lim 0.53.0 → 0.53.1

package/dist/lib/secret-env.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSecretEnv = parseSecretEnv;
+exports.secretReadPermissions = secretReadPermissions;
+exports.permissionCovers = permissionCovers;
+exports.parseSecretFiles = parseSecretFiles;
+const secret_input_1 = require("./secret-input");
+/** Parse names literally, including slashes and colons; never accept wildcard delegation here. */
+function parseSecretEnv(entries) {
+    if (!entries?.length)
+        return undefined;
+    const result = Object.create(null);
+    for (const entry of entries) {
+        const index = entry.indexOf('=');
+        const key = entry.slice(0, index);
+        const name = entry.slice(index + 1);
+        if (index < 1 || !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key) || !name || /[*?\0\r\n]/.test(name)) {
+            throw new Error('Use --env-from-secret NAME=secret/name. Names must be literal, without * or ?.');
+        }
+        if (/^(DYLD_|LD_|LIMRUN_|SIMCTL_CHILD_|__DYLD_|__XPC_|XPC_DYLD_|SWIFT_DEBUG_)/i.test(key) ||
+            [
+                'NODE_BINARY',
+                'PATH',
+                'HOME',
+                'USER',
+                'LOGNAME',
+                'SHELL',
+                'TMPDIR',
+                'TMP',
+                'TEMP',
+                'DEVELOPER_DIR',
+                'ANDROID_HOME',
+                'ANDROID_SDK_ROOT',
+            ].includes(key)) {
+            throw new Error(`--env-from-secret cannot override managed variable ${key}.`);
+        }
+        if (Object.prototype.hasOwnProperty.call(result, key))
+            throw new Error(`Duplicate secret binding for ${key}.`);
+        result[key] =
+            /^secret_[0-7][0-9a-hjkmnp-tv-z]{25}$/.test(name) || name.startsWith('name/') ? name : `name/${name}`;
+        if (result[key] === 'name/' || result[key].length > 517)
+            throw new Error('Invalid secret name.');
+    }
+    if (Object.keys(result).length > 64)
+        throw new Error('At most 64 secret bindings are supported.');
+    return result;
+}
+function secretReadPermissions(bindings) {
+    return [...new Set(Object.values(bindings ?? {}).map((target) => `secret:${target}:read`))];
+}
+function permissionCovers(existing, requested) {
+    if (existing === requested)
+        return true;
+    const split = (value) => [
+        value.slice(0, value.indexOf(':')),
+        value.slice(value.indexOf(':') + 1, value.lastIndexOf(':')),
+        value.slice(value.lastIndexOf(':') + 1),
+    ];
+    const [resource, target, action] = split(existing);
+    const [wantedResource, wantedTarget, wantedAction] = split(requested);
+    if (resource !== wantedResource || (action !== 'all' && action !== wantedAction))
+        return false;
+    if (target === '*' || target === wantedTarget)
+        return true;
+    if (!target?.startsWith('name/') || !wantedTarget?.startsWith('name/'))
+        return false;
+    const pattern = target
+        .split('')
+        .map((c) => c === '*' ? '.*'
+        : c === '?' ? '.'
+            : c.replace(/[\\^$.*+?()[\]{}|]/g, '\\$&'))
+        .join('');
+    return new RegExp(`^${pattern}$`, 's').test(wantedTarget);
+}
+/** Keep ~/ literal so it resolves against the remote workload home. */
+function parseSecretFiles(entries) {
+    if (!entries?.length)
+        return undefined;
+    const result = Object.create(null);
+    for (const entry of entries) {
+        const i = entry.indexOf('=');
+        const rawDestination = entry.slice(0, i);
+        const destination = rawDestination.replace(/^\/+/, '');
+        const relative = rawDestination.startsWith('~/') ? destination.slice(2) : destination;
+        if (i < 1 ||
+            rawDestination.length > 1024 ||
+            relative.startsWith('/') ||
+            relative.startsWith('~') ||
+            /[\\\0\r\n]/.test(relative) ||
+            relative.split('/').some((p) => !p || p === '.' || p === '..'))
+            throw new Error("Use --file-from-secret '~/path=secret/name' or 'path=secret/name'; other paths are command-relative, ignoring leading /; quote ~/ to keep it remote.");
+        if (Object.prototype.hasOwnProperty.call(result, destination))
+            throw new Error('Duplicate secret file destination.');
+        try {
+            result[destination] = (0, secret_input_1.secretTarget)(entry.slice(i + 1));
+        }
+        catch {
+            throw new Error('--file-from-secret requires an exact secret ID or name without wildcards.');
+        }
+    }
+    if (Object.keys(result).length > 64)
+        throw new Error('At most 64 secret files are supported.');
+    return result;
+}
+//# sourceMappingURL=secret-env.js.map

