@catladder/cli 0.0.0-next-4e7c6848 → 0.0.0-next-8b9ad5ca

package/dist/bundles/cli/index.js

@@ -2,7 +2,7 @@
 /******/ 	var __webpack_modules__ = ({
 
 /***/ 48618:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
@@ -11,6 +11,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.BaseContext = void 0;
+const vaultManagerAccess_1 = __nccwpck_require__(37881);
 /**
  * Base class for CommandContext implementations.
  * Handles caching, the `get()` method, and `promptDirect` delegation.
@@ -20,6 +21,10 @@ class BaseContext {
   constructor(command) {
     this.command = command;
     this.cache = new Map();
+    this.vaultManagerGetter = (0, vaultManagerAccess_1.createVaultManagerGetter)(() => this);
+  }
+  getVaultManager() {
+    return this.vaultManagerGetter();
   }
   get(name) {
     if (!this.cache.has(name)) {
@@ -91,6 +96,7 @@ Object.defineProperty(exports, "__esModule", ({
 exports.createTerminalIO = exports.createTerminalContext = void 0;
 const types_1 = __nccwpck_require__(92284);
 const baseContext_1 = __nccwpck_require__(48618);
+const vaultManagerAccess_1 = __nccwpck_require__(37881);
 /**
  * Resolve choices from a choices function.
  */
@@ -155,6 +161,10 @@ class TerminalContext extends baseContext_1.BaseContext {
     super(command);
     this.options = options;
   }
+  get interactive() {
+    var _a;
+    return (_a = this.options.interactive) !== null && _a !== void 0 ? _a : process.stdin.isTTY === true;
+  }
   log(message) {
     console.log(message);
   }
@@ -229,7 +239,10 @@ exports.createTerminalContext = createTerminalContext;
  * Create a bare IO instance for terminal helper functions.
  */
 function createTerminalIO(options = {}) {
-  return {
+  var _a;
+  const io = {
+    interactive: (_a = options.interactive) !== null && _a !== void 0 ? _a : process.stdin.isTTY === true,
+    getVaultManager: (0, vaultManagerAccess_1.createVaultManagerGetter)(() => io),
     log(message) {
       console.log(message);
     },
@@ -255,11 +268,45 @@ function createTerminalIO(options = {}) {
       throw new types_1.MissingInputError(spec.name, spec.message);
     }
   };
+  return io;
 }
 exports.createTerminalIO = createTerminalIO;
 
 /***/ }),
 
+/***/ 37881:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.createVaultManagerGetter = void 0;
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const VaultManager_1 = __nccwpck_require__(55771);
+/**
+ * lazily creates the vault manager of a context (once per context),
+ * loading the project config on first use
+ */
+const createVaultManagerGetter = (io, options = {}) => {
+  let managerPromise;
+  return () => managerPromise !== null && managerPromise !== void 0 ? managerPromise : managerPromise = (async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+      throw new Error("no catladder config found — the secrets vault needs a project config");
+    }
+    return new VaultManager_1.VaultManager(config, {
+      ...options,
+      io: io()
+    });
+  })();
+};
+exports.createVaultManagerGetter = createVaultManagerGetter;
+
+/***/ }),
+
 /***/ 38365:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -355,7 +402,9 @@ const pipeline_1 = __nccwpck_require__(60241);
 const common_tags_1 = __nccwpck_require__(63779);
 const lodash_es_1 = __nccwpck_require__(64284);
 const getProjectConfig_1 = __nccwpck_require__(50001);
+const commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
 const editAsFile_1 = __nccwpck_require__(82805);
+const github_1 = __nccwpck_require__(18036);
 const gitlab_1 = __nccwpck_require__(4508);
 const promise_1 = __nccwpck_require__(51762);
 /* for convenience, parse json objects. that makes it easier to edit secrets that are object */
@@ -433,21 +482,68 @@ const doItFor = async (instance, envAndComponents) => {
       }
     }
   }
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    throw new Error("no catladder config found");
+  }
   instance.log("");
-  instance.log("upserting all variables, please wait...");
+  instance.log("writing all secrets to the vault, please wait...");
   instance.log("");
   for (const [componentName, envs] of Object.entries(envAndComponents)) {
     for (const env of envs) {
-      instance.log("upserting " + env + ":" + componentName + "...\n");
-      await (0, gitlab_1.upsertAllVariables)(instance, valuesToEdit[componentName][env], env, componentName);
+      instance.log("writing " + env + ":" + componentName + "...\n");
+      await (await instance.getVaultManager()).writeSecrets(env, componentName, valuesToEdit[componentName][env]);
       instance.log("");
       instance.log("✅ " + env + ":" + componentName);
       instance.log("--------------------------------\n");
