lim 0.52.3 → 0.53.1

package/dist/lib/build-run-command.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildRunCommand = buildRunCommand;
+const secret_env_flags_1 = require("./secret-env-flags");
+const secret_env_1 = require("./secret-env");
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../base-command");
 const sync_flags_1 = require("./sync-flags");
@@ -24,6 +26,9 @@ function buildRunCommand(platform) {
                 const commandLine = commandArgs.length === 1 ? commandArgs[0] : commandArgs.map(quoteShellArgument).join(' ');
                 await this.withAuth(async () => {
                     const { target, client } = await this.resolveBuildToolClient(platform, flags.id);
+                    const envFromSecret = (0, secret_env_1.parseSecretEnv)(flags['env-from-secret']);
+                    const fileFromSecret = (0, secret_env_1.parseSecretFiles)(flags['file-from-secret']);
+                    await this.ensureSecretPermissions(target.id, envFromSecret, fileFromSecret);
                     // The build sandbox hosts no simulators, so simctl install/boot/launch
                     // is denied there. Steer to the attach flow before the command runs.
                     if (platform === 'xcode' && /\bsimctl\b/.test(commandLine)) {
@@ -38,6 +43,8 @@ function buildRunCommand(platform) {
                     this.info(`Running in ${args.cwd ?? '.'}: ${commandLine}`);
                     const proc = client.run(commandLine, {
                         cwd: args.cwd ?? '.',
+                        envFromSecret,
+                        fileFromSecret,
                         ...(env && { env }),
                         ...(flags.timeout !== undefined && { timeoutSeconds: flags.timeout }),
                     });
@@ -62,6 +69,8 @@ function buildRunCommand(platform) {
         },
         _a.flags = {
             ...base_command_1.BaseCommand.baseFlags,
+            ...secret_env_flags_1.secretEnvFlags,
+            ...secret_env_flags_1.secretFileFlags,
             ...sync_flags_1.syncFlags,
             id: core_1.Flags.string({
                 description: `${platform} instance ID to run on. Defaults to the most recent standalone ${platform} target.`,