package/dist/lib/secret-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.js","sourceRoot":"","sources":["../../src/lib/secret-env.ts"],"names":[],"mappings":";;AAGA,wCAqCC;AAED,sDAEC;AAED,4CAqBC;AAGD,4CA6BC;AAnGD,iDAA8C;AAE9C,kGAAkG;AAClG,SAAgB,cAAc,CAAC,OAA6B;IAC1D,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;QACD,IACE,2EAA2E,CAAC,IAAI,CAAC,GAAG,CAAC;YACrF;gBACE,aAAa;gBACb,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,SAAS;gBACT,OAAO;gBACP,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,eAAe;gBACf,cAAc;gBACd,kBAAkB;aACnB,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,GAAG,GAAG,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC;YACT,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QACxG,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACpG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,qBAAqB,CAAC,QAA4C;IAChF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAgB,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;IAClE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3D,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KACxC,CAAC;IACF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACtE,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/F,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM;SACnB,KAAK,CAAC,EAAE,CAAC;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI;QAChB,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG;YACjB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAC3C;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,uEAAuE;AACvE,SAAgB,gBAAgB,CAAC,OAA6B;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QACtF,IACE,CAAC,GAAG,CAAC;YACL,cAAc,CAAC,MAAM,GAAG,IAAI;YAC5B,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACxB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3B,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;YAE9D,MAAM,IAAI,KAAK,CACb,sJAAsJ,CACvJ,CAAC;QACJ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,GAAG,IAAA,2BAAY,EAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/secret-env.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-env.test.d.ts.map

package/dist/lib/secret-env.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.test.d.ts","sourceRoot":"","sources":["../../src/lib/secret-env.test.ts"],"names":[],"mappings":""}

package/dist/lib/secret-env.test.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const secret_env_1 = require("./secret-env");
+const delegated_permissions_1 = require("./delegated-permissions");
+test('literal names preserve slashes and colons, with exact read grants', () => {
+    const bindings = (0, secret_env_1.parseSecretEnv)([
+        'NPM_TOKEN=team/npm:production',
+        'PAT=name/github/private',
+        'ID=secret_01m7071h5qfavacqmm4mg23x1k',
+    ]);
+    expect(bindings).toEqual({
+        NPM_TOKEN: 'name/team/npm:production',
+        PAT: 'name/github/private',
+        ID: 'secret_01m7071h5qfavacqmm4mg23x1k',
+    });
+    expect((0, secret_env_1.secretReadPermissions)(bindings)).toEqual([
+        'secret:name/team/npm:production:read',
+        'secret:name/github/private:read',
+        'secret:secret_01m7071h5qfavacqmm4mg23x1k:read',
+    ]);
+    expect((0, delegated_permissions_1.delegatedPermissionsFromFlags)({
+        'env-from-secret': ['NPM_TOKEN=team/npm'],
+        permission: ['asset:name/source:read'],
+    })).toEqual(['asset:name/source:read', 'secret:name/team/npm:read']);
+});
+test.each([
+    'TOKEN=*',
+    'TOKEN=team/?',
+    'TOKEN=',
+    'BAD-KEY=name',
+    'PATH=path',
+    'LIMRUN_WORKLOAD_IDENTITY_TOKEN_FILE=token',
+    'TOKEN=name/',
+])('rejects invalid binding %s', (entry) => {
+    expect(() => (0, secret_env_1.parseSecretEnv)([entry])).toThrow();
+});
+test('rejects duplicate variables instead of silently granting the wrong secret', () => {
+    expect(() => (0, secret_env_1.parseSecretEnv)(['TOKEN=one', 'TOKEN=two'])).toThrow('Duplicate');
+});
+test('already-delegated wildcard permissions avoid unnecessary role updates', () => {
+    expect((0, secret_env_1.permissionCovers)('secret:*:read', 'secret:name/team/npm:read')).toBe(true);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/*:all', 'secret:name/team/npm:read')).toBe(true);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/*:write', 'secret:name/team/npm:read')).toBe(false);
+    expect((0, secret_env_1.permissionCovers)('asset:*:all', 'secret:name/team/npm:read')).toBe(false);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/a.b:read', 'secret:name/team/a+b:read')).toBe(false);
+    expect((0, secret_env_1.permissionCovers)('secret:name/team/npm:read', 'secret:name/team/npm:production:read')).toBe(false);
+});
+test('file bindings keep remote home paths and delegate exact secret names', () => {
+    expect((0, secret_env_1.parseSecretFiles)(['~/.npmrc=packages/npm:prod', 'config/token=team/service'])).toEqual({
+        '~/.npmrc': 'name/packages/npm:prod',
+        'config/token': 'name/team/service',
+    });
+    expect((0, delegated_permissions_1.delegatedPermissionsFromFlags)({ 'file-from-secret': ['~/.npmrc=packages/npm'] })).toEqual([
+        'secret:name/packages/npm:read',
+    ]);
+});
+test.each([
+    '/=key',
+    '/~/token=key',
+    '/../../token=key',
+    '../token=key',
+    '~/.config/../token=key',
+    '~/=key',
+    'a//b=key',
+    '~/.npmrc=*',
+])('rejects unsafe secret file %s', (entry) => {
+    expect(() => (0, secret_env_1.parseSecretFiles)([entry])).toThrow();
+});
+test('secret files normalize leading slashes and reject duplicate aliases', () => {
+    expect((0, secret_env_1.parseSecretFiles)(['/etc/var=one', '~/.npmrc=two'])).toEqual({
+        'etc/var': 'name/one',
+        '~/.npmrc': 'name/two',
+    });
+    expect(() => (0, secret_env_1.parseSecretFiles)(['/etc/var=one', 'etc/var=two'])).toThrow('Duplicate');
+});
+test.each(['*', '', 'name/'])('file binding errors name the file flag for target %s', (target) => {
+    expect(() => (0, secret_env_1.parseSecretFiles)([`~/.npmrc=${target}`])).toThrow('--file-from-secret');
+});
+//# sourceMappingURL=secret-env.test.js.map