     }
   }
+  await mirrorSecretsToCiBackends(instance, config, envAndComponents, valuesToEdit);
   instance.log("done! 😻");
   instance.log("");
 };
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the edited secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, valuesToEdit) => {
+  const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+  // gitlab mirror (unless gitlab is the vault itself, then it is
+  // already written)
+  if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
+    for (const [componentName, envs] of Object.entries(envAndComponents)) {
+      for (const env of envs) {
+        await (0, gitlab_1.upsertAllVariables)(instance, valuesToEdit[componentName][env], env, componentName);
+      }
+    }
+    instance.log("✅ mirrored to gitlab");
+  }
+  if (!enabled.includes("github")) {
+    return;
+  }
+  const secrets = Object.entries(envAndComponents).flatMap(([componentName, envs]) => envs.flatMap(env => {
+    var _a;
+    return Object.entries((_a = valuesToEdit[componentName][env]) !== null && _a !== void 0 ? _a : {}).map(([key, value]) => ({
+      name: (0, pipeline_1.getSecretVarName)(env, componentName, key),
+      value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : "")
+    }));
+  }));
+  if (secrets.length === 0) {
+    return;
+  }
+  if (!(await (0, github_1.isGhAuthenticated)())) {
+    instance.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
+    return;
+  }
+  const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+  if (!repo) {
+    instance.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
+    return;
+  }
+  instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+  await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets);
+};
 const projectConfigSecrets = async (io, envComponent) => {
   if (!envComponent) {
     const allEnvAndcomponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
@@ -1874,7 +1970,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(70243);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({
@@ -1975,6 +2071,13 @@ Object.defineProperty(exports, "commandSecretsClearBackups", ({
     return commandSecretsClearBackups_1.commandSecretsClearBackups;
   }
 }));
+var commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
+Object.defineProperty(exports, "commandSecretsSyncGithub", ({
+  enumerable: true,
+  get: function () {
+    return commandSecretsSyncGithub_1.commandSecretsSyncGithub;
+  }
+}));
 var commandOpenLogs_1 = __nccwpck_require__(98720);
 Object.defineProperty(exports, "commandOpenLogs", ({
   enumerable: true,
@@ -3186,6 +3289,140 @@ exports.commandSecretsClearBackups = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 50962:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretsFromVault = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const defineCommand_1 = __nccwpck_require__(39489);
+const github_1 = __nccwpck_require__(18036);
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+const collectSecretsFromVault = async io => {
+  const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+  const names = [];
+  for (const [componentName, envs] of Object.entries(envAndComponents)) {
+    for (const env of envs) {
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+      const keys = [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys];
+      keys.forEach(({
+        key
+      }) => names.push((0, pipeline_1.getSecretVarName)(env, componentName, key)));
+    }
+  }
+  const values = await (await io.getVaultManager()).readSecrets(names, io);
+  const secrets = names.filter(name => values[name] !== undefined).map(name => ({
+    name,
+    value: values[name]
+  }));
+  const missing = names.filter(name => values[name] === undefined);
+  return {
+    secrets,
+    missing
+  };
+};
+exports.collectSecretsFromVault = collectSecretsFromVault;
+/**
+ * pushes secrets to github repository secrets via the gh cli
+ */
+const pushSecretsToGithub = async (io, repo, secrets) => {
+  for (const {
+    name,
+    value
+  } of secrets) {
+    await (0, github_1.setGithubSecret)(repo, name, value);
+    io.log(`✅ ${name}`);
+  }
+};
+exports.pushSecretsToGithub = pushSecretsToGithub;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+const getConfiguredGithubRepo = async () => {
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    return undefined;
+  }
+  return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
+};
+exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
+/**
+ * copies the catladder secrets from the vault to github actions
+ * repository secrets, keeping the exact same names, so the github
+ * pipeline can reference them as ${{ secrets.<NAME> }}.