package/dist/lib/build-run-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-run-command.js","sourceRoot":"","sources":["../../src/lib/build-run-command.ts"],"names":[],"mappings":";;AAMA,0CA4FC;AAlGD,sCAA0C;AAC1C,kDAA8C;AAC9C,6CAA+D;AAC/D,mEAA+E;AAC/E,+CAAgD;AAEhD,SAAgB,eAAe,CAAC,QAA4B;;IAC1D,YAAO,MAAM,QAAS,SAAQ,0BAAW;YA0CvC,KAAK,CAAC,GAAG;gBACP,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,IAAI,CAAC,KAAK,CAAC,yDAAyD,QAAQ,kBAAkB,CAAC,CAAC;gBAClG,CAAC;gBACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBACnD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAClD,CAAC;gBACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClF,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAE3B,MAAM,GAAG,GAAG,IAAA,6BAAe,EAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/E,MAAM,WAAW,GACf,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAE5F,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;oBAC7B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;oBAEjF,uEAAuE;oBACvE,qEAAqE;oBACrE,IAAI,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC3D,IAAI,CAAC,IAAI,CACP,aAAa,QAAQ,mFAAmF;4BACtG,qGAAqG;4BACrG,yEAAyE;4BACzE,6BAA6B,MAAM,CAAC,EAAE,EAAE,CAC3C,CAAC;oBACJ,CAAC;oBAED,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;wBACtB,MAAM,IAAA,wCAAgB,EAAC,MAAM,EAAE,IAAA,iCAAoB,EAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC/F,CAAC;oBAED,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC,CAAC;oBAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;wBACnC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG;wBACpB,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;wBACnB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;qBACtE,CAAC,CAAC;oBACH,MAAM,IAAA,0CAAkB,EACtB,IAAI,EACJ,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAClD,gBAAgB,EAChB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACvE,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;SACF;QAzFQ,UAAO,GAAG,sBAAsB,QAAQ,UAAW;QACnD,cAAW,GAChB,6GAA8G;QAEzG,WAAQ,GAAG;YAChB,qBAAqB,QAAQ,kBAAkB;YAC/C,qBAAqB,QAAQ,gCAAgC;YAC7D,qBAAqB,QAAQ,oDAAoD;YACjF,qBAAqB,QAAQ,kCAAkC;SAC/D;QAEK,OAAI,GAAG;YACZ,GAAG,EAAE,WAAI,CAAC,MAAM,CAAC;gBACf,WAAW,EAAE,kFAAkF;gBAC/F,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,GAAG;aACb,CAAC;SACF;QAEK,QAAK,GAAG;YACb,GAAG,0BAAW,CAAC,SAAS;YACxB,GAAG,sBAAS;YACZ,EAAE,EAAE,YAAK,CAAC,MAAM,CAAC;gBACf,WAAW,EAAE,GAAG,QAAQ,kEAAkE,QAAQ,UAAU;aAC7G,CAAC;YACF,GAAG,EAAE,YAAK,CAAC,MAAM,CAAC;gBAChB,WAAW,EAAE,wEAAwE;gBACrF,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,IAAI;aACxB,CAAC;YACF,OAAO,EAAE,YAAK,CAAC,OAAO,CAAC;gBACrB,WAAW,EAAE,sEAAsE;gBACnF,GAAG,EAAE,CAAC;gBACN,GAAG,EAAE,KAAK;aACX,CAAC;YACF,SAAS,EAAE,YAAK,CAAC,OAAO,CAAC;gBACvB,WAAW,EAAE,gEAAgE;gBAC7E,OAAO,EAAE,KAAK;aACf,CAAC;SACF;WAkDF;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;AACjD,CAAC"}
+{"version":3,"file":"build-run-command.js","sourceRoot":"","sources":["../../src/lib/build-run-command.ts"],"names":[],"mappings":";;AAQA,0CAmGC;AA3GD,yDAAqE;AACrE,6CAAgE;AAChE,sCAA0C;AAC1C,kDAA8C;AAC9C,6CAA+D;AAC/D,mEAA+E;AAC/E,+CAAgD;AAEhD,SAAgB,eAAe,CAAC,QAA4B;;IAC1D,YAAO,MAAM,QAAS,SAAQ,0BAAW;YA4CvC,KAAK,CAAC,GAAG;gBACP,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;oBAClB,IAAI,CAAC,KAAK,CAAC,yDAAyD,QAAQ,kBAAkB,CAAC,CAAC;gBAClG,CAAC;gBACD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBACnD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBAClD,CAAC;gBACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;gBAClF,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAE3B,MAAM,GAAG,GAAG,IAAA,6BAAe,EAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC/E,MAAM,WAAW,GACf,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAE5F,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;oBAC7B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;oBACjF,MAAM,aAAa,GAAG,IAAA,2BAAc,EAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;oBAC/D,MAAM,cAAc,GAAG,IAAA,6BAAgB,EAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;oBACnE,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;oBAE7E,uEAAuE;oBACvE,qEAAqE;oBACrE,IAAI,QAAQ,KAAK,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC3D,IAAI,CAAC,IAAI,CACP,aAAa,QAAQ,mFAAmF;4BACtG,qGAAqG;4BACrG,yEAAyE;4BACzE,6BAA6B,MAAM,CAAC,EAAE,EAAE,CAC3C,CAAC;oBACJ,CAAC;oBAED,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;wBACtB,MAAM,IAAA,wCAAgB,EAAC,MAAM,EAAE,IAAA,iCAAoB,EAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC/F,CAAC;oBAED,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC,CAAC;oBAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;wBACnC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,GAAG;wBACpB,aAAa;wBACb,cAAc;wBACd,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;wBACnB,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;qBACtE,CAAC,CAAC;oBACH,MAAM,IAAA,0CAAkB,EACtB,IAAI,EACJ,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,EAClD,gBAAgB,EAChB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACvE,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;SACF;QAhGQ,UAAO,GAAG,sBAAsB,QAAQ,UAAW;QACnD,cAAW,GAChB,6GAA8G;QAEzG,WAAQ,GAAG;YAChB,qBAAqB,QAAQ,kBAAkB;YAC/C,qBAAqB,QAAQ,gCAAgC;YAC7D,qBAAqB,QAAQ,oDAAoD;YACjF,qBAAqB,QAAQ,kCAAkC;SAC/D;QAEK,OAAI,GAAG;YACZ,GAAG,EAAE,WAAI,CAAC,MAAM,CAAC;gBACf,WAAW,EAAE,kFAAkF;gBAC/F,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,GAAG;aACb,CAAC;SACF;QAEK,QAAK,GAAG;YACb,GAAG,0BAAW,CAAC,SAAS;YACxB,GAAG,iCAAc;YACjB,GAAG,kCAAe;YAClB,GAAG,sBAAS;YACZ,EAAE,EAAE,YAAK,CAAC,MAAM,CAAC;gBACf,WAAW,EAAE,GAAG,QAAQ,kEAAkE,QAAQ,UAAU;aAC7G,CAAC;YACF,GAAG,EAAE,YAAK,CAAC,MAAM,CAAC;gBAChB,WAAW,EAAE,wEAAwE;gBACrF,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,IAAI;aACxB,CAAC;YACF,OAAO,EAAE,YAAK,CAAC,OAAO,CAAC;gBACrB,WAAW,EAAE,sEAAsE;gBACnF,GAAG,EAAE,CAAC;gBACN,GAAG,EAAE,KAAK;aACX,CAAC;YACF,SAAS,EAAE,YAAK,CAAC,OAAO,CAAC;gBACvB,WAAW,EAAE,gEAAgE;gBAC7E,OAAO,EAAE,KAAK;aACf,CAAC;SACF;WAuDF;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;AACjD,CAAC"}

package/dist/lib/delegated-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegated-permissions.d.ts","sourceRoot":"","sources":["../../src/lib/delegated-permissions.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAqBlG"}
+{"version":3,"file":"delegated-permissions.d.ts","sourceRoot":"","sources":["../../src/lib/delegated-permissions.ts"],"names":[],"mappings":"AACA,wEAAwE;AACxE,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CA2BlG"}

package/dist/lib/delegated-permissions.js

@@ -1,9 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.delegatedPermissionsFromFlags = delegatedPermissionsFromFlags;
+const secret_env_1 = require("./secret-env");
 /** Resolve creation-time grants before sending the instance request. */
 function delegatedPermissionsFromFlags(flags) {
-    const provided = flags['permission'];
+    const explicit = flags['permission'];
+    const secrets = [
+        ...(0, secret_env_1.secretReadPermissions)((0, secret_env_1.parseSecretEnv)(flags['env-from-secret'])),
+        ...(0, secret_env_1.secretReadPermissions)((0, secret_env_1.parseSecretFiles)(flags['file-from-secret'])),
+    ];
+    const provided = explicit === undefined && secrets.length === 0 ? undefined : [...(explicit ?? []), ...secrets];
     const name = flags['upload'] ?? flags['auto-upload'];
     if (typeof name === 'string' && name) {
         if (/[*?]/.test(name))