package/dist/lib/secret-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.test.js","sourceRoot":"","sources":["../../src/lib/secret-env.test.ts"],"names":[],"mappings":";;AAAA,6CAAyG;AACzG,mEAAwE;AAExE,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;IAC7E,MAAM,QAAQ,GAAG,IAAA,2BAAc,EAAC;QAC9B,+BAA+B;QAC/B,yBAAyB;QACzB,sCAAsC;KACvC,CAAC,CAAC;IACH,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;QACvB,SAAS,EAAE,0BAA0B;QACrC,GAAG,EAAE,qBAAqB;QAC1B,EAAE,EAAE,mCAAmC;KACxC,CAAC,CAAC;IACH,MAAM,CAAC,IAAA,kCAAqB,EAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9C,sCAAsC;QACtC,iCAAiC;QACjC,+CAA+C;KAChD,CAAC,CAAC;IACH,MAAM,CACJ,IAAA,qDAA6B,EAAC;QAC5B,iBAAiB,EAAE,CAAC,oBAAoB,CAAC;QACzC,UAAU,EAAE,CAAC,wBAAwB,CAAC;KACvC,CAAC,CACH,CAAC,OAAO,CAAC,CAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,IAAI,CAAC;IACR,SAAS;IACT,cAAc;IACd,QAAQ;IACR,cAAc;IACd,WAAW;IACX,2CAA2C;IAC3C,aAAa;CACd,CAAC,CAAC,4BAA4B,EAAE,CAAC,KAAK,EAAE,EAAE;IACzC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,2BAAc,EAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2EAA2E,EAAE,GAAG,EAAE;IACrF,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,2BAAc,EAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;IACjF,MAAM,CAAC,IAAA,6BAAgB,EAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,CAAC,IAAA,6BAAgB,EAAC,wBAAwB,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,MAAM,CAAC,IAAA,6BAAgB,EAAC,0BAA0B,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,MAAM,CAAC,IAAA,6BAAgB,EAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,CAAC,IAAA,6BAAgB,EAAC,2BAA2B,EAAE,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,MAAM,CAAC,IAAA,6BAAgB,EAAC,2BAA2B,EAAE,sCAAsC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5G,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,CAAC,IAAA,6BAAgB,EAAC,CAAC,4BAA4B,EAAE,2BAA2B,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5F,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,mBAAmB;KACpC,CAAC,CAAC;IACH,MAAM,CAAC,IAAA,qDAA6B,EAAC,EAAE,kBAAkB,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/F,+BAA+B;KAChC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AACH,IAAI,CAAC,IAAI,CAAC;IACR,OAAO;IACP,cAAc;IACd,kBAAkB;IAClB,cAAc;IACd,wBAAwB;IACxB,QAAQ;IACR,UAAU;IACV,YAAY;CACb,CAAC,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;IAC5C,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAgB,EAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,CAAC,IAAA,6BAAgB,EAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACjE,SAAS,EAAE,UAAU;QACrB,UAAU,EAAE,UAAU;KACvB,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAgB,EAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,sDAAsD,EAAE,CAAC,MAAM,EAAE,EAAE;IAC/F,MAAM,CAAC,GAAG,EAAE,CAAC,IAAA,6BAAgB,EAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC"}

