lim 0.53.0 → 0.53.1

package/dist/commands/secret/commands.test.js

@@ -0,0 +1,137 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const create_1 = __importDefault(require("./create"));
+const get_1 = __importDefault(require("./get"));
+const update_1 = __importDefault(require("./update"));
+const delete_1 = __importDefault(require("./delete"));
+const read_1 = __importDefault(require("./read"));
+const write_1 = __importDefault(require("./write"));
+const secret_input_1 = require("../../lib/secret-input");
+function setup(command, args = {}, flags = {}) {
+    const value = { id: 'secret_test', name: 'npm/token', metadata: {} };
+    const secrets = {
+        create: jest.fn().mockResolvedValue(value),
+        get: jest.fn().mockResolvedValue(value),
+        update: jest.fn().mockResolvedValue(value),
+        delete: jest.fn().mockResolvedValue(undefined),
+        list: jest.fn().mockResolvedValue({ secrets: [value] }),
+        read: jest.fn().mockResolvedValue(new Uint8Array([0, 255, 10])),
+        write: jest.fn().mockResolvedValue(undefined),
+    };
+    const instance = Object.assign(Object.create(command.prototype), {
+        parse: async () => ({ args, flags: { json: true, ...flags } }),
+        setParsedFlags: jest.fn(),
+        withAuth: async (run) => run(),
+        outputResult: jest.fn(),
+        outputJson: jest.fn(),
+        error: (message) => {
+            throw new Error(message);
+        },
+    });
+    Object.defineProperty(instance, 'client', { value: { secrets } });
+    return { instance, secrets };
+}
+test('metadata commands never call value access methods', async () => {
+    for (const command of [create_1.default, get_1.default, update_1.default, delete_1.default]) {
+        const { instance, secrets } = setup(command, { name: 'npm/token', target: 'npm/token' }, { type: 'generic', metadata: '{"registry":"npm"}' });
+        await instance.run();
+        expect(secrets.read).not.toHaveBeenCalled();
+        expect(secrets.write).not.toHaveBeenCalled();
+        if (command === create_1.default)
+            expect(secrets.create).toHaveBeenCalledWith({
+                name: 'npm/token',
+                type: 'generic',
+                metadata: { registry: 'npm' },
+            });
+        if (command === update_1.default)
+            expect(secrets.update).toHaveBeenCalledWith('name/npm/token', { metadata: { registry: 'npm' } });
+    }
+});
+test('write takes its value argument by default and does not echo it', async () => {
+    const { instance, secrets } = setup(write_1.default, { target: 'npm/token', value: 'private-value' });
+    let received;
+    secrets.write.mockImplementation(async (_target, bytes) => {
+        received = Buffer.from(bytes);
+    });
+    await instance.run();
+    expect(received.toString()).toBe('private-value');
+    expect(JSON.stringify(instance.outputResult.mock.calls)).not.toContain('private-value');
+    expect(secrets.write.mock.calls[0][1].every((byte) => byte === 0)).toBe(true);
+});
+test.each([
+    [{ target: 'npm/token' }, {}],
+    [{ target: 'npm/token', value: 'secret' }, { file: '/tmp/input' }],
+    [{ target: 'npm/token', value: 'secret' }, { stdin: true }],
+])('write requires exactly one input source', async (args, flags) => {
+    const { instance, secrets } = setup(write_1.default, args, flags);
+    await expect(instance.run()).rejects.toThrow('exactly one');
+    expect(secrets.write).not.toHaveBeenCalled();
+});
+test('file writes preserve bytes, enforce the size limit, and read output is private without overwrite', async () => {
+    const dir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'lim-secret-test-'));
+    try {
+        const input = (0, node_path_1.join)(dir, 'input');
+        const output = (0, node_path_1.join)(dir, 'output');
+        (0, node_fs_1.writeFileSync)(input, Buffer.from([0, 255, 10]));
+        const write = setup(write_1.default, { target: 'npm/token' }, { file: input });
+        let received;
+        write.secrets.write.mockImplementation(async (_target, bytes) => {
+            received = Buffer.from(bytes);
+        });
+        await write.instance.run();
+        expect(received).toEqual(Buffer.from([0, 255, 10]));
+        const read = setup(read_1.default, { target: 'npm/token' }, { output });
+        await read.instance.run();
+        expect((0, node_fs_1.readFileSync)(output)).toEqual(Buffer.from([0, 255, 10]));
+        expect((0, node_fs_1.statSync)(output).mode & 0o777).toBe(0o600);
+        await expect(read.instance.run()).rejects.toThrow('EEXIST');
+        (0, node_fs_1.writeFileSync)(input, Buffer.alloc(65537));
+        await expect((0, secret_input_1.secretBytes)(input)).rejects.toThrow('64 KiB');
+    }
+    finally {
+        (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+});
+test('JSON reads are explicitly base64 and preserve binary values', async () => {
+    const { instance } = setup(read_1.default, { target: 'npm/token' });
+    await instance.run();
+    expect(instance.outputJson).toHaveBeenCalledWith({ encoding: 'base64', data: 'AP8K' });
+});
+test('names are literal and metadata must be a bounded object', () => {
+    expect((0, secret_input_1.secretTarget)('npm/token')).toBe('name/npm/token');
+    expect((0, secret_input_1.secretTarget)('name/npm/token')).toBe('name/npm/token');
+    expect(() => (0, secret_input_1.secretTarget)('npm/*')).toThrow();
+    for (const value of ['[]', 'null', 'invalid', JSON.stringify({ text: 'x'.repeat(16384) })])
+        expect(() => (0, secret_input_1.secretMetadata)(value)).toThrow();
+});
+test.each(['', 'x'.repeat(65537)])('write rejects invalid argument sizes before authentication', async (value) => {
+    const { instance, secrets } = setup(write_1.default, { target: 'npm/token', value });
+    instance.withAuth = jest.fn();
+    await expect(instance.run()).rejects.toThrow('64 KiB');
+    expect(instance.withAuth).not.toHaveBeenCalled();
+    expect(secrets.write).not.toHaveBeenCalled();
+});
+test.each([['--stdin'], ['--file', '-']])('parser leaves piped values for the explicit input handler: %s', async (...inputFlags) => {
+    const globals = globalThis;
+    const original = globals.oclif;
+    globals.oclif = { ...original, stdinCache: '  private-value\n' };
+    try {
+        const parsed = await core_1.Parser.parse(['npm/token', ...inputFlags], {
+            args: write_1.default.args,
+            flags: write_1.default.flags,
+        });
+        expect(parsed.args.target).toBe('npm/token');
+        expect(parsed.args.value).toBeUndefined();
+    }
+    finally {
+        globals.oclif = original;
+    }
+});
+//# sourceMappingURL=commands.test.js.map