package/dist/lib/delegated-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegated-permissions.js","sourceRoot":"","sources":["../../src/lib/delegated-permissions.ts"],"names":[],"mappings":";;AACA,sEAqBC;AAtBD,wEAAwE;AACxE,SAAgB,6BAA6B,CAAC,KAA8B;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAyB,CAAC;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,IAAI,KAAK,CAAC,mBAAmB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC;QAC9B,yEAAyE;QACzE,OAAO;YACL,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,SAAS,MAAM,SAAS;gBACxB,SAAS,MAAM,SAAS;gBACxB,SAAS,MAAM,SAAS;aACzB,CAAC;SACH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"delegated-permissions.js","sourceRoot":"","sources":["../../src/lib/delegated-permissions.ts"],"names":[],"mappings":";;AAEA,sEA2BC;AA7BD,6CAAuF;AACvF,wEAAwE;AACxE,SAAgB,6BAA6B,CAAC,KAA8B;IAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAyB,CAAC;IAC7D,MAAM,OAAO,GAAG;QACd,GAAG,IAAA,kCAAqB,EAAC,IAAA,2BAAc,EAAC,KAAK,CAAC,iBAAiB,CAAyB,CAAC,CAAC;QAC1F,GAAG,IAAA,kCAAqB,EAAC,IAAA,6BAAgB,EAAC,KAAK,CAAC,kBAAkB,CAAyB,CAAC,CAAC;KAC9F,CAAC;IACF,MAAM,QAAQ,GACZ,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,IAAI,KAAK,CAAC,mBAAmB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACzG,MAAM,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC;QAC9B,yEAAyE;QACzE,OAAO;YACL,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnB,SAAS,MAAM,SAAS;gBACxB,SAAS,MAAM,SAAS;gBACxB,SAAS,MAAM,SAAS;aACzB,CAAC;SACH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/lib/launch-app-runtime.d.ts

@@ -8,14 +8,17 @@ export type LaunchAppRuntime = {
 export type LaunchAppArgument = LaunchAppMode | {
     mode: LaunchAppMode;
     runtime?: undefined;
-    env: Record<string, string>;
+    env?: Record<string, string>;
+    envFromSecret?: Record<string, string>;
 } | {
     mode: 'RelaunchIfRunning';
     runtime: LaunchAppRuntime;
     env?: Record<string, string>;
+    envFromSecret?: Record<string, string>;
 };
 export type LaunchAppFlagValues = {
     env?: string[];
+    'env-from-secret'?: string[];
     mode?: LaunchAppMode;
     runtime?: string;
     'detox-server-url'?: string;

package/dist/lib/launch-app-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch-app-runtime.d.ts","sourceRoot":"","sources":["../../src/lib/launch-app-runtime.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AACF,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAqBF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE;IAAE,sBAAsB,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,iBAAiB,CA+CnB"}
+{"version":3,"file":"launch-app-runtime.d.ts","sourceRoot":"","sources":["../../src/lib/launch-app-runtime.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,mBAAmB,CAAC;AACxE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AACF,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAqBF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,mBAAmB,EAC1B,OAAO,EAAE;IAAE,sBAAsB,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACzD,iBAAiB,CAqDnB"}

package/dist/lib/launch-app-runtime.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildLaunchAppArgument = buildLaunchAppArgument;
+const secret_env_1 = require("./secret-env");
 const ios_launch_environment_1 = require("@limrun/api/ios-launch-environment");
 const detox_version_1 = require("./detox-version");
 const DETOX_FLAG_NAMES = ['--detox-server-url', '--detox-session-id', '--detox-version'];
@@ -21,6 +22,7 @@ function nonEmpty(value) {
 }
 function buildLaunchAppArgument(flags, options) {
     const env = flags.env?.length ? (0, ios_launch_environment_1.parseLaunchEnvironment)(flags.env) : undefined;
+    const envFromSecret = (0, secret_env_1.parseSecretEnv)(flags['env-from-secret']);
     const hasDetoxFlag = flags['detox-server-url'] !== undefined ||
         flags['detox-session-id'] !== undefined ||
         flags['detox-version'] !== undefined;
@@ -28,8 +30,12 @@ function buildLaunchAppArgument(flags, options) {
         if (hasDetoxFlag) {
             throw new Error(`${DETOX_FLAG_NAMES.join(', ')} require --runtime detox.`);
         }
-        return env ?
-            { mode: options.modeExplicitlyProvided && flags.mode ? flags.mode : 'RelaunchIfRunning', env }
+        return env || envFromSecret ?
+            {
+                mode: options.modeExplicitlyProvided && flags.mode ? flags.mode : 'RelaunchIfRunning',
+                ...(env && { env }),
+                ...(envFromSecret && { envFromSecret }),
+            }
             : flags.mode ?? 'ForegroundIfRunning';
     }
     if (flags.runtime !== 'detox') {
@@ -52,6 +58,7 @@ function buildLaunchAppArgument(flags, options) {
     return {
         mode: 'RelaunchIfRunning',
         ...(env ? { env } : {}),
+        ...(envFromSecret && { envFromSecret }),
         runtime: {
             kind: 'detox',
             serverUrl,

package/dist/lib/launch-app-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"launch-app-runtime.js","sourceRoot":"","sources":["../../src/lib/launch-app-runtime.ts"],"names":[],"mappings":";;AAmDA,wDAkDC;AArGD,+EAA4E;AAC5E,mDAA2D;AA+B3D,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,CAAU,CAAC;AAElG,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gEAAgE,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,gEAAgE,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,SAAgB,sBAAsB,CACpC,KAA0B,EAC1B,OAA0D;IAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAA,+CAAsB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,YAAY,GAChB,KAAK,CAAC,kBAAkB,CAAC,KAAK,SAAS;QACvC,KAAK,CAAC,kBAAkB,CAAC,KAAK,SAAS;QACvC,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC;IAEvC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,CAAC,CAAC;YACR,EAAE,IAAI,EAAE,OAAO,CAAC,sBAAsB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAChG,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,qBAAqB,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,OAAO,CAAC,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAA,wCAAwB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEpG,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,SAAS;YACT,SAAS;YACT,OAAO;SACR;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"launch-app-runtime.js","sourceRoot":"","sources":["../../src/lib/launch-app-runtime.ts"],"names":[],"mappings":";;AAuDA,wDAwDC;AA/GD,6CAA8C;AAC9C,+EAA4E;AAC5E,mDAA2D;AAkC3D,MAAM,gBAAgB,GAAG,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,CAAU,CAAC;AAElG,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gEAAgE,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,gEAAgE,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,SAAgB,sBAAsB,CACpC,KAA0B,EAC1B,OAA0D;IAE1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAA,+CAAsB,EAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,aAAa,GAAG,IAAA,2BAAc,EAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAChB,KAAK,CAAC,kBAAkB,CAAC,KAAK,SAAS;QACvC,KAAK,CAAC,kBAAkB,CAAC,KAAK,SAAS;QACvC,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC;IAEvC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,IAAI,aAAa,CAAC,CAAC;YACzB;gBACE,IAAI,EAAE,OAAO,CAAC,sBAAsB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;gBACrF,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;gBACnB,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;aACxC;YACH,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,qBAAqB,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,OAAO,CAAC,sBAAsB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAA,wCAAwB,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEpG,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,CAAC;QACvC,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,SAAS;YACT,SAAS;YACT,OAAO;SACR;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/secret-env-flags.d.ts