+ */
+exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
+  name: "project secrets-sync-github",
+  description: "copies all secrets from the vault to github repo secrets (same names), for the github pipeline",
+  group: "project",
+  inputs: {
+    repo: {
+      type: "string",
+      message: "github repository (owner/name)",
+      positional: true,
+      required: false
+    }
+  },
+  execute: async ctx => {
+    var _a;
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+      throw new Error("no catladder config found");
+    }
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    if (!enabled.includes("github")) {
+      throw new Error("the github pipeline is not enabled in `pipelines` — nothing to sync to");
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+      throw new Error("the github cli (gh) is not installed or not authenticated — run `gh auth login` first");
+    }
+    const repo = (_a = await ctx.get("repo")) !== null && _a !== void 0 ? _a : await (0, exports.getConfiguredGithubRepo)();
+    if (!repo) {
+      throw new Error(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — pass it as owner/name or configure pipelines.github.gitRemote`);
+    }
+    const {
+      secrets,
+      missing
+    } = await (0, exports.collectSecretsFromVault)(ctx);
+    if (missing.length > 0) {
+      ctx.log(`⚠️ ${missing.length} secrets are not set in the vault and will be skipped:`);
+      missing.forEach(name => ctx.log(`  - ${name}`));
+      ctx.log("");
+    }
+    if (secrets.length === 0) {
+      ctx.log("no secrets to sync 🤷");
+      return;
+    }
+    ctx.log(`about to set ${secrets.length} secrets on '${repo}':`);
+    secrets.forEach(({
+      name
+    }) => ctx.log(`  - ${name}`));
+    ctx.log("");
+    const confirmed = await ctx.confirm("continue? 🤔");
+    if (!confirmed) {
+      throw new Error("abort");
+    }
+    await (0, exports.pushSecretsToGithub)(ctx, repo, secrets);
+    ctx.log("");
+    ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
+  }
+});
+
+/***/ }),
+
 /***/ 92494:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -4179,14 +4416,24 @@ const getGitlabVar = async (io, env, componentName, variableName) => {
 };
 exports.getGitlabVar = getGitlabVar;
 const resolveSecrets = async (io, varSets) => {
-  const allVariablesInGitlab = await (0, gitlab_1.getAllVariables)(io);
+  // the secret variables actually referenced by the env var values —
+  // when they are all in the local cache, the vault is not contacted
+  const referencedNames = [...new Set(varSets.flatMap(({
+    envVars
+  }) => Object.values(envVars).flatMap(value => {
+    var _a;
+    return (_a = `${value}`.match(/\$CL_\w+/g)) !== null && _a !== void 0 ? _a : [];
+  })))].map(reference => reference.slice(1));
+  const vaultManager = await io.getVaultManager();
+  const secrets = await vaultManager.readSecrets(referencedNames, io);
+  const secretEntries = Object.entries(secrets);
   return Object.fromEntries(varSets.flatMap(({
     envVars,
     secretEnvVarKeys
   }) => Object.entries(envVars).filter(([key, value]) => {
     var _a;
     return value !== undefined && value !== null && !((_a = secretEnvVarKeys.find(k => k.key === key)) === null || _a === void 0 ? void 0 : _a.hidden);
-  }).map(([key, value]) => [key, allVariablesInGitlab.reduce((acc, curr) => acc.replace(new RegExp("\\$" + curr.key, "g"), curr.value), `${value}`)])));
+  }).map(([key, value]) => [key, secretEntries.reduce((acc, [name, secretValue]) => acc.replace(new RegExp("\\$" + name, "g"), secretValue), `${value}`)])));
 };
 const getEnvVarsResolved = async (io, env, componentName) => {
   if (!componentName) {
@@ -4291,8 +4538,15 @@ exports.defineCommand = defineCommand;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.MissingInputError = void 0;
+exports.MissingInputError = exports.NonInteractiveError = void 0;
 // ─── Errors ──────────────────────────────────────────────────────────
+class NonInteractiveError extends Error {
+  constructor(interaction) {
+    super(`${interaction} requires an interactive terminal, but this context is not interactive`);
+    this.name = "NonInteractiveError";
+  }
+}
+exports.NonInteractiveError = NonInteractiveError;
 class MissingInputError extends Error {
   constructor(inputName, promptMessage) {
     super(`Missing required input: "${inputName}" (${promptMessage}). ` + `Provide it via --${inputName}=<value> or --inputs='{"${inputName}": ...}'`);
@@ -4742,14 +4996,14 @@ exports.getProjectRootPath = getProjectRootPath;
 /**
  * Get the git remote hostname and project path from the git config.