package/dist/commands/secret/commands.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.test.js","sourceRoot":"","sources":["../../../src/commands/secret/commands.test.ts"],"names":[],"mappings":";;;;;AAAA,sCAAqC;AACrC,qCAAqF;AACrF,qCAAiC;AACjC,yCAAiC;AACjC,sDAAoC;AACpC,gDAA8B;AAC9B,sDAAoC;AACpC,sDAAoC;AACpC,kDAAgC;AAChC,oDAAkC;AAClC,yDAAmF;AAEnF,SAAS,KAAK,CACZ,OAMsB,EACtB,OAA+B,EAAE,EACjC,QAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAC1C,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACvC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAC1C,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC9C,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/D,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;KAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;QAC/D,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;QAC9D,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,QAAQ,EAAE,KAAK,EAAE,GAAwB,EAAE,EAAE,CAAC,GAAG,EAAE;QACnD,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;QACvB,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE;QACrB,KAAK,EAAE,CAAC,OAAe,EAAS,EAAE;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,KAAK,MAAM,OAAO,IAAI,CAAC,gBAAY,EAAE,aAAS,EAAE,gBAAY,EAAE,gBAAY,CAAC,EAAE,CAAC;QAC5E,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CACjC,OAAO,EACP,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,EAC1C,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CACpD,CAAC;QACF,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,IAAI,OAAO,KAAK,gBAAY;YAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC;gBAC1C,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC9B,CAAC,CAAC;QACL,IAAI,OAAO,KAAK,gBAAY;YAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;IAChF,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,eAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IAClG,IAAI,QAA4B,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxD,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;IACrB,MAAM,CAAC,QAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACxF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,IAAI,CAAC;IACR,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAClE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;CAC5D,CAAC,CAAC,yCAAyC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;IAClE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,eAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5D,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;IAClH,MAAM,GAAG,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACnC,IAAA,uBAAa,EAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,KAAK,CAAC,eAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,IAAI,QAA4B,CAAC;QACjC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAC9D,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,cAAU,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAA,sBAAY,EAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,IAAA,kBAAQ,EAAC,MAAM,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAA,uBAAa,EAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,IAAA,0BAAW,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;IAC7E,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,cAAU,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,CAAC,GAAG,EAAE,CAAC;IACrB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AACzF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,CAAC,IAAA,2BAAY,EAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzD,MAAM,CAAC,IAAA,2BAAY,EAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,2BAAY,EAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAc,EAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAChC,4DAA4D,EAC5D,KAAK,EAAE,KAAK,EAAE,EAAE;IACd,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,eAAW,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9B,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACjD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;AAC/C,CAAC,CACF,CAAC;AAEF,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CACvC,+DAA+D,EAC/D,KAAK,EAAE,GAAG,UAAU,EAAE,EAAE;IACtB,MAAM,OAAO,GAAG,UAAqE,CAAC;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAC/B,OAAO,CAAC,KAAK,GAAG,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,UAAU,CAAC,EAAE;YAC9D,IAAI,EAAE,eAAW,CAAC,IAAI;YACtB,KAAK,EAAE,eAAW,CAAC,KAAK;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC;IAC3B,CAAC;AACH,CAAC,CACF,CAAC"}

