nebutra 0.3.5 → 0.3.7

package/dist/delegate-7HQKV277.js

@@ -0,0 +1 @@
+import{a,b,c,d,e,f}from"./chunk-LGUMYJ4Q.js";import"./chunk-IYWUY3VA.js";export{b as delegate,e as dockerCompose,a as findMonorepoRoot,c as pnpmRun,f as prismaRun,d as turboRun};

package/dist/dist-64NZ7WFG.js

@@ -0,0 +1 @@
+import{a as v}from"./chunk-XPQG77BK.js";import"./chunk-ZCWB3HFB.js";import{a as A}from"./chunk-5ECPN42W.js";import{a as l,b as u,c as f,d as y,e as m,f as g,g as S}from"./chunk-QSLKOXQ6.js";import{a as d}from"./chunk-ZIBRKYXP.js";import{a as e}from"./chunk-XE3I3HCZ.js";import"./chunk-ZYSKNYCH.js";import"./chunk-ZQRYPBYL.js";import"./chunk-WJLTO7JW.js";import"./chunk-TW5BOTVX.js";import"./chunk-FNDUJLS6.js";import"./chunk-HGJYEXMU.js";import"./chunk-WU3IV4WF.js";import"./chunk-JTXBZ2SU.js";import"./chunk-W5TBFCWY.js";import"./chunk-XB6R2VIU.js";import"./chunk-EY2BHCQE.js";import"./chunk-TX7AAHER.js";import"./chunk-SPHQRDN5.js";import"./chunk-IYWUY3VA.js";var i=null;function _(){if(process.env.AWS_KMS_KEY_ID||process.env.AWS_KMS_KEY_ARN)return"aws-kms";if(process.env.VAULT_LOCAL_MASTER_KEY||process.env.VAULT_MASTER_KEY)return"local";throw new Error("No vault provider detected. Set AWS_KMS_KEY_ID/AWS_KMS_KEY_ARN (for AWS KMS) or VAULT_LOCAL_MASTER_KEY/VAULT_MASTER_KEY (for local). Or pass explicit config to createVault().")}async function p(n){let r=n?.provider??process.env.VAULT_PROVIDER??_();switch(d.info("[vault] Creating provider",{provider:r}),r){case"aws-kms":{let{AWSKMSProvider:o}=await import("./aws-kms-LKU7DI4V.js"),t=n;return new o({provider:"aws-kms",...t?.keyId!==void 0?{keyId:t.keyId}:{},...t?.region!==void 0?{region:t.region}:{},...t?.credentials!==void 0?{credentials:t.credentials}:{},...t?.keyVersion!==void 0?{keyVersion:t.keyVersion}:{}})}case"local":{let{LocalProvider:o}=await import("./local-6WWVOMA7.js"),t=n;return new o({provider:"local",...t?.masterKey!==void 0?{masterKey:t.masterKey}:{},...t?.salt!==void 0?{salt:t.salt}:{},...t?.keyVersion!==void 0?{keyVersion:t.keyVersion}:{}})}default:throw new Error(`Unknown vault provider: ${r}`)}}async function s(){return i||(i=await p()),i}function k(n){i=n}async function V(){i&&(await i.close(),i=null)}async function x(n,r={}){let o=JSON.stringify(n);if(o===void 0)throw new Error("[vault] Cannot encrypt undefined \u2014 value must be JSON-serializable");let t=await s(),c=r.context?.tenantId,a=r.context?.kind;return t.encrypt(o,{...r.id!==void 0?{id:r.id}:{},...c!==void 0?{tenantId:c}:{},metadata:{name:a??"json",type:"credential"}})}async function E(n,r={}){let o=await s(),t=r.context?.tenantId,c=await o.decrypt(n,t!==void 0?{tenantId:t}:void 0);try{return JSON.parse(c)}catch(a){throw new Error(`[vault] decryptJSON: failed to parse decrypted payload as JSON: ${a instanceof Error?a.message:String(a)}`)}}function w(n){if(!n||typeof n!="object")return!1;let r=n;return typeof r.ciphertext=="string"&&typeof r.encryptedDek=="string"&&typeof r.iv=="string"&&typeof r.authTag=="string"&&typeof r.keyVersion=="number"&&r.algorithm==="aes-256-gcm"}var K=e.object({id:e.string(),ciphertext:e.string(),encryptedDek:e.string(),iv:e.string(),authTag:e.string(),dekIv:e.string().optional(),dekAuthTag:e.string().optional(),keyVersion:e.number().int().min(1),envelopeVersion:e.literal(2).optional(),algorithm:e.literal("aes-256-gcm"),tenantId:e.string().optional(),metadata:e.object({name:e.string(),type:e.enum(["api_key","oauth_token","credential","certificate","generic"]),expiresAt:e.string().datetime().optional()}).optional(),createdAt:e.string().datetime(),rotatedAt:e.string().datetime().optional()}),h=e.object({id:e.string(),name:e.string(),tenantId:e.string().optional(),type:e.enum(["api_key","oauth_token","credential","certificate","generic"]),createdAt:e.string().datetime(),rotatedAt:e.string().datetime().optional(),expiresAt:e.string().datetime().optional()});export{v as AWSKMSProvider,K as EncryptedSecretSchema,A as LocalProvider,h as SecretMetadataSchema,u as aesDecrypt,l as aesEncrypt,V as closeVault,p as createVault,E as decryptJSON,f as deriveKey,x as encryptJSON,S as fromBase64,m as generateIv,y as generateKey,s as getVault,w as isEncryptedSecret,k as setVault,g as toBase64};