package/dist/lib/secret-input.d.ts

@@ -0,0 +1,5 @@
+export declare function secretTarget(value: string): string;
+/** Bound input before requesting a grant, including streams with unknown size. */
+export declare function secretBytes(file?: string): Promise<Buffer>;
+export declare function secretMetadata(value: string): Record<string, unknown>;
+//# sourceMappingURL=secret-input.d.ts.map

package/dist/lib/secret-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-input.d.ts","sourceRoot":"","sources":["../../src/lib/secret-input.ts"],"names":[],"mappings":"AAEA,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,kFAAkF;AAClF,wBAAsB,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAchE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYrE"}

package/dist/lib/secret-input.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretTarget = secretTarget;
+exports.secretBytes = secretBytes;
+exports.secretMetadata = secretMetadata;
+const node_fs_1 = require("node:fs");
+function secretTarget(value) {
+    if (!value || /[\0\r\n*?]/.test(value))
+        throw new Error('Use a secret ID or an exact name without wildcards.');
+    const target = /^secret_[0-7][0-9a-hjkmnp-tv-z]{25}$/.test(value) || value.startsWith('name/') ? value : `name/${value}`;
+    if (target === 'name/' || target.length > 517)
+        throw new Error('Invalid secret name.');
+    return target;
+}
+/** Bound input before requesting a grant, including streams with unknown size. */
+async function secretBytes(file) {
+    if ((!file || file === '-') && process.stdin.isTTY)
+        throw new Error('Pipe the value on stdin or supply --file PATH.');
+    const input = file && file !== '-' ? (0, node_fs_1.createReadStream)(file) : process.stdin;
+    const chunks = [];
+    let length = 0;
+    for await (const chunk of input) {
+        const bytes = Buffer.from(chunk);
+        length += bytes.length;
+        if (length > 65536)
+            throw new Error('Secret values must be at most 64 KiB.');
+        chunks.push(bytes);
+    }
+    if (!length)
+        throw new Error('Secret values cannot be empty.');
+    return Buffer.concat(chunks);
+}
+function secretMetadata(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error('--metadata must be a JSON object.');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('--metadata must be a JSON object.');
+    if (Buffer.byteLength(JSON.stringify(parsed)) > 16384)
+        throw new Error('Secret metadata must be at most 16 KiB.');
+    return parsed;
+}
+//# sourceMappingURL=secret-input.js.map

package/dist/lib/secret-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-input.js","sourceRoot":"","sources":["../../src/lib/secret-input.ts"],"names":[],"mappings":";;AAEA,oCAOC;AAGD,kCAcC;AAED,wCAYC;AAxCD,qCAA2C;AAE3C,SAAgB,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,MAAM,MAAM,GACV,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;IAC5G,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,WAAW,CAAC,IAAa;IAC7C,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAA,0BAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAgB,cAAc,CAAC,KAAa;IAC1C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK;QACnD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,OAAO,MAAiC,CAAC;AAC3C,CAAC"}

package/dist/lib/set-secret-env-command.d.ts

@@ -0,0 +1,3 @@
+import { BaseCommand } from '../base-command';
+export declare function setSecretEnvCommand(platform: 'xcode' | 'gradle' | 'ios' | 'android', kind?: 'env' | 'file'): typeof BaseCommand;
+//# sourceMappingURL=set-secret-env-command.d.ts.map

package/dist/lib/set-secret-env-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-secret-env-command.d.ts","sourceRoot":"","sources":["../../src/lib/set-secret-env-command.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,SAAS,EAChD,IAAI,GAAE,KAAK,GAAG,MAAc,GAC3B,OAAO,WAAW,CAoGpB"}