package/dist/commands/secret/create.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+export default class SecretCreate extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        type: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        metadata: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        quiet: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}
+//# sourceMappingURL=create.d.ts.map

package/dist/commands/secret/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/secret/create.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IACnD,MAAM,CAAC,OAAO,SAA+B;IAC7C,MAAM,CAAC,WAAW,SACiH;IACnI,MAAM,CAAC,IAAI;;MAA2F;IACtG,MAAM,CAAC,KAAK;;;;;;;MAOV;IACF,MAAM,CAAC,QAAQ,WAEb;IACI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAY3B"}

package/dist/commands/secret/create.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const secret_input_1 = require("../../lib/secret-input");
+class SecretCreate extends base_command_1.BaseCommand {
+    async run() {
+        const { args, flags } = await this.parse(SecretCreate);
+        this.setParsedFlags(flags);
+        const metadata = (0, secret_input_1.secretMetadata)(flags.metadata);
+        await this.withAuth(async () => {
+            const secret = await this.client.secrets.create({ name: args.name, type: flags.type, metadata });
+            this.outputResult(secret, `Created secret ${secret.name} (${secret.id}). Use lim secret write to save its value.`);
+        });
+    }
+}
+SecretCreate.summary = 'Create a secret container';
+SecretCreate.description = 'Creates metadata only. Use secret write to save the value directly in Google Secret Manager. Existing names return a conflict.';
+SecretCreate.args = { name: core_1.Args.string({ required: true, description: 'Exact name, such as npm/token' }) };
+SecretCreate.flags = {
+    ...base_command_1.BaseCommand.readOnlyFlags,
+    type: core_1.Flags.string({ default: 'generic', description: 'Payload type; descriptive only' }),
+    metadata: core_1.Flags.string({
+        default: '{}',
+        description: 'Non-sensitive JSON object stored by Limrun; never include credentials',
+    }),
+};
+SecretCreate.examples = [
+    '<%= config.bin %> secret create npm/token --type generic --metadata \'{"registry":"npm"}\'',
+];
+exports.default = SecretCreate;
+//# sourceMappingURL=create.js.map