  */
-const getGitRemoteHostAndPath = async () => {
+const getGitRemoteHostAndPath = async (remoteName = "origin") => {
   var _a;
-  const remoteUrl = await (0, gitConfig_1.gitConfigGet)("remote.origin.url");
+  const remoteUrl = await (0, gitConfig_1.gitConfigGet)(`remote.${remoteName}.url`);
   const remoteReg = /(https:\/\/|git@)([^:/]+)[:/]([^.]*)(\.git)?/;
   const match = (_a = remoteUrl.match(remoteReg)) !== null && _a !== void 0 ? _a : [];
   const [,, gitRemoteHost, gitRemotePath] = match;
   if (!(gitRemoteHost === null || gitRemoteHost === void 0 ? void 0 : gitRemoteHost.length) || !(gitRemotePath === null || gitRemotePath === void 0 ? void 0 : gitRemotePath.length)) {
-    throw new Error(`Failed to parse git remote hostname and path from git configs remote.origin.url! ${remoteUrl}`);
+    throw new Error(`Failed to parse git remote hostname and path from git configs remote.${remoteName}.url! ${remoteUrl}`);
   }
   return {
     gitRemoteHost,
@@ -5306,6 +5560,67 @@ exports["default"] = async () => {
 
 /***/ }),
 
+/***/ 18036:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+const child_process_1 = __nccwpck_require__(35317);
+const util_1 = __nccwpck_require__(39023);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * whether the github cli (gh) is installed and authenticated
+ */
+const isGhAuthenticated = async () => {
+  try {
+    await execFile("gh", ["auth", "status"]);
+    return true;
+  } catch (_a) {
+    return false;
+  }
+};
+exports.isGhAuthenticated = isGhAuthenticated;
+/**
+ * the github repository (owner/name) a git remote points to.
+ * Which remote belongs to github is configured per pipeline type
+ * (`pipelines.github.gitRemote`, defaults to origin).
+ */
+const getGithubRepoFromRemote = async remoteName => {
+  try {
+    const {
+      stdout
+    } = await execFile("git", ["remote", "get-url", remoteName]);
+    const match = stdout.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/);
+    return match === null || match === void 0 ? void 0 : match[1];
+  } catch (_a) {
+    return undefined;
+  }
+};
+exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
+/**
+ * sets a github actions repository secret via the gh cli.
+ * The value is passed via stdin so it never shows up in a process list.
+ */
+const setGithubSecret = async (repo, name, value) => new Promise((resolve, reject) => {
+  var _a, _b;
+  const child = (0, child_process_1.spawn)("gh", ["secret", "set", name, "--repo", repo], {
+    stdio: ["pipe", "ignore", "pipe"]
+  });
+  let stderr = "";
+  (_a = child.stderr) === null || _a === void 0 ? void 0 : _a.on("data", data => stderr += data);
+  child.on("error", reject);
+  child.on("close", code => code === 0 ? resolve() : reject(new Error(`gh secret set ${name} failed: ${stderr.trim()}`)));
+  (_b = child.stdin) === null || _b === void 0 ? void 0 : _b.end(value);
+});
+exports.setGithubSecret = setGithubSecret;
+
+/***/ }),
+
 /***/ 4508:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -5845,6 +6160,445 @@ exports.getShell = getShell;
 
 /***/ }),
 
+/***/ 63510:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.BitwardenVault = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const yaml_1 = __nccwpck_require__(6637);
+const bw_1 = __nccwpck_require__(52211);
+const DEFAULT_COLLECTION = "catladder";
+const SECURE_NOTE_TYPE = 2;
+/**
+ * one yaml note per env and component:
+ * `<customerName>/<appName>/<env>/<componentName>/secrets.yml`
+ */
+const itemName = (config, env, componentName) => `${config.customerName}/${config.appName}/${env}/${componentName}/secrets.yml`;
+const itemPrefix = config => `${config.customerName}/${config.appName}/`;
+/**
+ * parses env and componentName back out of an item name
+ */
+const parseItemName = (config, name) => {
+  const match = name.slice(itemPrefix(config).length).match(/^([^/]+)\/([^/]+)\/secrets\.yml$/);
+  return match ? {
+    env: match[1],
+    componentName: match[2]
+  } : null;
+};
+const findCollection = async (session, collectionName) => {
+  const collections = await (0, bw_1.runBwJson)(session, ["list", "collections", "--search", collectionName]);
+  const collection = collections.find(c => c.name === collectionName);
+  if (!collection) {
+    throw new Error(`bitwarden collection '${collectionName}' not found — create it and make sure you have access`);
+  }
+  return collection;
+};
+const encodePayload = payload => Buffer.from(JSON.stringify(payload), "utf-8").toString("base64");
+class BitwardenVault {
+  constructor(config, options,
