@catladder/cli 0.0.0-next-4e7c6848 → 0.0.0-next-8b9ad5ca

package/dist/cli/src/commands/project/commandSecretsSyncGithub.d.ts

@@ -0,0 +1,37 @@
+import type { IO } from "../../core/types";
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+export declare const collectSecretsFromVault: (io: IO) => Promise<{
+  secrets: {
+    name: string;
+    value: string;
+  }[];
+  missing: string[];
+}>;
+/**
+ * pushes secrets to github repository secrets via the gh cli
+ */
+export declare const pushSecretsToGithub: (io: IO, repo: string, secrets: {
+  name: string;
+  value: string;
+}[]) => Promise<void>;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+export declare const getConfiguredGithubRepo: () => Promise<string | undefined>;
+/**
+ * copies the catladder secrets from the vault to github actions
+ * repository secrets, keeping the exact same names, so the github
+ * pipeline can reference them as ${{ secrets.<NAME> }}.
+ */
+export declare const commandSecretsSyncGithub: import("../../core/types").CommandDef<{
+  readonly repo: {
+    readonly type: "string";
+    readonly message: "github repository (owner/name)";
+    readonly positional: true;
+    readonly required: false;
+  };
+}>;

package/dist/cli/src/commands/project/commandSecretsSyncGithub.js

@@ -0,0 +1,127 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretsFromVault = void 0;
+const pipeline_1 = require("../../../../pipeline/src/index.js");
+const getProjectConfig_1 = require("../../config/getProjectConfig");
+const defineCommand_1 = require("../../core/defineCommand");
+const github_1 = require("../../utils/github");
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+const collectSecretsFromVault = async io => {
+  const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+  const names = [];
+  for (const [componentName, envs] of Object.entries(envAndComponents)) {
+    for (const env of envs) {
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+      const keys = [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys];
+      keys.forEach(({
+        key
+      }) => names.push((0, pipeline_1.getSecretVarName)(env, componentName, key)));
+    }
+  }
+  const values = await (await io.getVaultManager()).readSecrets(names, io);
+  const secrets = names.filter(name => values[name] !== undefined).map(name => ({
+    name,
+    value: values[name]
+  }));
+  const missing = names.filter(name => values[name] === undefined);
+  return {
+    secrets,
+    missing
+  };
+};
+exports.collectSecretsFromVault = collectSecretsFromVault;
+/**
+ * pushes secrets to github repository secrets via the gh cli
+ */
+const pushSecretsToGithub = async (io, repo, secrets) => {
+  for (const {
+    name,
+    value
+  } of secrets) {
+    await (0, github_1.setGithubSecret)(repo, name, value);
+    io.log(`✅ ${name}`);
+  }
+};
+exports.pushSecretsToGithub = pushSecretsToGithub;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+const getConfiguredGithubRepo = async () => {
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    return undefined;
+  }
+  return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
+};
+exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
+/**
+ * copies the catladder secrets from the vault to github actions
+ * repository secrets, keeping the exact same names, so the github
+ * pipeline can reference them as ${{ secrets.<NAME> }}.
+ */
+exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
+  name: "project secrets-sync-github",
+  description: "copies all secrets from the vault to github repo secrets (same names), for the github pipeline",
+  group: "project",
+  inputs: {
+    repo: {
+      type: "string",
+      message: "github repository (owner/name)",
+      positional: true,
+      required: false
+    }
+  },
+  execute: async ctx => {
+    var _a;
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+      throw new Error("no catladder config found");
+    }
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    if (!enabled.includes("github")) {
+      throw new Error("the github pipeline is not enabled in `pipelines` — nothing to sync to");
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+      throw new Error("the github cli (gh) is not installed or not authenticated — run `gh auth login` first");
+    }
+    const repo = (_a = await ctx.get("repo")) !== null && _a !== void 0 ? _a : await (0, exports.getConfiguredGithubRepo)();
+    if (!repo) {
+      throw new Error(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — pass it as owner/name or configure pipelines.github.gitRemote`);
+    }
+    const {
+      secrets,
+      missing
+    } = await (0, exports.collectSecretsFromVault)(ctx);
+    if (missing.length > 0) {
+      ctx.log(`⚠️ ${missing.length} secrets are not set in the vault and will be skipped:`);
+      missing.forEach(name => ctx.log(`  - ${name}`));
+      ctx.log("");
+    }
+    if (secrets.length === 0) {
+      ctx.log("no secrets to sync 🤷");
+      return;
+    }
+    ctx.log(`about to set ${secrets.length} secrets on '${repo}':`);
+    secrets.forEach(({
+      name
+    }) => ctx.log(`  - ${name}`));
+    ctx.log("");
+    const confirmed = await ctx.confirm("continue? 🤔");
+    if (!confirmed) {
+      throw new Error("abort");
+    }
+    await (0, exports.pushSecretsToGithub)(ctx, repo, secrets);
+    ctx.log("");
+    ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
+  }
+});