package/dist/commands/secret/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../src/commands/secret/create.ts"],"names":[],"mappings":";;AAAA,sCAA0C;AAC1C,qDAAiD;AACjD,yDAAwD;AAExD,MAAqB,YAAa,SAAQ,0BAAW;IAgBnD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAA,6BAAc,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,YAAY,CACf,MAAM,EACN,kBAAkB,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,4CAA4C,CACxF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;;AA1BM,oBAAO,GAAG,2BAA2B,CAAC;AACtC,wBAAW,GAChB,gIAAgI,CAAC;AAC5H,iBAAI,GAAG,EAAE,IAAI,EAAE,WAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC,EAAE,CAAC;AAC/F,kBAAK,GAAG;IACb,GAAG,0BAAW,CAAC,aAAa;IAC5B,IAAI,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IACzF,QAAQ,EAAE,YAAK,CAAC,MAAM,CAAC;QACrB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,uEAAuE;KACrF,CAAC;CACH,CAAC;AACK,qBAAQ,GAAG;IAChB,4FAA4F;CAC7F,CAAC;kBAfiB,YAAY"}

package/dist/commands/secret/delete.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../base-command';
+export default class SecretDelete extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static args: {
+        target: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        quiet: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=delete.d.ts.map

package/dist/commands/secret/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/commands/secret/delete.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IACnD,MAAM,CAAC,OAAO,SAAwC;IACtD,MAAM,CAAC,WAAW,SAAuE;IACzF,MAAM,CAAC,IAAI;;MAAuF;IAClG,MAAM,CAAC,KAAK;;;;;MAAoC;IAC1C,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAS3B"}

package/dist/commands/secret/delete.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const secret_input_1 = require("../../lib/secret-input");
+class SecretDelete extends base_command_1.BaseCommand {
+    async run() {
+        const { args, flags } = await this.parse(SecretDelete);
+        this.setParsedFlags(flags);
+        const target = (0, secret_input_1.secretTarget)(args.target);
+        await this.withAuth(async () => {
+            await this.client.secrets.delete(target);
+            this.outputResult({ ok: true, target }, `Deleted secret ${target}.`);
+        });
+    }
+}
+SecretDelete.summary = 'Delete a secret and all its values';
+SecretDelete.description = 'Permanently deletes the secret container and all stored versions.';
+SecretDelete.args = { target: core_1.Args.string({ required: true, description: 'Secret ID or exact name' }) };
+SecretDelete.flags = { ...base_command_1.BaseCommand.readOnlyFlags };
+exports.default = SecretDelete;
+//# sourceMappingURL=delete.js.map

package/dist/commands/secret/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/commands/secret/delete.ts"],"names":[],"mappings":";;AAAA,sCAAmC;AACnC,qDAAiD;AACjD,yDAAsD;AAEtD,MAAqB,YAAa,SAAQ,0BAAW;IAKnD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,2BAAY,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,kBAAkB,MAAM,GAAG,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC;;AAZM,oBAAO,GAAG,oCAAoC,CAAC;AAC/C,wBAAW,GAAG,mEAAmE,CAAC;AAClF,iBAAI,GAAG,EAAE,MAAM,EAAE,WAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,EAAE,CAAC;AAC3F,kBAAK,GAAG,EAAE,GAAG,0BAAW,CAAC,aAAa,EAAE,CAAC;kBAJ7B,YAAY"}

package/dist/commands/secret/get.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '../../base-command';
+export default class SecretGet extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static aliases: string[];
+    static args: {
+        target: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        offset: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        quiet: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=get.d.ts.map

package/dist/commands/secret/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../src/commands/secret/get.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAC,OAAO,SAAkD;IAChE,MAAM,CAAC,WAAW,SAC4F;IAC9G,MAAM,CAAC,OAAO,WAAmB;IACjC,MAAM,CAAC,IAAI;;MAAsF;IACjG,MAAM,CAAC,KAAK;;;;;;;;MAKV;IACI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAe3B"}

