koppler 0.0.0-stage → 0.0.1

package/dist/scrub.js

@@ -0,0 +1,87 @@
+// Text made safe to show or post. `redact` masks secrets, for anything that reaches the page or an agent. `scrub` goes
+// further, for a public issue: everything that names the user, their company or their stack (apps, repos, hosts,
+// queues, paths, ticket ids, accounts) becomes a stable placeholder, so a log keeps its shape.
+import os from 'node:os';
+const SECRET_SETTING = /(password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|account[_-]?key)(\\?["']?\s*[=:]\s*)(?:(\\?["'])[^\n]*?\3|[^;"'\s]+)/gi;
+/** Masks what logs echo on errors: connection strings, tokens, keys. Terminal colours go too. */
+export const redact = (text) => text
+    .replace(/\x1b\[[0-9;]*[A-Za-z]/g, '')
+    .replace(SECRET_SETTING, (_all, key, separator, quote = '') => `${key}${separator}${String(quote)}***${String(quote)}`)
+    .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, '***private key***')
+    .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s@]+@/gi, '$1***:***@')
+    .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]{8,}@/gi, '$1***@')
+    .replace(/([?&;]sig=)[^&\s;"']+/gi, '$1***')
+    .replace(/\b(Basic\s+)[A-Za-z0-9+/=]{8,}/g, '$1***')
+    .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g, '***jwt***')
+    .replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/g, '$1***')
+    .replace(/\b(gh[pousr]_|github_pat_|glpat-|npm_|xox[abpsr]-|sk-|[sr]k_(?:live|test)_)[A-Za-z0-9_-]{10,}/g, '***token***')
+    .replace(/\b(AKIA|ASIA)[A-Z0-9]{16}\b/g, '***aws-key***');
+const HOST = /\b(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z][a-z0-9-]*[a-z0-9]\b/gi;
+const GENERIC = new Set(['localhost', 'example.com', 'github.com', 'host.docker.internal']);
+const FILE_NAME = /\.(json|js|mjs|ya?ml|toml|cs|dart|md)$/i;
+const escaped = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+// Not glued to a word or a dash on either side.
+const whole = (text) => new RegExp(`(?<![\\w-])${escaped(text)}(?![\\w-])`, 'gi');
+const text = (value) => (typeof value === 'string' ? value : '');
+/** Every name the stacks give away, each with its placeholder; a log can come from a stack used before this one. */
+export function namesOf(registries) {
+    const names = new Map();
+    const add = (value, as) => {
+        const term = text(value).trim();
+        if (term.length > 2 && !names.has(term.toLowerCase()))
+            names.set(term.toLowerCase(), { term, as });
+    };
+    // A name as written, and as code writes it ("Orders API" and "OrdersAPI").
+    const named = (name, as) => {
+        add(name, as);
+        add(text(name).replace(/[\s_-]+/g, ''), as.replace(/\s+/g, ''));
+    };
+    let apps = 0;
+    let queues = 0;
+    let stacks = 0;
+    let boards = 0;
+    for (const registry of [registries ?? []].flat().filter(Boolean)) {
+        named(registry.name, `my-stack-${String(++stacks)}`);
+        for (const [id, app] of Object.entries(registry.apps ?? {})) {
+            const n = String(++apps);
+            named(app.name, `App ${n}`);
+            add(id, `app-${n}`);
+            for (const part of text(app.slug).split('/').slice(-2))
+                add(part, `repo-${n}`);
+        }
+        for (const preset of registry.presets ?? [])
+            named(preset?.name, `Board ${String(++boards)}`);
+        for (const [id, queue] of Object.entries(registry.queues ?? {})) {
+            const n = String(++queues);
+            named(queue.name, `Queue ${n}`);
+            add(id, `queue-${n}`);
+            add(queue.queue, `queue-${n}`);
+            for (const overlay of Object.values(queue.envs ?? {}))
+                add(overlay.queue, `queue-${n}`);
+        }
+    }
+    const hosts = new Set(JSON.stringify(registries ?? {}).match(HOST) ?? []);
+    [...hosts]
+        .filter(host => !GENERIC.has(host.toLowerCase()) && !FILE_NAME.test(host))
+        .forEach((host, at) => {
+        add(host, `host-${String(at + 1)}.example`);
+    });
+    return names;
+}
+export function scrub(given, registries, { home = os.homedir(), user = os.userInfo().username } = {}) {
+    let out = redact(typeof given === 'string' ? given : String(given));
+    if (home)
+        out = out.split(home).join('~');
+    // Longest first, so "orders-api.acme.dev" goes before "orders-api".
