symbol")
+        return;
+      if (property.startsWith("$"))
+        return methodsOf(rootMethods, property);
+      return delegateFor(property);
+    }
+  });
+}
+// src/testing/window.ts
+function createTestStorage() {
+  const store = new Map;
+  return {
+    get length() {
+      return store.size;
+    },
+    clear: () => store.clear(),
+    getItem: (key) => store.get(key) ?? null,
+    key: (index) => [...store.keys()][index] ?? null,
+    removeItem: (key) => {
+      store.delete(key);
+    },
+    setItem: (key, value) => {
+      store.set(key, String(value));
+    }
+  };
+}
+var noop2 = () => {};
+function locationOf(href) {
+  const { origin, protocol, host, hostname, port, pathname, search, hash } = new URL(href);
+  return {
+    href,
+    origin,
+    protocol,
+    host,
+    hostname,
+    port,
+    pathname,
+    search,
+    hash
+  };
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function installWindowShim(href = "http://localhost/") {
+  const shim = {
+    location: locationOf(href),
+    addEventListener: noop2,
+    removeEventListener: noop2,
+    localStorage: createTestStorage()
+  };
+  const assign = (value) => {
+    if (!isObject(value))
+      return;
+    if (value.localStorage)
+      shim.localStorage = value.localStorage;
+    shim.location = isObject(value.location) && typeof value.location.href === "string" ? value.location : locationOf(href);
+    shim.addEventListener = typeof value.addEventListener === "function" ? value.addEventListener : noop2;
+    shim.removeEventListener = typeof value.removeEventListener === "function" ? value.removeEventListener : noop2;
+  };
+  const install = () => {
+    Object.defineProperty(globalThis, "window", {
+      configurable: true,
+      enumerable: true,
+      get: () => shim,
+      set: assign
+    });
+  };
+  install();
+  return () => {
+    shim.location = locationOf(href);
+    shim.addEventListener = noop2;
+    shim.removeEventListener = noop2;
+    shim.localStorage = createTestStorage();
+    install();
+  };
+}
+export {
+  ModuleMocker,
+  connectionAuthContract,
+  createPrismaMock,
+  createTestStorage,
+  installWindowShim,
+  mockCallArg,
+  noopLogger
+};