@catladder/cli 0.0.0-next-aea5d3ad → 0.0.0-next-2b60440e

package/dist/cli/src/commands/project/secrets/commandSecretsSet.d.ts

@@ -0,0 +1,24 @@
+export declare const commandSecretsSet: import("../../../core/types").CommandDef<{
+    readonly envComponent: {
+        readonly type: "string";
+        readonly message: "scope: env:component, env:, or :component";
+        readonly positional: true;
+        readonly choices: () => Promise<string[]>;
+    };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "which secret?";
+        readonly positional: true;
+        readonly choices: (ctx: any) => Promise<string[]>;
+    };
+    readonly value: {
+        readonly type: "string";
+        readonly message: "the secret value (prefer --value-file or stdin over shell history)";
+        readonly required: false;
+    };
+    readonly valueFile: {
+        readonly type: "string";
+        readonly message: "read the secret value from this file";
+        readonly required: false;
+    };
+}>;

package/dist/cli/src/commands/project/secrets/commandSecretsSet.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecretsSet = void 0;
+const fs_extra_1 = require("fs-extra");
+const defineCommand_1 = require("../../../core/defineCommand");
+const readStdin_1 = require("../../../utils/readStdin");
+const document_1 = require("./document");
+const scope_1 = require("./scope");
+const resolveValue = async (io, value, valueFile) => {
+    if (valueFile) {
+        // a trailing newline is almost never part of the secret
+        return (await (0, fs_extra_1.readFile)(valueFile)).toString("utf-8").replace(/\n$/, "");
+    }
+    if (value !== undefined) {
+        return value;
+    }
+    if (!process.stdin.isTTY) {
+        return (await (0, readStdin_1.readStdin)()).replace(/\n$/, "");
+    }
+    return io.promptDirect({
+        name: "value",
+        type: "string",
+        message: "value",
+    });
+};
+exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-set",
+    description: "sets one secret — in one env (dev:web), one env everywhere (dev:), or all envs of a component (:web); value via --value, --value-file or stdin",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, or :component",
+            positional: true,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "which secret?",
+            positional: true,
+            choices: async (ctx) => {
+                const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+                const scoped = await (0, scope_1.getScopedSecretKeys)(scope);
+                return [...new Set(scoped.flatMap(({ keys }) => keys))];
+            },
+        },
+        value: {
+            type: "string",
+            message: "the secret value (prefer --value-file or stdin over shell history)",
+            required: false,
+        },
+        valueFile: {
+            type: "string",
+            message: "read the secret value from this file",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const key = await ctx.get("key");
+        // drops env/component pairs where the key is not declared and
+        // throws when it is declared nowhere in the scope
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, [key]);
+        const value = await resolveValue(ctx, await ctx.get("value"), await ctx.get("valueFile"));
+        const targets = scoped.map(({ env, componentName }) => `${env}:${componentName}`);
+        ctx.log(`setting ${key} in: ${targets.join(", ")}`);
+        if (targets.length > 1) {
+            const confirmed = await ctx.confirm(`write the same value to ${targets.length} environments? 🤔`);
+            if (!confirmed) {
+                throw new Error("abort");
+            }
+        }
+        const writes = scoped.map(({ env, componentName }) => ({
+            env,
+            componentName,
+            secrets: { [key]: value },
+        }));
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+    },
+});
+//# sourceMappingURL=commandSecretsSet.js.map

package/dist/cli/src/commands/project/secrets/commandSecretsSet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsSet.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/commandSecretsSet.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+DAA4D;AAE5D,wDAAqD;AAErD,yCAAmD;AACnD,mCAIiB;AAEjB,MAAM,YAAY,GAAG,KAAK,EACxB,EAAM,EACN,KAAyB,EACzB,SAA6B,EACZ,EAAE;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,wDAAwD;QACxD,OAAO,CAAC,MAAM,IAAA,mBAAQ,EAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEW,QAAA,iBAAiB,GAAG,IAAA,6BAAa,EAAC;IAC7C,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,gJAAgJ;IAClJ,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2CAA2C;YACpD,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,oEAAoE;YACtE,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sCAAsC;YAC/C,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,GAAG,EACH,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EACtB,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CACxB,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CACtD,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CACjC,2BAA2B,OAAO,CAAC,MAAM,mBAAmB,CAC7D,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG;YACH,aAAa;YACb,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,MAAM,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/document.d.ts

