norn-cli 2.3.0 → 2.4.0

package/out/secrets/keyStore.js

@@ -0,0 +1,259 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSecretKey = resolveSecretKey;
+exports.setSessionSecretKey = setSessionSecretKey;
+exports.clearSessionSecretKeys = clearSessionSecretKeys;
+exports.listSessionSecretKeyIds = listSessionSecretKeyIds;
+exports.saveSecretKeyToCache = saveSecretKeyToCache;
+exports.removeSecretKeyFromCache = removeSecretKeyFromCache;
+exports.listCachedSecretKeyIds = listCachedSecretKeyIds;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const cacheDir_1 = require("../cacheDir");
+const CACHE_FILE = 'secret-keys.json';
+const CACHE_VERSION = 1;
+const CACHE_SCAN_IGNORED_DIRS = new Set(['node_modules', '.git', 'dist', 'out']);
+const sessionKeys = new Map();
+const projectSecretKeyCacheDirs = new Map();
+function getCacheFilePath(cacheDir) {
+    return path.join(cacheDir, CACHE_FILE);
+}
+function cacheFileExists(cacheDir) {
+    const cacheFilePath = getCacheFilePath(cacheDir);
+    try {
+        return fs.existsSync(cacheFilePath) && fs.statSync(cacheFilePath).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function getProjectSecretKeyCacheDirs(projectRoot) {
+    const cached = projectSecretKeyCacheDirs.get(projectRoot);
+    if (cached && cached.every(cacheDir => cacheFileExists(cacheDir))) {
+        return cached;
+    }
+    const results = [];
+    const queue = [projectRoot];
+    while (queue.length > 0) {
+        const dir = queue.shift();
+        if (!dir) {
+            continue;
+        }
+        const cacheDir = path.join(dir, cacheDir_1.NORN_CACHE_DIR);
+        if (cacheFileExists(cacheDir)) {
+            results.push(cacheDir);
+        }
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory()) {
+                continue;
+            }
+            if (entry.name === cacheDir_1.NORN_CACHE_DIR || CACHE_SCAN_IGNORED_DIRS.has(entry.name)) {
+                continue;
+            }
+            queue.push(path.join(dir, entry.name));
+        }
+    }
+    results.sort();
+    projectSecretKeyCacheDirs.set(projectRoot, results);
+    return results;
+}
+function getCacheDistance(targetPath, cacheDir) {
+    const relative = path.relative((0, cacheDir_1.getSearchStartDirectory)(targetPath), cacheDir);
+    if (!relative || relative === '.') {
+        return 0;
+    }
+    return relative.split(path.sep).filter(segment => segment !== '').length;
+}
+function findExistingSecretKeyCacheDir(targetPath) {
+    const projectRoot = (0, cacheDir_1.findProjectRoot)(targetPath);
+    const candidates = getProjectSecretKeyCacheDirs(projectRoot);
+    let bestMatch;
+    let bestScore = Number.POSITIVE_INFINITY;
+    for (const candidate of candidates) {
+        const score = getCacheDistance(targetPath, candidate);
+        if (score < bestScore || (score === bestScore && candidate < (bestMatch ?? candidate))) {
+            bestMatch = candidate;
+            bestScore = score;
+        }
+    }
+    return bestMatch;
+}
+function rememberSecretKeyCacheDir(targetPath, cacheDir) {
+    const projectRoot = (0, cacheDir_1.findProjectRoot)(targetPath);
+    const cached = projectSecretKeyCacheDirs.get(projectRoot) ?? [];
+    if (cached.includes(cacheDir)) {
+        return;
+    }
+    projectSecretKeyCacheDirs.set(projectRoot, [...cached, cacheDir].sort());
+}
+function ensureCacheDir(targetPath) {
+    const existing = findExistingSecretKeyCacheDir(targetPath);
+    const projectRoot = (0, cacheDir_1.findProjectRoot)(targetPath);
+    const cacheDir = existing ?? path.join(projectRoot, cacheDir_1.NORN_CACHE_DIR);
+    if (!fs.existsSync(cacheDir)) {
+        fs.mkdirSync(cacheDir, { recursive: true });
+    }
+    (0, cacheDir_1.ensureNornCacheGitignore)(cacheDir);
+    rememberSecretKeyCacheDir(targetPath, cacheDir);
+    return cacheDir;
+}
+function getReadCachePath(targetPath) {
+    const existing = findExistingSecretKeyCacheDir(targetPath);
+    if (existing) {
+        return getCacheFilePath(existing);
+    }
+    const projectRoot = (0, cacheDir_1.findProjectRoot)(targetPath);
