proofscan 0.7.2 → 0.7.3

package/dist/secrets/management.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Secrets management utilities (Phase 3.6)
+ *
+ * Provides functions for:
+ * - Listing secrets with bindings
+ * - Setting/updating secrets
+ * - Pruning orphan secrets
+ * - Export/import encrypted bundles
+ *
+ * Security: Never logs, prints, or writes plaintext secrets.
+ */
+import { type ProviderType } from './types.js';
+/** Information about a secret and its binding */
+export interface SecretBindingInfo {
+    /** Secret reference (dpapi:xxx, plain:xxx) */
+    secret_ref: string;
+    /** Secret ID */
+    secret_id: string;
+    /** Connector ID (if bound) */
+    connector_id?: string;
+    /** Environment key (if bound) */
+    env_key?: string;
+    /** Provider type */
+    provider: ProviderType;
+    /** Creation timestamp */
+    created_at: string;
+    /** Last used timestamp (if tracked) */
+    last_used_at?: string;
+    /** Status: OK (bound), ORPHAN (not bound), MISSING (ref in config but not in store) */
+    status: 'OK' | 'ORPHAN' | 'MISSING';
+}
+/** Options for setting a secret */
+export interface SetSecretOptions {
+    configPath: string;
+    connectorId: string;
+    envKey: string;
+    secretValue: string;
+}
+/** Result of setting a secret */
+export interface SetSecretResult {
+    secretRef: string;
+    secretId: string;
+    updated: boolean;
+}
+/** Options for pruning secrets */
+export interface PruneOptions {
+    configDir: string;
+    configPath: string;
+    dryRun?: boolean;
+    olderThanDays?: number;
+}
+/** Result of pruning secrets */
+export interface PruneResult {
+    orphanCount: number;
+    removedCount: number;
+    removedIds: string[];
+}
+/** Options for exporting secrets */
+export interface ExportOptions {
+    configDir: string;
+    configPath: string;
+    outputPath: string;
+    passphrase: string;
+}
+/** Result of exporting secrets */
+export interface ExportResult {
+    exportedCount: number;
+}
+/** Options for importing secrets */
+export interface ImportOptions {
+    configDir: string;
+    configPath: string;
+    inputPath: string;
+    passphrase: string;
+    overwrite?: boolean;
+}
+/** Error detail for import failures */
+export interface ImportError {
+    connector_id: string;
+    env_key: string;
+    error: string;
+}
+/** Result of importing secrets */
+export interface ImportResult {
+    importedCount: number;
+    skippedCount: number;
+    errorCount: number;
+    /** Details about individual import failures */
+    errors?: ImportError[];
+}
+/**
+ * List all secrets with their binding information
+ */
+export declare function listSecretBindings(configDir: string, configPath: string): Promise<SecretBindingInfo[]>;
+/**
+ * Set a secret value for a connector environment variable
+ * Uses file locking to prevent race conditions during concurrent access.
+ */
+export declare function setSecret(options: SetSecretOptions): Promise<SetSecretResult>;
+/**
+ * Remove orphan secrets not referenced by config
+ */
+export declare function pruneOrphanSecrets(options: PruneOptions): Promise<PruneResult>;
+/**
+ * Export secrets to encrypted bundle file
+ */
+export declare function exportSecrets(options: ExportOptions): Promise<ExportResult>;
+/**
+ * Import secrets from encrypted bundle file
+ */
+export declare function importSecrets(options: ImportOptions): Promise<ImportResult>;
+//# sourceMappingURL=management.d.ts.map

package/dist/secrets/management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.d.ts","sourceRoot":"","sources":["../../src/secrets/management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAAiC,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAO9E,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB;IACpB,QAAQ,EAAE,YAAY,CAAC;IACvB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAC;CACrC;AAED,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,oCAAoC;AACpC,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,kCAAkC;AAClC,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AA0KD;;GAEG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CA0D9B;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwDnF;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAwDpF;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA4EjF;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CA8HjF"}

package/dist/secrets/management.js

@@ -0,0 +1,488 @@
+/**
+ * Secrets management utilities (Phase 3.6)
+ *
+ * Provides functions for:
+ * - Listing secrets with bindings
+ * - Setting/updating secrets
+ * - Pruning orphan secrets
+ * - Export/import encrypted bundles
+ *
+ * Security: Never logs, prints, or writes plaintext secrets.