@@ -0,0 +1,7 @@
+export declare const secretFileFlags: {
+    'file-from-secret': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+};
+export declare const secretEnvFlags: {
+    'env-from-secret': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+};
+//# sourceMappingURL=secret-env-flags.d.ts.map

package/dist/lib/secret-env-flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env-flags.d.ts","sourceRoot":"","sources":["../../src/lib/secret-env-flags.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,eAAe;;CAO3B,CAAC;AAEF,eAAO,MAAM,cAAc;;CAO1B,CAAC"}

package/dist/lib/secret-env-flags.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretEnvFlags = exports.secretFileFlags = void 0;
+const core_1 = require("@oclif/core");
+exports.secretFileFlags = {
+    'file-from-secret': core_1.Flags.string({
+        description: "Use a stored credential file, for example '~/.npmrc=packages/npmrc' or '~/.netrc=github/netrc'. Quote ~/ for the remote home. Other paths resolve relative to the command working directory; leading / is ignored. Command bindings are removed on completion or failure; create saves defaults. Existing files are not overwritten.",
+        multiple: true,
+        multipleNonGreedy: true,
+    }),
+};
+exports.secretEnvFlags = {
+    'env-from-secret': core_1.Flags.string({
+        description: 'Set an environment variable from a stored secret: NAME=secret/name or NAME=secret_TID. Repeat for multiple variables.',
+        multiple: true,
+        multipleNonGreedy: true,
+    }),
+};
+//# sourceMappingURL=secret-env-flags.js.map

package/dist/lib/secret-env-flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env-flags.js","sourceRoot":"","sources":["../../src/lib/secret-env-flags.ts"],"names":[],"mappings":";;;AAAA,sCAAoC;AAEvB,QAAA,eAAe,GAAG;IAC7B,kBAAkB,EAAE,YAAK,CAAC,MAAM,CAAC;QAC/B,WAAW,EACT,sUAAsU;QACxU,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,IAAI;KACxB,CAAC;CACH,CAAC;AAEW,QAAA,cAAc,GAAG;IAC5B,iBAAiB,EAAE,YAAK,CAAC,MAAM,CAAC;QAC9B,WAAW,EACT,uHAAuH;QACzH,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,IAAI;KACxB,CAAC;CACH,CAAC"}

package/dist/lib/secret-env.d.ts

@@ -0,0 +1,7 @@
+/** Parse names literally, including slashes and colons; never accept wildcard delegation here. */
+export declare function parseSecretEnv(entries: string[] | undefined): Record<string, string> | undefined;
+export declare function secretReadPermissions(bindings: Record<string, string> | undefined): string[];
+export declare function permissionCovers(existing: string, requested: string): boolean;
+/** Keep ~/ literal so it resolves against the remote workload home. */
+export declare function parseSecretFiles(entries: string[] | undefined): Record<string, string> | undefined;
+//# sourceMappingURL=secret-env.d.ts.map

package/dist/lib/secret-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.d.ts","sourceRoot":"","sources":["../../src/lib/secret-env.ts"],"names":[],"mappings":"AAEA,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAqChG;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAAG,MAAM,EAAE,CAE5F;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAqB7E;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CA6BlG"}