package/dist/lib/set-secret-env-command.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setSecretEnvCommand = setSecretEnvCommand;
+const core_1 = require("@oclif/core");
+const api_1 = require("@limrun/api");
+const base_command_1 = require("../base-command");
+const secret_env_1 = require("./secret-env");
+function setSecretEnvCommand(platform, kind = 'env') {
+    var _a;
+    const field = kind === 'file' ? 'fileFromSecret' : 'envFromSecret';
+    const parse = kind === 'file' ? secret_env_1.parseSecretFiles : secret_env_1.parseSecretEnv;
+    return _a = class SetSecretEnv extends base_command_1.BaseCommand {
+            async run() {
+                const { argv, flags } = await this.parse(_a);
+                this.setParsedFlags(flags);
+                const additions = parse(argv) ?? {};
+                const remove = (flags.unset ?? []).map((key) => kind === 'file' ? Object.keys((0, secret_env_1.parseSecretFiles)([key + '=validation']))[0] : key);
+                if (!Object.keys(additions).length && !remove.length && !flags.clear)
+                    this.error('Provide NAME=secret/name, --unset NAME, or --clear.');
+                for (const key of remove)
+                    if (kind === 'env' && !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key))
+                        this.error('Invalid --unset environment variable name.');
+                await this.withAuth(async () => {
+                    const target = platform === 'xcode' ? await this.resolveXcodeTarget(flags.id)
+                        : platform === 'gradle' ? this.resolveGradleTarget(flags.id)
+                            : platform === 'ios' ? this.resolveIosInstance(flags.id)
+                                : this.resolveAndroidInstance(flags.id);
+                    const resources = {
+                        xcode: this.client.xcodeInstances,
+                        gradle: this.client.gradleInstances,
+                        ios: this.client.iosInstances,
+                        android: this.client.androidInstances,
+                    };
+                    const instances = resources[platform];
+                    for (let attempt = 0; attempt < 3; attempt++) {
+                        const { data: instance, response } = await instances.get(target.id).withResponse();
+                        const etag = response.headers.get('etag');
+                        const role = instance.spec.role;
+                        if (!etag || !role || instance.status.state === 'terminated')
+                            this.error('Select a live instance with an editable role.');
+                        const bindings = {
+                            ...(flags.clear ? {}
+                                : kind === 'file' ?
+                                    (0, secret_env_1.parseSecretFiles)(Object.entries(('fileFromSecret' in instance.spec ? instance.spec.fileFromSecret : undefined) ?? {}).map(([key, target]) => `${key}=${target}`))
+                                    : instance.spec.envFromSecret),
+                        };
+                        for (const key of remove)
+                            delete bindings[key];
+                        Object.assign(bindings, additions);
+                        if (Object.keys(bindings).length > 64)
+                            this.error('At most 64 secret bindings are supported.');
+                        const required = (0, secret_env_1.secretReadPermissions)(additions).filter((permission) => !role.permissions.some((granted) => (0, secret_env_1.permissionCovers)(granted, permission)));
+                        try {
+                            await instances.update(target.id, {
+                                ifMatch: etag,
+                                spec: {
+                                    [field]: bindings,
+                                    ...(required.length && {
+                                        role: { permissions: [...new Set([...role.permissions, ...required])] },
+                                    }),
+                                },
+                            });
+                            this.outputResult({ instanceId: target.id, [field]: bindings }, `Updated secret ${kind} bindings on ${target.id}.`);
+                            return;
+                        }
+                        catch (error) {
+                            if (!(error instanceof api_1.APIError) || error.status !== 412 || attempt === 2)
+                                throw error;
+                        }
+                    }
+                });
+            }
+        },
+        _a.summary = `Save secret-backed ${kind === 'file' ? 'files' : 'environment variables'} on the ${platform} instance`,
+        _a.description = (kind === 'file' ?
+            'Use quoted remote paths, for example "~/.npmrc=packages/npmrc" or "~/.netrc=github/netrc", for private packages and Git repositories. Other paths, including those starting with /, resolve relative to the command working directory. Files are refreshed on the next command and kept for future commands; unset files are removed when the next command starts. '
+            : 'Environment bindings apply to subsequent commands. ') +
+            'The workload fetches values using its delegated secret read permissions. Repeated bindings are merged; --unset removes one and --clear removes all before applying new bindings. Removing a binding preserves delegated permissions.',
+        _a.strict = false,
+        _a.examples = [
+            `<%= config.bin %> ${platform} set ${kind}-from-secret ${kind === 'file' ? "'~/.npmrc=packages/npmrc'" : 'NPM_TOKEN=my/secret'}`,
+            `<%= config.bin %> ${platform} set ${kind}-from-secret --unset ${kind === 'file' ? "'~/.npmrc'" : 'NPM_TOKEN'}`,
+        ],
+        _a.flags = {
+            ...base_command_1.BaseCommand.baseFlags,
+            id: core_1.Flags.string({ description: 'Instance ID. Defaults to the current target.' }),
+            unset: core_1.Flags.string({
+                description: 'Remove a saved binding by variable name or quoted remote file path.',
+                multiple: true,
+                multipleNonGreedy: true,
+            }),
+            clear: core_1.Flags.boolean({ description: 'Remove all saved bindings before applying new ones.' }),
+        },
+        _a;
+}
+//# sourceMappingURL=set-secret-env-command.js.map