+    const byLength = [...namesOf(registries).values()].sort((a, b) => b.term.length - a.term.length);
+    // A long name is replaced even when glued to other text (".NETOrders API"); a short one only as a whole word.
+    for (const { term, as } of byLength)
+        out = out.replace(term.length >= 8 ? new RegExp(escaped(term), 'gi') : whole(term), as);
+    return out
+        .replace(whole(user), 'user')
+        .replace(/[\w.+-]+@[\w-]+(?:\.[\w-]+)+/g, 'someone@example.com')
+        .replace(/\b[A-Z][A-Z0-9]+-\d+\b/g, 'TICKET-1')
+        .replace(/\b\d{12}\b/g, '<account>')
+        .replace(/\b(?!127\.|0\.0\.0\.0)(?:\d{1,3}\.){3}\d{1,3}\b/g, '<ip>');
+}
+//# sourceMappingURL=scrub.js.map

package/dist/scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub.js","sourceRoot":"","sources":["../src/scrub.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,iHAAiH;AACjH,+FAA+F;AAC/F,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,cAAc,GAClB,qIAAqI,CAAC;AACxI,iGAAiG;AACjG,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI;KACD,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;KACrC,OAAO,CACN,cAAc,EACd,CAAC,IAAI,EAAE,GAAW,EAAE,SAAiB,EAAE,KAAK,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9G;KACA,OAAO,CAAC,mFAAmF,EAAE,mBAAmB,CAAC;KACjH,OAAO,CAAC,gDAAgD,EAAE,YAAY,CAAC;KACvE,OAAO,CAAC,2CAA2C,EAAE,QAAQ,CAAC;KAC9D,OAAO,CAAC,yBAAyB,EAAE,OAAO,CAAC;KAC3C,OAAO,CAAC,iCAAiC,EAAE,OAAO,CAAC;KACnD,OAAO,CAAC,iEAAiE,EAAE,WAAW,CAAC;KACvF,OAAO,CAAC,sCAAsC,EAAE,OAAO,CAAC;KACxD,OAAO,CACN,gGAAgG,EAChG,aAAa,CACd;KACA,OAAO,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;AAE9D,MAAM,IAAI,GAAG,qEAAqE,CAAC;AACnF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC5F,MAAM,SAAS,GAAG,yCAAyC,CAAC;AAC5D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAC9E,gDAAgD;AAChD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AAU1F,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1E,oHAAoH;AACpH,MAAM,UAAU,OAAO,CAAC,UAAmB;IACzC,MAAM,KAAK,GAAU,IAAI,GAAG,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,EAAU,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC;IACF,2EAA2E;IAC3E,MAAM,KAAK,GAAG,CAAC,IAAa,EAAE,EAAU,EAAE,EAAE;QAC1C,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,QAAQ,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,CAAY,EAAE,CAAC;QAC5E,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE;YAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YAC3B,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAChC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YACtB,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;YAC/B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC,GAAG,KAAK,CAAC;SACP,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACzE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;QACpB,GAAG,CAAC,IAAI,EAAE,QAAQ,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACL,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,KAAc,EACd,UAAmB,EACnB,EAAE,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;IAE3D,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,IAAI;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,oEAAoE;IACpE,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjG,8GAA8G;IAC9G,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,QAAQ;QACjC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,GAAG;SACP,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;SAC5B,OAAO,CAAC,+BAA+B,EAAE,qBAAqB,CAAC;SAC/D,OAAO,CAAC,yBAAyB,EAAE,UAAU,CAAC;SAC9C,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC;SACnC,OAAO,CAAC,kDAAkD,EAAE,MAAM,CAAC,CAAC;AACzE,CAAC"}

package/dist/secret-check.mjs

@@ -0,0 +1,262 @@
+// Checks that a stored credential really works, by connecting to the address inside the value itself.