package/dist/cli/src/commands/project/commandSecretsSyncGithub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsSyncGithub.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandSecretsSyncGithub.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAC7B,oEAIuC;AACvC,4DAAyD;AAEzD,+CAI4B;AAE5B;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAAM,EAAE,EAAE;IACtD,MAAM,gBAAgB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAEzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CACvB,KAAK,CAAC,IAAI,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AA3BW,QAAA,uBAAuB,2BA2BlC;AAEF;;GAEG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAM,EACN,IAAY,EACZ,OAA0C,EAC1C,EAAE;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AATW,QAAA,mBAAmB,uBAS9B;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,IAE1C,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC;AARW,QAAA,uBAAuB,2BAQlC;AAEF;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,IAAA,6BAAa,EAAC;IACpD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,gGAAgG;IAClG,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;QACrB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mCAAI,CAAC,MAAM,IAAA,+BAAuB,GAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,0EAA0E,CACvJ,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,+BAAuB,EAAC,GAAG,CAAC,CAAC;QAEhE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CACL,MAAM,OAAO,CAAC,MAAM,wDAAwD,CAC7E,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,gBAAgB,IAAI,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,2BAAmB,EAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,oEAAoE,CACrE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/config/getProjectConfig.d.ts

@@ -18,7 +18,7 @@ export declare const getAllPipelineContexts: (onlyComponent?: string | string[],
 }) => Promise<import("../../../pipeline/src/index.js").ComponentContext[]>;
 export declare const getEnvironment: (env: string, componentName: string) => Promise<import("../../../pipeline/src/index.js").Environment>;
 export declare const getGitlabVar: (io: IO, env: string, componentName: string, variableName: string) => Promise<string>;
-export declare const getEnvVarsResolved: (io: IO | null, env: string, componentName: string | null) => Promise<Record<string, string>>;
+export declare const getEnvVarsResolved: (io: IO, env: string, componentName: string | null) => Promise<Record<string, string>>;
 /**
  *
  * is used to get job only vars that should also be editable locally with catladder.

package/dist/cli/src/config/getProjectConfig.js

@@ -89,14 +89,24 @@ const getGitlabVar = async (io, env, componentName, variableName) => {
 };
 exports.getGitlabVar = getGitlabVar;
 const resolveSecrets = async (io, varSets) => {
-  const allVariablesInGitlab = await (0, gitlab_1.getAllVariables)(io);
+  // the secret variables actually referenced by the env var values —
+  // when they are all in the local cache, the vault is not contacted
+  const referencedNames = [...new Set(varSets.flatMap(({
+    envVars
+  }) => Object.values(envVars).flatMap(value => {
+    var _a;
+    return (_a = `${value}`.match(/\$CL_\w+/g)) !== null && _a !== void 0 ? _a : [];
+  })))].map(reference => reference.slice(1));
+  const vaultManager = await io.getVaultManager();
+  const secrets = await vaultManager.readSecrets(referencedNames, io);
+  const secretEntries = Object.entries(secrets);
   return Object.fromEntries(varSets.flatMap(({
     envVars,
     secretEnvVarKeys
   }) => Object.entries(envVars).filter(([key, value]) => {
     var _a;
     return value !== undefined && value !== null && !((_a = secretEnvVarKeys.find(k => k.key === key)) === null || _a === void 0 ? void 0 : _a.hidden);
-  }).map(([key, value]) => [key, allVariablesInGitlab.reduce((acc, curr) => acc.replace(new RegExp("\\$" + curr.key, "g"), curr.value), `${value}`)])));
+  }).map(([key, value]) => [key, secretEntries.reduce((acc, [name, secretValue]) => acc.replace(new RegExp("\\$" + name, "g"), secretValue), `${value}`)])));
 };
 const getEnvVarsResolved = async (io, env, componentName) => {
   if (!componentName) {