package/dist/lib/secret-env.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSecretEnv = parseSecretEnv;
+exports.secretReadPermissions = secretReadPermissions;
+exports.permissionCovers = permissionCovers;
+exports.parseSecretFiles = parseSecretFiles;
+const secret_input_1 = require("./secret-input");
+/** Parse names literally, including slashes and colons; never accept wildcard delegation here. */
+function parseSecretEnv(entries) {
+    if (!entries?.length)
+        return undefined;
+    const result = Object.create(null);
+    for (const entry of entries) {
+        const index = entry.indexOf('=');
+        const key = entry.slice(0, index);
+        const name = entry.slice(index + 1);
+        if (index < 1 || !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key) || !name || /[*?\0\r\n]/.test(name)) {
+            throw new Error('Use --env-from-secret NAME=secret/name. Names must be literal, without * or ?.');
+        }
+        if (/^(DYLD_|LD_|LIMRUN_|SIMCTL_CHILD_|__DYLD_|__XPC_|XPC_DYLD_|SWIFT_DEBUG_)/i.test(key) ||
+            [
+                'NODE_BINARY',
+                'PATH',
+                'HOME',
+                'USER',
+                'LOGNAME',
+                'SHELL',
+                'TMPDIR',
+                'TMP',
+                'TEMP',
+                'DEVELOPER_DIR',
+                'ANDROID_HOME',
+                'ANDROID_SDK_ROOT',
+            ].includes(key)) {
+            throw new Error(`--env-from-secret cannot override managed variable ${key}.`);
+        }
+        if (Object.prototype.hasOwnProperty.call(result, key))
+            throw new Error(`Duplicate secret binding for ${key}.`);
+        result[key] =
+            /^secret_[0-7][0-9a-hjkmnp-tv-z]{25}$/.test(name) || name.startsWith('name/') ? name : `name/${name}`;
+        if (result[key] === 'name/' || result[key].length > 517)
+            throw new Error('Invalid secret name.');
+    }
+    if (Object.keys(result).length > 64)
+        throw new Error('At most 64 secret bindings are supported.');
+    return result;
+}
+function secretReadPermissions(bindings) {
+    return [...new Set(Object.values(bindings ?? {}).map((target) => `secret:${target}:read`))];
+}
+function permissionCovers(existing, requested) {
+    if (existing === requested)
+        return true;
+    const split = (value) => [
+        value.slice(0, value.indexOf(':')),
+        value.slice(value.indexOf(':') + 1, value.lastIndexOf(':')),
+        value.slice(value.lastIndexOf(':') + 1),
+    ];
+    const [resource, target, action] = split(existing);
+    const [wantedResource, wantedTarget, wantedAction] = split(requested);
+    if (resource !== wantedResource || (action !== 'all' && action !== wantedAction))
+        return false;
+    if (target === '*' || target === wantedTarget)
+        return true;
+    if (!target?.startsWith('name/') || !wantedTarget?.startsWith('name/'))
+        return false;
+    const pattern = target
+        .split('')
+        .map((c) => c === '*' ? '.*'
+        : c === '?' ? '.'
+            : c.replace(/[\\^$.*+?()[\]{}|]/g, '\\$&'))
+        .join('');
+    return new RegExp(`^${pattern}$`, 's').test(wantedTarget);
+}
+/** Keep ~/ literal so it resolves against the remote workload home. */
+function parseSecretFiles(entries) {
+    if (!entries?.length)
+        return undefined;
+    const result = Object.create(null);
+    for (const entry of entries) {
+        const i = entry.indexOf('=');
+        const rawDestination = entry.slice(0, i);
+        const destination = rawDestination.replace(/^\/+/, '');
+        const relative = rawDestination.startsWith('~/') ? destination.slice(2) : destination;
+        if (i < 1 ||
+            rawDestination.length > 1024 ||
+            relative.startsWith('/') ||
+            relative.startsWith('~') ||
+            /[\\\0\r\n]/.test(relative) ||
+            relative.split('/').some((p) => !p || p === '.' || p === '..'))
+            throw new Error("Use --file-from-secret '~/path=secret/name' or 'path=secret/name'; other paths are command-relative, ignoring leading /; quote ~/ to keep it remote.");
+        if (Object.prototype.hasOwnProperty.call(result, destination))
+            throw new Error('Duplicate secret file destination.');
+        try {
+            result[destination] = (0, secret_input_1.secretTarget)(entry.slice(i + 1));
+        }
+        catch {
+            throw new Error('--file-from-secret requires an exact secret ID or name without wildcards.');
+        }
+    }
+    if (Object.keys(result).length > 64)
+        throw new Error('At most 64 secret files are supported.');
+    return result;
+}
+//# sourceMappingURL=secret-env.js.map

package/dist/lib/secret-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.js","sourceRoot":"","sources":["../../src/lib/secret-env.ts"],"names":[],"mappings":";;AAGA,wCAqCC;AAED,sDAEC;AAED,4CAqBC;AAGD,4CA6BC;AAnGD,iDAA8C;AAE9C,kGAAkG;AAClG,SAAgB,cAAc,CAAC,OAA6B;IAC1D,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;QACD,IACE,2EAA2E,CAAC,IAAI,CAAC,GAAG,CAAC;YACrF;gBACE,aAAa;gBACb,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,SAAS;gBACT,OAAO;gBACP,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,eAAe;gBACf,cAAc;gBACd,kBAAkB;aACnB,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,GAAG,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC;YACT,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QACxG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,qBAAqB,CAAC,QAA4C;IAChF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;IAClE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3D,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM;SACnB,KAAK,CAAC,EAAE,CAAC;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI;QAChB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG;YACjB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAC3C;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,uEAAuE;AACvE,SAAgB,gBAAgB,CAAC,OAA6B;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACtF,IACE,CAAC,GAAG,CAAC;YACL,cAAc,CAAC,MAAM,GAAG,IAAI;YAC5B,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACxB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;YAE9D,MAAM,IAAI,KAAK,CACb,sJAAsJ,CACvJ,CAAC;QACJ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,GAAG,IAAA,2BAAY,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/secret-env.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-env.test.d.ts.map

package/dist/lib/secret-env.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.test.d.ts","sourceRoot":"","sources":["../../src/lib/secret-env.test.ts"],"names":[],"mappings":""}