+// Says only the outcome: never the value, and never the server's own message (it can echo names from the value).
+// A value is only ever sent to the host it names; nothing in stack.json can point a test somewhere else.
+import { execFile, execFileSync } from 'node:child_process';
+import net from 'node:net';
+import tls from 'node:tls';
+import { SECRET_TYPES } from "./core/secret-types.js";
+import { clientEnv, findClient } from "./safe-env.js";
+export const TYPES = SECRET_TYPES;
+const PORTS = { postgres: 5432, mysql: 3306, redis: 6379 };
+/** "Key=Value;Key=Value" as .NET writes it; a quoted value may hold a semicolon. */
+export function keyValues(value) {
+    const out = {};
+    for (const [, key = '', written = ''] of value.matchAll(/\s*([^=;]+?)\s*=\s*("(?:[^"]|"")*"|'(?:[^']|'')*'|[^;]*)\s*(?:;|$)/g)) {
+        const inside = written.slice(1, -1);
+        out[key.toLowerCase()] = /^".*"$/.test(written)
+            ? inside.replaceAll('""', '"')
+            : /^'.*'$/.test(written)
+                ? inside.replaceAll("''", "'")
+                : written;
+    }
+    return out;
+}
+const pick = (pairs, ...names) => names.map(name => pairs[name]).find(value => value !== undefined && value !== '');
+/** A StackExchange.Redis value: "host:port,password=...,ssl=true". */
+function redisOptions(written) {
+    const options = written
+        .split(',')
+        .filter(Boolean)
+        .map((option) => {
+        const at = option.indexOf('=');
+        return at < 0 ? [option.toLowerCase(), 'true'] : [option.slice(0, at).trim().toLowerCase(), option.slice(at + 1)];
+    });
+    return Object.fromEntries(options);
+}
+/**
+ * Where the value points and how to sign in, or null when it is not a connection Koppler reads. `type` comes from the
+ * stack, else from the value's shape.
+ */
+export function parse(value, type) {
+    const text = value.trim();
+    const scheme = /^(postgres(?:ql)?|mysql|rediss?):\/\//i.exec(text)?.[1]?.toLowerCase();
+    if (scheme) {
+        let url;
+        try {
+            url = new URL(text);
+        }
+        catch {
+            return null;
+        }
+        const kind = scheme.startsWith('postgres') ? 'postgres' : scheme.startsWith('redis') ? 'redis' : 'mysql';
+        return {
+            type: type ?? kind,
+            host: url.hostname,
+            port: Number(url.port) || PORTS[kind],
+            user: decodeURIComponent(url.username),
+            password: decodeURIComponent(url.password),
+            database: decodeURIComponent(url.pathname.slice(1)),
+            tls: scheme === 'rediss',
+        };
+    }
+    const [, redisHost, redisPort, redisRest] = /^([\w.-]+)(?::(\d+))?((?:,[^,]*)*)$/.exec(text) ?? [];
+    if (redisHost !== undefined && (type === 'redis' || (!type && (redisPort || redisRest) && !text.includes(';')))) {
+        const options = redisOptions(redisRest ?? '');
+        return {
+            type: 'redis',
+            host: redisHost,
+            port: Number(redisPort) || PORTS.redis,
+            user: options['user'] ?? '',
+            password: options['password'] ?? '',
+            tls: /^true$/i.test(options['ssl'] ?? ''),
+        };
+    }
+    const pairs = keyValues(text);
+    const host = pick(pairs, 'host', 'server', 'data source', 'datasource', 'address');
+    const user = pick(pairs, 'username', 'user id', 'userid', 'user', 'uid');
+    if (!host || !user)
+        return null;
+    const port = Number(pick(pairs, 'port')) || null;
+    // "Server=" is written for both; without a type the port decides.