+  /**
+   * whether a locked bitwarden may be unlocked interactively
+   * (false with catenv --vault-mode no-prompt)
+   */
+  allowPrompt) {
+    var _a;
+    this.config = config;
+    this.allowPrompt = allowPrompt;
+    this.collectionName = (_a = options.collection) !== null && _a !== void 0 ? _a : DEFAULT_COLLECTION;
+    this.id = `bitwarden:${this.collectionName}`;
+  }
+  session(io) {
+    return (0, bw_1.getBwSession)(io, {
+      allowPrompt: this.allowPrompt
+    });
+  }
+  async readAllSecrets(io) {
+    const {
+      config,
+      collectionName
+    } = this;
+    const bwSession = await this.session(io);
+    const collection = await findCollection(bwSession, collectionName);
+    const items = await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id]);
+    const secrets = {};
+    for (const item of items) {
+      const parsed = parseItemName(config, item.name);
+      if (!parsed || !item.notes) {
+        continue;
+      }
+      const values = (0, yaml_1.parse)(item.notes);
+      Object.entries(values !== null && values !== void 0 ? values : {}).forEach(([key, value]) => {
+        secrets[(0, pipeline_1.getSecretVarName)(parsed.env, parsed.componentName, key)] = typeof value === "string" ? value : JSON.stringify(value);
+      });
+    }
+    return secrets;
+  }
+  async writeSecrets(io, env, componentName, secrets) {
+    const {
+      config,
+      collectionName
+    } = this;
+    const bwSession = await this.session(io);
+    const collection = await findCollection(bwSession, collectionName);
+    const name = itemName(config, env, componentName);
+    const existing = (await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id, "--search", name])).find(item => item.name === name);
+    const notes = (0, yaml_1.stringify)(secrets);
+    if (existing) {
+      await (0, bw_1.runBw)(bwSession, ["edit", "item", existing.id, encodePayload({
+        ...existing,
+        notes
+      })]);
+    } else {
+      await (0, bw_1.runBw)(bwSession, ["create", "item", encodePayload({
+        type: SECURE_NOTE_TYPE,
+        secureNote: {
+          type: 0
+        },
+        name,
+        notes,
+        ...(collection.organizationId ? {
+          organizationId: collection.organizationId,
+          collectionIds: [collection.id]
+        } : {})
+      })]);
+    }
+  }
+}
+exports.BitwardenVault = BitwardenVault;
+
+/***/ }),
+
+/***/ 31107:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.GitlabVault = void 0;
+const gitlab_1 = __nccwpck_require__(4508);
+/**
+ * the legacy (and default) vault: the gitlab project variables double
+ * as the secret store
+ */
+class GitlabVault {
+  constructor() {
+    this.id = "gitlab";
+  }
+  async readAllSecrets(io) {
+    const variables = await (0, gitlab_1.getAllVariables)(io);
+    return Object.fromEntries(variables.map(v => [v.key, v.value]));
+  }
+  async writeSecrets(io, env, componentName, secrets) {
+    await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+  }
+}
+exports.GitlabVault = GitlabVault;
+
+/***/ }),
+
+/***/ 55771:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.VaultManager = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const BitwardenVault_1 = __nccwpck_require__(63510);
+const cache_1 = __nccwpck_require__(14236);
+const GitlabVault_1 = __nccwpck_require__(31107);
+/**
+ * only secrets of this env are cached locally — the other envs'
+ * secrets have no business sitting on developer machines
+ */
+const CACHED_ENV = "local";
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+class VaultManager {
+  constructor(config, options = {}) {
+    var _a, _b;
+    this.config = config;
+    /** refresh mode bypasses the cache only once per manager */
+    this.refreshed = false;
+    this.mode = (_a = options.mode) !== null && _a !== void 0 ? _a : "auto";
+    this.io = (_b = options.io) !== null && _b !== void 0 ? _b : null;
+    this.vault = this.createVault();
+  }
+  createVault() {
+    const vaultConfig = (0, pipeline_1.getVaultConfig)(this.config);
+    switch (vaultConfig.type) {
+      case "gitlab":
+        return new GitlabVault_1.GitlabVault();
+      case "bitwarden":
+        return new BitwardenVault_1.BitwardenVault(this.config, vaultConfig, this.mode === "auto" || this.mode === "refresh");
+    }
+  }
+  /**
+   * the vault secrets, served from the local cache when it contains
+   * all required names; otherwise (depending on the mode) refreshed
+   * from the vault. Only the "local" env is (re-)cached.
