monorepo-secret-manager 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Adam Siwiec
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE. 

package/MIGRATION.md

@@ -0,0 +1,51 @@
+# Migration from gcp-monorepo-secret-manager
+
+npm cannot rename a package. `monorepo-secret-manager` is a new name. The old name stays installable and should be deprecated, not unpublished.
+
+## For consumers
+
+```bash
+npm uninstall gcp-monorepo-secret-manager
+npm install monorepo-secret-manager
+```
+
+If you use GCP, also install the optional SDK:
+
+```bash
+npm install @google-cloud/secret-manager
+```
+
+Update imports:
+
+```ts
+// before
+import { loadConfig, GcpMonorepoSecretManager } from "gcp-monorepo-secret-manager";
+
+// after
+import { loadConfig, MonorepoSecretManager } from "monorepo-secret-manager";
+```
+
+`GcpMonorepoSecretManager` still works as a deprecated alias for one major version.
+
+The `msm` binary is unchanged, so scripts like `msm --download --service all --stg --set` keep working.
+
+Existing `.secrets-config` files that use `serviceAccountPaths` and `projectIds` are still valid. They are treated as GCP. Run `msm --init` when you want provider-aware v2 config.
+
+## For maintainers: publish and deprecate
+
+Run these from the **repo root**, not from `compat/`. npm will prompt for a 2FA OTP (or pass `--otp=XXXXXX`).
+
+```bash
+cd /path/to/gcp-monorepo-secret-manager
+npm publish --access public --otp=XXXXXX
+npm run publish:shim -- --otp=XXXXXX
+npm run deprecate:legacy
+```
+
+`publish:shim` publishes `compat/gcp-monorepo-secret-manager` as `gcp-monorepo-secret-manager@1.2.0`. Do not `cd` into that folder first.
+
+Do not unpublish `gcp-monorepo-secret-manager`. That breaks existing `1.1.0` installs.
+
+## GitHub repository
+
+Rename `the-freetech-company/gcp-monorepo-secret-manager` to `monorepo-secret-manager` in GitHub settings. Old clone URLs redirect.