+    const postgresWords = pairs['host'] !== undefined || pairs['username'] !== undefined;
+    const byShape = postgresWords
+        ? 'postgres'
+        : port === 3306
+            ? 'mysql'
+            : port === 5432
+                ? 'postgres'
+                : pairs['uid'] !== undefined
+                    ? 'mysql'
+                    : null;
+    const kind = type ?? byShape;
+    if (!kind)
+        return { type: null };
+    return {
+        type: kind,
+        host: host.split(',')[0] ?? '',
+        port: port ?? PORTS[kind],
+        user,
+        password: pick(pairs, 'password', 'pwd') ?? '',
+        database: pick(pairs, 'database', 'db', 'initial catalog') ?? '',
+    };
+}
+const run = (command, args, env) => new Promise(resolve => {
+    execFile(command, args, { env: clientEnv(env), timeout: 20000, maxBuffer: 256 * 1024 }, (error, stdout, stderr) => {
+        resolve({ ok: !error, text: `${stdout}${stderr}` });
+    });
+});
+const REFUSED = /password authentication failed|access denied|no pg_hba\.conf entry|WRONGPASS|NOAUTH|invalid username-password|invalid password/i;
+const UNREACHED = /connection refused|could not connect|can't connect|timeout|timed out|server closed the connection|could not translate|unknown (mysql )?server host|ECONNREFUSED|ENOTFOUND|ECONNRESET|EHOSTUNREACH/i;
+const REJECTED = 'failed: it rejected the connection';
+/** The server's message decides the wording; the message itself is never passed on. */
+const reason = (text) => {
+    if (REFUSED.test(text))
+        return 'failed: it refused the user name or password';
+    if (UNREACHED.test(text))
+        return 'failed: nothing answers at its address (is the tunnel up?)';
+    if (/does not exist|unknown database/i.test(text))
+        return 'failed: the database or user does not exist on that server';
+    return REJECTED;
+};
+const outcomeOf = (ran) => ran.ok ? { code: 0, message: 'connected' } : { code: 1, message: reason(ran.text) };
+async function postgres(to) {
+    const psql = findClient('psql', 'libpq');
+    if (!psql)
+        return { code: 2, message: 'cannot test: psql is not installed (brew install libpq)' };
+    const args = [
+        '-h',
+        to.host,
+        '-p',
+        String(to.port),
+        '-U',
+        to.user,
+        '-d',
+        to.database || 'postgres',
+        '-XAtc',
+        'select 1',
+    ];
+    return outcomeOf(await run(psql, args, { PGPASSWORD: to.password, PGCONNECT_TIMEOUT: '10' }));
+}
+async function mysql(to) {
+    const client = findClient('mysql', 'mysql-client');
+    if (!client)
+        return { code: 2, message: 'cannot test: the mysql client is not installed (brew install mysql-client)' };
+    const database = to.database ? ['-D', to.database] : [];
+    const args = [
+        '--connect-timeout=10',
+        '-h',
+        to.host,
+        '-P',
+        String(to.port),
+        '-u',
+        to.user,
+        ...database,
+        '-N',
+        '-e',
+        'select 1',
+    ];
+    return outcomeOf(await run(client, args, { MYSQL_PWD: to.password }));
+}
+/** Redis and Valkey speak a plain line protocol, so no client is needed: sign in if there is a password, then PING. */
+function redis(to) {
+    return new Promise(resolve => {
+        const options = { host: to.host, port: to.port, timeout: 10000 };
+        const socket = to.tls
+            ? tls.connect({ ...options, ...(!net.isIP(to.host) && { servername: to.host }) })
+            : net.connect(options);
+        const done = (code, message) => {
+            socket.destroy();
+            resolve({ code, message });
+        };
+        const send = (...parts) => {
+            const sized = parts.map(part => `$${String(Buffer.byteLength(part))}\r\n${part}\r\n`);
+            socket.write(`*${String(parts.length)}\r\n${sized.join('')}`);
+        };
+        let waiting = to.password ? 'auth' : 'ping';
+        let seen = '';
+        socket.once(to.tls ? 'secureConnect' : 'connect', () => {
+            if (waiting === 'auth')
+                send('AUTH', ...(to.user ? [to.user] : []), to.password);
+            else
+                send('PING');
+        });
+        socket.on('data', (chunk) => {
+            seen += chunk.toString();
+            if (!seen.includes('\r\n'))
+                return;
+            const line = seen.split('\r\n')[0] ?? '';
+            seen = '';
+            if (line.startsWith('-'))
+                done(1, reason(/NOAUTH|WRONGPASS|invalid/i.test(line) ? line : 'rejected'));
+            else if (waiting === 'auth') {
+                waiting = 'ping';
+                send('PING');
+            }
+            else if (line === '+PONG')
+                done(0, 'connected');
+            else
+                done(1, REJECTED);