package/dist/lib/secret-env.test.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const secret_env_1 = require("./secret-env");
+const delegated_permissions_1 = require("./delegated-permissions");
+test('literal names preserve slashes and colons, with exact read grants', () => {
+    const bindings = (0, secret_env_1.parseSecretEnv)([
+        'NPM_TOKEN=team/npm:production',
+        'PAT=name/github/private',
+        'ID=secret_01m7071h5qfavacqmm4mg23x1k',
+    ]);
+    expect(bindings).toEqual({
+        NPM_TOKEN: 'name/team/npm:production',
+        PAT: 'name/github/private',
+        ID: 'secret_01m7071h5qfavacqmm4mg23x1k',
+    });
+    expect((0, secret_env_1.secretReadPermissions)(bindings)).toEqual([
+        'secret:name/team/npm:production:read',
+        'secret:name/github/private:read',
+        'secret:secret_01m7071h5qfavacqmm4mg23x1k:read',
+    ]);
+    expect((0, delegated_permissions_1.delegatedPermissionsFromFlags)({
+        'env-from-secret': ['NPM_TOKEN=team/npm'],
+        permission: ['asset:name/source:read'],
+    })).toEqual(['asset:name/source:read', 'secret:name/team/npm:read']);
+});
+test.each([
+    'TOKEN=*',
+    'TOKEN=team/?',
+    'TOKEN=',
+    'BAD-KEY=name',
+    'PATH=path',
+    'LIMRUN_WORKLOAD_IDENTITY_TOKEN_FILE=token',
+    'TOKEN=name/',
+])('rejects invalid binding %s', (entry) => {
+    expect(() => (0, secret_env_1.parseSecretEnv)([entry])).toThrow();
+});
+test('rejects duplicate variables instead of silently granting the wrong secret', () => {
+    expect(() => (0, secret_env_1.parseSecretEnv)(['TOKEN=one', 'TOKEN=two'])).toThrow('Duplicate');
+});
+test('already-delegated wildcard permissions avoid unnecessary role updates', () => {
+    expect((0, secret_env_1.permissionCovers)('secret:*:read', 'secret:name/team/npm:read')).toBe(true);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/*:all', 'secret:name/team/npm:read')).toBe(true);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/*:write', 'secret:name/team/npm:read')).toBe(false);
+    expect((0, secret_env_1.permissionCovers)('asset:*:all', 'secret:name/team/npm:read')).toBe(false);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/a.b:read', 'secret:name/team/a+b:read')).toBe(false);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/npm:read', 'secret:name/team/npm:production:read')).toBe(false);
+});
+test('file bindings keep remote home paths and delegate exact secret names', () => {
+    expect((0, secret_env_1.parseSecretFiles)(['~/.npmrc=packages/npm:prod', 'config/token=team/service'])).toEqual({
+        '~/.npmrc': 'name/packages/npm:prod',
+        'config/token': 'name/team/service',
+    });
+    expect((0, delegated_permissions_1.delegatedPermissionsFromFlags)({ 'file-from-secret': ['~/.npmrc=packages/npm'] })).toEqual([
+        'secret:name/packages/npm:read',
+    ]);
+});
+test.each([
+    '/=key',
+    '/~/token=key',
+    '/../../token=key',
+    '../token=key',
+    '~/.config/../token=key',
+    '~/=key',
+    'a//b=key',
+    '~/.npmrc=*',
+])('rejects unsafe secret file %s', (entry) => {
+    expect(() => (0, secret_env_1.parseSecretFiles)([entry])).toThrow();
+});
+test('secret files normalize leading slashes and reject duplicate aliases', () => {
+    expect((0, secret_env_1.parseSecretFiles)(['/etc/var=one', '~/.npmrc=two'])).toEqual({
+        'etc/var': 'name/one',
+        '~/.npmrc': 'name/two',
+    });
+    expect(() => (0, secret_env_1.parseSecretFiles)(['/etc/var=one', 'etc/var=two'])).toThrow('Duplicate');
+});
+test.each(['*', '', 'name/'])('file binding errors name the file flag for target %s', (target) => {
+    expect(() => (0, secret_env_1.parseSecretFiles)([`~/.npmrc=${target}`])).toThrow('--file-from-secret');
+});
+//# sourceMappingURL=secret-env.test.js.map

package/dist/lib/secret-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.test.js","sourceRoot":"","sources":["../../src/lib/secret-env.test.ts"],"names":[],"mappings":";;AAAA,6CAAyG;AACzG,mEAAwE;AAExE,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,QAAQ,GAAG,IAAA,2BAAc,EAAC;QAC9B,+BAA+B;QAC/B,yBAAyB;QACzB,sCAAsC;KACvC,CAAC,CAAC;IACH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QACvB,SAAS,EAAE,0BAA0B;QACrC,GAAG,EAAE,qBAAqB;QAC1B,EAAE,EAAE,mCAAmC;KACxC,CAAC,CAAC;IACH,MAAM,CAAC,IAAA,kCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,sCAAsC;QACtC,iCAAiC;QACjC,+CAA+C;KAChD,CAAC,CAAC;IACH,MAAM,CACJ,IAAA,qDAA6B,EAAC;QAC5B,iBAAiB,EAAE,CAAC,oBAAoB,CAAC;QACzC,UAAU,EAAE,CAAC,wBAAwB,CAAC;KACvC,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,IAAI,CAAC;IACR,SAAS;IACT,cAAc;IACd,QAAQ;IACR,cAAc;IACd,WAAW;IACX,2CAA2C;IAC3C,aAAa;CACd,CAAC,CAAC,4BAA4B,EAAE,CAAC,KAAK,EAAE,EAAE;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,2BAAc,EAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,2BAAc,EAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,CAAC,IAAA,6BAAgB,EAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,CAAC,IAAA,6BAAgB,EAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,IAAA,6BAAgB,EAAC,0BAA0B,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,MAAM,CAAC,IAAA,6BAAgB,EAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,CAAC,IAAA,6BAAgB,EAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,MAAM,CAAC,IAAA,6BAAgB,EAAC,2BAA2B,EAAE,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,CAAC,IAAA,6BAAgB,EAAC,CAAC,4BAA4B,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5F,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,mBAAmB;KACpC,CAAC,CAAC;IACH,MAAM,CAAC,IAAA,qDAA6B,EAAC,EAAE,kBAAkB,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/F,+BAA+B;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,IAAI,CAAC;IACR,OAAO;IACP,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,wBAAwB;IACxB,QAAQ;IACR,UAAU;IACV,YAAY;CACb,CAAC,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;IAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAgB,EAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,CAAC,IAAA,6BAAgB,EAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjE,SAAS,EAAE,UAAU;QACrB,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAgB,EAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,sDAAsD,EAAE,CAAC,MAAM,EAAE,EAAE;IAC/F,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAgB,EAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC"}

package/dist/lib/secret-input.d.ts

@@ -0,0 +1,5 @@
+export declare function secretTarget(value: string): string;
+/** Bound input before requesting a grant, including streams with unknown size. */
+export declare function secretBytes(file?: string): Promise<Buffer>;
+export declare function secretMetadata(value: string): Record<string, unknown>;
+//# sourceMappingURL=secret-input.d.ts.map

package/dist/lib/secret-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-input.d.ts","sourceRoot":"","sources":["../../src/lib/secret-input.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,kFAAkF;AAClF,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAchE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYrE"}