package/dist/cli/src/config/getProjectConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"getProjectConfig.js","sourceRoot":"","sources":["../../../../src/config/getProjectConfig.ts"],"names":[],"mappings":";;;AAKA,kDAM6B;AAG7B,4CAA6E;AAE7E,gDAA+C;AAE/C,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,IAAI,aAAa,GAAkB,IAAI,CAAC;AAExC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAU,GAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAU,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;AAChC,CAAC,CAAC;AAEK,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,aAAuB,CAAC;AACjC,CAAC,CAAC;AALW,QAAA,gBAAgB,oBAK3B;AAEK,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B;AAEK,MAAM,0BAA0B,GAAG,KAAK,EAC7C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,OAAO,MAAM,IAAA,iCAAsB,EAAC;QAClC,MAAM;QACN,aAAa;QACb,GAAG;KACJ,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,0BAA0B,8BAUrC;AACK,MAAM,+BAA+B,GAAG,KAAK,IAElD,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,yCAAyC,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC;AARW,QAAA,+BAA+B,mCAQ1C;AAEK,MAAM,uCAAuC,GAAG,KAAK,IAEzD,EAAE;IACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;QACpD,aAAa;QACb,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC;KAClC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAdW,QAAA,uCAAuC,2CAclD;AAEK,MAAM,sBAAsB,GAAG,KAAK,EACzC,aAAiC,EACjC,EAAE,YAAY,GAAG,KAAK,KAAiC,EAAE,EACzD,EAAE;IACF,MAAM,mBAAmB,GAAG,aAAa;QACvC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,aAAa,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,MAAM,IAAA,uCAA+B,GAAE,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC;SAChD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CACxE;SACA,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAC9B,IAAA,kCAA0B,EAAC,GAAG,EAAE,aAAa,CAAC,CAC/C,CACJ,CAAC;AACJ,CAAC,CAAC;AApBW,QAAA,sBAAsB,0BAoBjC;AAEK,MAAM,cAAc,GAAG,KAAK,EAAE,GAAW,EAAE,aAAqB,EAAE,EAAE;IACzE,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAExC,OAAO,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC;AAJW,QAAA,cAAc,kBAIzB;AAEK,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,YAAoB,EACpB,EAAE;IACF,MAAM,eAAe,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC3E,OAAO,MAAM,IAAA,kCAAyB,EAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9D,CAAC,CAAC;AARW,QAAA,YAAY,gBAQvB;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,EAAa,EACb,OAA6B,EACI,EAAE;IACnC,MAAM,oBAAoB,GAAG,MAAM,IAAA,wBAAe,EAAC,EAAE,CAAC,CAAC;IAEvD,OAAO,MAAM,CAAC,WAAW,CACvB,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACpB,MAAM,CACL,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;QACf,OAAA,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,IAAI;YACd,CAAC,CAAA,MAAA,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,0CAAE,MAAM,CAAA,CAAA;KAAA,CACvD;SACA,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACrB,GAAG;QACH,oBAAoB,CAAC,MAAM,CACzB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CACZ,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,EAC5D,GAAG,KAAK,EAAE,CACX;KACF,CAAC,CACL,CACF,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,kBAAkB,GAAG,KAAK,EACrC,EAAa,EACb,GAAW,EACX,aAA4B,EAC5B,EAAE;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAE5D,yEAAyE;IACzE,yCAAyC;IACzC,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB;YACE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;SAC9C;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAnBW,QAAA,kBAAkB,sBAmB7B;AAEF;;;GAGG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,UAAU,CAAC,WAAW,CAAC,KAAK;QAC5B,UAAU,CAAC,WAAW,CAAC,MAAM;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,yBAAyB,6BAUpC;AACF,SAAS,yCAAyC,CAChD,MAAc;IAEd,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CAC9D,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"getProjectConfig.js","sourceRoot":"","sources":["../../../../src/config/getProjectConfig.ts"],"names":[],"mappings":";;;AAKA,kDAM6B;AAG7B,4CAA4D;AAE5D,gDAA+C;AAE/C,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,IAAI,aAAa,GAAkB,IAAI,CAAC;AAExC,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAU,GAAE,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAU,EAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;AAChC,CAAC,CAAC;AAEK,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,UAAU,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,aAAuB,CAAC;AACjC,CAAC,CAAC;AALW,QAAA,gBAAgB,oBAK3B;AAEK,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC,CAAC;AAJW,QAAA,oBAAoB,wBAI/B;AAEK,MAAM,0BAA0B,GAAG,KAAK,EAC7C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,OAAO,MAAM,IAAA,iCAAsB,EAAC;QAClC,MAAM;QACN,aAAa;QACb,GAAG;KACJ,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,0BAA0B,8BAUrC;AACK,MAAM,+BAA+B,GAAG,KAAK,IAElD,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,yCAAyC,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC,CAAC;AARW,QAAA,+BAA+B,mCAQ1C;AAEK,MAAM,uCAAuC,GAAG,KAAK,IAEzD,EAAE;IACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC;QACpD,aAAa;QACb,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC;KAClC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAdW,QAAA,uCAAuC,2CAclD;AAEK,MAAM,sBAAsB,GAAG,KAAK,EACzC,aAAiC,EACjC,EAAE,YAAY,GAAG,KAAK,KAAiC,EAAE,EACzD,EAAE;IACF,MAAM,mBAAmB,GAAG,aAAa;QACvC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,CAAC,aAAa,CAAC;QACnB,CAAC,CAAC,IAAI,CAAC;IACT,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,MAAM,IAAA,uCAA+B,GAAE,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC;SAChD,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,mBAAmB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CACxE;SACA,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAC9B,IAAA,kCAA0B,EAAC,GAAG,EAAE,aAAa,CAAC,CAC/C,CACJ,CAAC;AACJ,CAAC,CAAC;AApBW,QAAA,sBAAsB,0BAoBjC;AAEK,MAAM,cAAc,GAAG,KAAK,EAAE,GAAW,EAAE,aAAqB,EAAE,EAAE;IACzE,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAgB,GAAE,CAAC;IAExC,OAAO,IAAA,yBAAe,EAAC,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;AACzD,CAAC,CAAC;AAJW,QAAA,cAAc,kBAIzB;AAEK,MAAM,YAAY,GAAG,KAAK,EAC/B,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,YAAoB,EACpB,EAAE;IACF,MAAM,eAAe,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;IAC3E,OAAO,MAAM,IAAA,kCAAyB,EAAC,EAAE,EAAE,eAAe,CAAC,CAAC;AAC9D,CAAC,CAAC;AARW,QAAA,YAAY,gBAQvB;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,EAAM,EACN,OAA6B,EACI,EAAE;IACnC,mEAAmE;IACnE,mEAAmE;IACnE,MAAM,eAAe,GAAG;QACtB,GAAG,IAAI,GAAG,CACR,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAC5B,CAAC,KAAK,EAAE,EAAE,WAAC,OAAA,MAAA,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,mCAAI,EAAE,CAAA,EAAA,CAC/C,CACF,CACF;KACF,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9C,OAAO,MAAM,CAAC,WAAW,CACvB,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAChD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACpB,MAAM,CACL,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;QACf,OAAA,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,IAAI;YACd,CAAC,CAAA,MAAA,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,0CAAE,MAAM,CAAA,CAAA;KAAA,CACvD;SACA,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACrB,GAAG;QACH,aAAa,CAAC,MAAM,CAClB,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,CAC3B,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,EACzD,GAAG,KAAK,EAAE,CACX;KACF,CAAC,CACL,CACF,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,kBAAkB,GAAG,KAAK,EACrC,EAAM,EACN,GAAW,EACX,aAA4B,EAC5B,EAAE;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAE5D,yEAAyE;IACzE,yCAAyC;IACzC,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB;YACE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;SAC9C;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAnBW,QAAA,kBAAkB,sBAmB7B;AAEF;;;GAGG;AACI,MAAM,yBAAyB,GAAG,KAAK,EAC5C,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAc,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,cAAc,CAAC,EAAE,EAAE;QACxB,UAAU,CAAC,WAAW,CAAC,KAAK;QAC5B,UAAU,CAAC,WAAW,CAAC,MAAM;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC;AAVW,QAAA,yBAAyB,6BAUpC;AACF,SAAS,yCAAyC,CAChD,MAAc;IAEd,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,EAAE,CAC9D,IAAA,qBAAU,EAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CACzE,CAAC;AACJ,CAAC"}

