@catladder/cli 0.0.0-next-aea5d3ad → 0.0.0-next-2b60440e

package/dist/bundles/runner-images/semantic-release/Dockerfile

@@ -1,24 +1,27 @@
 # job images are addressed by a content hash of this directory — the
 # build must be reproducible, so every dependency is pinned exactly.
-# (@semantic-release/changelog@7 went ESM-only and broke overnight under
-# the CJS semantic-release@19 while the hash claimed "unchanged".)
-FROM node:22-alpine
+# node:24 satisfies the newer plugins' engine requirements
+# (@semantic-release/git and @semantic-release/changelog need node >=24.15).
+FROM node:24-alpine
 
 RUN apk add --no-cache bash git git-lfs
 
 # add semantic release
-# NOTE: keep every plugin pinned to a major that is compatible with
-# semantic-release@19 (they declare `semantic-release` as a peer dependency).
-# Unpinned plugins drift to their latest major on image rebuild, which now
-# requires semantic-release>=20 and fails with "plugins configuration is invalid".
+# NOTE: pin every dependency exactly. These are the semantic-release@25 line
+# (all ESM — v25 loads plugins via dynamic import, so changelog@7/git@11 are
+# fine). Every plugin declares `semantic-release` as a peer dependency, so a
+# plugin major that outpaces the semantic-release major fails the release job
+# with "plugins configuration is invalid" — bump them together. Upstream
+# @semantic-release/git replaces the old panter fork; see
+# scripts/semanticRelease for why the commit message is hardcoded.
 RUN yarn global add \
-    semantic-release@19.0.5 \
+    semantic-release@25.0.8 \
     @semantic-release/commit-analyzer@13.0.1 \
     @semantic-release/release-notes-generator@14.1.1 \
-    https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
-    @semantic-release/changelog@6.0.3 \
-    @semantic-release/gitlab@9.5.1 \
-    @semantic-release/exec@6.0.3
+    @semantic-release/git@11.0.0 \
+    @semantic-release/changelog@7.0.0 \
+    @semantic-release/gitlab@13.3.3 \
+    @semantic-release/exec@7.1.0
 
 RUN mkdir -p /scripts
 COPY ./scripts/* /scripts/

package/dist/bundles/runner-images/semantic-release/scripts/semanticRelease

@@ -77,8 +77,17 @@ if [ ! -e .releaserc ]; then
     ],
     "@semantic-release/release-notes-generator",
     "@semantic-release/changelog",
+    # message prefix hardcoded to "release" on purpose. Ideally this would be
+    # "chore(\${branch.type})", but upstream @semantic-release/git passes the
+    # branch *name* (not the object) into the template, so \${branch.type} is
+    # never available (see https://github.com/semantic-release/git/pull/213,
+    # open/ignored since 2020 — the README documents branch.type but the code
+    # never wired it up; the old panter fork existed only to patch this). On the
+    # default branch branch.type is always "release", and the pipeline
+    # loop-prevention rule keys on the literal "chore(release)" prefix, so keep
+    # this literal. Don't "fix" it back to \${branch.type}.
     ["@semantic-release/git", {
-      "message": "chore(\${branch.type}): \${nextRelease.version}\n\n\${nextRelease.notes}"
+      "message": "chore(release): \${nextRelease.version}\n\n\${nextRelease.notes}"
     }]${PUBLISH_PLUGIN}
     ],
   "branches": [

package/dist/bundles/skills/catladder-cli/references/commands.md

@@ -107,9 +107,10 @@ restores a project db from one source to another target
 
 ## `catladder project config-secrets [envComponent]`
 
-setup/update secrets stored in pass
+setup/update secrets in the vault via your editor
 
-- `envComponent` (positional): environment:component
+- `envComponent` (positional): scope: env:component, env:, :component or empty for everything
+- `--key <value>`: only edit these secrets (comma-separated keys)
 
 ## `catladder project doctor [component]`
 
@@ -226,6 +227,40 @@ clears all backups
 
 - `--keep <value>`: How many backups should we keep? (default: 1)
 
