@catladder/cli 0.0.0-next-e9e5af68 → 0.0.0-next-1c65899f

package/dist/cli/src/commands/project/secrets/commandSecretsPull.d.ts

@@ -0,0 +1,19 @@
+export declare const commandSecretsPull: import("../../../core").CommandDef<{
+    readonly envComponent: {
+        readonly type: "string";
+        readonly message: "scope: env:component, env:, :component or empty for everything";
+        readonly positional: true;
+        readonly required: false;
+        readonly choices: () => Promise<string[]>;
+    };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "only these secrets (comma-separated keys)";
+        readonly required: false;
+    };
+    readonly out: {
+        readonly type: "string";
+        readonly message: "write the yaml to this file instead of stdout";
+        readonly required: false;
+    };
+}>;

package/dist/cli/src/commands/project/secrets/commandSecretsPull.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecretsPull = void 0;
+const fs_extra_1 = require("fs-extra");
+const yaml_1 = require("yaml");
+const defineCommand_1 = require("../../../core/defineCommand");
+const document_1 = require("./document");
+const scope_1 = require("./scope");
+const parseKeysInput_1 = require("./parseKeysInput");
+exports.commandSecretsPull = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-pull",
+    description: "prints the current secrets of a scope as yaml (unset ones as a placeholder) — edit and feed to secrets-push",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only these secrets (comma-separated keys)",
+            required: false,
+        },
+        out: {
+            type: "string",
+            message: "write the yaml to this file instead of stdout",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const document = await (0, document_1.buildSecretsDocument)(ctx, scoped);
+        const yaml = (0, yaml_1.stringify)(document, { aliasDuplicateObjects: false });
+        const out = await ctx.get("out");
+        if (out) {
+            await (0, fs_extra_1.writeFile)(out, yaml);
+            ctx.log(`wrote secrets to ${out} — ⚠️ contains secret values, don't commit it`);
+        }
+        else {
+            ctx.log(yaml);
+        }
+    },
+});
+//# sourceMappingURL=commandSecretsPull.js.map

package/dist/cli/src/commands/project/secrets/commandSecretsPull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsPull.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/commandSecretsPull.ts"],"names":[],"mappings":";;;AAAA,uCAAqC;AACrC,+BAAiC;AACjC,+DAA4D;AAC5D,yCAAkD;AAClD,mCAIiB;AACjB,qDAAkD;AAErC,QAAA,kBAAkB,GAAG,IAAA,6BAAa,EAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,6GAA6G;IAC/G,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2CAA2C;YACpD,QAAQ,EAAE,KAAK;SAChB;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+CAA+C;YACxD,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EACtC,KAAK,EACL,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAA,+BAAoB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAA,gBAAS,EAAC,QAAQ,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC;QAEnE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAA,oBAAS,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,GAAG,CAAC,GAAG,CACL,oBAAoB,GAAG,+CAA+C,CACvE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/commandSecretsPush.d.ts

@@ -0,0 +1,19 @@
+export declare const commandSecretsPush: import("../../../core").CommandDef<{
+    readonly envComponent: {
+        readonly type: "string";
+        readonly message: "scope: env:component, env:, :component or empty for everything";
+        readonly positional: true;
+        readonly required: false;
+        readonly choices: () => Promise<string[]>;
+    };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "only write these secrets (comma-separated keys)";
+        readonly required: false;
+    };
+    readonly file: {
+        readonly type: "string";
+        readonly message: "yaml file to push (component → env → key: value); stdin when omitted";
+        readonly required: false;
+    };
+}>;