+   */
+  async readSecrets(requiredNames, io = this.io) {
+    const bypassCache = this.mode === "refresh" && !this.refreshed;
+    const cache = bypassCache ? null : await (0, cache_1.readSecretsCache)();
+    // known entries include recorded misses (null values), so declared
+    // but intentionally unset secrets don't force a vault refresh
+    const known = (cache === null || cache === void 0 ? void 0 : cache.vaultId) === this.vault.id ? flattenSecrets(cache.secrets) : undefined;
+    const missing = requiredNames.filter(name => !(name in (known !== null && known !== void 0 ? known : {})));
+    // nothing missing (or nothing required at all): don't touch the vault
+    if (missing.length === 0 && (known || requiredNames.length === 0)) {
+      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    }
+    if (this.mode === "offline") {
+      if (missing.length > 0) {
+        io === null || io === void 0 ? void 0 : io.log(`⚠️ vault is offline (--vault-mode offline) and ${missing.length} secrets are not in the local cache: ${missing.join(", ")}`);
+      }
+      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    }
+    const secrets = await this.vault.readAllSecrets(io);
+    this.refreshed = true;
+    await (0, cache_1.writeSecretsCache)(this.vault.id, await this.cacheableSubset(secrets));
+    return secrets;
+  }
+  /**
+   * writes secrets of one env/component to the vault and updates the
+   * local cache (write-through, "local" env only)
+   */
+  async writeSecrets(env, componentName, secrets, io = this.io) {
+    if (!io) {
+      throw new Error("writing to the vault requires an interactive context");
+    }
+    await this.vault.writeSecrets(io, env, componentName, secrets);
+    if (env === CACHED_ENV) {
+      await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [key, typeof value === "string" ? value : JSON.stringify(value)])));
+    }
+  }
+  /**
+   * the subset of the vault secrets that may be cached: the declared
+   * secrets of the "local" env, per component, as a hierarchy
+   */
+  async cacheableSubset(flatSecrets) {
+    const local = {};
+    for (const componentName of Object.keys(this.config.components)) {
+      const keys = await this.declaredSecretKeys(componentName);
+      const values = Object.fromEntries(keys.map(key => {
+        var _a;
+        return [key,
+        // null records "absent in the vault" (a known miss)
+        (_a = flatSecrets[(0, pipeline_1.getSecretVarName)(CACHED_ENV, componentName, key)]) !== null && _a !== void 0 ? _a : null];
+      }));
+      if (Object.keys(values).length > 0) {
+        local[componentName] = values;
+      }
+    }
+    return Object.keys(local).length > 0 ? {
+      [CACHED_ENV]: local
+    } : {};
+  }
+  async declaredSecretKeys(componentName) {
+    try {
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, pipeline_1.getEnvironment)({
+        config: this.config,
+        componentName,
+        env: CACHED_ENV
+      });
+      return [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys].map(({
+        key
+      }) => key);
+    } catch (_a) {
+      // components without a local env simply have nothing to cache
+      return [];
+    }
+  }
+}
+exports.VaultManager = VaultManager;
+/**
+ * the cache hierarchy as a flat map of raw secret variable names
+ * (null values = recorded misses)
+ */
+const flattenSecrets = secrets => Object.fromEntries(Object.entries(secrets).flatMap(([env, components]) => Object.entries(components).flatMap(([componentName, values]) => Object.entries(values).map(([key, value]) => [(0, pipeline_1.getSecretVarName)(env, componentName, key), value]))));
+/**
+ * only actual values — recorded misses stay unresolved, like any other
+ * unset variable
+ */
+const withoutMisses = known => Object.fromEntries(Object.entries(known).filter(entry => entry[1] !== null));
+
+/***/ }),
+
+/***/ 52211:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.runBwJson = exports.runBw = exports.getBwSession = void 0;
+const child_process_1 = __nccwpck_require__(35317);
+const util_1 = __nccwpck_require__(39023);
+const preferences_1 = __nccwpck_require__(66261);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+const SESSION_PREFERENCE = "bwsession";
+class BitwardenLockedError extends Error {
+  constructor() {
+    super("bitwarden is locked and prompting is disabled — run `bw unlock` or catenv without --vault-mode no-prompt");