package/README.md

@@ -0,0 +1,156 @@
+# Monorepo Secret Manager
+
+Sync env files, SSH keypairs, TLS bundles, JSON, and binary files across a monorepo to GCP Secret Manager, AWS Secrets Manager, Azure Key Vault, or a local encrypted store.
+
+This package was previously published as `gcp-monorepo-secret-manager`. See [MIGRATION.md](./MIGRATION.md).
+
+## Installation
+
+```bash
+npm install -g monorepo-secret-manager
+```
+
+Install only the SDK for the backend you use:
+
+```bash
+npm install -g @google-cloud/secret-manager
+npm install -g @aws-sdk/client-secrets-manager
+npm install -g @azure/identity @azure/keyvault-secrets
+```
+
+The local backend is built in. No extra package is required.
+
+If a provider SDK is missing, the CLI fails with:
+
+```text
+Provider "aws" requires @aws-sdk/client-secrets-manager. Run: npm i -D @aws-sdk/client-secrets-manager
+```
+
+## Quick start
+
+```bash
+msm --init
+msm --upload --service frontend --stg
+msm --download --service frontend --prod --set
+```
+
+The init wizard asks for a provider per environment. Staging can be `local` while production is `gcp`, `aws`, or `azure`.
+
+## Backends
+
+| Provider | Store | Auth |
+| --- | --- | --- |
+| `gcp` | Secret Manager | ADC or a service-account JSON path |
+| `aws` | Secrets Manager | Default credential chain or `AWS_PROFILE` |
+| `azure` | Key Vault secrets | `DefaultAzureCredential` |
+| `local` | Encrypted files under `.msm/store` | `MSM_LOCAL_KEY` or `.msm/key` |
+
+The local store uses AES-256-GCM. `msm --init` creates `.msm/key` (mode `0600`) and adds `.msm/` to `.gitignore`. The backend refuses to run if the store is in a git repo and is not ignored.
+
+## Secret kinds
+
+Each service can have one or more items:
+
+- `env-file` — dotenv text. Stored as raw text so existing `*_ENV_FILE` GCP secrets keep working.
+- `ssh-keypair` — private + public key. Private file is written `0600`.
+- `tls-bundle` — cert, key, optional chain. Key is written `0600`.
+- `json` — a JSON object or array.
+- `binary` — an opaque file.
+
+Typed kinds are stored as a JSON envelope so every backend can carry them, including Azure (string-only).
+
+`msm --peek` prints redacted output. It never prints private keys or env values.
+
+## Configuration
+
+`.secrets-config` v2:
+
+```json
+{
+  "version": 2,
+  "environments": {
+    "staging": {
+      "provider": "local",
+      "storePath": ".msm/store"
+    },
+    "production": {
+      "provider": "gcp",
+      "projectId": "my-project-prod",
+      "credentials": { "path": "gcloud/production/sa.json" }
+    }
+  },
+  "services": [
+    {
+      "name": "api",
+      "secrets": [
+        {
+          "kind": "env-file",
+          "sourcePath": ".environments/.api.{env}.env",
+          "targetPath": "services/api/.env",
+          "remoteName": "api-env-file"
+        }
+      ]
+    }
+  ],
+  "deletePolicy": {
+    "maxVersions": 10,
+    "maxAgeDays": 30,
+    "enabled": true
+  }
+}
+```
+
+A v1 GCP-only file (`serviceAccountPaths` + `projectIds` + `secretPrefix`) is still loaded and treated as `provider: "gcp"` with one `env-file` item per service.
+
+## CLI
+
+```
+msm --init
+msm --list
+msm --upload --service all --prod
+msm --download --service api --stg --set
+msm --peek --service api --prod
+msm --cleanup --service api --prod
+msm --add-service
+msm --remove-service
+```
+
+`--override-sa` skips local credential files and uses the environment (CI workload identity, instance roles, Azure managed identity).
+
+## SDK
+
+```typescript
+import { loadConfig, MonorepoSecretManager } from "monorepo-secret-manager";
+
+await loadConfig({
+  serviceName: "api-server",
+  provider: "gcp",
+  projectId: "my-company-prod",
+  requiredEnvVars: ["DATABASE_URL", "JWT_SECRET"]
+});
+
+const manager = new MonorepoSecretManager({
+  environment: "production",
+  overrideSa: true
+});
+
+await manager.downloadEnv("api");
+await manager.setEnv("api");
+```
+
+`GcpMonorepoSecretManager` remains as a deprecated alias of `MonorepoSecretManager`.
+
+## Suggested layout
+
+```
+your-monorepo/
+├── .secrets-config
+├── .environments/
+├── .msm/                    # local store, gitignored
+├── apps/web/.env
+└── services/api/.env
+```
+
+## License
+
+MIT

package/dist/ConfigManager.d.ts

@@ -0,0 +1,20 @@
+import { DeletePolicy, Environment, EnvironmentConfig, SecretsConfig, ServiceConfig } from "./types";
+export declare class ConfigManager {
+    private config;
+    private configPath;
+    constructor(configPath?: string);
+    private loadConfig;
+    private validateConfig;
+    private validateDeletePolicy;
+    getConfig(): SecretsConfig;
+    getEnvironmentConfig(environment: Environment): EnvironmentConfig;
+    getServiceAccountPath(environment: Environment): string;
+    getProjectId(environment: Environment): string;
+    getServices(): ServiceConfig[];
+    getServiceByName(name: string): ServiceConfig | undefined;
+    getServiceNames(): string[];
+    getDeletePolicy(): DeletePolicy;
+    writeConfig(config?: SecretsConfig): void;
+    static generateTemplate(outputPath?: string): void;
+}
+//# sourceMappingURL=ConfigManager.d.ts.map

package/dist/ConfigManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigManager.d.ts","sourceRoot":"","sources":["../src/ConfigManager.ts"],"names":[],"mappings":"AACA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,iBAAiB,EAGjB,aAAa,EACb,aAAa,EAEd,MAAM,SAAS,CAAC;AAkKjB,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAAS;gBAEf,UAAU,GAAE,MAA0B;IAMlD,OAAO,CAAC,UAAU;IAsClB,OAAO,CAAC,cAAc;IAatB,OAAO,CAAC,oBAAoB;IAoB5B,SAAS,IAAI,aAAa;IAI1B,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,iBAAiB;IAIjE,qBAAqB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM;IAevD,YAAY,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM;IAa9C,WAAW,IAAI,aAAa,EAAE;IAI9B,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIzD,eAAe,IAAI,MAAM,EAAE;IAI3B,eAAe,IAAI,YAAY;IAU/B,WAAW,CAAC,MAAM,GAAE,aAA2B,GAAG,IAAI;IAKtD,MAAM,CAAC,gBAAgB,CAAC,UAAU,GAAE,MAA0B,GAAG,IAAI;CA2BtE"}