package/dist/cli/src/commands/project/secrets/commandSecretsPush.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecretsPush = void 0;
+const fs_extra_1 = require("fs-extra");
+const yaml_1 = require("yaml");
+const defineCommand_1 = require("../../../core/defineCommand");
+const readStdin_1 = require("../../../utils/readStdin");
+const document_1 = require("./document");
+const scope_1 = require("./scope");
+const parseKeysInput_1 = require("./parseKeysInput");
+exports.commandSecretsPush = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-push",
+    description: "writes secrets from a yaml document (secrets-pull format, --file or stdin) to the vault; may be partial",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, :component or empty for everything",
+            positional: true,
+            required: false,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "only write these secrets (comma-separated keys)",
+            required: false,
+        },
+        file: {
+            type: "string",
+            message: "yaml file to push (component → env → key: value); stdin when omitted",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, (0, parseKeysInput_1.parseKeysInput)(await ctx.get("key")));
+        const file = await ctx.get("file");
+        if (!file && process.stdin.isTTY) {
+            throw new Error("nothing to push — pass --file <secrets.yml> or pipe yaml (secrets-pull format) to stdin");
+        }
+        const raw = file
+            ? (await (0, fs_extra_1.readFile)(file)).toString("utf-8")
+            : await (0, readStdin_1.readStdin)();
+        const document = (0, yaml_1.parse)(raw);
+        if (!document || typeof document !== "object") {
+            throw new Error("the document must be a yaml object: component → env → key: value (see secrets-pull)");
+        }
+        const problems = (0, document_1.checkSecretsDocument)(document, scoped, {
+            requireComplete: false,
+        });
+        if (problems.length > 0) {
+            throw new Error("😿 the document does not match the config:\n" +
+                problems.map((problem) => `  - ${problem}`).join("\n"));
+        }
+        const { writes, skipped } = (0, document_1.collectSecretsWrites)(document, scoped);
+        if (skipped.length > 0) {
+            ctx.log("⏭️ skipping placeholder/empty values:");
+            skipped.forEach((entry) => ctx.log(`  - ${entry}`));
+        }
+        if (writes.length === 0) {
+            ctx.log("no secrets to write 🤷");
+            return;
+        }
+        ctx.log("about to write:");
+        writes.forEach(({ env, componentName, secrets }) => ctx.log(`  - ${env}:${componentName}: ${Object.keys(secrets).join(", ")}`));
+        const confirmed = await ctx.confirm("continue? 🤔");
+        if (!confirmed) {
+            throw new Error("abort");
+        }
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+    },
+});
+//# sourceMappingURL=commandSecretsPush.js.map

package/dist/cli/src/commands/project/secrets/commandSecretsPush.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsPush.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/commandSecretsPush.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+BAA6B;AAC7B,+DAA4D;AAC5D,wDAAqD;AAErD,yCAIoB;AACpB,mCAIiB;AACjB,qDAAkD;AAErC,QAAA,kBAAkB,GAAG,IAAA,6BAAa,EAAC;IAC9C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACT,yGAAyG;IAC3G,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gEAAgE;YACzE,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iDAAiD;YAC1D,QAAQ,EAAE,KAAK;SAChB;QACD,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,sEAAsE;YACxE,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EACtC,KAAK,EACL,IAAA,+BAAc,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CACrC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI;YACd,CAAC,CAAC,CAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC1C,CAAC,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAA,YAAK,EAAC,GAAG,CAAoB,CAAC;QAC/C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,EAAE;YACtD,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,8CAA8C;gBAC5C,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,+BAAoB,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;YACjD,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC3B,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CACjD,GAAG,CAAC,GAAG,CACL,OAAO,GAAG,IAAI,aAAa,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClE,CACF,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/commandSecretsSet.d.ts

@@ -0,0 +1,24 @@
+export declare const commandSecretsSet: import("../../../core/types").CommandDef<{
+    readonly envComponent: {
+        readonly type: "string";
+        readonly message: "scope: env:component, env:, or :component";
+        readonly positional: true;
+        readonly choices: () => Promise<string[]>;
+    };
+    readonly key: {
+        readonly type: "string";
+        readonly message: "which secret?";
+        readonly positional: true;
+        readonly choices: (ctx: any) => Promise<string[]>;
+    };
+    readonly value: {
+        readonly type: "string";
+        readonly message: "the secret value (prefer --value-file or stdin over shell history)";
+        readonly required: false;
+    };
+    readonly valueFile: {
+        readonly type: "string";
+        readonly message: "read the secret value from this file";
+        readonly required: false;
+    };
+}>;