+ */
+import { existsSync, readFileSync, writeFileSync, unlinkSync, openSync, closeSync, renameSync } from 'fs';
+import { dirname } from 'path';
+import { randomBytes, createCipheriv, createDecipheriv, scryptSync, createHmac, timingSafeEqual } from 'crypto';
+import { SqliteSecretStore } from './store.js';
+import { parseSecretRef, makeSecretRef } from './types.js';
+// ============================================================
+// Crypto utilities
+// ============================================================
+const SCRYPT_N = 2 ** 14; // CPU/memory cost (16384 - compatible with low-memory environments)
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const KEY_LEN = 32; // 256 bits
+function deriveKey(passphrase, salt) {
+    return scryptSync(passphrase, salt, KEY_LEN, {
+        N: SCRYPT_N,
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+    });
+}
+function encryptPayload(plaintext, key) {
+    const iv = randomBytes(12); // 96 bits for GCM
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return { iv, authTag, ciphertext };
+}
+function decryptPayload(ciphertext, key, iv, authTag) {
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+// ============================================================
+// File locking utilities
+// ============================================================
+const LOCK_TIMEOUT_MS = 10000; // 10 seconds
+const LOCK_RETRY_INTERVAL_MS = 100;
+/**
+ * Acquire exclusive lock on config file
+ * Uses a .lock file mechanism for cross-process safety
+ */
+async function acquireConfigLock(configPath) {
+    const lockPath = `${configPath}.lock`;
+    const startTime = Date.now();
+    while (Date.now() - startTime < LOCK_TIMEOUT_MS) {
+        try {
+            // O_CREAT | O_EXCL - fails if file already exists (atomic check-and-create)
+            const fd = openSync(lockPath, 'wx');
+            closeSync(fd);
+            return lockPath;
+        }
+        catch (err) {
+            if (err.code === 'EEXIST') {
+                // Lock exists, wait and retry
+                await new Promise(resolve => setTimeout(resolve, LOCK_RETRY_INTERVAL_MS));
+            }
+            else {
+                throw err;
+            }
+        }
+    }
+    throw new Error(`Failed to acquire lock on ${configPath} (timeout after ${LOCK_TIMEOUT_MS}ms)`);
+}
+/**
+ * Release config file lock
+ */
+function releaseConfigLock(lockPath) {
+    try {
+        unlinkSync(lockPath);
+    }
+    catch {
+        // Ignore errors (lock may have been removed by timeout)
+    }
+}
+/**
+ * Read and write config file atomically with file locking
+ */
+async function withConfigLock(configPath, operation) {
+    const lockPath = await acquireConfigLock(configPath);
+    const tempPath = `${configPath}.tmp`;
+    try {
+        // Read current config
+        if (!existsSync(configPath)) {
+            throw new Error(`Config file not found: ${configPath}`);
+        }
+        const config = JSON.parse(readFileSync(configPath, 'utf-8'));
+        // Execute operation
+        const { config: updatedConfig, result } = await operation(config);
+        // Write atomically: write to temp file first, then rename to original
+        writeFileSync(tempPath, JSON.stringify(updatedConfig, null, 2));
+        renameSync(tempPath, configPath);
+        return result;
+    }
+    finally {
+        // Clean up temp file if it exists
+        try {
+            if (existsSync(tempPath)) {
+                unlinkSync(tempPath);
+            }
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+        releaseConfigLock(lockPath);
+    }
+}
+// ============================================================
+// Helper functions
+// ============================================================
+/** Extract all secret refs from config */
+function collectConfigSecretRefs(config) {
+    const refs = new Map();
+    for (const connector of config.connectors || []) {
+        const env = connector.transport?.env;
+        if (!env)
+            continue;
+        for (const [key, value] of Object.entries(env)) {
+            const parsed = parseSecretRef(value);
+            if (parsed) {
+                refs.set(parsed.id, { connectorId: connector.id, envKey: key });
+            }
+        }
+    }
+    return refs;
+}
+// ============================================================
+// Management functions
+// ============================================================
+/**
+ * List all secrets with their binding information
+ */
+export async function listSecretBindings(configDir, configPath) {
+    const results = [];
+    const store = new SqliteSecretStore(configDir);
+    try {
+        // Get all secret IDs from store
+        const secretIds = await store.list();
+        // Load config to find bindings