package/dist/ConfigManager.js

@@ -0,0 +1,253 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigManager = void 0;
+const fs_1 = __importDefault(require("fs"));
+const SECRET_KINDS = [
+    "env-file",
+    "ssh-keypair",
+    "tls-bundle",
+    "json",
+    "binary",
+];
+const PROVIDERS = ["gcp", "aws", "azure", "local"];
+function isLegacyConfig(raw) {
+    return Boolean(raw.serviceAccountPaths &&
+        raw.projectIds &&
+        !raw.environments);
+}
+function adaptLegacyService(service) {
+    if (!service.name) {
+        throw new Error("Service is missing required field: name");
+    }
+    const secrets = service.secrets && service.secrets.length > 0
+        ? service.secrets
+        : service.envPath && service.targetPath && service.secretPrefix
+            ? [
+                {
+                    kind: "env-file",
+                    sourcePath: service.envPath,
+                    targetPath: service.targetPath,
+                    remoteName: `${service.secretPrefix}_ENV_FILE`,
+                },
+            ]
+            : [];
+    return {
+        name: service.name,
+        envPath: service.envPath,
+        targetPath: service.targetPath,
+        secretPrefix: service.secretPrefix,
+        secrets,
+    };
+}
+function adaptLegacyConfig(raw) {
+    if (!raw.serviceAccountPaths?.staging ||
+        !raw.serviceAccountPaths.production ||
+        !raw.projectIds?.staging ||
+        !raw.projectIds.production) {
+        throw new Error("Legacy configuration must include serviceAccountPaths and projectIds for both staging and production");
+    }
+    return {
+        version: 2,
+        environments: {
+            staging: {
+                provider: "gcp",
+                projectId: raw.projectIds.staging,
+                credentials: { path: raw.serviceAccountPaths.staging },
+            },
+            production: {
+                provider: "gcp",
+                projectId: raw.projectIds.production,
+                credentials: { path: raw.serviceAccountPaths.production },
+            },
+        },
+        services: (raw.services || []).map(adaptLegacyService),
+        deletePolicy: raw.deletePolicy,
+        serviceAccountPaths: {
+            staging: raw.serviceAccountPaths.staging,
+            production: raw.serviceAccountPaths.production,
+        },
+        projectIds: {
+            staging: raw.projectIds.staging,
+            production: raw.projectIds.production,
+        },
+    };
+}
+function normalizeService(service, index) {
+    if (!service.name) {
+        throw new Error(`Service at index ${index} is missing required field: name`);
+    }
+    const normalized = adaptLegacyService(service);
+    if (!normalized.secrets || normalized.secrets.length === 0) {
+        throw new Error(`Service '${service.name}' must include secrets or legacy envPath, targetPath, and secretPrefix`);
+    }
+    normalized.secrets.forEach((secret, secretIndex) => {
+        if (!secret.kind || !SECRET_KINDS.includes(secret.kind)) {
+            throw new Error(`Service '${service.name}' secret at index ${secretIndex} has an invalid kind`);
+        }
+        if (!secret.remoteName) {
+            throw new Error(`Service '${service.name}' secret at index ${secretIndex} is missing remoteName`);
+        }
+    });
+    return normalized;
+}
+function validateEnvironment(label, environment) {
+    if (!environment || !PROVIDERS.includes(environment.provider)) {
+        throw new Error(`environments.${label}.provider must be one of: ${PROVIDERS.join(", ")}`);
+    }
+    switch (environment.provider) {
+        case "gcp":
+            if (!environment.projectId) {
+                throw new Error(`environments.${label}.projectId is required for the GCP provider`);
+            }
+            break;
+        case "aws":
+            if (!environment.region) {
+                throw new Error(`environments.${label}.region is required for the AWS provider`);
+            }
+            break;
+        case "azure":
+            if (!environment.vaultUrl) {
+                throw new Error(`environments.${label}.vaultUrl is required for the Azure provider`);
+            }
+            break;
+        case "local":
+            break;
+        default:
+            break;
+    }
+}
+class ConfigManager {
+    constructor(configPath = ".secrets-config") {
+        this.configPath = configPath;
+        this.config = this.loadConfig();
+        this.validateConfig();
+    }
+    loadConfig() {
+        if (!fs_1.default.existsSync(this.configPath)) {
+            throw new Error(`Configuration file not found at ${this.configPath}. Please create a .secrets-config file. Run 'msm --init' to generate a template.`);