package/dist/cli/src/core/types.d.ts

@@ -1,3 +1,4 @@
+import type { VaultManager } from "../vault/VaultManager";
 import type { ComponentContext } from "../../../pipeline/src/index.js";
 export type PromptChoice = string | {
   name: string;
@@ -57,6 +58,17 @@ export type InputsSchema = Record<string, InputDef>;
  * that are NOT part of a command's declared input schema.
  */
 export interface IO {
+  /**
+   * whether this context can interact with the user (prompts, editors).
+   * Non-interactive contexts throw {@link NonInteractiveError} when an
+   * interaction would be required.
+   */
+  readonly interactive: boolean;
+  /**
+   * the secrets vault of this context, created lazily from the project
+   * config
+   */
+  getVaultManager(): Promise<VaultManager>;
   log(message: string): void;
   /**
    * Ask for confirmation. Returns true/false.
@@ -100,6 +112,9 @@ export interface CommandDef<TInputs extends InputsSchema = InputsSchema> {
   isAvailable?: (contexts: ComponentContext[]) => boolean;
   execute: (ctx: CommandContext<TInputs>) => Promise<void>;
 }
+export declare class NonInteractiveError extends Error {
+  constructor(interaction: string);
+}
 export declare class MissingInputError extends Error {
   readonly inputName: string;
   readonly promptMessage: string;

package/dist/cli/src/core/types.js

@@ -3,8 +3,15 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.MissingInputError = void 0;
+exports.MissingInputError = exports.NonInteractiveError = void 0;
 // ─── Errors ──────────────────────────────────────────────────────────
+class NonInteractiveError extends Error {
+  constructor(interaction) {
+    super(`${interaction} requires an interactive terminal, but this context is not interactive`);
+    this.name = "NonInteractiveError";
+  }
+}
+exports.NonInteractiveError = NonInteractiveError;
 class MissingInputError extends Error {
   constructor(inputName, promptMessage) {
     super(`Missing required input: "${inputName}" (${promptMessage}). ` + `Provide it via --${inputName}=<value> or --inputs='{"${inputName}": ...}'`);