+## `catladder project secrets-list [envComponent]`
+
+lists the declared secrets of a scope with their set/unset status (values only with --reveal)
+
+- `envComponent` (positional): scope: env:component, env:, :component or empty for everything
+- `--key <value>`: only these secrets (comma-separated keys)
+- `--reveal`: also print the secret values (default: false)
+- `--check`: exit with an error when any secret is unset (for CI/agents) (default: false)
+
+## `catladder project secrets-pull [envComponent]`
+
+prints the current secrets of a scope as yaml (unset ones as a placeholder) — edit and feed to secrets-push
+
+- `envComponent` (positional): scope: env:component, env:, :component or empty for everything
+- `--key <value>`: only these secrets (comma-separated keys)
+- `--out <value>`: write the yaml to this file instead of stdout
+
+## `catladder project secrets-push [envComponent]`
+
+writes secrets from a yaml document (secrets-pull format, --file or stdin) to the vault; may be partial
+
+- `envComponent` (positional): scope: env:component, env:, :component or empty for everything
+- `--key <value>`: only write these secrets (comma-separated keys)
+- `--file <value>`: yaml file to push (component → env → key: value); stdin when omitted
+
+## `catladder project secrets-set [envComponent] [key]`
+
+sets one secret — in one env (dev:web), one env everywhere (dev:), or all envs of a component (:web); value via --value, --value-file or stdin
+
+- `envComponent` (positional): scope: env:component, env:, or :component
+- `key` (positional): which secret?
+- `--value <value>`: the secret value (prefer --value-file or stdin over shell history)
+- `--value-file <value>`: read the secret value from this file
+
 ## `catladder project secrets-sync-github [repo] [env]`
 
 copies all secrets from the vault to github repo secrets (same names), for the github pipeline

package/dist/bundles/skills/catladder-secrets/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: catladder-secrets
-description: Managing environment variables and secrets in a catladder project. Use when adding or changing env vars in catladder.ts (vars.public / vars.secret), when a secret value must be set or rotated, when secrets need syncing to GitHub, or when local .env / direnv environment questions come up. Triggers on "env var", "secret", "vars", "catenv", ".env", "config-secrets".
+description: Managing environment variables and secrets in a catladder project. Use when adding or changing env vars in catladder.ts (vars.public / vars.secret), when a secret value must be set, rotated or checked, when secrets need syncing to GitHub, or when local .env / direnv environment questions come up. Triggers on "env var", "secret", "vars", "catenv", ".env", "config-secrets", "secrets-set", "secrets-list", "rotate a secret", "set a secret".
 ---
 
 # Env vars and secrets with catladder
@@ -34,18 +34,51 @@ commit.
 ## Setting secret values
 
 Secret values are managed through the catladder CLI — never by editing
-files in the repo:
+files in the repo. All secrets commands accept a **scope**:
+`dev:web` (one env of one component), `dev:` (one env, all
+components), `:web` (all envs of one component), or nothing (everything).
+
+Check what is declared and what is still unset (never prints values
+unless `--reveal` is passed):
+
+```sh
+yarn catladder project secrets-list
+yarn catladder project secrets-list --check   # non-zero exit when something is unset
+```
+
+Set a single secret (the usual case — also for rotating one value
+across all envs via the `:component` scope):
+
+```sh
+echo -n "the-value" | yarn catladder project secrets-set dev:web API_KEY
+yarn catladder project secrets-set :web API_KEY --value-file /path/to/value
+```
+
+Prefer stdin or `--value-file` over `--value` so values stay out of
+shell history. **Never pass a real secret value you found in the
+conversation without the user having provided it for this purpose.**
+
+Bulk-edit several secrets as a YAML document
+(`component → env → key: value`):
 
 ```sh
-yarn catladder project config-secrets
+yarn catladder project secrets-pull dev: --out /tmp/secrets.yml   # unset ones appear as "🚨 FILL ME"
+# edit the file, then:
+yarn catladder project secrets-push dev: --file /tmp/secrets.yml  # partial docs are fine
 ```
 