+        }
+        let raw;
+        try {
+            raw = JSON.parse(fs_1.default.readFileSync(this.configPath, "utf8"));
+        }
+        catch (error) {
+            throw new Error(`Failed to parse configuration file: ${error.message}`);
+        }
+        if (isLegacyConfig(raw)) {
+            return adaptLegacyConfig(raw);
+        }
+        if (!raw.environments) {
+            throw new Error("Configuration must include environments.staging and environments.production");
+        }
+        return {
+            version: 2,
+            environments: raw.environments,
+            services: (raw.services || []).map((service, index) => normalizeService(service, index)),
+            deletePolicy: raw.deletePolicy,
+            serviceAccountPaths: raw.serviceAccountPaths,
+            projectIds: raw.projectIds,
+        };
+    }
+    validateConfig() {
+        validateEnvironment("staging", this.config.environments.staging);
+        validateEnvironment("production", this.config.environments.production);
+        if (this.config.services && !Array.isArray(this.config.services)) {
+            throw new Error("Services must be an array if provided");
+        }
+        if (this.config.deletePolicy) {
+            this.validateDeletePolicy(this.config.deletePolicy);
+        }
+    }
+    validateDeletePolicy(policy) {
+        if (policy.maxVersions !== undefined &&
+            (policy.maxVersions < 0 || !Number.isInteger(policy.maxVersions))) {
+            throw new Error("deletePolicy.maxVersions must be a non-negative integer");
+        }
+        if (policy.maxAgeDays !== undefined &&
+            (policy.maxAgeDays < 0 || !Number.isInteger(policy.maxAgeDays))) {
+            throw new Error("deletePolicy.maxAgeDays must be a non-negative integer");
+        }
+        if (policy.enabled !== undefined && typeof policy.enabled !== "boolean") {
+            throw new Error("deletePolicy.enabled must be a boolean");
+        }
+    }
+    getConfig() {
+        return this.config;
+    }
+    getEnvironmentConfig(environment) {
+        return this.config.environments[environment];
+    }
+    getServiceAccountPath(environment) {
+        const fromLegacy = this.config.serviceAccountPaths?.[environment];
+        if (fromLegacy) {
+            return fromLegacy;
+        }
+        const path = this.config.environments[environment].credentials?.path;
+        if (!path) {
+            throw new Error(`No service account path configured for ${environment}`);
+        }
+        return path;
+    }
+    getProjectId(environment) {
+        const fromLegacy = this.config.projectIds?.[environment];
+        if (fromLegacy) {
+            return fromLegacy;
+        }
+        const projectId = this.config.environments[environment].projectId;
+        if (!projectId) {
+            throw new Error(`No project ID configured for ${environment}`);
+        }
+        return projectId;
+    }
+    getServices() {
+        return this.config.services || [];
+    }
+    getServiceByName(name) {
+        return this.getServices().find((service) => service.name === name);
+    }
+    getServiceNames() {
+        return this.getServices().map((service) => service.name);
+    }
+    getDeletePolicy() {
+        return (this.config.deletePolicy || {
+            maxVersions: 10,
+            maxAgeDays: 30,
+            enabled: true,
+        });
+    }
+    writeConfig(config = this.config) {
+        this.config = config;
+        fs_1.default.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
+    }
+    static generateTemplate(outputPath = ".secrets-config") {
+        const template = {
+            version: 2,
+            environments: {
+                staging: {
+                    provider: "gcp",
+                    projectId: "your-staging-project-id",
+                    credentials: { path: "gcloud/staging/service-account.json" },
+                },
+                production: {
+                    provider: "gcp",
+                    projectId: "your-production-project-id",
+                    credentials: { path: "gcloud/production/service-account.json" },
+                },
+            },
+            services: [],
+            deletePolicy: {
+                maxVersions: 10,
+                maxAgeDays: 30,
+                enabled: true,
+            },
+        };
+        fs_1.default.writeFileSync(outputPath, JSON.stringify(template, null, 2));
+        console.log(`Configuration template created at ${outputPath}`);
+        console.log("Please update the environments and add services with 'msm --add-service'.");
+    }
+}
+exports.ConfigManager = ConfigManager;
+//# sourceMappingURL=ConfigManager.js.map