+  }
+}
+/**
+ * runs an interactive bw command that prints a session key on stdout
+ * (login/unlock) while the user types the password on the terminal
+ */
+const interactiveSessionCommand = args => new Promise((resolve, reject) => {
+  var _a;
+  const child = (0, child_process_1.spawn)("bw", [...args, "--raw"], {
+    stdio: ["inherit", "pipe", "inherit"]
+  });
+  let session = "";
+  (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on("data", data => session += data.toString("utf-8"));
+  child.on("error", reject);
+  child.on("close", code => code === 0 && session.trim() ? resolve(session.trim()) : reject(new Error(`bw ${args[0]} failed`)));
+});
+const getBwStatus = async session => {
+  try {
+    const {
+      stdout
+    } = await execFile("bw", ["status"], {
+      env: {
+        ...process.env,
+        ...(session ? {
+          BW_SESSION: session
+        } : {})
+      }
+    });
+    return JSON.parse(stdout).status;
+  } catch (_a) {
+    return "unauthenticated";
+  }
+};
+/**
+ * a working bw session: reuses the cached one, otherwise unlocks (or
+ * logs in) interactively — unless prompting is disabled
+ */
+const getBwSession = async (io, {
+  allowPrompt
+}) => {
+  const cached = (await (0, preferences_1.hasPreference)(SESSION_PREFERENCE)) ? String(await (0, preferences_1.getPreference)(SESSION_PREFERENCE)) : null;
+  const status = await getBwStatus(cached);
+  if (status === "unlocked" && cached) {
+    return cached;
+  }
+  if (!allowPrompt) {
+    throw new BitwardenLockedError();
+  }
+  io === null || io === void 0 ? void 0 : io.log("");
+  io === null || io === void 0 ? void 0 : io.log(status === "unauthenticated" ? "# Please login to Bitwarden:" : "# Bitwarden is locked, please unlock:");
+  io === null || io === void 0 ? void 0 : io.log("");
+  const session = await interactiveSessionCommand([status === "unauthenticated" ? "login" : "unlock"]);
+  await (0, preferences_1.setPreference)(SESSION_PREFERENCE, session);
+  await (0, exports.runBw)(session, ["sync"]);
+  return session;
+};
+exports.getBwSession = getBwSession;
+/**
+ * runs a bw command with the given session and returns stdout
+ */
+const runBw = async (session, args) => {
+  const {
+    stdout
+  } = await execFile("bw", [...args, "--raw", "--nointeraction"], {
+    env: {
+      ...process.env,
+      BW_SESSION: session
+    },
+    maxBuffer: 50 * 1024 * 1024
+  });
+  return stdout;
+};
+exports.runBw = runBw;
+const runBwJson = async (session, args) => JSON.parse(await (0, exports.runBw)(session, args));
+exports.runBwJson = runBwJson;
+
+/***/ }),
+
+/***/ 14236:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.updateSecretsCache = exports.writeSecretsCache = exports.readSecretsCache = void 0;
+const promises_1 = __nccwpck_require__(91943);
+const path_1 = __nccwpck_require__(16928);
+const gitProjectInformation_1 = __nccwpck_require__(21111);
+const getCacheFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder");
+const getCachePath = async () => (0, path_1.join)(await getCacheFolder(), "secrets.json");
+const readSecretsCache = async () => {
+  try {
+    return JSON.parse(await (0, promises_1.readFile)(await getCachePath(), "utf-8"));
+  } catch (_a) {
+    return null;
+  }
+};
+exports.readSecretsCache = readSecretsCache;
+const writeSecretsCache = async (vaultId, secrets) => {
+  const folder = await getCacheFolder();
+  await (0, promises_1.mkdir)(folder, {
+    recursive: true
+  });
+  // the folder ignores itself, so the cache can never be committed
+  await (0, promises_1.writeFile)((0, path_1.join)(folder, ".gitignore"), "*\n");
+  const cache = {
+    vaultId,
+    updatedAt: new Date().toISOString(),
+    secrets
+  };
+  await (0, promises_1.writeFile)(await getCachePath(), JSON.stringify(cache, null, 2));
+};
+exports.writeSecretsCache = writeSecretsCache;
+/**
+ * merges freshly written secrets of one env/component into the cache
+ * (write-through from config-secrets), so the next catenv run doesn't
+ * need the vault
+ */
+const updateSecretsCache = async (vaultId, env, componentName, values) => {
+  var _a;
+  const existing = await (0, exports.readSecretsCache)();
+  const secrets = (existing === null || existing === void 0 ? void 0 : existing.vaultId) === vaultId ? existing.secrets : {};
+  secrets[env] = {
+    ...secrets[env],
+    [componentName]: {