@@ -0,0 +1,47 @@
+import type { IO } from "../../../core/types";
+import type { ScopedSecretKeys } from "./scope";
+/** placeholder for secrets that have no value in the vault yet */
+export declare const FILL_ME = "\uD83D\uDEA8 FILL ME";
+/**
+ * component → env → key → value: the document shape shared by the
+ * editor, `secrets-pull` and `secrets-push`
+ */
+export type SecretsDocument = {
+    [componentName: string]: {
+        [env: string]: Record<string, unknown>;
+    };
+};
+/** secrets of one env of one component, ready to be written */
+export type SecretsWrite = {
+    env: string;
+    componentName: string;
+    secrets: Record<string, unknown>;
+};
+/**
+ * builds the document for the given scope with the current values from
+ * the vault; unset secrets appear as the FILL_ME placeholder
+ */
+export declare const buildSecretsDocument: (io: IO, scoped: ScopedSecretKeys) => Promise<SecretsDocument>;
+/**
+ * validates a document against the scope. Undeclared components, envs
+ * or keys are always problems; missing keys only when `requireComplete`
+ * (the guided editor flow) — pushes may be partial.
+ */
+export declare const checkSecretsDocument: (document: SecretsDocument, scoped: ScopedSecretKeys, { requireComplete }: {
+    requireComplete: boolean;
+}) => string[];
+/**
+ * turns a (validated) document into writes. FILL_ME placeholders and
+ * empty (null) values are skipped, so an untouched placeholder can
+ * never end up as a live secret value.
+ */
+export declare const collectSecretsWrites: (document: SecretsDocument, scoped: ScopedSecretKeys) => {
+    writes: SecretsWrite[];
+    skipped: string[];
+};
+/**
+ * writes secrets to the vault (the source of truth) and mirrors them
+ * to every enabled CI backend — which backends exist is invisible to
+ * the caller
+ */
+export declare const writeSecretsAndMirror: (io: IO, writes: SecretsWrite[]) => Promise<void>;