package/dist/lib/set-secret-env-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-secret-env-command.js","sourceRoot":"","sources":["../../src/lib/set-secret-env-command.ts"],"names":[],"mappings":";;AAKA,kDAuGC;AA5GD,sCAAoC;AACpC,qCAAuC;AACvC,kDAA8C;AAC9C,6CAAyG;AAEzG,SAAgB,mBAAmB,CACjC,QAAgD,EAChD,OAAuB,KAAK;;IAE5B,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,6BAAgB,CAAC,CAAC,CAAC,2BAAc,CAAC;IAClE,YAAO,MAAM,YAAa,SAAQ,0BAAW;YA4B3C,KAAK,CAAC,GAAG;gBACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,EAAY,CAAC,CAAC;gBACvD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,IAAgB,CAAC,IAAI,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC7C,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAA,6BAAgB,EAAC,CAAC,GAAG,GAAG,aAAa,CAAC,CAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,GAAG,CAClF,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK;oBAClE,IAAI,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACpE,KAAK,MAAM,GAAG,IAAI,MAAM;oBACtB,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;wBAC/D,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE;oBAC7B,MAAM,MAAM,GACV,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9D,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC5D,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gCACxD,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC1C,MAAM,SAAS,GAAG;wBAChB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;wBACjC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;wBACnC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;wBAC7B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;qBACtC,CAAC;oBACF,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;oBACtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;wBAC7C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;wBACnF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;wBAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;wBAChC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,YAAY;4BAC1D,IAAI,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;wBAC9D,MAAM,QAAQ,GAA2B;4BACvC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gCACpB,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;oCACjB,IAAA,6BAAgB,EACd,MAAM,CAAC,OAAO,CACZ,CAAC,gBAAgB,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CACrF,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,EAAE,CAAC,CAC7C;oCACH,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;yBAC/B,CAAC;wBACF,KAAK,MAAM,GAAG,IAAI,MAAM;4BAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;wBAC/C,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;wBACnC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,EAAE;4BAAE,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;wBAC/F,MAAM,QAAQ,GAAG,IAAA,kCAAqB,EAAC,SAAS,CAAC,CAAC,MAAM,CACtD,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,6BAAgB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAC3F,CAAC;wBACF,IAAI,CAAC;4BACH,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;gCAChC,OAAO,EAAE,IAAI;gCACb,IAAI,EAAE;oCACJ,CAAC,KAAK,CAAC,EAAE,QAAQ;oCACjB,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI;wCACrB,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE;qCACxE,CAAC;iCACH;6BACF,CAAC,CAAC;4BACH,IAAI,CAAC,YAAY,CACf,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,EAC5C,kBAAkB,IAAI,gBAAgB,MAAM,CAAC,EAAE,GAAG,CACnD,CAAC;4BACF,OAAO;wBACT,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC;gCAAE,MAAM,KAAK,CAAC;wBACzF,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;SACF;QA/FQ,UAAO,GAAG,sBACf,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAC9B,WAAW,QAAQ,WAAY;QACxB,cAAW,GAChB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAChB,qWAAqW;YACvW,CAAC,CAAC,qDAAqD,CAAC;YACxD,sOAAuO;QAClO,SAAM,GAAG,KAAM;QACf,WAAQ,GAAG;YAChB,qBAAqB,QAAQ,QAAQ,IAAI,gBACvC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,qBAClD,EAAE;YACF,qBAAqB,QAAQ,QAAQ,IAAI,wBACvC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WACnC,EAAE;SACF;QACK,QAAK,GAAG;YACb,GAAG,0BAAW,CAAC,SAAS;YACxB,EAAE,EAAE,YAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;YACjF,KAAK,EAAE,YAAK,CAAC,MAAM,CAAC;gBAClB,WAAW,EAAE,qEAAqE;gBAClF,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,IAAI;aACxB,CAAC;YACF,KAAK,EAAE,YAAK,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;SAC5F;WAqEF;AACJ,CAAC"}

package/dist/lib/set-secret-env-command.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=set-secret-env-command.test.d.ts.map

package/dist/lib/set-secret-env-command.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-secret-env-command.test.d.ts","sourceRoot":"","sources":["../../src/lib/set-secret-env-command.test.ts"],"names":[],"mappings":""}