package/dist/lib/secret-input.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretTarget = secretTarget;
+exports.secretBytes = secretBytes;
+exports.secretMetadata = secretMetadata;
+const node_fs_1 = require("node:fs");
+function secretTarget(value) {
+    if (!value || /[\0\r\n*?]/.test(value))
+        throw new Error('Use a secret ID or an exact name without wildcards.');
+    const target = /^secret_[0-7][0-9a-hjkmnp-tv-z]{25}$/.test(value) || value.startsWith('name/') ? value : `name/${value}`;
+    if (target === 'name/' || target.length > 517)
+        throw new Error('Invalid secret name.');
+    return target;
+}
+/** Bound input before requesting a grant, including streams with unknown size. */
+async function secretBytes(file) {
+    if ((!file || file === '-') && process.stdin.isTTY)
+        throw new Error('Pipe the value on stdin or supply --file PATH.');
+    const input = file && file !== '-' ? (0, node_fs_1.createReadStream)(file) : process.stdin;
+    const chunks = [];
+    let length = 0;
+    for await (const chunk of input) {
+        const bytes = Buffer.from(chunk);
+        length += bytes.length;
+        if (length > 65536)
+            throw new Error('Secret values must be at most 64 KiB.');
+        chunks.push(bytes);
+    }
+    if (!length)
+        throw new Error('Secret values cannot be empty.');
+    return Buffer.concat(chunks);
+}
+function secretMetadata(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error('--metadata must be a JSON object.');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('--metadata must be a JSON object.');
+    if (Buffer.byteLength(JSON.stringify(parsed)) > 16384)
+        throw new Error('Secret metadata must be at most 16 KiB.');
+    return parsed;
+}
+//# sourceMappingURL=secret-input.js.map

package/dist/lib/secret-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-input.js","sourceRoot":"","sources":["../../src/lib/secret-input.ts"],"names":[],"mappings":";;AAEA,oCAOC;AAGD,kCAcC;AAED,wCAYC;AAxCD,qCAA2C;AAE3C,SAAgB,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,MAAM,MAAM,GACV,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;IAC5G,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,cAAc,CAAC,KAAa;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK;QACnD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,OAAO,MAAiC,CAAC;AAC3C,CAAC"}

package/dist/lib/set-secret-env-command.d.ts

@@ -0,0 +1,3 @@
+import { BaseCommand } from '../base-command';
+export declare function setSecretEnvCommand(platform: 'xcode' | 'gradle' | 'ios' | 'android', kind?: 'env' | 'file'): typeof BaseCommand;
+//# sourceMappingURL=set-secret-env-command.d.ts.map

package/dist/lib/set-secret-env-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-secret-env-command.d.ts","sourceRoot":"","sources":["../../src/lib/set-secret-env-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,EAChD,IAAI,GAAE,KAAK,GAAG,MAAc,GAC3B,OAAO,WAAW,CAoGpB"}

package/dist/lib/set-secret-env-command.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setSecretEnvCommand = setSecretEnvCommand;
+const core_1 = require("@oclif/core");
+const api_1 = require("@limrun/api");
+const base_command_1 = require("../base-command");
+const secret_env_1 = require("./secret-env");
+function setSecretEnvCommand(platform, kind = 'env') {
+    var _a;
+    const field = kind === 'file' ? 'fileFromSecret' : 'envFromSecret';
+    const parse = kind === 'file' ? secret_env_1.parseSecretFiles : secret_env_1.parseSecretEnv;
+    return _a = class SetSecretEnv extends base_command_1.BaseCommand {
+            async run() {
+                const { argv, flags } = await this.parse(_a);
+                this.setParsedFlags(flags);
+                const additions = parse(argv) ?? {};
+                const remove = (flags.unset ?? []).map((key) => kind === 'file' ? Object.keys((0, secret_env_1.parseSecretFiles)([key + '=validation']))[0] : key);
+                if (!Object.keys(additions).length && !remove.length && !flags.clear)
+                    this.error('Provide NAME=secret/name, --unset NAME, or --clear.');
+                for (const key of remove)
+                    if (kind === 'env' && !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key))
+                        this.error('Invalid --unset environment variable name.');
+                await this.withAuth(async () => {
+                    const target = platform === 'xcode' ? await this.resolveXcodeTarget(flags.id)
+                        : platform === 'gradle' ? this.resolveGradleTarget(flags.id)
+                            : platform === 'ios' ? this.resolveIosInstance(flags.id)
+                                : this.resolveAndroidInstance(flags.id);
+                    const resources = {
+                        xcode: this.client.xcodeInstances,
+                        gradle: this.client.gradleInstances,
+                        ios: this.client.iosInstances,
+                        android: this.client.androidInstances,
+                    };
+                    const instances = resources[platform];
+                    for (let attempt = 0; attempt < 3; attempt++) {
+                        const { data: instance, response } = await instances.get(target.id).withResponse();
+                        const etag = response.headers.get('etag');
+                        const role = instance.spec.role;
+                        if (!etag || !role || instance.status.state === 'terminated')
+                            this.error('Select a live instance with an editable role.');
+                        const bindings = {
+                            ...(flags.clear ? {}
+                                : kind === 'file' ?
+                                    (0, secret_env_1.parseSecretFiles)(Object.entries(('fileFromSecret' in instance.spec ? instance.spec.fileFromSecret : undefined) ?? {}).map(([key, target]) => `${key}=${target}`))
+                                    : instance.spec.envFromSecret),
+                        };
+                        for (const key of remove)
+                            delete bindings[key];
+                        Object.assign(bindings, additions);
+                        if (Object.keys(bindings).length > 64)
+                            this.error('At most 64 secret bindings are supported.');
+                        const required = (0, secret_env_1.secretReadPermissions)(additions).filter((permission) => !role.permissions.some((granted) => (0, secret_env_1.permissionCovers)(granted, permission)));
+                        try {
+                            await instances.update(target.id, {
+                                ifMatch: etag,
+                                spec: {
+                                    [field]: bindings,
+                                    ...(required.length && {
+                                        role: { permissions: [...new Set([...role.permissions, ...required])] },
+                                    }),
+                                },
+                            });
+                            this.outputResult({ instanceId: target.id, [field]: bindings }, `Updated secret ${kind} bindings on ${target.id}.`);
+                            return;
+                        }
+                        catch (error) {
+                            if (!(error instanceof api_1.APIError) || error.status !== 412 || attempt === 2)
+                                throw error;
+                        }
+                    }
+                });
+            }
+        },
+        _a.summary = `Save secret-backed ${kind === 'file' ? 'files' : 'environment variables'} on the ${platform} instance`,
+        _a.description = (kind === 'file' ?
+            'Use quoted remote paths, for example "~/.npmrc=packages/npmrc" or "~/.netrc=github/netrc", for private packages and Git repositories. Other paths, including those starting with /, resolve relative to the command working directory. Files are refreshed on the next command and kept for future commands; unset files are removed when the next command starts. '
+            : 'Environment bindings apply to subsequent commands. ') +
+            'The workload fetches values using its delegated secret read permissions. Repeated bindings are merged; --unset removes one and --clear removes all before applying new bindings. Removing a binding preserves delegated permissions.',
+        _a.strict = false,
+        _a.examples = [
+            `<%= config.bin %> ${platform} set ${kind}-from-secret ${kind === 'file' ? "'~/.npmrc=packages/npmrc'" : 'NPM_TOKEN=my/secret'}`,
+            `<%= config.bin %> ${platform} set ${kind}-from-secret --unset ${kind === 'file' ? "'~/.npmrc'" : 'NPM_TOKEN'}`,
+        ],
+        _a.flags = {
+            ...base_command_1.BaseCommand.baseFlags,
+            id: core_1.Flags.string({ description: 'Instance ID. Defaults to the current target.' }),
+            unset: core_1.Flags.string({
+                description: 'Remove a saved binding by variable name or quoted remote file path.',
+                multiple: true,
+                multipleNonGreedy: true,
+            }),
+            clear: core_1.Flags.boolean({ description: 'Remove all saved bindings before applying new ones.' }),
+        },
+        _a;
+}
+//# sourceMappingURL=set-secret-env-command.js.map