package/dist/cli/src/commands/project/secrets/document.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeSecretsAndMirror = exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
+const pipeline_1 = require("../../../../../pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../config/getProjectConfig");
+const github_1 = require("../../../utils/github");
+const gitlab_1 = require("../../../utils/gitlab");
+const commandSecretsSyncGithub_1 = require("../commandSecretsSyncGithub");
+/** placeholder for secrets that have no value in the vault yet */
+exports.FILL_ME = "🚨 FILL ME";
+/* for convenience, parse json values. that makes it easier to edit secrets that are objects */
+const parseJsonValue = (value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch (e) {
+        return value;
+    }
+};
+/**
+ * builds the document for the given scope with the current values from
+ * the vault; unset secrets appear as the FILL_ME placeholder
+ */
+const buildSecretsDocument = async (io, scoped) => {
+    var _a;
+    const names = scoped.flatMap(({ env, componentName, keys }) => keys.map((key) => (0, pipeline_1.getSecretVarName)(env, componentName, key)));
+    const values = await (await io.getVaultManager()).readSecrets(names, io);
+    const document = {};
+    for (const { env, componentName, keys } of scoped) {
+        (_a = document[componentName]) !== null && _a !== void 0 ? _a : (document[componentName] = {});
+        document[componentName][env] = Object.fromEntries(keys.map((key) => {
+            const value = values[(0, pipeline_1.getSecretVarName)(env, componentName, key)];
+            return [key, value === undefined ? exports.FILL_ME : parseJsonValue(value)];
+        }));
+    }
+    return document;
+};
+exports.buildSecretsDocument = buildSecretsDocument;
+/**
+ * validates a document against the scope. Undeclared components, envs
+ * or keys are always problems; missing keys only when `requireComplete`
+ * (the guided editor flow) — pushes may be partial.
+ */
+const checkSecretsDocument = (document, scoped, { requireComplete }) => {
+    var _a, _b;
+    const problems = [];
+    const scopedKeys = new Map();
+    scoped.forEach(({ env, componentName, keys }) => scopedKeys.set(`${env}:${componentName}`, keys));
+    const scopedComponents = new Set(scoped.map((s) => s.componentName));
+    for (const [componentName, envs] of Object.entries(document !== null && document !== void 0 ? document : {})) {
+        if (!scopedComponents.has(componentName)) {
+            problems.push(`"${componentName}" is not a component in this scope — remove it or widen the scope`);
+            continue;
+        }
+        for (const [env, secrets] of Object.entries(envs !== null && envs !== void 0 ? envs : {})) {
+            const keys = scopedKeys.get(`${env}:${componentName}`);
+            if (!keys) {
+                problems.push(`"${env}:${componentName}" is not in this scope — remove it or widen the scope`);
+                continue;
+            }
+            const extraneous = Object.keys(secrets !== null && secrets !== void 0 ? secrets : {}).filter((key) => !keys.includes(key));
+            extraneous.forEach((key) => problems.push(`"${env}:${componentName}": "${key}" is not declared in the config (or filtered out by --key)`));
+        }
+    }
+    if (requireComplete) {
+        for (const { env, componentName, keys } of scoped) {
+            const provided = Object.keys((_b = (_a = document === null || document === void 0 ? void 0 : document[componentName]) === null || _a === void 0 ? void 0 : _a[env]) !== null && _b !== void 0 ? _b : {});
+            keys
+                .filter((key) => !provided.includes(key))
+                .forEach((key) => problems.push(`"${env}:${componentName}": "${key}" has not been provided`));
+        }
+    }
+    return problems;
+};
+exports.checkSecretsDocument = checkSecretsDocument;
+/**
+ * turns a (validated) document into writes. FILL_ME placeholders and
+ * empty (null) values are skipped, so an untouched placeholder can
+ * never end up as a live secret value.
+ */
+const collectSecretsWrites = (document, scoped) => {
+    var _a, _b;
+    const writes = [];
+    const skipped = [];
+    for (const { env, componentName, keys } of scoped) {
+        const provided = (_b = (_a = document === null || document === void 0 ? void 0 : document[componentName]) === null || _a === void 0 ? void 0 : _a[env]) !== null && _b !== void 0 ? _b : {};
+        const secrets = {};
+        for (const key of keys) {
+            if (!(key in provided)) {
+                continue;
+            }
+            const value = provided[key];
+            if (value === exports.FILL_ME || value === null || value === undefined) {
+                skipped.push(`${env}:${componentName} ${key}`);
+                continue;
+            }
+            secrets[key] = value;
+        }
+        if (Object.keys(secrets).length > 0) {
+            writes.push({ env, componentName, secrets });
+        }
+    }
+    return { writes, skipped };
+};
+exports.collectSecretsWrites = collectSecretsWrites;
+/**
+ * writes secrets to the vault (the source of truth) and mirrors them
+ * to every enabled CI backend — which backends exist is invisible to
+ * the caller
+ */
+const writeSecretsAndMirror = async (io, writes) => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
+    }
+    io.log("");
+    io.log("writing secrets to the vault, please wait...");
+    io.log("");
+    for (const { env, componentName, secrets } of writes) {
+        io.log("writing " + env + ":" + componentName + "...\n");
+        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets);
+        io.log("");
+        io.log("✅ " + env + ":" + componentName);
+        io.log("--------------------------------\n");
+    }
+    await mirrorSecretsToCiBackends(io, config, writes);
+};
+exports.writeSecretsAndMirror = writeSecretsAndMirror;
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the written secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (io, config, writes) => {
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    // gitlab mirror (unless gitlab is the vault itself, then it is
+    // already written)
+    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
+        for (const { env, componentName, secrets } of writes) {
+            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+        }
+        io.log("✅ mirrored to gitlab");
+    }
+    if (!enabled.includes("github")) {
+        return;
+    }
+    const kinds = new Map();
+    for (const { env, componentName } of writes) {
+        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+        [
+            ...secretEnvVarKeys,
+            ...jobOnlyVars.build.secretEnvVarKeys,
+            ...jobOnlyVars.deploy.secretEnvVarKeys,
+        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
+        var _a;
+        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
+        return {
+            name,
+            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        };
+    }));
+    if (secrets.length === 0) {
+        return;
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    if (!repo) {
+        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+    await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(io, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
+};
+//# sourceMappingURL=document.js.map