package/dist/lib/set-secret-env-command.test.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("@limrun/api");
+const set_secret_env_command_1 = require("./set-secret-env-command");
+test.each(['xcode', 'gradle', 'ios', 'android'])('%s saves bindings and permissions atomically, retrying ETag conflicts', async (platform) => {
+    const Command = (0, set_secret_env_command_1.setSecretEnvCommand)(platform);
+    const command = new Command([], {});
+    const id = 'instance';
+    const live = jest
+        .fn()
+        .mockResolvedValueOnce({
+        data: {
+            spec: { envFromSecret: { OLD: 'name/old' }, role: { permissions: ['asset:name/source:read'] } },
+            status: { state: 'ready' },
+        },
+        response: new Response(null, { headers: { etag: '"1"' } }),
+    })
+        .mockResolvedValueOnce({
+        data: {
+            spec: {
+                envFromSecret: { OLD: 'name/old', CONCURRENT: 'name/concurrent' },
+                role: { permissions: ['asset:name/source:read', 'secret:name/concurrent:read'] },
+            },
+            status: { state: 'ready' },
+        },
+        response: new Response(null, { headers: { etag: '"2"' } }),
+    });
+    const update = jest
+        .fn()
+        .mockRejectedValueOnce(api_1.APIError.generate(412, {}, 'changed', new Headers()))
+        .mockResolvedValue(undefined);
+    Object.assign(command, {
+        parse: async () => ({ argv: ['NPM_TOKEN=team/npm'], flags: { unset: ['OLD', 'NPM_TOKEN'] } }),
+        withAuth: async (fn) => fn(),
+        resolveXcodeTarget: async () => ({ id }),
+        resolveGradleTarget: () => ({ id }),
+        resolveIosInstance: () => ({ id }),
+        resolveAndroidInstance: () => ({ id }),
+        outputResult: jest.fn(),
+    });
+    Object.defineProperty(command, 'client', {
+        value: { [`${platform}Instances`]: { get: () => ({ withResponse: live }), update } },
+    });
+    await command.run();
+    expect(update).toHaveBeenLastCalledWith(id, {
+        ifMatch: '"2"',
+        spec: {
+            envFromSecret: { CONCURRENT: 'name/concurrent', NPM_TOKEN: 'name/team/npm' },
+            role: {
+                permissions: ['asset:name/source:read', 'secret:name/concurrent:read', 'secret:name/team/npm:read'],
+            },
+        },
+    });
+});
+test.each(['xcode', 'gradle'])('%s saves file bindings and permissions atomically, retrying ETag conflicts', async (platform) => {
+    const Command = (0, set_secret_env_command_1.setSecretEnvCommand)(platform, 'file');
+    const command = new Command([], {});
+    const id = 'instance';
+    const live = jest
+        .fn()
+        .mockResolvedValueOnce({
+        data: {
+            spec: {
+                fileFromSecret: { '/etc/old': 'name/old', 'config/token': 'name/previous' },
+                role: { permissions: ['asset:name/source:read'] },
+            },
+            status: { state: 'ready' },
+        },
+        response: new Response(null, { headers: { etag: '"1"' } }),
+    })
+        .mockResolvedValueOnce({
+        data: {
+            spec: {
+                fileFromSecret: {
+                    '/etc/old': 'name/old',
+                    'config/token': 'name/previous',
+                    '~/concurrent': 'name/concurrent',
+                },
+                role: { permissions: ['asset:name/source:read', 'secret:name/concurrent:read'] },
+            },
+            status: { state: 'ready' },
+        },
+        response: new Response(null, { headers: { etag: '"2"' } }),
+    });
+    const update = jest
+        .fn()
+        .mockRejectedValueOnce(api_1.APIError.generate(412, {}, 'changed', new Headers()))
+        .mockResolvedValue(undefined);
+    Object.assign(command, {
+        parse: async () => ({
+            argv: ['/config/token=team/npm'],
+            flags: { unset: ['etc/old', 'config/token'] },
+        }),
+        withAuth: async (fn) => fn(),
+        resolveXcodeTarget: async () => ({ id }),
+        resolveGradleTarget: () => ({ id }),
+        resolveIosInstance: () => ({ id }),
+        resolveAndroidInstance: () => ({ id }),
+        outputResult: jest.fn(),
+    });
+    Object.defineProperty(command, 'client', {
+        value: { [`${platform}Instances`]: { get: () => ({ withResponse: live }), update } },
+    });
+    await command.run();
+    expect(update).toHaveBeenLastCalledWith(id, {
+        ifMatch: '"2"',
+        spec: {
+            fileFromSecret: { '~/concurrent': 'name/concurrent', 'config/token': 'name/team/npm' },
+            role: {
+                permissions: ['asset:name/source:read', 'secret:name/concurrent:read', 'secret:name/team/npm:read'],
+            },
+        },
+    });
+});
+//# sourceMappingURL=set-secret-env-command.test.js.map