+        let config = { version: 1, connectors: [] };
+        if (existsSync(configPath)) {
+            config = JSON.parse(readFileSync(configPath, 'utf-8'));
+        }
+        const configRefs = collectConfigSecretRefs(config);
+        // Build binding info for each secret
+        for (const id of secretIds) {
+            const binding = configRefs.get(id);
+            const createdAt = await store.getCreatedAt(id);
+            // Determine provider from meta or try to get from store
+            let provider = 'plain';
+            // We need to get the record to know the provider
+            // For now, use the store's provider type
+            provider = store.getProviderType();
+            results.push({
+                secret_ref: makeSecretRef(provider, id),
+                secret_id: id,
+                connector_id: binding?.connectorId,
+                env_key: binding?.envKey,
+                provider,
+                created_at: createdAt?.toISOString() ?? new Date().toISOString(),
+                status: binding ? 'OK' : 'ORPHAN',
+            });
+            // Remove from configRefs to track what we've seen
+            configRefs.delete(id);
+        }
+        // Any remaining configRefs are MISSING (in config but not in store)
+        for (const [id, binding] of configRefs) {
+            results.push({
+                secret_ref: `unknown:${id}`,
+                secret_id: id,
+                connector_id: binding.connectorId,
+                env_key: binding.envKey,
+                provider: 'plain',
+                created_at: '',
+                status: 'MISSING',
+            });
+        }
+        return results;
+    }
+    finally {
+        store.close();
+    }
+}
+/**
+ * Set a secret value for a connector environment variable
+ * Uses file locking to prevent race conditions during concurrent access.
+ */
+export async function setSecret(options) {
+    const { configPath, connectorId, envKey, secretValue } = options;
+    const configDir = dirname(configPath);
+    // Store the secret first (outside the lock to minimize lock time)
+    const store = new SqliteSecretStore(configDir);
+    let storeResult;
+    try {
+        storeResult = await store.store(secretValue, {
+            connectorId,
+            keyName: envKey,
+            source: `${connectorId}.transport.env.${envKey}`,
+        });
+    }
+    finally {
+        store.close();
+    }
+    // Update config with file locking
+    return withConfigLock(configPath, async (config) => {
+        // Find connector
+        const connector = config.connectors?.find(c => c.id === connectorId);
+        if (!connector) {
+            throw new Error(`Connector not found: ${connectorId}`);
+        }
+        // Ensure transport.env exists
+        if (!connector.transport) {
+            connector.transport = { type: 'stdio', command: '' };
+        }
+        const transport = connector.transport;
+        if (!transport.env) {
+            transport.env = {};
+        }
+        // Check if there's an existing secret
+        const existingValue = transport.env[envKey];
+        let updated = false;
+        if (existingValue) {
+            const parsed = parseSecretRef(existingValue);
+            if (parsed) {
+                updated = true;
+            }
+        }
+        // Update config with new reference
+        transport.env[envKey] = storeResult.reference;
+        return {
+            config,
+            result: {
+                secretRef: storeResult.reference,
+                secretId: storeResult.id,
+                updated,
+            },
+        };
+    });
+}
+/**
+ * Remove orphan secrets not referenced by config
+ */
+export async function pruneOrphanSecrets(options) {
+    const { configDir, configPath, dryRun = false, olderThanDays } = options;
+    const store = new SqliteSecretStore(configDir);
+    try {
+        const secretIds = await store.list();
+        // Load config to find active bindings
+        let config = { version: 1, connectors: [] };
+        if (existsSync(configPath)) {
+            config = JSON.parse(readFileSync(configPath, 'utf-8'));
+        }
+        const configRefs = collectConfigSecretRefs(config);
+        // Find orphans
+        const orphanIds = [];
+        const now = Date.now();
+        const ageThreshold = olderThanDays ? olderThanDays * 24 * 60 * 60 * 1000 : 0;
+        for (const id of secretIds) {
+            if (!configRefs.has(id)) {
+                // Check age if specified
+                if (ageThreshold > 0) {
+                    const createdAt = await store.getCreatedAt(id);
+                    if (createdAt) {
+                        const age = now - createdAt.getTime();
+                        if (age < ageThreshold) {