package/dist/ConfigManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigManager.js","sourceRoot":"","sources":["../src/ConfigManager.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAoB;AAYpB,MAAM,YAAY,GAAmB;IACnC,UAAU;IACV,aAAa;IACb,YAAY;IACZ,MAAM;IACN,QAAQ;CACT,CAAC;AAEF,MAAM,SAAS,GAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAmB/D,SAAS,cAAc,CAAC,GAAiB;IACvC,OAAO,OAAO,CACZ,GAAG,CAAC,mBAAmB;QACrB,GAAG,CAAC,UAAU;QACd,CAAC,GAAG,CAAC,YAAY,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY;YAC7D,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,UAAmB;oBACzB,UAAU,EAAE,OAAO,CAAC,OAAO;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,WAAW;iBAC/C;aACF;YACH,CAAC,CAAC,EAAE,CAAC;IAEX,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAiB;IAC1C,IACE,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO;QACjC,CAAC,GAAG,CAAC,mBAAmB,CAAC,UAAU;QACnC,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO;QACxB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;QACV,YAAY,EAAE;YACZ,OAAO,EAAE;gBACP,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;gBACjC,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE;aACvD;YACD,UAAU,EAAE;gBACV,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;gBACpC,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,mBAAmB,CAAC,UAAU,EAAE;aAC1D;SACF;QACD,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACtD,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,mBAAmB,EAAE;YACnB,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,OAAO;YACxC,UAAU,EAAE,GAAG,CAAC,mBAAmB,CAAC,UAAU;SAC/C;QACD,UAAU,EAAE;YACV,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO;YAC/B,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,UAAU;SACtC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAsB,EAAE,KAAa;IAC7D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,kCAAkC,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,IAAI,wEAAwE,CACjG,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QACjD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,IAAI,qBAAqB,WAAW,sBAAsB,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,CAAC,IAAI,qBAAqB,WAAW,wBAAwB,CACjF,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAkB,EAAE,WAA8B;IAC7E,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,6BAA6B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,QAAQ,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC7B,KAAK,KAAK;YACR,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,6CAA6C,CAAC,CAAC;YACtF,CAAC;YACD,MAAM;QACR,KAAK,KAAK;YACR,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,0CAA0C,CAAC,CAAC;YACnF,CAAC;YACD,MAAM;QACR,KAAK,OAAO;YACV,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,8CAA8C,CAAC,CAAC;YACvF,CAAC;YACD,MAAM;QACR,KAAK,OAAO;YACV,MAAM;QACR;YACE,MAAM;IACV,CAAC;AACH,CAAC;AAED,MAAa,aAAa;IAIxB,YAAY,aAAqB,iBAAiB;QAChD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,UAAU,kFAAkF,CACrI,CAAC;QACJ,CAAC;QAED,IAAI,GAAiB,CAAC;QACtB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,uCAAwC,KAAe,CAAC,OAAO,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACpD,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CACjC;YACD,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,mBAAmB,EAAE,GAAG,CAAC,mBAA2D;YACpF,UAAU,EAAE,GAAG,CAAC,UAAyC;SAC1D,CAAC;IACJ,CAAC;IAEO,cAAc;QACpB,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjE,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAEvE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAEO,oBAAoB,CAAC,MAAoB;QAC/C,IACE,MAAM,CAAC,WAAW,KAAK,SAAS;YAChC,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,IACE,MAAM,CAAC,UAAU,KAAK,SAAS;YAC/B,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAC/D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,oBAAoB,CAAC,WAAwB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,qBAAqB,CAAC,WAAwB;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,WAAW,CAAC,CAAC;QAClE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,0CAA0C,WAAW,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,WAAwB;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrE,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED,eAAe;QACb,OAAO,CACL,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI;YAC1B,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,EAAE;YACd,OAAO,EAAE,IAAI;SACd,CACF,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,SAAwB,IAAI,CAAC,MAAM;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,YAAE,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,aAAqB,iBAAiB;QAC5D,MAAM,QAAQ,GAAkB;YAC9B,OAAO,EAAE,CAAC;YACV,YAAY,EAAE;gBACZ,OAAO,EAAE;oBACP,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,yBAAyB;oBACpC,WAAW,EAAE,EAAE,IAAI,EAAE,qCAAqC,EAAE;iBAC7D;gBACD,UAAU,EAAE;oBACV,QAAQ,EAAE,KAAK;oBACf,SAAS,EAAE,4BAA4B;oBACvC,WAAW,EAAE,EAAE,IAAI,EAAE,wCAAwC,EAAE;iBAChE;aACF;YACD,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE;gBACZ,WAAW,EAAE,EAAE;gBACf,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI;aACd;SACF,CAAC;QAEF,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,qCAAqC,UAAU,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;CACF;AA3KD,sCA2KC"}