+        });
+        socket.on('timeout', () => {
+            done(1, reason('timeout'));
+        });
+        socket.on('error', (error) => {
+            done(1, reason(error.code ?? error.message));
+        });
+    });
+}
+const TESTS = { postgres, mysql, redis };
+/** Tries the connection a value holds. */
+export async function check(value, type) {
+    if (type && !TYPES.includes(type))
+        return {
+            code: 2,
+            message: `cannot test: Koppler has no test for type "${type}" (it tests ${TYPES.join(', ')})`,
+        };
+    const found = parse(value, type);
+    if (!found)
+        return { code: 2, message: 'cannot test: not a database or cache connection Koppler reads' };
+    if (found.type === null)
+        return {
+            code: 2,
+            message: 'cannot test: say which database it is with "type" on this secret in stack.json (postgres or mysql)',
+        };
+    if (!found.host)
+        return { code: 2, message: 'cannot test: the value names no host' };
+    const test = TESTS[found.type];
+    if (!test)
+        throw new TypeError(`no test for ${found.type}`);
+    return test(found);
+}
+/** secret-test <app or app@env> <NAME> [--type <type>] */
+export async function main(args, here) {
+    const [store = '', name = ''] = args;
+    const typeAt = args.indexOf('--type');
+    const type = typeAt >= 0 ? args[typeAt + 1] : undefined;
+    const fail = (message) => {
+        console.error(message);
+        process.exit(2);
+    };
+    if (!/^[a-z0-9-]+(@[a-z0-9-]+)?$/.test(store))
+        fail(`invalid app id: ${store}`);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        fail(`invalid env name: ${name}`);
+    let value = '';
+    try {
+        value = execFileSync(`${here}/secret-store`, ['value', store, name], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+    }
+    catch {
+        // Not stored, or the store refused: both read as not stored.
+    }
+    if (!value) {
+        console.log('not stored');
+        process.exit(2);
+    }
+    const { code, message } = await check(value, type);
+    console.log(message);
+    process.exit(code);
+}
+//# sourceMappingURL=secret-check.mjs.map

package/dist/secret-check.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-check.mjs","sourceRoot":"","sources":["../src/secret-check.mts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,iHAAiH;AACjH,yGAAyG;AACzG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,CAAC;AAElC,MAAM,KAAK,GAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAoBjF,oFAAoF;AACpF,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,CACrD,qEAAqE,CACtE,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;YAC9B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;gBACtB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;gBAC9B,CAAC,CAAC,OAAO,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,MAAM,IAAI,GAAG,CAAC,KAA6B,EAAE,GAAG,KAAe,EAAE,EAAE,CACjE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;AAEpF,sEAAsE;AACtE,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,MAAM,EAAoB,EAAE;QAChC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC,CAAC;IACL,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,IAAa;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACvF,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAS,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/G,OAAO;YACL,IAAI,EAAE,IAAI,IAAI,IAAI;YAClB,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;YACrC,IAAI,EAAE,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1C,QAAQ,EAAE,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnD,GAAG,EAAE,MAAM,KAAK,QAAQ;SACzB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnG,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,KAAK;YACtC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YAC3B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE;YACnC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;IACjD,kEAAkE;IAClE,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC;IACrF,MAAM,OAAO,GAAG,aAAa;QAC3B,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,KAAK,IAAI;YACb,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,KAAK,IAAI;gBACb,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;oBAC1B,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,IAAI,CAAC;IACf,MAAM,IAAI,GAAG,IAAI,IAAI,OAAO,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC9B,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,IAAY,CAAC;QACjC,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9C,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE;KACjE,CAAC;AACJ,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,GAA2B,EAAE,EAAE,CAC3E,IAAI,OAAO,CAAgC,OAAO,CAAC,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAChH,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AACL,MAAM,OAAO,GACX,iIAAiI,CAAC;AACpI,MAAM,SAAS,GACb,oMAAoM,CAAC;AACvM,MAAM,QAAQ,GAAG,oCAAoC,CAAC;AACtD,uFAAuF;AACvF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,8CAA8C,CAAC;IAC9E,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,4DAA4D,CAAC;IAC9F,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/C,OAAO,4DAA4D,CAAC;IACtE,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AACF,MAAM,SAAS,GAAG,CAAC,GAAkC,EAAW,EAAE,CAChE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAEtF,KAAK,UAAU,QAAQ,CAAC,EAAc;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG;QACX,IAAI;QACJ,EAAE,CAAC,IAAI;QACP,IAAI;QACJ,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;QACf,IAAI;QACJ,EAAE,CAAC,IAAI;QACP,IAAI;QACJ,EAAE,CAAC,QAAQ,IAAI,UAAU;QACzB,OAAO;QACP,UAAU;KACX,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AACD,KAAK,UAAU,KAAK,CAAC,EAAc;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QACT,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC;IAC5G,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG;QACX,sBAAsB;QACtB,IAAI;QACJ,EAAE,CAAC,IAAI;QACP,IAAI;QACJ,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC;QACf,IAAI;QACJ,EAAE,CAAC,IAAI;QACP,GAAG,QAAQ;QACX,IAAI;QACJ,IAAI;QACJ,UAAU;KACX,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AACD,uHAAuH;AACvH,SAAS,KAAK,CAAC,EAAc;IAC3B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG;YACnB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjF,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,IAAW,EAAE,OAAe,EAAE,EAAE;YAC5C,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;YACtF,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC,CAAC;QACF,IAAI,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE;YACrD,IAAI,OAAO,KAAK,MAAM;gBAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;;gBAC5E,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,GAAG,EAAE,CAAC;YACV,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;iBACjG,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC5B,OAAO,GAAG,MAAM,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;;gBAC7C,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YAClD,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,KAAK,GAAuE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAE7G,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,KAAa,EAAE,IAAa;IACtD,IAAI,IAAI,IAAI,CAAE,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,8CAA8C,IAAI,eAAe,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC9F,CAAC;IACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC;IACzG,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QACrB,OAAO;YACL,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,oGAAoG;SAC9G,CAAC;IACJ,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,eAAe,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,IAAY;IACrD,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;QACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,CAAC;QACH,KAAK,GAAG,YAAY,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE;YACnE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}

package/dist/server/browser-console.js

@@ -0,0 +1,117 @@
+// A web app's browser console on its card: the page loads a small script from this server that forwards what it
+// writes to the console, and its uncaught errors, into the app's log. Only with the app's own key, and only lines.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { APP_ID } from "../ids.js";
+import { writeJson } from "../json-files.js";
+import { logsDir, tempDir } from "../paths.js";
+const keysFile = () => path.join(tempDir(), 'console-keys.json');
+const MAX_BODY = 64 * 1024;
+const LEVELS = ['log', 'info', 'warn', 'error', 'debug'];
+const keys = () => {
+    try {
+        return JSON.parse(fs.readFileSync(keysFile(), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+};
+/** The app's key: made once, kept on this Mac. */
+export function consoleKey(app) {
+    const all = keys();
+    const key = all[app] ?? crypto.randomBytes(16).toString('hex');
+    if (!all[app])
+        writeJson(keysFile(), { ...all, [app]: key });
+    return key;
+}
+/** The script the page loads: it keeps the console as it is and sends a copy of each line here, in batches. */
+const script = (to) => `(() => {
+  const to = ${JSON.stringify(to)};
+  const queue = [];
+  let timer = 0;
+  const send = () => {
+    timer = 0;
+    const lines = queue.splice(0, 50);
+    if (lines.length) fetch(to, { method: 'POST', mode: 'no-cors', keepalive: true, body: JSON.stringify(lines) }).catch(() => {});
+  };
+  const add = (level, text) => {
+    queue.push({ level, text: String(text).slice(0, 2000) });
+    if (!timer) timer = setTimeout(send, 300);
+  };
+  const said = value => {
+    if (typeof value === 'string') return value;