package/dist/commands/secret/get.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const secret_input_1 = require("../../lib/secret-input");
+class SecretGet extends base_command_1.BaseCommand {
+    async run() {
+        const { args, flags } = await this.parse(SecretGet);
+        this.setParsedFlags(flags);
+        await this.withAuth(async () => {
+            const result = args.target ?
+                await this.client.secrets.get((0, secret_input_1.secretTarget)(args.target))
+                : await this.client.secrets.list({
+                    limit: flags.limit,
+                    offset: flags.offset,
+                    ...(flags.name ? { nameFilter: flags.name } : {}),
+                });
+            this.outputResult(result, JSON.stringify(result, null, 2));
+        });
+    }
+}
+SecretGet.summary = 'Get secret metadata, or list visible secrets';
+SecretGet.description = 'Returns metadata only. Use secret read to fetch a value. Listing is paginated using --limit and --offset.';
+SecretGet.aliases = ['secret:list'];
+SecretGet.args = { target: core_1.Args.string({ description: 'Secret ID or exact name. Omit to list.' }) };
+SecretGet.flags = {
+    ...base_command_1.BaseCommand.readOnlyFlags,
+    limit: core_1.Flags.integer({ min: 1, max: 100, default: 50 }),
+    offset: core_1.Flags.integer({ min: 0, max: 100000, default: 0 }),
+    name: core_1.Flags.string({ description: 'Exact name filter for listing' }),
+};
+exports.default = SecretGet;
+//# sourceMappingURL=get.js.map

package/dist/commands/secret/get.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/commands/secret/get.ts"],"names":[],"mappings":";;AAAA,sCAA0C;AAC1C,qDAAiD;AACjD,yDAAsD;AAEtD,MAAqB,SAAU,SAAQ,0BAAW;IAYhD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,CAAC,CAAC;gBACX,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAA,2BAAY,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC1D,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD,CAAC,CAAC;YACP,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;IACL,CAAC;;AAzBM,iBAAO,GAAG,8CAA8C,CAAC;AACzD,qBAAW,GAChB,2GAA2G,CAAC;AACvG,iBAAO,GAAG,CAAC,aAAa,CAAC,CAAC;AAC1B,cAAI,GAAG,EAAE,MAAM,EAAE,WAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC,EAAE,CAAC;AAC1F,eAAK,GAAG;IACb,GAAG,0BAAW,CAAC,aAAa;IAC5B,KAAK,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvD,MAAM,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC1D,IAAI,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;CACrE,CAAC;kBAXiB,SAAS"}

package/dist/commands/secret/read.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../base-command';
+export default class SecretRead extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static args: {
+        target: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        output: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        quiet: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}
+//# sourceMappingURL=read.d.ts.map

package/dist/commands/secret/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../../src/commands/secret/read.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,MAAM,CAAC,OAAO,SAA8C;IAC5D,MAAM,CAAC,WAAW,SACmL;IACrM,MAAM,CAAC,IAAI;;MAAuF;IAClG,MAAM,CAAC,KAAK;;;;;;MAGV;IACF,MAAM,CAAC,QAAQ,WAGb;IACI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAqB3B"}

package/dist/commands/secret/read.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const promises_1 = require("node:fs/promises");
+const base_command_1 = require("../../base-command");
+const secret_input_1 = require("../../lib/secret-input");
+class SecretRead extends base_command_1.BaseCommand {
+    async run() {
+        const { args, flags } = await this.parse(SecretRead);
+        this.setParsedFlags(flags);
+        const target = (0, secret_input_1.secretTarget)(args.target);
+        await this.withAuth(async () => {
+            const bytes = await this.client.secrets.read(target);
+            try {
+                if (flags.output) {
+                    await (0, promises_1.writeFile)(flags.output, bytes, { mode: 0o600, flag: 'wx' });
+                    this.outputResult({ ok: true, target, path: flags.output }, `Saved secret to ${flags.output}.`);
+                }
+                else if (flags.json)
+                    this.outputJson({ encoding: 'base64', data: Buffer.from(bytes).toString('base64') });
+                else
+                    await new Promise((resolve, reject) => process.stdout.write(bytes, (error) => (error ? reject(error) : resolve())));
+            }
+            finally {
+                bytes.fill(0);
+            }
+        });
+    }
+}
+SecretRead.summary = 'Read a secret value directly from Google';
+SecretRead.description = 'Writes exact bytes to stdout with no added newline, or creates a private file with --output. --json returns base64 data. Requires secret read permission; values never pass through Limrun APIs.';
+SecretRead.args = { target: core_1.Args.string({ required: true, description: 'Secret ID or exact name' }) };
+SecretRead.flags = {
+    ...base_command_1.BaseCommand.readOnlyFlags,
+    output: core_1.Flags.string({ description: 'Create an output file with mode 0600; refuses to overwrite' }),
+};
+SecretRead.examples = [
+    '<%= config.bin %> secret read npm/token',
+    '<%= config.bin %> secret read npm/config --output .npmrc',
+];
+exports.default = SecretRead;
+//# sourceMappingURL=read.js.map