+      ...((_a = secrets[env]) === null || _a === void 0 ? void 0 : _a[componentName]),
+      ...values
+    }
+  };
+  await (0, exports.writeSecretsCache)(vaultId, secrets);
+};
+exports.updateSecretsCache = updateSecretsCache;
+
+/***/ }),
+
 /***/ 54038:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -7163,7 +7917,7 @@ var __exportStar = this && this.__exportStar || function (m, exports) {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.getEnabledPipelineTypes = exports.getPipelineBackend = void 0;
+exports.getEnabledPipelineTypes = exports.getVaultConfig = exports.getPipelineGitRemote = exports.getPipelineOptions = exports.getPipelineBackend = void 0;
 const github_1 = __nccwpck_require__(99635);
 const gitlab_1 = __nccwpck_require__(8475);
 __exportStar(__nccwpck_require__(92474), exports);
@@ -7181,6 +7935,38 @@ const getPipelineBackend = type => {
   return createBackend();
 };
 exports.getPipelineBackend = getPipelineBackend;
+/**
+ * the options of an enabled pipeline type (empty object when enabled
+ * with `true`)
+ */
+const getPipelineOptions = (config, type) => {
+  var _a;
+  const value = (_a = config.pipelines) === null || _a === void 0 ? void 0 : _a[type];
+  return typeof value === "object" ? value : {};
+};
+exports.getPipelineOptions = getPipelineOptions;
+/**
+ * the git remote pointing to the repository of this pipeline type's CI
+ * system (e.g. during a migration, gitlab may be `origin` and github a
+ * second remote)
+ */
+const getPipelineGitRemote = (config, type) => {
+  var _a;
+  return (_a = (0, exports.getPipelineOptions)(config, type).gitRemote) !== null && _a !== void 0 ? _a : "origin";
+};
+exports.getPipelineGitRemote = getPipelineGitRemote;
+/**
+ * the normalized secrets vault of a config (string shorthands resolved
+ * to their object form; defaults to the legacy gitlab store)
+ */
+const getVaultConfig = config => {
+  var _a, _b;
+  const vault = (_b = (_a = config.secrets) === null || _a === void 0 ? void 0 : _a.vault) !== null && _b !== void 0 ? _b : "gitlab";
+  return typeof vault === "string" ? {
+    type: vault
+  } : vault;
+};
+exports.getVaultConfig = getVaultConfig;
 /**
  * the pipeline types enabled for this config. Multiple types can be
  * enabled at once (parallel generation, e.g. during a CI migration).
@@ -9147,7 +9933,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-4e7c6848" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-8b9ad5ca" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -11052,13 +11838,15 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
     }
     return {};
   },
-  additionalSecretKeys: ctx => [{
+  additionalSecretKeys: ctx => [
+  // deploy-time credentials don't exist for the local env
+  ...(ctx.envType !== "local" ? [{
     key: exports.GCLOUD_DEPLOY_CREDENTIALS_KEY,
     hidden: true
   }, {
     key: exports.GCLOUD_RUN_CANONICAL_HOST_SUFFIX,
     hidden: true
-  }, ...(ctx.deployConfigRaw && ctx.deployConfigRaw.cloudSql ? [{
+  }] : []), ...(ctx.deployConfigRaw && ctx.deployConfigRaw.cloudSql ? [{
     key: "DB_PASSWORD"
   }] : [])],
   getAdditionalEnvVars: ctx => {
@@ -11066,7 +11854,8 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
       fullName,
       env,
       componentName,
-      deployConfigRaw
+      deployConfigRaw,
+      envType
     } = ctx;
     const HOSTNAME_INTERNAL = (0, BashExpression_1.joinBashExpressions)([fullName, (0, BashExpression_1.getBashVariable)((0, context_1.getSecretVarName)(env, componentName, exports.GCLOUD_RUN_CANONICAL_HOST_SUFFIX))], "-").toLowerCase();
     const jobTriggers = deployConfigRaw && deployConfigRaw.jobs ? Object.fromEntries(Object.entries(deployConfigRaw.jobs).filter(([name, job]) => Boolean(job)).map(([name, job]) => ["CLOUD_RUN_JOB_TRIGGER_URL_" + (0, gitlab_1.sanitizeForBashVariable)(name), (0, cloudRunExecutionUrl_1.getCloudRunJobExecuteUrl)(name, {
@@ -11075,7 +11864,11 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
       region: deployConfigRaw.region
     })])) : {};
     return {
-      HOSTNAME_INTERNAL,
+      // references the canonical host suffix secret, which doesn't
+      // exist for the local env
+      ...(envType !== "local" ? {
+        HOSTNAME_INTERNAL
+      } : {}),
       ...getCloudSqlVariables(ctx),
       ...jobTriggers,
       DEPLOY_CLOUD_RUN_SERVICE_NAME: (0, getServiceName_1.getServiceNameForEnvContext)(ctx),