package/dist/cli/src/commands/project/secrets/commandSecretsSet.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandSecretsSet = void 0;
+const fs_extra_1 = require("fs-extra");
+const defineCommand_1 = require("../../../core/defineCommand");
+const readStdin_1 = require("../../../utils/readStdin");
+const document_1 = require("./document");
+const scope_1 = require("./scope");
+const resolveValue = async (io, value, valueFile) => {
+    if (valueFile) {
+        // a trailing newline is almost never part of the secret
+        return (await (0, fs_extra_1.readFile)(valueFile)).toString("utf-8").replace(/\n$/, "");
+    }
+    if (value !== undefined) {
+        return value;
+    }
+    if (!process.stdin.isTTY) {
+        return (await (0, readStdin_1.readStdin)()).replace(/\n$/, "");
+    }
+    return io.promptDirect({
+        name: "value",
+        type: "string",
+        message: "value",
+    });
+};
+exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
+    name: "project secrets-set",
+    description: "sets one secret — in one env (dev:web), one env everywhere (dev:), or all envs of a component (:web); value via --value, --value-file or stdin",
+    group: "project",
+    inputs: {
+        envComponent: {
+            type: "string",
+            message: "scope: env:component, env:, or :component",
+            positional: true,
+            choices: async () => (0, scope_1.secretsScopeChoices)(),
+        },
+        key: {
+            type: "string",
+            message: "which secret?",
+            positional: true,
+            choices: async (ctx) => {
+                const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+                const scoped = await (0, scope_1.getScopedSecretKeys)(scope);
+                return [...new Set(scoped.flatMap(({ keys }) => keys))];
+            },
+        },
+        value: {
+            type: "string",
+            message: "the secret value (prefer --value-file or stdin over shell history)",
+            required: false,
+        },
+        valueFile: {
+            type: "string",
+            message: "read the secret value from this file",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        const scope = await (0, scope_1.resolveSecretsScope)(await ctx.get("envComponent"));
+        const key = await ctx.get("key");
+        // drops env/component pairs where the key is not declared and
+        // throws when it is declared nowhere in the scope
+        const scoped = await (0, scope_1.getScopedSecretKeys)(scope, [key]);
+        const value = await resolveValue(ctx, await ctx.get("value"), await ctx.get("valueFile"));
+        const targets = scoped.map(({ env, componentName }) => `${env}:${componentName}`);
+        ctx.log(`setting ${key} in: ${targets.join(", ")}`);
+        if (targets.length > 1) {
+            const confirmed = await ctx.confirm(`write the same value to ${targets.length} environments? 🤔`);
+            if (!confirmed) {
+                throw new Error("abort");
+            }
+        }
+        const writes = scoped.map(({ env, componentName }) => ({
+            env,
+            componentName,
+            secrets: { [key]: value },
+        }));
+        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        ctx.log("done! 😻");
+    },
+});
+//# sourceMappingURL=commandSecretsSet.js.map

package/dist/cli/src/commands/project/secrets/commandSecretsSet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandSecretsSet.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/commandSecretsSet.ts"],"names":[],"mappings":";;;AAAA,uCAAoC;AACpC,+DAA4D;AAE5D,wDAAqD;AAErD,yCAAmD;AACnD,mCAIiB;AAEjB,MAAM,YAAY,GAAG,KAAK,EACxB,EAAM,EACN,KAAyB,EACzB,SAA6B,EACZ,EAAE;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,wDAAwD;QACxD,OAAO,CAAC,MAAM,IAAA,mBAAQ,EAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,IAAA,qBAAS,GAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,CAAC,YAAY,CAAC;QACrB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;AACL,CAAC,CAAC;AAEW,QAAA,iBAAiB,GAAG,IAAA,6BAAa,EAAC;IAC7C,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,gJAAgJ;IAClJ,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,YAAY,EAAE;YACZ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,2CAA2C;YACpD,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,2BAAmB,GAAE;SAC3C;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;SACF;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,oEAAoE;YACtE,QAAQ,EAAE,KAAK;SAChB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sCAAsC;YAC/C,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,IAAA,2BAAmB,EAAC,MAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,8DAA8D;QAC9D,kDAAkD;QAClD,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,EAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,GAAG,EACH,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EACtB,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAC3B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CACxB,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CACtD,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CACjC,2BAA2B,OAAO,CAAC,MAAM,mBAAmB,CAC7D,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAmB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG;YACH,aAAa;YACb,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;SAC1B,CAAC,CAAC,CAAC;QACJ,MAAM,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/document.d.ts