package/dist/commands/secret/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../src/commands/secret/read.ts"],"names":[],"mappings":";;AAAA,sCAA0C;AAC1C,+CAA6C;AAC7C,qDAAiD;AACjD,yDAAsD;AAEtD,MAAqB,UAAW,SAAQ,0BAAW;IAajD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,2BAAY,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAA,oBAAS,EAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;oBAClE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,mBAAmB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBAClG,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI;oBACnB,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;;oBAErF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC5E,CAAC;YACN,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;;AAhCM,kBAAO,GAAG,0CAA0C,CAAC;AACrD,sBAAW,GAChB,kMAAkM,CAAC;AAC9L,eAAI,GAAG,EAAE,MAAM,EAAE,WAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,EAAE,CAAC;AAC3F,gBAAK,GAAG;IACb,GAAG,0BAAW,CAAC,aAAa;IAC5B,MAAM,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC;CACpG,CAAC;AACK,mBAAQ,GAAG;IAChB,yCAAyC;IACzC,0DAA0D;CAC3D,CAAC;kBAZiB,UAAU"}

package/dist/commands/secret/update.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../base-command';
+export default class SecretUpdate extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static args: {
+        target: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        metadata: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        quiet: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=update.d.ts.map

package/dist/commands/secret/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/commands/secret/update.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,CAAC,OAAO,OAAO,YAAa,SAAQ,WAAW;IACnD,MAAM,CAAC,OAAO,SAAyC;IACvD,MAAM,CAAC,WAAW,SACqI;IACvJ,MAAM,CAAC,IAAI;;MAAuF;IAClG,MAAM,CAAC,KAAK;;;;;;MAGV;IACI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAU3B"}

package/dist/commands/secret/update.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const secret_input_1 = require("../../lib/secret-input");
+class SecretUpdate extends base_command_1.BaseCommand {
+    async run() {
+        const { args, flags } = await this.parse(SecretUpdate);
+        this.setParsedFlags(flags);
+        const target = (0, secret_input_1.secretTarget)(args.target);
+        const metadata = (0, secret_input_1.secretMetadata)(flags.metadata);
+        await this.withAuth(async () => {
+            const result = await this.client.secrets.update(target, { metadata });
+            this.outputResult(result, `Updated metadata for ${result.name}.`);
+        });
+    }
+}
+SecretUpdate.summary = 'Replace descriptive secret metadata';
+SecretUpdate.description = 'Requires secret update permission. Does not change the name, type, or secret value. Metadata is stored by Limrun and must not contain credentials.';
+SecretUpdate.args = { target: core_1.Args.string({ required: true, description: 'Secret ID or exact name' }) };
+SecretUpdate.flags = {
+    ...base_command_1.BaseCommand.readOnlyFlags,
+    metadata: core_1.Flags.string({ required: true, description: 'Replacement JSON object; use {} to clear' }),
+};
+exports.default = SecretUpdate;
+//# sourceMappingURL=update.js.map

package/dist/commands/secret/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../src/commands/secret/update.ts"],"names":[],"mappings":";;AAAA,sCAA0C;AAC1C,qDAAiD;AACjD,yDAAsE;AAEtE,MAAqB,YAAa,SAAQ,0BAAW;IASnD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,2BAAY,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAA,6BAAc,EAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,wBAAwB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;;AAjBM,oBAAO,GAAG,qCAAqC,CAAC;AAChD,wBAAW,GAChB,oJAAoJ,CAAC;AAChJ,iBAAI,GAAG,EAAE,MAAM,EAAE,WAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,EAAE,CAAC;AAC3F,kBAAK,GAAG;IACb,GAAG,0BAAW,CAAC,aAAa;IAC5B,QAAQ,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;CACpG,CAAC;kBARiB,YAAY"}