package/dist/lib/set-secret-env-command.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-secret-env-command.test.js","sourceRoot":"","sources":["../../src/lib/set-secret-env-command.test.ts"],"names":[],"mappings":";;AACA,qCAAuC;AACvC,qEAA+D;AAE/D,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAU,CAAC,CACvD,uEAAuE,EACvE,KAAK,EAAE,QAAQ,EAAE,EAAE;IACjB,MAAM,OAAO,GAAG,IAAA,4CAAmB,EAAC,QAAQ,CAE5B,CAAC;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,EAAW,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,UAAU,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI;SACd,EAAE,EAAE;SACJ,qBAAqB,CAAC;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE,EAAE;YAC/F,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B;QACD,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;KAC3D,CAAC;SACD,qBAAqB,CAAC;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,aAAa,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,iBAAiB,EAAE;gBACjE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,EAAE;aACjF;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B;QACD,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;KAC3D,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,IAAI;SAChB,EAAE,EAAE;SACJ,qBAAqB,CAAC,cAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;SAC3E,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC;QAC7F,QAAQ,EAAE,KAAK,EAAE,EAAuB,EAAE,EAAE,CAAC,EAAE,EAAE;QACjD,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACxC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACnC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACtC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;KACxB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE;QACvC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;KACrF,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACpB,MAAM,CAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE;QAC1C,OAAO,EAAE,KAAK;QACd,IAAI,EAAE;YACJ,aAAa,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE;YAC5E,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC,wBAAwB,EAAE,6BAA6B,EAAE,2BAA2B,CAAC;aACpG;SACF;KACF,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEF,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC,CACrC,4EAA4E,EAC5E,KAAK,EAAE,QAAQ,EAAE,EAAE;IACjB,MAAM,OAAO,GAAG,IAAA,4CAAmB,EAAC,QAAQ,EAAE,MAAM,CAEpC,CAAC;IACjB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,EAAW,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,UAAU,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI;SACd,EAAE,EAAE;SACJ,qBAAqB,CAAC;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,cAAc,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE;gBAC3E,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,wBAAwB,CAAC,EAAE;aAClD;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B;QACD,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;KAC3D,CAAC;SACD,qBAAqB,CAAC;QACrB,IAAI,EAAE;YACJ,IAAI,EAAE;gBACJ,cAAc,EAAE;oBACd,UAAU,EAAE,UAAU;oBACtB,cAAc,EAAE,eAAe;oBAC/B,cAAc,EAAE,iBAAiB;iBAClC;gBACD,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,wBAAwB,EAAE,6BAA6B,CAAC,EAAE;aACjF;YACD,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3B;QACD,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;KAC3D,CAAC,CAAC;IACL,MAAM,MAAM,GAAG,IAAI;SAChB,EAAE,EAAE;SACJ,qBAAqB,CAAC,cAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;SAC3E,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAClB,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,cAAc,CAAC,EAAE;SAC9C,CAAC;QACF,QAAQ,EAAE,KAAK,EAAE,EAAuB,EAAE,EAAE,CAAC,EAAE,EAAE;QACjD,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACxC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACnC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QAClC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;QACtC,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;KACxB,CAAC,CAAC;IACH,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE;QACvC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE;KACrF,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;IACpB,MAAM,CAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,EAAE,EAAE;QAC1C,OAAO,EAAE,KAAK;QACd,IAAI,EAAE;YACJ,cAAc,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE;YACtF,IAAI,EAAE;gBACJ,WAAW,EAAE,CAAC,wBAAwB,EAAE,6BAA6B,EAAE,2BAA2B,CAAC;aACpG;SACF;KACF,CAAC,CAAC;AACL,CAAC,CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lim",
-  "version": "0.53.0",
+  "version": "0.53.1",
   "description": "Use remote XCode, Gradle, iOS Simulator, Android Emulator and more to build and test apps from Linux, Windows or macOS.",
   "bin": {
     "lim": "./bin/run.js",
@@ -26,7 +26,7 @@
     "test": "jest"
   },
   "dependencies": {
-    "@limrun/api": "0.70.1",
+    "@limrun/api": "0.70.2",
     "@oclif/core": "^4",
     "cli-progress": "^3.12.0",
     "cli-table3": "^0.6.5",