package/dist/cli/src/commands/project/secrets/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/document.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uEAG0C;AAE1C,kDAA0D;AAC1D,kDAA2D;AAC3D,0EAIqC;AAGrC,kEAAkE;AACrD,QAAA,OAAO,GAAG,YAAY,CAAC;AAmBpC,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,EAAM,EACN,MAAwB,EACE,EAAE;;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5D,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAC7D,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAA,QAAQ,CAAC,aAAa,qCAAtB,QAAQ,CAAC,aAAa,IAAM,EAAE,EAAC;QAC/B,QAAQ,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAC/C,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AApBW,QAAA,oBAAoB,wBAoB/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACxB,EAAE,eAAe,EAAgC,EACvC,EAAE;;IACZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9C,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,EAAE,IAAI,CAAC,CAChD,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAErE,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CACX,IAAI,aAAa,mEAAmE,CACrF,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,uDAAuD,CAChF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC7B,CAAC;YACF,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACzB,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,4DAA4D,CAC/F,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC;YACrE,IAAI;iBACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBACxC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,yBAAyB,CAC5D,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AArDW,QAAA,oBAAoB,wBAqD/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACuB,EAAE;;IACjD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC;QACxD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,eAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC,CAAC;AAzBW,QAAA,oBAAoB,wBAyB/B;AAEF;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,KAAK,EACxC,EAAM,EACN,MAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACvD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;QACzD,MAAM,CACJ,MAAM,EAAE,CAAC,eAAe,EAAE,CAC3B,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5C,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;QACzC,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC,CAAC;AAvBW,QAAA,qBAAqB,yBAuBhC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,EAAM,EACN,MAAc,EACd,MAAsB,EACtB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;YACrD,MAAM,IAAA,2BAAkB,EAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC5D,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;QACF;YACE,GAAG,gBAAgB;YACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;YACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;SACvC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CACjE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;QAC3C,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;YACtE,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;SAC7C,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,GAAG,CACJ,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,EAAE,CAAC,GAAG,CACJ,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IACvE,MAAM,IAAA,8CAAmB,EACvB,EAAE,EACF,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;AACJ,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/parseKeysInput.d.ts

@@ -0,0 +1,2 @@
+/** parses a comma-separated `--key` input into a list of keys */
+export declare const parseKeysInput: (input?: string) => string[] | undefined;

package/dist/cli/src/commands/project/secrets/parseKeysInput.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeysInput = void 0;
+/** parses a comma-separated `--key` input into a list of keys */
+const parseKeysInput = (input) => {
+    const keys = input === null || input === void 0 ? void 0 : input.split(",").map((key) => key.trim()).filter(Boolean);
+    return keys && keys.length > 0 ? keys : undefined;
+};
+exports.parseKeysInput = parseKeysInput;
+//# sourceMappingURL=parseKeysInput.js.map

package/dist/cli/src/commands/project/secrets/parseKeysInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseKeysInput.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/parseKeysInput.ts"],"names":[],"mappings":";;;AAAA,iEAAiE;AAC1D,MAAM,cAAc,GAAG,CAAC,KAAc,EAAwB,EAAE;IACrE,MAAM,IAAI,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CACd,KAAK,CAAC,GAAG,EACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EACvB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC,CAAC;AANW,QAAA,cAAc,kBAMzB"}