package/dist/cli/src/core/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/types.ts"],"names":[],"mappings":";;;AAmIA,wEAAwE;AAExE,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YACkB,SAAiB,EACjB,aAAqB;QAErC,KAAK,CACH,4BAA4B,SAAS,MAAM,aAAa,KAAK;YAC3D,oBAAoB,SAAS,2BAA2B,SAAS,UAAU,CAC9E,CAAC;QANc,cAAS,GAAT,SAAS,CAAQ;QACjB,kBAAa,GAAb,aAAa,CAAQ;QAMrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAXD,8CAWC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/types.ts"],"names":[],"mappings":";;;AAiJA,wEAAwE;AAExE,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,WAAmB;QAC7B,KAAK,CACH,GAAG,WAAW,wEAAwE,CACvF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAPD,kDAOC;AAED,MAAa,iBAAkB,SAAQ,KAAK;IAC1C,YACkB,SAAiB,EACjB,aAAqB;QAErC,KAAK,CACH,4BAA4B,SAAS,MAAM,aAAa,KAAK;YAC3D,oBAAoB,SAAS,2BAA2B,SAAS,UAAU,CAC9E,CAAC;QANc,cAAS,GAAT,SAAS,CAAQ;QACjB,kBAAa,GAAb,aAAa,CAAQ;QAMrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAXD,8CAWC"}

package/dist/cli/src/git/gitProjectInformation.d.ts

@@ -5,7 +5,7 @@ export declare const getProjectRootPath: () => Promise<string>;
 /**
  * Get the git remote hostname and project path from the git config.
  */
-export declare const getGitRemoteHostAndPath: () => Promise<{
+export declare const getGitRemoteHostAndPath: (remoteName?: string) => Promise<{
   gitRemoteHost: string;
   gitRemotePath: string;
 }>;

package/dist/cli/src/git/gitProjectInformation.js

@@ -19,14 +19,14 @@ exports.getProjectRootPath = getProjectRootPath;
 /**
  * Get the git remote hostname and project path from the git config.
  */
-const getGitRemoteHostAndPath = async () => {
+const getGitRemoteHostAndPath = async (remoteName = "origin") => {
   var _a;
-  const remoteUrl = await (0, gitConfig_1.gitConfigGet)("remote.origin.url");
+  const remoteUrl = await (0, gitConfig_1.gitConfigGet)(`remote.${remoteName}.url`);
   const remoteReg = /(https:\/\/|git@)([^:/]+)[:/]([^.]*)(\.git)?/;
   const match = (_a = remoteUrl.match(remoteReg)) !== null && _a !== void 0 ? _a : [];
   const [,, gitRemoteHost, gitRemotePath] = match;
   if (!(gitRemoteHost === null || gitRemoteHost === void 0 ? void 0 : gitRemoteHost.length) || !(gitRemotePath === null || gitRemotePath === void 0 ? void 0 : gitRemotePath.length)) {
-    throw new Error(`Failed to parse git remote hostname and path from git configs remote.origin.url! ${remoteUrl}`);
+    throw new Error(`Failed to parse git remote hostname and path from git configs remote.${remoteName}.url! ${remoteUrl}`);
   }
   return {
     gitRemoteHost,

package/dist/cli/src/git/gitProjectInformation.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitProjectInformation.js","sourceRoot":"","sources":["../../../../src/git/gitProjectInformation.ts"],"names":[],"mappings":";;;AAAA,2CAA2C;AAC3C,iEAA6C;AAE7C;;GAEG;AACI,MAAM,kBAAkB,GAAG,KAAK,IAAqB,EAAE;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,4BAAI,EAAC,+BAA+B,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAHW,QAAA,kBAAkB,sBAG7B;AAEF;;GAEG;AACI,MAAM,uBAAuB,GAAG,KAAK,IAGzC,EAAE;;IACH,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAY,EAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,8CAA8C,CAAC;IACjE,MAAM,KAAK,GAAG,MAAA,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC;IAC/C,MAAM,CAAC,EAAE,AAAD,EAAG,aAAa,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;IACjD,IAAI,CAAC,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,CAAA,IAAI,CAAC,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,CAAA,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,oFAAoF,SAAS,EAAE,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC,CAAC;AAdW,QAAA,uBAAuB,2BAclC;AAEK,MAAM,qBAAqB,GAAG,KAAK,IAAI,EAAE;IAC9C,MAAM,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3E,CAAC,IAAA,+BAAuB,GAAE,EAAE,IAAA,0BAAkB,GAAE,CAAC,CAClD,CAAC;IACF,OAAO;QACL,aAAa;QACb,aAAa;QACb,eAAe;KAChB,CAAC;AACJ,CAAC,CAAC;AATW,QAAA,qBAAqB,yBAShC"}
+{"version":3,"file":"gitProjectInformation.js","sourceRoot":"","sources":["../../../../src/git/gitProjectInformation.ts"],"names":[],"mappings":";;;AAAA,2CAA2C;AAC3C,iEAA6C;AAE7C;;GAEG;AACI,MAAM,kBAAkB,GAAG,KAAK,IAAqB,EAAE;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,4BAAI,EAAC,+BAA+B,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAHW,QAAA,kBAAkB,sBAG7B;AAEF;;GAEG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAU,GAAG,QAAQ,EAIpB,EAAE;;IACH,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAY,EAAC,UAAU,UAAU,MAAM,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,8CAA8C,CAAC;IACjE,MAAM,KAAK,GAAG,MAAA,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC;IAC/C,MAAM,CAAC,EAAE,AAAD,EAAG,aAAa,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC;IACjD,IAAI,CAAC,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,CAAA,IAAI,CAAC,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,CAAA,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,wEAAwE,UAAU,SAAS,SAAS,EAAE,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;AAC1C,CAAC,CAAC;AAhBW,QAAA,uBAAuB,2BAgBlC;AAEK,MAAM,qBAAqB,GAAG,KAAK,IAAI,EAAE;IAC9C,MAAM,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3E,CAAC,IAAA,+BAAuB,GAAE,EAAE,IAAA,0BAAkB,GAAE,CAAC,CAClD,CAAC;IACF,OAAO;QACL,aAAa;QACb,aAAa;QACb,eAAe;KAChB,CAAC;AACJ,CAAC,CAAC;AATW,QAAA,qBAAqB,yBAShC"}