+                            // Secret is too new, skip it
+                            continue;
+                        }
+                    }
+                }
+                orphanIds.push(id);
+            }
+        }
+        // Remove orphans if not dry run
+        let removedCount = 0;
+        if (!dryRun) {
+            for (const id of orphanIds) {
+                const deleted = await store.delete(id);
+                if (deleted) {
+                    removedCount++;
+                }
+            }
+        }
+        return {
+            orphanCount: orphanIds.length,
+            removedCount,
+            removedIds: orphanIds,
+        };
+    }
+    finally {
+        store.close();
+    }
+}
+/**
+ * Export secrets to encrypted bundle file
+ */
+export async function exportSecrets(options) {
+    const { configDir, configPath, outputPath, passphrase } = options;
+    const store = new SqliteSecretStore(configDir);
+    try {
+        const secretIds = await store.list();
+        // Load config to get bindings
+        let config = { version: 1, connectors: [] };
+        if (existsSync(configPath)) {
+            config = JSON.parse(readFileSync(configPath, 'utf-8'));
+        }
+        const configRefs = collectConfigSecretRefs(config);
+        // Build entries
+        const entries = [];
+        for (const id of secretIds) {
+            const binding = configRefs.get(id);
+            if (!binding)
+                continue; // Skip orphans
+            // Retrieve plaintext (in-memory only)
+            const plaintext = await store.retrieve(id);
+            if (!plaintext)
+                continue;
+            entries.push({
+                connector_id: binding.connectorId,
+                env_key: binding.envKey,
+                secret_bytes_b64: Buffer.from(plaintext, 'utf-8').toString('base64'),
+            });
+        }
+        // Encrypt bundle
+        const payloadJson = JSON.stringify({ entries });
+        const payloadBytes = Buffer.from(payloadJson, 'utf-8');
+        const salt = randomBytes(16);
+        const key = deriveKey(passphrase, salt);
+        const { iv, authTag, ciphertext } = encryptPayload(payloadBytes, key);
+        // Prepare bundle metadata
+        const kdfInfo = {
+            name: 'scrypt',
+            salt: salt.toString('base64'),
+            N: SCRYPT_N,
+            r: SCRYPT_R,
+            p: SCRYPT_P,
+            keyLen: KEY_LEN,
+        };
+        const cipherInfo = {
+            name: 'aes-256-gcm',
+            iv: iv.toString('base64'),
+            authTag: authTag.toString('base64'),
+        };
+        // Compute HMAC over metadata to detect tampering of KDF/cipher parameters
+        const metadataForHmac = JSON.stringify({ version: 1, kdf: kdfInfo, cipher: cipherInfo });
+        const metadataHmac = createHmac('sha256', key).update(metadataForHmac).digest('base64');
+        const bundle = {
+            version: 1,
+            kdf: kdfInfo,
+            cipher: cipherInfo,
+            payload: ciphertext.toString('base64'),
+            metadataHmac,
+        };
+        // Write bundle to file
+        writeFileSync(outputPath, JSON.stringify(bundle, null, 2));
+        return {
+            exportedCount: entries.length,
+        };
+    }
+    finally {
+        store.close();
+    }
+}
+/**
+ * Import secrets from encrypted bundle file
+ */
+export async function importSecrets(options) {
+    const { configDir, configPath, inputPath, passphrase, overwrite = false } = options;
+    // Read and parse bundle
+    const bundleJson = readFileSync(inputPath, 'utf-8');
+    const bundle = JSON.parse(bundleJson);
+    if (bundle.version !== 1) {
+        throw new Error(`Unsupported export bundle version: ${bundle.version}`);
+    }
+    // Derive key
+    const salt = Buffer.from(bundle.kdf.salt, 'base64');
+    const key = deriveKey(passphrase, salt);
+    // Verify HMAC before trusting metadata (prevents KDF parameter tampering)
+    // Uses timing-safe comparison to prevent timing attacks
+    const metadataForHmac = JSON.stringify({ version: bundle.version, kdf: bundle.kdf, cipher: bundle.cipher });
+    const expectedHmacBuf = createHmac('sha256', key).update(metadataForHmac).digest();
+    const actualHmacBuf = Buffer.from(bundle.metadataHmac, 'base64');
+    if (expectedHmacBuf.length !== actualHmacBuf.length || !timingSafeEqual(expectedHmacBuf, actualHmacBuf)) {
+        throw new Error('Bundle integrity check failed. The file may have been tampered with or the passphrase is incorrect.');
+    }
+    // Decrypt payload
+    const iv = Buffer.from(bundle.cipher.iv, 'base64');
+    const authTag = Buffer.from(bundle.cipher.authTag, 'base64');
+    const ciphertext = Buffer.from(bundle.payload, 'base64');
+    let payloadBytes;
+    try {