package/dist/cli/src/commands/project/secrets/scope.d.ts

@@ -0,0 +1,35 @@
+/** which envs of which components a secrets command operates on */
+export type SecretsScope = {
+    [componentName: string]: string[];
+};
+/**
+ * resolves a scope expression to component → envs:
+ * - (empty): all components, all envs
+ * - `env:component`: one env of one component
+ * - `env` / `env:`: one env, every component that has it
+ * - `:component`: every env of one component
+ */
+export declare const resolveSecretsScope: (scope?: string) => Promise<SecretsScope>;
+/**
+ * all valid scope expressions, for autocompletion: `env:component`
+ * pairs plus the `env:` (one env, all components) and `:component`
+ * (one component, all envs) forms
+ */
+export declare const secretsScopeChoices: () => Promise<string[]>;
+/** one env of one component together with its (filtered) secret keys */
+export type ScopedSecretKeys = Array<{
+    env: string;
+    componentName: string;
+    keys: string[];
+}>;
+/** the secret keys declared in the config for one env of one component */
+export declare const getDeclaredSecretKeys: (env: string, componentName: string) => Promise<string[]>;
+/**
+ * expands a scope to its declared secret keys, optionally filtered to
+ * `onlyKeys`. Throws when a requested key is not declared anywhere in
+ * the scope (typo protection); env/component pairs without matching
+ * keys are dropped.
+ */
+export declare const getScopedSecretKeys: (scope: SecretsScope, onlyKeys?: string[]) => Promise<ScopedSecretKeys>;
+/** human-readable one-line-per-component summary of a scope */
+export declare const formatScope: (scoped: ScopedSecretKeys) => string;

package/dist/cli/src/commands/project/secrets/scope.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatScope = exports.getScopedSecretKeys = exports.getDeclaredSecretKeys = exports.secretsScopeChoices = exports.resolveSecretsScope = void 0;
+const getProjectConfig_1 = require("../../../config/getProjectConfig");
+/**
+ * resolves a scope expression to component → envs:
+ * - (empty): all components, all envs
+ * - `env:component`: one env of one component
+ * - `env` / `env:`: one env, every component that has it
+ * - `:component`: every env of one component
+ */
+const resolveSecretsScope = async (scope) => {
+    const all = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    if (Object.keys(all).length === 0) {
+        throw new Error("no catladder config found");
+    }
+    if (!scope) {
+        return all;
+    }
+    const [env, componentName] = scope.split(":").map((x) => x || null);
+    if (componentName && !(componentName in all)) {
+        throw new Error(`unknown component "${componentName}" — components: ${Object.keys(all).join(", ")}`);
+    }
+    const scoped = Object.fromEntries(Object.entries(all)
+        .filter(([name]) => !componentName || name === componentName)
+        .map(([name, envs]) => [
+        name,
+        env ? envs.filter((e) => e === env) : envs,
+    ])
+        .filter(([, envs]) => envs.length > 0));
+    if (Object.keys(scoped).length === 0) {
+        const allEnvs = [...new Set(Object.values(all).flat())];
+        throw new Error(`no component has the environment "${env}" — environments: ${allEnvs.join(", ")}`);
+    }
+    return scoped;
+};
+exports.resolveSecretsScope = resolveSecretsScope;
+/**
+ * all valid scope expressions, for autocompletion: `env:component`
+ * pairs plus the `env:` (one env, all components) and `:component`
+ * (one component, all envs) forms
+ */
+const secretsScopeChoices = async () => {
+    const all = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    const pairs = Object.entries(all).flatMap(([componentName, envs]) => envs.map((env) => `${env}:${componentName}`));
+    const envs = [...new Set(Object.values(all).flat())];
+    return [
+        ...pairs,
+        ...envs.map((env) => `${env}:`),
+        ...Object.keys(all).map((componentName) => `:${componentName}`),
+    ];
+};
+exports.secretsScopeChoices = secretsScopeChoices;
+/** the secret keys declared in the config for one env of one component */
+const getDeclaredSecretKeys = async (env, componentName) => {
+    const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+    return [
+        ...jobOnlyVars.build.secretEnvVarKeys,
+        ...jobOnlyVars.deploy.secretEnvVarKeys,
+        ...secretEnvVarKeys,
+    ]
+        .filter((k) => !k.hidden)
+        .map((k) => k.key);
+};
+exports.getDeclaredSecretKeys = getDeclaredSecretKeys;
+/**
+ * expands a scope to its declared secret keys, optionally filtered to
+ * `onlyKeys`. Throws when a requested key is not declared anywhere in
+ * the scope (typo protection); env/component pairs without matching
+ * keys are dropped.
+ */
+const getScopedSecretKeys = async (scope, onlyKeys) => {
+    const scoped = [];
+    const declaredAnywhere = new Set();
+    for (const [componentName, envs] of Object.entries(scope)) {
+        for (const env of envs) {
+            const declared = await (0, exports.getDeclaredSecretKeys)(env, componentName);
+            declared.forEach((key) => declaredAnywhere.add(key));
+            const keys = onlyKeys
+                ? declared.filter((key) => onlyKeys.includes(key))
+                : declared;
+            if (keys.length > 0) {
+                scoped.push({ env, componentName, keys });
+            }
+        }
+    }
+    const unknownKeys = (onlyKeys !== null && onlyKeys !== void 0 ? onlyKeys : []).filter((key) => !declaredAnywhere.has(key));
+    if (unknownKeys.length > 0) {
+        throw new Error(`these secrets are not declared in this scope: ${unknownKeys.join(", ")}` +
+            `\ndeclared secrets: ${[...declaredAnywhere].join(", ")}`);
+    }
+    if (scoped.length === 0) {
+        throw new Error("there are no secrets to configure in this scope");
+    }
+    return scoped;
+};
+exports.getScopedSecretKeys = getScopedSecretKeys;
+/** human-readable one-line-per-component summary of a scope */
+const formatScope = (scoped) => {
+    var _a;
+    const byComponent = new Map();
+    for (const { env, componentName } of scoped) {
+        byComponent.set(componentName, [
+            ...((_a = byComponent.get(componentName)) !== null && _a !== void 0 ? _a : []),
+            env,
+        ]);
+    }
+    return [...byComponent.entries()]
+        .map(([componentName, envs]) => `- ${componentName}: ${envs.join(", ")}`)
+        .join("\n");
+};
+exports.formatScope = formatScope;
+//# sourceMappingURL=scope.js.map