package/dist/cli/src/utils/github.d.ts

@@ -0,0 +1,15 @@
+/**
+ * whether the github cli (gh) is installed and authenticated
+ */
+export declare const isGhAuthenticated: () => Promise<boolean>;
+/**
+ * the github repository (owner/name) a git remote points to.
+ * Which remote belongs to github is configured per pipeline type
+ * (`pipelines.github.gitRemote`, defaults to origin).
+ */
+export declare const getGithubRepoFromRemote: (remoteName: string) => Promise<string | undefined>;
+/**
+ * sets a github actions repository secret via the gh cli.
+ * The value is passed via stdin so it never shows up in a process list.
+ */
+export declare const setGithubSecret: (repo: string, name: string, value: string) => Promise<void>;

package/dist/cli/src/utils/github.js

@@ -0,0 +1,54 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * whether the github cli (gh) is installed and authenticated
+ */
+const isGhAuthenticated = async () => {
+  try {
+    await execFile("gh", ["auth", "status"]);
+    return true;
+  } catch (_a) {
+    return false;
+  }
+};
+exports.isGhAuthenticated = isGhAuthenticated;
+/**
+ * the github repository (owner/name) a git remote points to.
+ * Which remote belongs to github is configured per pipeline type
+ * (`pipelines.github.gitRemote`, defaults to origin).
+ */
+const getGithubRepoFromRemote = async remoteName => {
+  try {
+    const {
+      stdout
+    } = await execFile("git", ["remote", "get-url", remoteName]);
+    const match = stdout.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/);
+    return match === null || match === void 0 ? void 0 : match[1];
+  } catch (_a) {
+    return undefined;
+  }
+};
+exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
+/**
+ * sets a github actions repository secret via the gh cli.
+ * The value is passed via stdin so it never shows up in a process list.
+ */
+const setGithubSecret = async (repo, name, value) => new Promise((resolve, reject) => {
+  var _a, _b;
+  const child = (0, child_process_1.spawn)("gh", ["secret", "set", name, "--repo", repo], {
+    stdio: ["pipe", "ignore", "pipe"]
+  });
+  let stderr = "";
+  (_a = child.stderr) === null || _a === void 0 ? void 0 : _a.on("data", data => stderr += data);
+  child.on("error", reject);
+  child.on("close", code => code === 0 ? resolve() : reject(new Error(`gh secret set ${name} failed: ${stderr.trim()}`)));
+  (_b = child.stdin) === null || _b === void 0 ? void 0 : _b.end(value);
+});
+exports.setGithubSecret = setGithubSecret;

package/dist/cli/src/utils/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACE,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACxE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAlBQ,QAAA,eAAe,mBAkBvB"}

package/dist/cli/src/vault/BitwardenVault.d.ts

@@ -0,0 +1,24 @@
+import type { Config } from "../../../pipeline/src/index.js";
+import type { IO } from "../core/types";
+import type { SecretsVault } from "./types";
+export declare class BitwardenVault implements SecretsVault {
+  private readonly config;
+  /**
+   * whether a locked bitwarden may be unlocked interactively
+   * (false with catenv --vault-mode no-prompt)
+   */
+  private readonly allowPrompt;
+  readonly id: string;
+  private readonly collectionName;
+  constructor(config: Config, options: {
+    collection?: string;
+  },
+  /**
+   * whether a locked bitwarden may be unlocked interactively
+   * (false with catenv --vault-mode no-prompt)
+   */
+  allowPrompt: boolean);
+  private session;
+  readAllSecrets(io: IO | null): Promise<Record<string, string>>;
+  writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
+}