package/dist/commands/secret/write.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '../../base-command';
+export default class SecretWrite extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static args: {
+        target: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        value: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        stdin: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        quiet: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}
+//# sourceMappingURL=write.d.ts.map

package/dist/commands/secret/write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.d.ts","sourceRoot":"","sources":["../../../src/commands/secret/write.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,WAAW;IAClD,MAAM,CAAC,OAAO,SAA6C;IAC3D,MAAM,CAAC,WAAW,SACsN;IACxO,MAAM,CAAC,IAAI;;;MAMT;IACF,MAAM,CAAC,KAAK;;;;;;;MAIV;IACF,MAAM,CAAC,QAAQ,WAIb;IACI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAsB3B"}

package/dist/commands/secret/write.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const secret_input_1 = require("../../lib/secret-input");
+class SecretWrite extends base_command_1.BaseCommand {
+    async run() {
+        const { args, flags } = await this.parse(SecretWrite);
+        this.setParsedFlags(flags);
+        const target = (0, secret_input_1.secretTarget)(args.target);
+        const sources = Number(args.value !== undefined) + Number(flags.file !== undefined) + Number(Boolean(flags.stdin));
+        if (sources !== 1)
+            this.error('Provide VALUE, --file PATH, or --stdin, exactly one.');
+        const bytes = args.value !== undefined ?
+            Buffer.from(args.value, 'utf8')
+            : await (0, secret_input_1.secretBytes)(flags.stdin ? '-' : flags.file);
+        try {
+            if (!bytes.length || bytes.length > 65536)
+                this.error('Secret values must contain between 1 byte and 64 KiB.');
+            await this.withAuth(async () => {
+                await this.client.secrets.write(target, bytes);
+                this.outputResult({ ok: true, target }, `Saved secret ${target}.`);
+            });
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+}
+SecretWrite.summary = 'Write a secret value directly to Google';
+SecretWrite.description = 'Adds a new version to an existing secret. Takes VALUE as an argument by default. Use --file PATH or --stdin to read exact bytes without trimming newlines. Values never pass through Limrun APIs. Requires secret write permission.';
+SecretWrite.args = {
+    target: core_1.Args.string({ ignoreStdin: true, required: true, description: 'Secret ID or exact name' }),
+    value: core_1.Args.string({
+        ignoreStdin: true,
+        description: 'Value to save; alternatively use --file or --stdin',
+    }),
+};
+SecretWrite.flags = {
+    ...base_command_1.BaseCommand.readOnlyFlags,
+    file: core_1.Flags.string({ description: 'Read value from a file; use - for stdin', exclusive: ['stdin'] }),
+    stdin: core_1.Flags.boolean({ description: 'Read the value from stdin', exclusive: ['file'] }),
+};
+SecretWrite.examples = [
+    '<%= config.bin %> secret write npm/token "$NPM_TOKEN"',
+    '<%= config.bin %> secret write npm/token --file ./npm-token',
+    'printf %s "$NPM_TOKEN" | <%= config.bin %> secret write npm/token --stdin',
+];
+exports.default = SecretWrite;
+//# sourceMappingURL=write.js.map

package/dist/commands/secret/write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write.js","sourceRoot":"","sources":["../../../src/commands/secret/write.ts"],"names":[],"mappings":";;AAAA,sCAA0C;AAC1C,qDAAiD;AACjD,yDAAmE;AAEnE,MAAqB,WAAY,SAAQ,0BAAW;IAqBlD,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,2BAAY,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACrG,IAAI,OAAO,KAAK,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;YACjC,CAAC,CAAC,MAAM,IAAA,0BAAW,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;gBACvC,IAAI,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;gBAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBAC/C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,gBAAgB,MAAM,GAAG,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;;AAzCM,mBAAO,GAAG,yCAAyC,CAAC;AACpD,uBAAW,GAChB,qOAAqO,CAAC;AACjO,gBAAI,GAAG;IACZ,MAAM,EAAE,WAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAClG,KAAK,EAAE,WAAI,CAAC,MAAM,CAAC;QACjB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,oDAAoD;KAClE,CAAC;CACH,CAAC;AACK,iBAAK,GAAG;IACb,GAAG,0BAAW,CAAC,aAAa;IAC5B,IAAI,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpG,KAAK,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,2BAA2B,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;CACxF,CAAC;AACK,oBAAQ,GAAG;IAChB,uDAAuD;IACvD,6DAA6D;IAC7D,2EAA2E;CAC5E,CAAC;kBApBiB,WAAW"}