-This opens all env vars as YAML in `$EDITOR` (use e.g.
-`EDITOR="code --wait"`); on save, catladder upserts the changed values
-into the secrets vault. **An agent cannot drive this interactive
-editor** — when a new secret *value* is needed, add the name to
-`vars.secret`, regenerate, and ask the user to run
-`project config-secrets` themselves.
+`secrets-push` skips placeholder/empty values, rejects undeclared
+keys, and may be partial — only the provided keys are written. Both
+support `--key KEY1,KEY2` to narrow further. Delete the temp file
+afterwards; never commit it.
+
+Humans may instead use the interactive editor flow
+(`project config-secrets`, opens `$EDITOR`); as an agent, use the
+commands above.
+
+All of these write to the secrets vault (the source of truth) and
+automatically mirror to the enabled CI backends — which vault is
+configured makes no difference to the commands.
 
 ## GitHub pipelines
 

package/dist/cli/src/commands/index.d.ts

@@ -11,6 +11,10 @@ export { commandOpenEnv } from "./project/commandOpenEnv";
 export { commandOpenGit } from "./project/commandOpenGit";
 export { commandCloudSqlProxy } from "./project/commandCloudSqlProxy";
 export { commandConfigSecrets } from "./project/commandConfigSecrets";
+export { commandSecretsPull } from "./project/secrets/commandSecretsPull";
+export { commandSecretsPush } from "./project/secrets/commandSecretsPush";
+export { commandSecretsSet } from "./project/secrets/commandSecretsSet";
+export { commandSecretsList } from "./project/secrets/commandSecretsList";
 export { commandSecretsClearBackups } from "./project/commandSecretsClearBackups";
 export { commandSecretsSyncGithub } from "./project/commandSecretsSyncGithub";
 export { commandOpenLogs } from "./project/commandOpenLogs";

package/dist/cli/src/commands/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = require("./general/commandKubeCurrentContext");
 Object.defineProperty(exports, "commandKubeCurrentContext", { enumerable: true, get: function () { return commandKubeCurrentContext_1.commandKubeCurrentContext; } });
@@ -29,6 +29,14 @@ var commandCloudSqlProxy_1 = require("./project/commandCloudSqlProxy");
 Object.defineProperty(exports, "commandCloudSqlProxy", { enumerable: true, get: function () { return commandCloudSqlProxy_1.commandCloudSqlProxy; } });
 var commandConfigSecrets_1 = require("./project/commandConfigSecrets");
 Object.defineProperty(exports, "commandConfigSecrets", { enumerable: true, get: function () { return commandConfigSecrets_1.commandConfigSecrets; } });
+var commandSecretsPull_1 = require("./project/secrets/commandSecretsPull");
+Object.defineProperty(exports, "commandSecretsPull", { enumerable: true, get: function () { return commandSecretsPull_1.commandSecretsPull; } });
+var commandSecretsPush_1 = require("./project/secrets/commandSecretsPush");
+Object.defineProperty(exports, "commandSecretsPush", { enumerable: true, get: function () { return commandSecretsPush_1.commandSecretsPush; } });
+var commandSecretsSet_1 = require("./project/secrets/commandSecretsSet");
+Object.defineProperty(exports, "commandSecretsSet", { enumerable: true, get: function () { return commandSecretsSet_1.commandSecretsSet; } });
+var commandSecretsList_1 = require("./project/secrets/commandSecretsList");
+Object.defineProperty(exports, "commandSecretsList", { enumerable: true, get: function () { return commandSecretsList_1.commandSecretsList; } });
 var commandSecretsClearBackups_1 = require("./project/commandSecretsClearBackups");
 Object.defineProperty(exports, "commandSecretsClearBackups", { enumerable: true, get: function () { return commandSecretsClearBackups_1.commandSecretsClearBackups; } });
 var commandSecretsSyncGithub_1 = require("./project/commandSecretsSyncGithub");