package/dist/cli/src/commands/project/secrets/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/scope.ts"],"names":[],"mappings":";;;AAAA,uEAG0C;AAO1C;;;;;;GAMG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,KAAc,EACS,EAAE;IACzB,MAAM,GAAG,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAEpE,IAAI,aAAa,IAAI,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sBAAsB,aAAa,mBAAmB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI,KAAK,aAAa,CAAC;SAC5D,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAsB,EAAE,CAAC;QACzC,IAAI;QACJ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;KAC3C,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CACzC,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,qCAAqC,GAAG,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AApCW,QAAA,mBAAmB,uBAoC9B;AAEF;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,KAAK,IAAuB,EAAE;IAC/D,MAAM,GAAG,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAClE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC,CAC7C,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,OAAO;QACL,GAAG,KAAK;QACR,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC;QAC/B,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC,CAAC;AAXW,QAAA,mBAAmB,uBAW9B;AASF,0EAA0E;AACnE,MAAM,qBAAqB,GAAG,KAAK,EACxC,GAAW,EACX,aAAqB,EACF,EAAE;IACrB,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;IACF,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;QACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;QACtC,GAAG,gBAAgB;KACpB;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AAfW,QAAA,qBAAqB,yBAehC;AAEF;;;;;GAKG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,KAAmB,EACnB,QAAmB,EACQ,EAAE;IAC7B,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAqB,EAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACjE,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,QAAQ;gBACnB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClD,CAAC,CAAC,QAAQ,CAAC;YACb,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC,MAAM,CACzC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CACpC,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,iDAAiD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACvE,uBAAuB,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAhCW,QAAA,mBAAmB,uBAgC9B;AAEF,+DAA+D;AACxD,MAAM,WAAW,GAAG,CAAC,MAAwB,EAAU,EAAE;;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,MAAM,EAAE,CAAC;QAC5C,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE;YAC7B,GAAG,CAAC,MAAA,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,mCAAI,EAAE,CAAC;YACzC,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SACxE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC;AAXW,QAAA,WAAW,eAWtB"}