package/dist/cli/src/vault/BitwardenVault.js

@@ -0,0 +1,107 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.BitwardenVault = void 0;
+const pipeline_1 = require("../../../pipeline/src/index.js");
+const yaml_1 = require("yaml");
+const bw_1 = require("./bw");
+const DEFAULT_COLLECTION = "catladder";
+const SECURE_NOTE_TYPE = 2;
+/**
+ * one yaml note per env and component:
+ * `<customerName>/<appName>/<env>/<componentName>/secrets.yml`
+ */
+const itemName = (config, env, componentName) => `${config.customerName}/${config.appName}/${env}/${componentName}/secrets.yml`;
+const itemPrefix = config => `${config.customerName}/${config.appName}/`;
+/**
+ * parses env and componentName back out of an item name
+ */
+const parseItemName = (config, name) => {
+  const match = name.slice(itemPrefix(config).length).match(/^([^/]+)\/([^/]+)\/secrets\.yml$/);
+  return match ? {
+    env: match[1],
+    componentName: match[2]
+  } : null;
+};
+const findCollection = async (session, collectionName) => {
+  const collections = await (0, bw_1.runBwJson)(session, ["list", "collections", "--search", collectionName]);
+  const collection = collections.find(c => c.name === collectionName);
+  if (!collection) {
+    throw new Error(`bitwarden collection '${collectionName}' not found — create it and make sure you have access`);
+  }
+  return collection;
+};
+const encodePayload = payload => Buffer.from(JSON.stringify(payload), "utf-8").toString("base64");
+class BitwardenVault {
+  constructor(config, options,
+  /**
+   * whether a locked bitwarden may be unlocked interactively
+   * (false with catenv --vault-mode no-prompt)
+   */
+  allowPrompt) {
+    var _a;
+    this.config = config;
+    this.allowPrompt = allowPrompt;
+    this.collectionName = (_a = options.collection) !== null && _a !== void 0 ? _a : DEFAULT_COLLECTION;
+    this.id = `bitwarden:${this.collectionName}`;
+  }
+  session(io) {
+    return (0, bw_1.getBwSession)(io, {
+      allowPrompt: this.allowPrompt
+    });
+  }
+  async readAllSecrets(io) {
+    const {
+      config,
+      collectionName
+    } = this;
+    const bwSession = await this.session(io);
+    const collection = await findCollection(bwSession, collectionName);
+    const items = await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id]);
+    const secrets = {};
+    for (const item of items) {
+      const parsed = parseItemName(config, item.name);
+      if (!parsed || !item.notes) {
+        continue;
+      }
+      const values = (0, yaml_1.parse)(item.notes);
+      Object.entries(values !== null && values !== void 0 ? values : {}).forEach(([key, value]) => {
+        secrets[(0, pipeline_1.getSecretVarName)(parsed.env, parsed.componentName, key)] = typeof value === "string" ? value : JSON.stringify(value);
+      });
+    }
+    return secrets;
+  }
+  async writeSecrets(io, env, componentName, secrets) {
+    const {
+      config,
+      collectionName
+    } = this;
+    const bwSession = await this.session(io);
+    const collection = await findCollection(bwSession, collectionName);
+    const name = itemName(config, env, componentName);
+    const existing = (await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id, "--search", name])).find(item => item.name === name);
+    const notes = (0, yaml_1.stringify)(secrets);
+    if (existing) {
+      await (0, bw_1.runBw)(bwSession, ["edit", "item", existing.id, encodePayload({
+        ...existing,
+        notes
+      })]);
+    } else {
+      await (0, bw_1.runBw)(bwSession, ["create", "item", encodePayload({
+        type: SECURE_NOTE_TYPE,
+        secureNote: {
+          type: 0
+        },
+        name,
+        notes,
+        ...(collection.organizationId ? {
+          organizationId: collection.organizationId,
+          collectionIds: [collection.id]
+        } : {})
+      })]);
+    }
+  }
+}
+exports.BitwardenVault = BitwardenVault;

package/dist/cli/src/vault/BitwardenVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BitwardenVault.js","sourceRoot":"","sources":["../../../../src/vault/BitwardenVault.ts"],"names":[],"mappings":";;;AAAA,kDAAuD;AAEvD,+BAAwC;AAExC,6BAAsD;AAGtD,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAW3B;;;GAGG;AACH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,aAAqB,EAAU,EAAE,CAC9E,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,aAAa,cAAc,CAAC;AAEjF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAE,EAAE,CACpC,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;AAE9C;;GAEG;AACH,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,EAAE;IACrD,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;SAChC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAC1B,OAAe,EACf,cAAsB,EACC,EAAE;IACzB,MAAM,WAAW,GAAG,MAAM,IAAA,cAAS,EAAiB,OAAO,EAAE;QAC3D,MAAM;QACN,aAAa;QACb,UAAU;QACV,cAAc;KACf,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,yBAAyB,cAAc,uDAAuD,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,EAAE,CACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEnE,MAAa,cAAc;IAKzB,YACmB,MAAc,EAC/B,OAAgC;IAChC;;;OAGG;IACc,WAAoB;;QANpB,WAAM,GAAN,MAAM,CAAQ;QAMd,gBAAW,GAAX,WAAW,CAAS;QAErC,IAAI,CAAC,cAAc,GAAG,MAAA,OAAO,CAAC,UAAU,mCAAI,kBAAkB,CAAC;QAC/D,IAAI,CAAC,EAAE,GAAG,aAAa,IAAI,CAAC,cAAc,EAAE,CAAC;IAC/C,CAAC;IAEO,OAAO,CAAC,EAAa;QAC3B,OAAO,IAAA,iBAAY,EAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAa;QAChC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACjD,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;SACd,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAA,YAAK,EAAC,IAAI,CAAC,KAAK,CAAmC,CAAC;YACnE,MAAM,CAAC,OAAO,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBACpD,OAAO,CAAC,IAAA,2BAAgB,EAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;oBAC9D,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,OAAgC;QAEhC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAElD,MAAM,QAAQ,GAAG,CACf,MAAM,IAAA,cAAS,EAAW,SAAS,EAAE;YACnC,MAAM;YACN,OAAO;YACP,gBAAgB;YAChB,UAAU,CAAC,EAAE;YACb,UAAU;YACV,IAAI;SACL,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAErC,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,CAAC;QAEjC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAA,UAAK,EAAC,SAAS,EAAE;gBACrB,MAAM;gBACN,MAAM;gBACN,QAAQ,CAAC,EAAE;gBACX,aAAa,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,UAAK,EAAC,SAAS,EAAE;gBACrB,QAAQ;gBACR,MAAM;gBACN,aAAa,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;oBACvB,IAAI;oBACJ,KAAK;oBACL,GAAG,CAAC,UAAU,CAAC,cAAc;wBAC3B,CAAC,CAAC;4BACE,cAAc,EAAE,UAAU,CAAC,cAAc;4BACzC,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;yBAC/B;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;aACH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAlGD,wCAkGC"}