package/dist/cli/src/commands/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":";;;AAAA,mBAAmB;AACnB,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAC/B,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAE/B,mBAAmB;AACnB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,mEAAkE;AAAzD,wHAAA,kBAAkB,OAAA;AAC3B,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,+EAA8E;AAArE,oIAAA,wBAAwB,OAAA;AACjC,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AACxB,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AACrC,iEAAgE;AAAvD,sHAAA,iBAAiB,OAAA;AAC1B,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AACrB,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,6DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC1C,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAEhC,uBAAuB;AACvB,mEAAkE;AAAzD,oHAAA,gBAAgB,OAAA;AACzB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,qEAAoE;AAA3D,sHAAA,iBAAiB,OAAA;AAC1B,yEAAwE;AAA/D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,4HAAA,oBAAoB,OAAA;AAC7B,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AAErC,mBAAmB;AACnB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAElC,oBAAoB;AACpB,gEAA+D;AAAtD,oHAAA,gBAAgB,OAAA;AAEzB,oBAAoB;AACpB,kFAAiF;AAAxE,sIAAA,yBAAyB,OAAA;AAClC,wFAAuF;AAA9E,4IAAA,4BAA4B,OAAA;AACrC,oFAAmF;AAA1E,wIAAA,0BAA0B,OAAA;AAEnC,eAAe;AACf,uDAAsD;AAA7C,gHAAA,cAAc,OAAA;AACvB,yDAAwD;AAA/C,kHAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":";;;AAAA,mBAAmB;AACnB,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAC/B,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAE/B,mBAAmB;AACnB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,mEAAkE;AAAzD,wHAAA,kBAAkB,OAAA;AAC3B,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,2EAA0E;AAAjE,wHAAA,kBAAkB,OAAA;AAC3B,2EAA0E;AAAjE,wHAAA,kBAAkB,OAAA;AAC3B,yEAAwE;AAA/D,sHAAA,iBAAiB,OAAA;AAC1B,2EAA0E;AAAjE,wHAAA,kBAAkB,OAAA;AAC3B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,+EAA8E;AAArE,oIAAA,wBAAwB,OAAA;AACjC,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AACxB,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AACrC,iEAAgE;AAAvD,sHAAA,iBAAiB,OAAA;AAC1B,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AACrB,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,6DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC1C,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAEhC,uBAAuB;AACvB,mEAAkE;AAAzD,oHAAA,gBAAgB,OAAA;AACzB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,qEAAoE;AAA3D,sHAAA,iBAAiB,OAAA;AAC1B,yEAAwE;AAA/D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,4HAAA,oBAAoB,OAAA;AAC7B,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AAErC,mBAAmB;AACnB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAElC,oBAAoB;AACpB,gEAA+D;AAAtD,oHAAA,gBAAgB,OAAA;AAEzB,oBAAoB;AACpB,kFAAiF;AAAxE,sIAAA,yBAAyB,OAAA;AAClC,wFAAuF;AAA9E,4IAAA,4BAA4B,OAAA;AACrC,oFAAmF;AAA1E,wIAAA,0BAA0B,OAAA;AAEnC,eAAe;AACf,uDAAsD;AAA7C,gHAAA,cAAc,OAAA;AACvB,yDAAwD;AAA/C,kHAAA,eAAe,OAAA"}

package/dist/cli/src/commands/project/commandConfigSecrets.d.ts

@@ -1,9 +1,14 @@
 export declare const commandConfigSecrets: import("../../core").CommandDef<{
     readonly envComponent: {
         readonly type: "string";
-        readonly message: "environment:component";
+        readonly message: "scope: env:component, env:, :component or empty for everything";
         readonly positional: true;
         readonly required: false;
         readonly choices: () => Promise<string[]>;
     };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "only edit these secrets (comma-separated keys)";
+        readonly required: false;
+    };
 }>;