+        payloadBytes = decryptPayload(ciphertext, key, iv, authTag);
+    }
+    catch {
+        throw new Error('Decryption failed. Wrong passphrase?');
+    }
+    const payload = JSON.parse(payloadBytes.toString('utf-8'));
+    // Store secrets first (outside the config lock to minimize lock time)
+    const store = new SqliteSecretStore(configDir);
+    const storedSecrets = [];
+    const errors = [];
+    try {
+        for (const entry of payload.entries) {
+            try {
+                // Decode plaintext (in-memory only)
+                const plaintext = Buffer.from(entry.secret_bytes_b64, 'base64').toString('utf-8');
+                // Store secret
+                const result = await store.store(plaintext, {
+                    connectorId: entry.connector_id,
+                    keyName: entry.env_key,
+                    source: `${entry.connector_id}.transport.env.${entry.env_key}`,
+                });
+                storedSecrets.push({ entry, reference: result.reference });
+            }
+            catch (err) {
+                errors.push({
+                    connector_id: entry.connector_id,
+                    env_key: entry.env_key,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            }
+        }
+    }
+    finally {
+        store.close();
+    }
+    // If no secrets were stored, return early without touching config
+    if (storedSecrets.length === 0) {
+        return {
+            importedCount: 0,
+            skippedCount: payload.entries.length - errors.length,
+            errorCount: errors.length,
+            errors: errors.length > 0 ? errors : undefined,
+        };
+    }
+    // Update config with file locking to prevent race conditions
+    return withConfigLock(configPath, async (config) => {
+        let importedCount = 0;
+        let skippedCount = 0;
+        for (const { entry, reference } of storedSecrets) {
+            // Find connector
+            const connector = config.connectors?.find(c => c.id === entry.connector_id);
+            if (!connector) {
+                // Connector doesn't exist in config, skip
+                skippedCount++;
+                continue;
+            }
+            // Check if already has a secret ref
+            const transport = connector.transport;
+            const existingValue = transport?.env?.[entry.env_key];
+            if (existingValue && parseSecretRef(existingValue)) {
+                if (!overwrite) {
+                    skippedCount++;
+                    continue;
+                }
+            }
+            // Update config
+            if (!transport) {
+                connector.transport = { type: 'stdio', command: '' };
+            }
+            const t = connector.transport;
+            if (!t.env) {
+                t.env = {};
+            }
+            t.env[entry.env_key] = reference;
+            importedCount++;
+        }
+        return {
+            config,
+            result: {
+                importedCount,
+                skippedCount: skippedCount + (payload.entries.length - storedSecrets.length - errors.length),
+                errorCount: errors.length,
+                errors: errors.length > 0 ? errors : undefined,
+            },
+        };
+    });
+}
+//# sourceMappingURL=management.js.map

package/dist/secrets/management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.js","sourceRoot":"","sources":["../../src/secrets/management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC1G,OAAO,EAAE,OAAO,EAAQ,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAChH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAqB,MAAM,YAAY,CAAC;AA2H9E,+DAA+D;AAC/D,mBAAmB;AACnB,+DAA+D;AAE/D,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,oEAAoE;AAC9F,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,WAAW;AAE/B,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE;QAC3C,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB,EAAE,GAAW,EAAE,EAAU,EAAE,OAAe;IAClF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,+DAA+D;AAC/D,yBAAyB;AACzB,+DAA+D;AAE/D,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,aAAa;AAC5C,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACjD,MAAM,QAAQ,GAAG,GAAG,UAAU,OAAO,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,4EAA4E;YAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpC,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,8BAA8B;gBAC9B,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;YAC5E,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,mBAAmB,eAAe,KAAK,CAAC,CAAC;AAClG,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,CAAC;QACH,UAAU,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,SAAqE;IAErE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,GAAG,UAAU,MAAM,CAAC;IACrC,IAAI,CAAC;QACH,sBAAsB;