package/dist/cli/src/vault/GitlabVault.d.ts

@@ -0,0 +1,11 @@
+import type { IO } from "../core/types";
+import type { SecretsVault } from "./types";
+/**
+ * the legacy (and default) vault: the gitlab project variables double
+ * as the secret store
+ */
+export declare class GitlabVault implements SecretsVault {
+  readonly id = "gitlab";
+  readAllSecrets(io: IO | null): Promise<Record<string, string>>;
+  writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
+}

package/dist/cli/src/vault/GitlabVault.js

@@ -0,0 +1,24 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.GitlabVault = void 0;
+const gitlab_1 = require("../utils/gitlab");
+/**
+ * the legacy (and default) vault: the gitlab project variables double
+ * as the secret store
+ */
+class GitlabVault {
+  constructor() {
+    this.id = "gitlab";
+  }
+  async readAllSecrets(io) {
+    const variables = await (0, gitlab_1.getAllVariables)(io);
+    return Object.fromEntries(variables.map(v => [v.key, v.value]));
+  }
+  async writeSecrets(io, env, componentName, secrets) {
+    await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+  }
+}
+exports.GitlabVault = GitlabVault;

package/dist/cli/src/vault/GitlabVault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GitlabVault.js","sourceRoot":"","sources":["../../../../src/vault/GitlabVault.ts"],"names":[],"mappings":";;;AACA,4CAAsE;AAGtE;;;GAGG;AACH,MAAa,WAAW;IAAxB;QACW,OAAE,GAAG,QAAQ,CAAC;IAezB,CAAC;IAbC,KAAK,CAAC,cAAc,CAAC,EAAa;QAChC,MAAM,SAAS,GAAG,MAAM,IAAA,wBAAe,EAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,EAAM,EACN,GAAW,EACX,aAAqB,EACrB,OAAgC;QAEhC,MAAM,IAAA,2BAAkB,EAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC5D,CAAC;CACF;AAhBD,kCAgBC"}

package/dist/cli/src/vault/VaultManager.d.ts

@@ -0,0 +1,43 @@
+import type { Config } from "../../../pipeline/src/index.js";
+import type { IO } from "../core/types";
+import type { SecretsMode, SecretsVault } from "./types";
+export type VaultManagerOptions = {
+  mode?: SecretsMode;
+  /**
+   * default IO for vault interactions (logging, unlock prompts).
+   * Method-level io takes precedence.
+   */
+  io?: IO | null;
+};
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+export declare class VaultManager {
+  private readonly config;
+  readonly mode: SecretsMode;
+  readonly vault: SecretsVault;
+  private readonly io;
+  /** refresh mode bypasses the cache only once per manager */
+  private refreshed;
+  constructor(config: Config, options?: VaultManagerOptions);
+  private createVault;
+  /**
+   * the vault secrets, served from the local cache when it contains
+   * all required names; otherwise (depending on the mode) refreshed
+   * from the vault. Only the "local" env is (re-)cached.
+   */
+  readSecrets(requiredNames: string[], io?: IO | null): Promise<Record<string, string>>;
+  /**
+   * writes secrets of one env/component to the vault and updates the
+   * local cache (write-through, "local" env only)
+   */
+  writeSecrets(env: string, componentName: string, secrets: Record<string, unknown>, io?: IO | null): Promise<void>;
+  /**
+   * the subset of the vault secrets that may be cached: the declared
+   * secrets of the "local" env, per component, as a hierarchy
+   */
+  private cacheableSubset;
+  private declaredSecretKeys;
+}