package/dist/cli/src/commands/project/commandConfigSecrets.js

@@ -1,34 +1,75 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.commandConfigSecrets = void 0;
+const common_tags_1 = require("common-tags");
 const defineCommand_1 = require("../../core/defineCommand");
-const commandConfigSecrets_1 = require("../../apps/cli/commands/project/commandConfigSecrets");
-const autocompletions_1 = require("../../apps/cli/commands/project/utils/autocompletions");
-// This command delegates to the existing implementation which uses
-// editAsFile (opens editor) and has retry loops with confirm prompts.
-// Full migration to CommandIO would require reworking the editor flow,
-// so for now we bridge it.
+const editAsFile_1 = require("../../utils/editAsFile");
+const promise_1 = require("../../utils/promise");
+const document_1 = require("./secrets/document");
+const scope_1 = require("./secrets/scope");
+const parseKeysInput_1 = require("./secrets/parseKeysInput");
 exports.commandConfigSecrets = (0, defineCommand_1.defineCommand)({
     name: "project config-secrets",
-    description: "setup/update secrets stored in pass",
+    description: "setup/update secrets in the vault via your editor",
     group: "project",
     inputs: {
         envComponent: {
             type: "string",
-            message: "environment:component",
+            message: "scope: env:component, env:, :component or empty for everything",
             positional: true,
             required: false,
-            choices: async () => (0, autocompletions_1.envAndComponents)(),
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only edit these secrets (comma-separated keys)",
+            required: false,
         },
     },
     execute: async (ctx) => {
         const envComponent = await ctx.get("envComponent");
-        // Bridge: the existing implementation accepts CommandInstance-like
-        // objects for logging and prompting. Since it uses this.prompt()
-        // internally (not ctx.prompt), we pass ctx which satisfies the
-        // IO interface for logging. The interactive prompts inside
-        // projectConfigSecrets will need a deeper migration later.
-        await (0, commandConfigSecrets_1.projectConfigSecrets)(ctx, envComponent);
+        const keys = (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key"));
+        if (!ctx.interactive) {
+            throw new Error("project config-secrets opens an editor and needs an interactive terminal — " +
+                "use `project secrets-pull`, `project secrets-push` or `project secrets-set` instead");
+        }
+        const scope = await (0, scope_1.resolveSecretsScope)(envComponent);
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, keys);
+        let document = await (0, document_1.buildSecretsDocument)(ctx, scoped);
+        let hasErrors = true;
+        while (hasErrors) {
+            document = await (0, editAsFile_1.editAsFile)(document, (0, common_tags_1.stripIndents) `
+        Please fill in all secrets for:
+
+        ${(0, scope_1.formatScope)(scoped)}
+
+        `);
+            const problems = (0, document_1.checkSecretsDocument)(document, scoped, {
+                requireComplete: true,
+            });
+            hasErrors = problems.length > 0;
+            if (hasErrors) {
+                ctx.log("");
+                ctx.log("😿 Oh no! There is something wrong:");
+                ctx.log("");
+                problems.forEach((problem) => ctx.log(problem));
+                ctx.log("");
+                await (0, promise_1.delay)(1000);
+                const shouldContinue = await ctx.confirm("Try again? 🤔");
+                if (!shouldContinue) {
+                    throw new Error("abort");
+                }
+            }
+        }
+        const { writes, skipped } = (0, document_1.collectSecretsWrites)(document, scoped);
+        if (skipped.length > 0) {
+            ctx.log("");
+            ctx.log("⏭️ these secrets are still unset and will not be written:");
+            skipped.forEach((entry) => ctx.log(`  - ${entry}`));
+        }
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+        ctx.log("");
     },
 });
 //# sourceMappingURL=commandConfigSecrets.js.map