+    const projectCacheDir = path.join(projectRoot, cacheDir_1.NORN_CACHE_DIR);
+    if (fs.existsSync(projectCacheDir) && fs.statSync(projectCacheDir).isDirectory()) {
+        return getCacheFilePath(projectCacheDir);
+    }
+    return undefined;
+}
+function getWriteCachePath(targetPath) {
+    return getCacheFilePath(ensureCacheDir(targetPath));
+}
+function readCache(targetPath) {
+    const cachePath = getReadCachePath(targetPath);
+    if (!cachePath || !fs.existsSync(cachePath)) {
+        return { version: CACHE_VERSION, keys: {} };
+    }
+    try {
+        const parsed = JSON.parse(fs.readFileSync(cachePath, 'utf8'));
+        if (parsed.version !== CACHE_VERSION || typeof parsed.keys !== 'object' || parsed.keys === null) {
+            return { version: CACHE_VERSION, keys: {} };
+        }
+        return parsed;
+    }
+    catch {
+        return { version: CACHE_VERSION, keys: {} };
+    }
+}
+function writeCache(targetPath, cache) {
+    const cachePath = getWriteCachePath(targetPath);
+    fs.writeFileSync(cachePath, JSON.stringify(cache, null, 2), { encoding: 'utf8', mode: 0o600 });
+    try {
+        fs.chmodSync(cachePath, 0o600);
+    }
+    catch {
+        // Best-effort permission hardening.
+    }
+}
+function kidToEnvVarSuffix(kid) {
+    return kid.replace(/[^a-zA-Z0-9]/g, '_').toUpperCase();
+}
+function getEnvMappedKeys() {
+    const raw = process.env.NORN_SECRET_KEYS;
+    if (!raw) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        const mapped = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (typeof value === 'string' && value.trim() !== '') {
+                mapped[key] = value;
+            }
+        }
+        return mapped;
+    }
+    catch {
+        return {};
+    }
+}
+function resolveSecretKey(kid, targetPath) {
+    const sessionValue = sessionKeys.get(kid);
+    if (sessionValue) {
+        return sessionValue;
+    }
+    const mapped = getEnvMappedKeys();
+    if (mapped[kid]) {
+        return mapped[kid];
+    }
+    const specific = process.env[`NORN_SECRET_KEY_${kidToEnvVarSuffix(kid)}`];
+    if (specific && specific.trim() !== '') {
+        return specific;
+    }
+    const cache = readCache(targetPath);
+    const cached = cache.keys[kid]?.value;
+    if (cached && cached.trim() !== '') {
+        return cached;
+    }
+    const fallback = process.env.NORN_SECRET_KEY;
+    if (fallback && fallback.trim() !== '') {
+        return fallback;
+    }
+    return undefined;
+}
+function setSessionSecretKey(kid, key) {
+    sessionKeys.set(kid, key);
+}
+function clearSessionSecretKeys() {
+    sessionKeys.clear();
+}
+function listSessionSecretKeyIds() {
+    return Array.from(sessionKeys.keys()).sort();
+}
+function saveSecretKeyToCache(kid, key, targetPath) {
+    const cache = readCache(targetPath);
+    cache.keys[kid] = {
+        value: key,
+        updatedAt: new Date().toISOString()
+    };
+    writeCache(targetPath, cache);
+    setSessionSecretKey(kid, key);
+}
+function removeSecretKeyFromCache(kid, targetPath) {
+    const cache = readCache(targetPath);
+    if (!cache.keys[kid]) {
+        return false;
+    }
+    delete cache.keys[kid];
+    writeCache(targetPath, cache);
+    sessionKeys.delete(kid);
+    return true;
+}
+function listCachedSecretKeyIds(targetPath) {
+    const cache = readCache(targetPath);
+    return Object.keys(cache.keys).sort();
+}
+//# sourceMappingURL=keyStore.js.map

package/out/sequenceDeclaration.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findSequenceDeclarationLine = findSequenceDeclarationLine;
+function findSequenceDeclarationLine(lines, seqStartLine, seqEndLine, options = {}) {
+    const pattern = options.testOnly
+        ? /^\s*test\s+sequence\s+/
+        : /^\s*(test\s+)?sequence\s+/;
+    for (let index = seqStartLine; index <= seqEndLine; index++) {
+        if (pattern.test(lines[index])) {
+            return index;
+        }
+    }
+    return seqStartLine;
+}
+//# sourceMappingURL=sequenceDeclaration.js.map