package/dist/commands/xcode/build.d.ts

@@ -58,6 +58,8 @@ export default class XcodeBuild extends BaseCommand {
         'xcodegen-project': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'xcodegen-project-root': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         permission: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'file-from-secret': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'env-from-secret': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'api-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         quiet: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/xcode/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/xcode/build.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAiDjD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,MAAM,CAAC,OAAO,SAAwC;IACtD,MAAM,CAAC,WAAW,SACoU;IAEtV,MAAM,CAAC,QAAQ,WAiCb;IAEF,MAAM,CAAC,IAAI;;MAKT;IAEF,MAAM,CAAC,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA6KV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YA+TZ,mBAAmB;YAgBnB,wBAAwB;YA8BxB,cAAc;YAQd,oBAAoB;YAcpB,yBAAyB;CAkBxC"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/commands/xcode/build.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAiDjD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,MAAM,CAAC,OAAO,SAAwC;IACtD,MAAM,CAAC,WAAW,SACoU;IAEtV,MAAM,CAAC,QAAQ,WAkCb;IAEF,MAAM,CAAC,IAAI;;MAKT;IAEF,MAAM,CAAC,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA+KV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;YAmUZ,mBAAmB;YAgBnB,wBAAwB;YA8BxB,cAAc;YAQd,oBAAoB;YAcpB,yBAAyB;CAkBxC"}

package/dist/commands/xcode/build.js

@@ -1,6 +1,8 @@
 "use strict";
 var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
+const secret_env_flags_1 = require("../../lib/secret-env-flags");
+const secret_env_1 = require("../../lib/secret-env");
 const promises_1 = require("node:fs/promises");
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
@@ -88,7 +90,11 @@ class XcodeBuild extends base_command_1.BaseCommand {
                 }
                 settings.artifactName = artifactName;
             }
-            const options = {};
+            const options = {
+                envFromSecret: (0, secret_env_1.parseSecretEnv)(flags['env-from-secret']),
+                fileFromSecret: (0, secret_env_1.parseSecretFiles)(flags['file-from-secret']),
+            };
+            await this.ensureSecretPermissions(id, options.envFromSecret, options.fileFromSecret);
             if (flags['git-init']) {
                 options.gitInit = true;
             }
@@ -395,6 +401,7 @@ _a = XcodeBuild;
 XcodeBuild.summary = 'Run xcodebuild on an Xcode sandbox';
 XcodeBuild.description = 'Sync a local project path once (or the current working directory if omitted), then trigger a remote xcodebuild with streaming output. Use `--detach` for headless builds that should return as soon as the build starts, optionally with a webhook for the terminal result. Use `--ios` to build and run on an iOS simulator-backed Xcode target.';
 XcodeBuild.examples = [
+    "<%= config.bin %> xcode build --file-from-secret '~/.npmrc=packages/npmrc'",
     '<%= config.bin %> xcode build',
     '<%= config.bin %> xcode build ./MyProject',
     '<%= config.bin %> xcode build ./MyProject --ios',
@@ -436,6 +443,8 @@ XcodeBuild.args = {
 };
 XcodeBuild.flags = {
     ...base_command_1.BaseCommand.baseFlags,
+    ...secret_env_flags_1.secretEnvFlags,
+    ...secret_env_flags_1.secretFileFlags,
     ...base_command_1.BaseCommand.permissionFlags,
     ...xcode_project_flags_1.xcodeProjectFlags,
     ...sync_flags_1.syncFlags,