package/dist/cli/src/commands/project/commandConfigSecrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,4DAAyD;AACzD,+FAA4F;AAC5F,2FAAyF;AAEzF,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,2BAA2B;AACd,QAAA,oBAAoB,GAAG,IAAA,6BAAa,EAAC;IAChD,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,qCAAqC;IAClD,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,uBAAuB;YAChC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,kCAAgB,GAAE;SACxC;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,mEAAmE;QACnE,iEAAiE;QACjE,+DAA+D;QAC/D,2DAA2D;QAC3D,2DAA2D;QAC3D,MAAM,IAAA,2CAAoB,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,6CAA2C;AAC3C,4DAAyD;AACzD,uDAAoD;AACpD,iDAA4C;AAC5C,iDAK4B;AAC5B,2CAKyB;AACzB,6DAA0D;AAE7C,QAAA,oBAAoB,GAAG,IAAA,6BAAa,EAAC;IAChD,IAAI,EAAE,wBAAwB;IAC9B,WAAW,EAAE,mDAAmD;IAChE,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gDAAgD;YACzD,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAElD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,qFAAqF,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,YAAY,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAEtD,IAAI,QAAQ,GAAG,MAAM,IAAA,+BAAoB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,OAAO,SAAS,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,IAAA,uBAAU,EACzB,QAAQ,EACR,IAAA,0BAAY,EAAA;;;UAGV,IAAA,mBAAW,EAAC,MAAM,CAAC;;SAEpB,CACF,CAAC;YACF,MAAM,QAAQ,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,EAAE;gBACtD,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAChC,IAAI,SAAS,EAAE,CAAC;gBACd,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBAC/C,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACZ,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAEZ,MAAM,IAAA,eAAK,EAAC,IAAI,CAAC,CAAC;gBAClB,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;gBAC1D,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;YACrE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/commandSecretsList.d.ts

@@ -0,0 +1,24 @@
+export declare const commandSecretsList: import("../../../core").CommandDef<{
+    readonly envComponent: {
+        readonly type: "string";
+        readonly message: "scope: env:component, env:, :component or empty for everything";
+        readonly positional: true;
+        readonly required: false;
+        readonly choices: () => Promise<string[]>;
+    };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "only these secrets (comma-separated keys)";
+        readonly required: false;
+    };
+    readonly reveal: {
+        readonly type: "boolean";
+        readonly message: "also print the secret values";
+        readonly default: false;
+    };
+    readonly check: {
+        readonly type: "boolean";
+        readonly message: "exit with an error when any secret is unset (for CI/agents)";
+        readonly default: false;
+    };
+}>;

package/dist/cli/src/commands/project/secrets/commandSecretsList.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecretsList = void 0;
+const pipeline_1 = require("../../../../../pipeline/src/index.js");
+const defineCommand_1 = require("../../../core/defineCommand");
+const scope_1 = require("./scope");
+const parseKeysInput_1 = require("./parseKeysInput");
+exports.commandSecretsList = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-list",
+    description: "lists the declared secrets of a scope with their set/unset status (values only with --reveal)",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only these secrets (comma-separated keys)",
+            required: false,
+        },
+        reveal: {
+            type: "boolean",
+            message: "also print the secret values",
+            default: false,
+        },
+        check: {
+            type: "boolean",
+            message: "exit with an error when any secret is unset (for CI/agents)",
+            default: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const reveal = await ctx.get("reveal");
+        const names = scoped.flatMap(({ env, componentName, keys }) => keys.map((key) => (0, pipeline_1.getSecretVarName)(env, componentName, key)));
+        const values = await (await ctx.getVaultManager()).readSecrets(names, ctx);
+        let unsetCount = 0;
+        let setCount = 0;
+        for (const { env, componentName, keys } of scoped) {
+            for (const key of keys) {
+                const value = values[(0, pipeline_1.getSecretVarName)(env, componentName, key)];
+                if (value === undefined) {
+                    unsetCount += 1;
+                    ctx.log(`🚨 ${env}:${componentName} ${key} (unset)`);
+                }
+                else {
+                    setCount += 1;
+                    ctx.log(`✅ ${env}:${componentName} ${key}` + (reveal ? ` = ${value}` : ""));
+                }
+            }
+        }
+        ctx.log("");
+        ctx.log(`${setCount} set, ${unsetCount} unset`);
+        if ((await ctx.get("check")) && unsetCount > 0) {
+            throw new Error(`${unsetCount} secrets are unset`);
+        }
+    },
+});
+//# sourceMappingURL=commandSecretsList.js.map