QACtB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAW,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QAErE,oBAAoB;QACpB,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QAElE,sEAAsE;QACtE,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEjC,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,kCAAkC;QAClC,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QACD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,mBAAmB;AACnB,+DAA+D;AAE/D,0CAA0C;AAC1C,SAAS,uBAAuB,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmD,CAAC;IAExE,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAI,SAAS,CAAC,SAA4B,EAAE,GAAG,CAAC;QACzD,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,uBAAuB;AACvB,+DAA+D;AAE/D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,UAAkB;IAElB,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,gCAAgC;QAChC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,+BAA+B;QAC/B,IAAI,MAAM,GAAW,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEnD,qCAAqC;QACrC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAE/C,wDAAwD;YACxD,IAAI,QAAQ,GAAiB,OAAO,CAAC;YACrC,iDAAiD;YACjD,yCAAyC;YACzC,QAAQ,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC;YAEnC,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACvC,SAAS,EAAE,EAAE;gBACb,YAAY,EAAE,OAAO,EAAE,WAAW;gBAClC,OAAO,EAAE,OAAO,EAAE,MAAM;gBACxB,QAAQ;gBACR,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAChE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;aAClC,CAAC,CAAC;YAEH,kDAAkD;YAClD,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,CAAC;QAED,oEAAoE;QACpE,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC;gBACX,UAAU,EAAE,WAAW,EAAE,EAAE;gBAC3B,SAAS,EAAE,EAAE;gBACb,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,QAAQ,EAAE,OAAO;gBACjB,UAAU,EAAE,EAAE;gBACd,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEtC,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,WAA8C,CAAC;IACnD,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE;YAC3C,WAAW;YACX,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,GAAG,WAAW,kBAAkB,MAAM,EAAE;SACjD,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,kCAAkC;IAClC,OAAO,cAAc,CAAkB,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAClE,iBAAiB;QACjB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;QACrE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,8BAA8B;QAC9B,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACxB,SAAuB,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAoB,CAAC;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAA2B,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;QACrB,CAAC;QAED,sCAAsC;QACtC,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,SAAS,CAAC;QAE9C,OAAO;YACL,MAAM;YACN,MAAM,EAAE;gBACN,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,QAAQ,EAAE,WAAW,CAAC,EAAE;gBACxB,OAAO;aACR;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAqB;IAC5D,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAEzE,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,sCAAsC;QACtC,IAAI,MAAM,GAAW,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEnD,eAAe;QACf,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7E,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,yBAAyB;gBACzB,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;oBAC/C,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;wBACtC,IAAI,GAAG,GAAG,YAAY,EAAE,CAAC;4BACvB,6BAA6B;4BAC7B,SAAS;wBACX,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvC,IAAI,OAAO,EAAE,CAAC;oBACZ,YAAY,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,MAAM;YAC7B,YAAY;YACZ,UAAU,EAAE,SAAS;SACtB,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAsB;IACxD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAElE,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QAErC,8BAA8B;QAC9B,IAAI,MAAM,GAAW,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAEnD,gBAAgB;QAChB,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,SAAS,CAAC,eAAe;YAEvC,sCAAsC;YACtC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,OAAO,CAAC,IAAI,CAAC;gBACX,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACrE,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,cAAc,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,QAAiB;YACvB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,MAAM,EAAE,OAAO;SAChB,CAAC;QACF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,aAAsB;YAC5B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACpC,CAAC;QAEF,0EAA0E;QAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACzF,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAExF,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,CAAC;YACV,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtC,YAAY;SACb,CAAC;QAEF,uBAAuB;QACvB,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3D,OAAO;YACL,aAAa,EAAE,OAAO,CAAC,MAAM;SAC9B