+    if (value instanceof Error) return value.stack || value.message;
+    try { return JSON.stringify(value); } catch { return String(value); }
+  };
+  for (const level of ${JSON.stringify(LEVELS)}) {
+    const own = console[level];
+    console[level] = (...args) => {
+      own.apply(console, args);
+      add(level, args.map(said).join(' '));
+    };
+  }
+  addEventListener('error', event => add('error', (event.error && event.error.stack) || event.message));
+  addEventListener('unhandledrejection', event => add('error', 'Unhandled rejection: ' + said(event.reason)));
+})();
+`;
+/** Answers /console.js and /console for a page of another origin, the app's: its key decides, not the token. */
+export function serveConsole(req, res, url) {
+    const app = url.searchParams.get('app') ?? '';
+    const given = Buffer.from(url.searchParams.get('key') ?? '');
+    const own = Buffer.from(APP_ID.test(app) ? (keys()[app] ?? '') : '');
+    if (!own.length || given.length !== own.length || !crypto.timingSafeEqual(given, own)) {
+        req.resume();
+        res.writeHead(404).end();
+        return;
+    }
+    if (req.method === 'GET' && url.pathname === '/console.js') {
+        // Loaded by the app's page, which is another origin.
+        res.setHeader('cross-origin-resource-policy', 'cross-origin');
+        res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-store' });
+        res.end(script(`http://${req.headers.host ?? '127.0.0.1'}/console?app=${app}&key=${url.searchParams.get('key') ?? ''}`));
+        return;
+    }
+    if (req.method !== 'POST') {
+        req.resume();
+        res.writeHead(404).end();
+        return;
+    }
+    let size = 0;
+    const chunks = [];
+    req.on('data', (chunk) => {
+        size += chunk.length;
+        if (size <= MAX_BODY)
+            chunks.push(chunk);
+    });
+    req.on('end', () => {
+        let lines;
+        try {
+            lines = size <= MAX_BODY ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : null;
+        }
+        catch {
+            lines = null;
+        }
+        const list = (Array.isArray(lines) ? lines : []).slice(0, 50).flatMap(line => {
+            const { level, text } = (line ?? {});
+            if (typeof text !== 'string' || typeof level !== 'string' || !LEVELS.includes(level))
+                return [];
+            const time = new Date().toTimeString().slice(0, 8);
+            return text
+                .slice(0, 2000)
+                .split('\n')
+                .map(one => `${time} browser ${level}: ${one}\n`);
+        });
+        try {
+            if (list.length) {
+                fs.mkdirSync(logsDir(), { recursive: true, mode: 0o700 });
+                fs.appendFileSync(path.join(logsDir(), `${app}.log`), list.join(''), { mode: 0o600 });
+            }
+            res.writeHead(204).end();
+        }
+        catch {
+            res.writeHead(500).end();
+        }
+    });
+}
+//# sourceMappingURL=browser-console.js.map

package/dist/server/browser-console.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-console.js","sourceRoot":"","sources":["../../src/server/browser-console.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,mHAAmH;AACnH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACjE,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,CAAC;AAC3B,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEzD,MAAM,IAAI,GAAG,GAA2B,EAAE;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAA2B,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AACF,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAC/G,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC;eAChB,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;wBAiBT,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;;;;;;;;;CAU7C,CAAC;AAEF,gHAAgH;AAChH,MAAM,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB,EAAE,GAAQ;IACxF,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,EAAE,CAAC;QACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3D,qDAAqD;QACrD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;QACtG,GAAG,CAAC,GAAG,CACL,MAAM,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,gBAAgB,GAAG,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAChH,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,EAAE,CAAC;QACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACjB,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;YAC1F,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwC,CAAC;YAC5E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChG,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO,IAAI;iBACR,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;iBACd,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,YAAY,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}