package/dist/cli/src/utils/readStdin.d.ts

@@ -0,0 +1,2 @@
+/** reads the whole stdin stream (for piped input in non-interactive use) */
+export declare const readStdin: () => Promise<string>;

package/dist/cli/src/utils/readStdin.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readStdin = void 0;
+/** reads the whole stdin stream (for piped input in non-interactive use) */
+const readStdin = async () => {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf-8");
+};
+exports.readStdin = readStdin;
+//# sourceMappingURL=readStdin.js.map

package/dist/cli/src/utils/readStdin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readStdin.js","sourceRoot":"","sources":["../../../../src/utils/readStdin.ts"],"names":[],"mappings":";;;AAAA,4EAA4E;AACrE,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC,CAAC;AANW,QAAA,SAAS,aAMpB"}

package/dist/runner-images/semantic-release/Dockerfile

@@ -1,24 +1,27 @@
 # job images are addressed by a content hash of this directory — the
 # build must be reproducible, so every dependency is pinned exactly.
-# (@semantic-release/changelog@7 went ESM-only and broke overnight under
-# the CJS semantic-release@19 while the hash claimed "unchanged".)
-FROM node:22-alpine
+# node:24 satisfies the newer plugins' engine requirements
+# (@semantic-release/git and @semantic-release/changelog need node >=24.15).
+FROM node:24-alpine
 
 RUN apk add --no-cache bash git git-lfs
 
 # add semantic release
-# NOTE: keep every plugin pinned to a major that is compatible with
-# semantic-release@19 (they declare `semantic-release` as a peer dependency).
-# Unpinned plugins drift to their latest major on image rebuild, which now
-# requires semantic-release>=20 and fails with "plugins configuration is invalid".
+# NOTE: pin every dependency exactly. These are the semantic-release@25 line
+# (all ESM — v25 loads plugins via dynamic import, so changelog@7/git@11 are
+# fine). Every plugin declares `semantic-release` as a peer dependency, so a
+# plugin major that outpaces the semantic-release major fails the release job
+# with "plugins configuration is invalid" — bump them together. Upstream
+# @semantic-release/git replaces the old panter fork; see
+# scripts/semanticRelease for why the commit message is hardcoded.
 RUN yarn global add \
-    semantic-release@19.0.5 \
+    semantic-release@25.0.8 \
     @semantic-release/commit-analyzer@13.0.1 \
     @semantic-release/release-notes-generator@14.1.1 \
-    https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
-    @semantic-release/changelog@6.0.3 \
-    @semantic-release/gitlab@9.5.1 \
-    @semantic-release/exec@6.0.3
+    @semantic-release/git@11.0.0 \
+    @semantic-release/changelog@7.0.0 \
+    @semantic-release/gitlab@13.3.3 \
+    @semantic-release/exec@7.1.0
 
 RUN mkdir -p /scripts
 COPY ./scripts/* /scripts/

package/dist/runner-images/semantic-release/scripts/semanticRelease

@@ -77,8 +77,17 @@ if [ ! -e .releaserc ]; then
     ],
     "@semantic-release/release-notes-generator",
     "@semantic-release/changelog",
+    # message prefix hardcoded to "release" on purpose. Ideally this would be
+    # "chore(\${branch.type})", but upstream @semantic-release/git passes the
+    # branch *name* (not the object) into the template, so \${branch.type} is
+    # never available (see https://github.com/semantic-release/git/pull/213,
+    # open/ignored since 2020 — the README documents branch.type but the code
+    # never wired it up; the old panter fork existed only to patch this). On the
+    # default branch branch.type is always "release", and the pipeline
+    # loop-prevention rule keys on the literal "chore(release)" prefix, so keep
+    # this literal. Don't "fix" it back to \${branch.type}.
     ["@semantic-release/git", {
-      "message": "chore(\${branch.type}): \${nextRelease.version}\n\n\${nextRelease.notes}"
+      "message": "chore(release): \${nextRelease.version}\n\n\${nextRelease.notes}"
     }]${PUBLISH_PLUGIN}
     ],
   "branches": [