package/dist/lib/set-secret-env-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-secret-env-command.js","sourceRoot":"","sources":["../../src/lib/set-secret-env-command.ts"],"names":[],"mappings":";;AAKA,kDAuGC;AA5GD,sCAAoC;AACpC,qCAAuC;AACvC,kDAA8C;AAC9C,6CAAyG;AAEzG,SAAgB,mBAAmB,CACjC,QAAgD,EAChD,OAAuB,KAAK;;IAE5B,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,6BAAgB,CAAC,CAAC,CAAC,2BAAc,CAAC;IAClE,YAAO,MAAM,YAAa,SAAQ,0BAAW;YA4B3C,KAAK,CAAC,GAAG;gBACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAY,CAAC,CAAC;gBACvD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAgB,CAAC,IAAI,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC7C,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAA,6BAAgB,EAAC,CAAC,GAAG,GAAG,aAAa,CAAC,CAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,CAClF,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK;oBAClE,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACpE,KAAK,MAAM,GAAG,IAAI,MAAM;oBACtB,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAC/D,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;oBAC7B,MAAM,MAAM,GACV,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9D,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC5D,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gCACxD,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC1C,MAAM,SAAS,GAAG;wBAChB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;wBACjC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;wBACnC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;wBAC7B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;qBACtC,CAAC;oBACF,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;oBACtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;wBAC7C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;wBACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;wBAChC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY;4BAC1D,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;wBAC9D,MAAM,QAAQ,GAA2B;4BACvC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gCACpB,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;oCACjB,IAAA,6BAAgB,EACd,MAAM,CAAC,OAAO,CACZ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CACrF,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,CAC7C;oCACH,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;yBAC/B,CAAC;wBACF,KAAK,MAAM,GAAG,IAAI,MAAM;4BAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;wBAC/C,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;wBACnC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,EAAE;4BAAE,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;wBAC/F,MAAM,QAAQ,GAAG,IAAA,kCAAqB,EAAC,SAAS,CAAC,CAAC,MAAM,CACtD,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,6BAAgB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAC3F,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gCAChC,OAAO,EAAE,IAAI;gCACb,IAAI,EAAE;oCACJ,CAAC,KAAK,CAAC,EAAE,QAAQ;oCACjB,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI;wCACrB,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE;qCACxE,CAAC;iCACH;6BACF,CAAC,CAAC;4BACH,IAAI,CAAC,YAAY,CACf,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAC5C,kBAAkB,IAAI,gBAAgB,MAAM,CAAC,EAAE,GAAG,CACnD,CAAC;4BACF,OAAO;wBACT,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC;gCAAE,MAAM,KAAK,CAAC;wBACzF,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;SACF;QA/FQ,UAAO,GAAG,sBACf,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAC9B,WAAW,QAAQ,WAAY;QACxB,cAAW,GAChB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChB,qWAAqW;YACvW,CAAC,CAAC,qDAAqD,CAAC;YACxD,sOAAuO;QAClO,SAAM,GAAG,KAAM;QACf,WAAQ,GAAG;YAChB,qBAAqB,QAAQ,QAAQ,IAAI,gBACvC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,qBAClD,EAAE;YACF,qBAAqB,QAAQ,QAAQ,IAAI,wBACvC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WACnC,EAAE;SACF;QACK,QAAK,GAAG;YACb,GAAG,0BAAW,CAAC,SAAS;YACxB,EAAE,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;YACjF,KAAK,EAAE,YAAK,CAAC,MAAM,CAAC;gBAClB,WAAW,EAAE,qEAAqE;gBAClF,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,IAAI;aACxB,CAAC;YACF,KAAK,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;SAC5F;WAqEF;AACJ,CAAC"}

package/dist/lib/set-secret-env-command.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=set-secret-env-command.test.d.ts.map