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAsB;IACxD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAEpF,wBAAwB;IACxB,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAiB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,aAAa;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,0EAA0E;IAC1E,wDAAwD;IACxD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5G,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,CAAC;IACnF,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACjE,IAAI,eAAe,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,EAAE,aAAa,CAAC,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,CAAC;IAED,kBAAkB;IAClB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEzD,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACH,YAAY,GAAG,cAAc,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA+B,CAAC;IAEzF,sEAAsE;IACtE,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAgD,EAAE,CAAC;IACtE,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,oCAAoC;gBACpC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAElF,eAAe;gBACf,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE;oBAC1C,WAAW,EAAE,KAAK,CAAC,YAAY;oBAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,GAAG,KAAK,CAAC,YAAY,kBAAkB,KAAK,CAAC,OAAO,EAAE;iBAC/D,CAAC,CAAC;gBAEH,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAED,kEAAkE;IAClE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM;YACpD,UAAU,EAAE,MAAM,CAAC,MAAM;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC/C,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,OAAO,cAAc,CAAe,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC/D,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,YAAY,GAAG,CAAC,CAAC;QAErB,KAAK,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,CAAC;YACjD,iBAAiB;YACjB,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;YAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,0CAA0C;gBAC1C,YAAY,EAAE,CAAC;gBACf,SAAS;YACX,CAAC;YAED,oCAAoC;YACpC,MAAM,SAAS,GAAG,SAAS,CAAC,SAA2B,CAAC;YACxD,MAAM,aAAa,GAAG,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,aAAa,IAAI,cAAc,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,YAAY,EAAE,CAAC;oBACf,SAAS;gBACX,CAAC;YACH,CAAC;YAED,gBAAgB;YAChB,IAAI,CAAC,SAAS,EAAE,CAAC;gBACd,SAAuB,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAoB,CAAC;YACxF,CAAC;YACD,MAAM,CAAC,GAAG,SAAS,CAAC,SAA2B,CAAC;YAChD,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;gBACX,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC;YACb,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;YAEjC,aAAa,EAAE,CAAC;QAClB,CAAC;QAED,OAAO;YACL,MAAM;YACN,MAAM,EAAE;gBACN,aAAa;gBACb,YAAY,EAAE,YAAY,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC5F,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;aAC/C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/secrets/resolve.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Secret reference resolution (Phase 3.6)
+ *
+ * Resolves secret references (dpapi:<id>, keychain:<id>, plain:<id>) in env vars
+ * to their plaintext values at runtime.
+ *
+ * Security:
+ * - Plaintext is only held in memory during process spawn
+ * - Never written to disk, logs, or config files
+ * - Original env with refs is not modified
+ */
+/** Result of resolving env secrets */
+export interface ResolveEnvSecretsResult {
+    /** Resolved env (with plaintext values) - SENSITIVE, in-memory only */
+    envResolved: Record<string, string>;
+    /** Secret refs that were successfully resolved */
+    resolvedRefs: string[];
+    /** Errors encountered during resolution */
+    errors: ResolveError[];
+    /** Whether resolution was fully successful */
+    success: boolean;
+}
+/** Error during secret resolution */
+export interface ResolveError {
+    /** Environment key */
+    key: string;
+    /** Secret reference that failed */
+    ref: string;
+    /** Error message */
+    message: string;
+    /** Suggested fix command */
+    suggestion?: string;
+}
+/**
+ * Resolve secret references in env vars to plaintext values
+ *
+ * This function should be called just before spawning a child process.
+ * The returned envResolved should be passed to spawn() and then
+ * immediately discarded (not stored or logged).
+ *
+ * @param env - Environment variables potentially containing secret refs
+ * @param connectorId - Connector ID for error messages and suggestions
+ * @param configDir - Config directory (default: ~/.proofscan)
+ * @returns Resolved env and any errors
+ */
+export declare function resolveEnvSecrets(env: Record<string, string> | undefined, connectorId: string, configDir?: string): Promise<ResolveEnvSecretsResult>;
+/**
+ * Format resolution errors for user display
+ */
+export declare function formatResolveErrors(errors: ResolveError[], connectorId: string): string[];
+//# sourceMappingURL=resolve.d.ts.map