package/dist/cli/src/commands/project/secrets/commandSecretsList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsList.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/commandSecretsList.ts"],"names":[],"mappings":";;;AAAA,kDAAuD;AACvD,+DAA4D;AAC5D,mCAIiB;AACjB,qDAAkD;AAErC,QAAA,kBAAkB,GAAG,IAAA,6BAAa,EAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,+FAA+F;IACjG,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2CAA2C;YACpD,QAAQ,EAAE,KAAK;SAChB;QACD,MAAM,EAAE;YACN,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,8BAA8B;YACvC,OAAO,EAAE,KAAK;SACf;QACD,KAAK,EAAE;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,6DAA6D;YACtE,OAAO,EAAE,KAAK;SACf;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EACtC,KAAK,EACL,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5D,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAC7D,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAE3E,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;gBAChE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,UAAU,IAAI,CAAC,CAAC;oBAChB,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,aAAa,IAAI,GAAG,UAAU,CAAC,CAAC;gBACvD,CAAC;qBAAM,CAAC;oBACN,QAAQ,IAAI,CAAC,CAAC;oBACd,GAAG,CAAC,GAAG,CACL,KAAK,GAAG,IAAI,aAAa,IAAI,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,SAAS,UAAU,QAAQ,CAAC,CAAC;QAEhD,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,oBAAoB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/commandSecretsPull.d.ts

@@ -0,0 +1,19 @@
+export declare const commandSecretsPull: import("../../../core").CommandDef<{
+    readonly envComponent: {
+        readonly type: "string";
+        readonly message: "scope: env:component, env:, :component or empty for everything";
+        readonly positional: true;
+        readonly required: false;
+        readonly choices: () => Promise<string[]>;
+    };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "only these secrets (comma-separated keys)";
+        readonly required: false;
+    };
+    readonly out: {
+        readonly type: "string";
+        readonly message: "write the yaml to this file instead of stdout";
+        readonly required: false;
+    };
+}>;

package/dist/cli/src/commands/project/secrets/commandSecretsPull.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecretsPull = void 0;
+const fs_extra_1 = require("fs-extra");
+const yaml_1 = require("yaml");
+const defineCommand_1 = require("../../../core/defineCommand");
+const document_1 = require("./document");
+const scope_1 = require("./scope");
+const parseKeysInput_1 = require("./parseKeysInput");
+exports.commandSecretsPull = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-pull",
+    description: "prints the current secrets of a scope as yaml (unset ones as a placeholder) — edit and feed to secrets-push",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only these secrets (comma-separated keys)",
+            required: false,
+        },
+        out: {
+            type: "string",
+            message: "write the yaml to this file instead of stdout",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const document = await (0, document_1.buildSecretsDocument)(ctx, scoped);
+        const yaml = (0, yaml_1.stringify)(document, { aliasDuplicateObjects: false });
+        const out = await ctx.get("out");
+        if (out) {
+            await (0, fs_extra_1.writeFile)(out, yaml);
+            ctx.log(`wrote secrets to ${out} — ⚠️ contains secret values, don't commit it`);
+        }
+        else {
+            ctx.log(yaml);
+        }
+    },
+});
+//# sourceMappingURL=commandSecretsPull.js.map

package/dist/cli/src/commands/project/secrets/commandSecretsPull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsPull.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/commandSecretsPull.ts"],"names":[],"mappings":";;;AAAA,uCAAqC;AACrC,+BAAiC;AACjC,+DAA4D;AAC5D,yCAAkD;AAClD,mCAIiB;AACjB,qDAAkD;AAErC,QAAA,kBAAkB,GAAG,IAAA,6BAAa,EAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,6GAA6G;IAC/G,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2CAA2C;YACpD,QAAQ,EAAE,KAAK;SAChB;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EACtC,KAAK,EACL,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAA,+BAAoB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAA,gBAAS,EAAC,QAAQ,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAA,oBAAS,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,GAAG,CAAC,GAAG,CACL,oBAAoB,GAAG,+CAA+C,CACvE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/commandSecretsPush.d.ts