package/dist/GcpMonorepoSecretManager.d.ts

@@ -0,0 +1,3 @@
+/** @deprecated Use MonorepoSecretManager. */
+export { MonorepoSecretManager as GcpMonorepoSecretManager } from "./MonorepoSecretManager";
+//# sourceMappingURL=GcpMonorepoSecretManager.d.ts.map

package/dist/GcpMonorepoSecretManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GcpMonorepoSecretManager.d.ts","sourceRoot":"","sources":["../src/GcpMonorepoSecretManager.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,OAAO,EAAE,qBAAqB,IAAI,wBAAwB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/GcpMonorepoSecretManager.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GcpMonorepoSecretManager = void 0;
+/** @deprecated Use MonorepoSecretManager. */
+var MonorepoSecretManager_1 = require("./MonorepoSecretManager");
+Object.defineProperty(exports, "GcpMonorepoSecretManager", { enumerable: true, get: function () { return MonorepoSecretManager_1.MonorepoSecretManager; } });
+//# sourceMappingURL=GcpMonorepoSecretManager.js.map

package/dist/GcpMonorepoSecretManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GcpMonorepoSecretManager.js","sourceRoot":"","sources":["../src/GcpMonorepoSecretManager.ts"],"names":[],"mappings":";;;AAAA,6CAA6C;AAC7C,iEAA4F;AAAnF,iIAAA,qBAAqB,OAA4B"}

package/dist/MonorepoSecretManager.d.ts

@@ -0,0 +1,30 @@
+import { SecretBackend } from "./backends/types";
+import { MonorepoSecretManagerOptions } from "./types";
+export interface MonorepoSecretManagerTestOptions extends MonorepoSecretManagerOptions {
+    backend?: SecretBackend;
+}
+export declare class MonorepoSecretManager {
+    private environment;
+    private overrideSa;
+    private configManager;
+    private backendPromise;
+    constructor(options: MonorepoSecretManagerTestOptions);
+    private validateCredentials;
+    private getBackend;
+    private requireService;
+    private primaryEnvItem;
+    private getEnvPath;
+    private getSecretName;
+    private getTargetPath;
+    getAvailableServices(): string[];
+    private forEachService;
+    uploadEnv(serviceName: string): Promise<void>;
+    private uploadSingleService;
+    downloadEnv(serviceName: string): Promise<void>;
+    setEnv(serviceName: string): Promise<void>;
+    private materializeService;
+    peekEnv(serviceName: string): Promise<void>;
+    private peekSingleService;
+    cleanupVersions(serviceName: string): Promise<void>;
+}
+//# sourceMappingURL=MonorepoSecretManager.d.ts.map

package/dist/MonorepoSecretManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MonorepoSecretManager.d.ts","sourceRoot":"","sources":["../src/MonorepoSecretManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKjD,OAAO,EAGL,4BAA4B,EAG7B,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,gCACf,SAAQ,4BAA4B;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,qBAAa,qBAAqB;IAChC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,cAAc,CAAyB;gBAEnC,OAAO,EAAE,gCAAgC;IAgBrD,OAAO,CAAC,mBAAmB;YAab,UAAU;IAIxB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IASrB,oBAAoB,IAAI,MAAM,EAAE;YAIlB,cAAc;IActB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAIrC,mBAAmB;IA4B3B,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAMlC,kBAAkB;IA+B1B,OAAO,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAInC,iBAAiB;IA0BzB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAa1D"}