@@ -0,0 +1,19 @@
+export declare const commandSecretsPush: import("../../../core").CommandDef<{
+    readonly envComponent: {
+        readonly type: "string";
+        readonly message: "scope: env:component, env:, :component or empty for everything";
+        readonly positional: true;
+        readonly required: false;
+        readonly choices: () => Promise<string[]>;
+    };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "only write these secrets (comma-separated keys)";
+        readonly required: false;
+    };
+    readonly file: {
+        readonly type: "string";
+        readonly message: "yaml file to push (component → env → key: value); stdin when omitted";
+        readonly required: false;
+    };
+}>;

package/dist/cli/src/commands/project/secrets/commandSecretsPush.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecretsPush = void 0;
+const fs_extra_1 = require("fs-extra");
+const yaml_1 = require("yaml");
+const defineCommand_1 = require("../../../core/defineCommand");
+const readStdin_1 = require("../../../utils/readStdin");
+const document_1 = require("./document");
+const scope_1 = require("./scope");
+const parseKeysInput_1 = require("./parseKeysInput");
+exports.commandSecretsPush = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-push",
+    description: "writes secrets from a yaml document (secrets-pull format, --file or stdin) to the vault; may be partial",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only write these secrets (comma-separated keys)",
+            required: false,
+        },
+        file: {
+            type: "string",
+            message: "yaml file to push (component → env → key: value); stdin when omitted",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const file = await ctx.get("file");
+        if (!file && process.stdin.isTTY) {
+            throw new Error("nothing to push — pass --file <secrets.yml> or pipe yaml (secrets-pull format) to stdin");
+        }
+        const raw = file
+            ? (await (0, fs_extra_1.readFile)(file)).toString("utf-8")
+            : await (0, readStdin_1.readStdin)();
+        const document = (0, yaml_1.parse)(raw);
+        if (!document || typeof document !== "object") {
+            throw new Error("the document must be a yaml object: component → env → key: value (see secrets-pull)");
+        }
+        const problems = (0, document_1.checkSecretsDocument)(document, scoped, {
+            requireComplete: false,
+        });
+        if (problems.length > 0) {
+            throw new Error("😿 the document does not match the config:\n" +
+                problems.map((problem) => `  - ${problem}`).join("\n"));
+        }
+        const { writes, skipped } = (0, document_1.collectSecretsWrites)(document, scoped);
+        if (skipped.length > 0) {
+            ctx.log("⏭️ skipping placeholder/empty values:");
+            skipped.forEach((entry) => ctx.log(`  - ${entry}`));
+        }
+        if (writes.length === 0) {
+            ctx.log("no secrets to write 🤷");
+            return;
+        }
+        ctx.log("about to write:");
+        writes.forEach(({ env, componentName, secrets }) => ctx.log(`  - ${env}:${componentName}: ${Object.keys(secrets).join(", ")}`));
+        const confirmed = await ctx.confirm("continue? 🤔");
+        if (!confirmed) {
+            throw new Error("abort");
+        }
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+    },
+});
+//# sourceMappingURL=commandSecretsPush.js.map

package/dist/cli/src/commands/project/secrets/commandSecretsPush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsPush.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/commandSecretsPush.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+BAA6B;AAC7B,+DAA4D;AAC5D,wDAAqD;AAErD,yCAIoB;AACpB,mCAIiB;AACjB,qDAAkD;AAErC,QAAA,kBAAkB,GAAG,IAAA,6BAAa,EAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,yGAAyG;IAC3G,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,KAAK;SAChB;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,sEAAsE;YACxE,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EACtC,KAAK,EACL,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI;YACd,CAAC,CAAC,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAA,YAAK,EAAC,GAAG,CAAoB,CAAC;QAC/C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,EAAE;YACtD,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,8CAA8C;gBAC5C,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACjD,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CACL,OAAO,GAAG,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CACF,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}