@@ -0,0 +1,47 @@
+import type { IO } from "../../../core/types";
+import type { ScopedSecretKeys } from "./scope";
+/** placeholder for secrets that have no value in the vault yet */
+export declare const FILL_ME = "\uD83D\uDEA8 FILL ME";
+/**
+ * component → env → key → value: the document shape shared by the
+ * editor, `secrets-pull` and `secrets-push`
+ */
+export type SecretsDocument = {
+    [componentName: string]: {
+        [env: string]: Record<string, unknown>;
+    };
+};
+/** secrets of one env of one component, ready to be written */
+export type SecretsWrite = {
+    env: string;
+    componentName: string;
+    secrets: Record<string, unknown>;
+};
+/**
+ * builds the document for the given scope with the current values from
+ * the vault; unset secrets appear as the FILL_ME placeholder
+ */
+export declare const buildSecretsDocument: (io: IO, scoped: ScopedSecretKeys) => Promise<SecretsDocument>;
+/**
+ * validates a document against the scope. Undeclared components, envs
+ * or keys are always problems; missing keys only when `requireComplete`
+ * (the guided editor flow) — pushes may be partial.
+ */
+export declare const checkSecretsDocument: (document: SecretsDocument, scoped: ScopedSecretKeys, { requireComplete }: {
+    requireComplete: boolean;
+}) => string[];
+/**
+ * turns a (validated) document into writes. FILL_ME placeholders and
+ * empty (null) values are skipped, so an untouched placeholder can
+ * never end up as a live secret value.
+ */
+export declare const collectSecretsWrites: (document: SecretsDocument, scoped: ScopedSecretKeys) => {
+    writes: SecretsWrite[];
+    skipped: string[];
+};
+/**
+ * writes secrets to the vault (the source of truth) and mirrors them
+ * to every enabled CI backend — which backends exist is invisible to
+ * the caller
+ */
+export declare const writeSecretsAndMirror: (io: IO, writes: SecretsWrite[]) => Promise<void>;

package/dist/cli/src/commands/project/secrets/document.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeSecretsAndMirror = exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
+const pipeline_1 = require("../../../../../pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../config/getProjectConfig");
+const github_1 = require("../../../utils/github");
+const gitlab_1 = require("../../../utils/gitlab");
+const commandSecretsSyncGithub_1 = require("../commandSecretsSyncGithub");
+/** placeholder for secrets that have no value in the vault yet */
+exports.FILL_ME = "🚨 FILL ME";
+/* for convenience, parse json values. that makes it easier to edit secrets that are objects */
+const parseJsonValue = (value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch (e) {
+        return value;
+    }
+};
+/**
+ * builds the document for the given scope with the current values from
+ * the vault; unset secrets appear as the FILL_ME placeholder
+ */
+const buildSecretsDocument = async (io, scoped) => {
+    var _a;
+    const names = scoped.flatMap(({ env, componentName, keys }) => keys.map((key) => (0, pipeline_1.getSecretVarName)(env, componentName, key)));
+    const values = await (await io.getVaultManager()).readSecrets(names, io);
+    const document = {};
+    for (const { env, componentName, keys } of scoped) {
+        (_a = document[componentName]) !== null && _a !== void 0 ? _a : (document[componentName] = {});
+        document[componentName][env] = Object.fromEntries(keys.map((key) => {
+            const value = values[(0, pipeline_1.getSecretVarName)(env, componentName, key)];
+            return [key, value === undefined ? exports.FILL_ME : parseJsonValue(value)];
+        }));
+    }
+    return document;
+};
+exports.buildSecretsDocument = buildSecretsDocument;
+/**
+ * validates a document against the scope. Undeclared components, envs
+ * or keys are always problems; missing keys only when `requireComplete`
+ * (the guided editor flow) — pushes may be partial.
+ */
+const checkSecretsDocument = (document, scoped, { requireComplete }) => {
+    var _a, _b;
+    const problems = [];
+    const scopedKeys = new Map();
+    scoped.forEach(({ env, componentName, keys }) => scopedKeys.set(`${env}:${componentName}`, keys));
+    const scopedComponents = new Set(scoped.map((s) => s.componentName));
+    for (const [componentName, envs] of Object.entries(document !== null && document !== void 0 ? document : {})) {
+        if (!scopedComponents.has(componentName)) {
+            problems.push(`"${componentName}" is not a component in this scope — remove it or widen the scope`);
+            continue;
+        }
+        for (const [env, secrets] of Object.entries(envs !== null && envs !== void 0 ? envs : {})) {
+            const keys = scopedKeys.get(`${env}:${componentName}`);
+            if (!keys) {
+                problems.push(`"${env}:${componentName}" is not in this scope — remove it or widen the scope`);
+                continue;
+            }
+            const extraneous = Object.keys(secrets !== null && secrets !== void 0 ? secrets : {}).filter((key) => !keys.includes(key));
+            extraneous.forEach((key) => problems.push(`"${env}:${componentName}": "${key}" is not declared in the config (or filtered out by --key)`));
+        }
+    }
+    if (requireComplete) {
+        for (const { env, componentName, keys } of scoped) {
+            const provided = Object.keys((_b = (_a = document === null || document === void 0 ? void 0 : document[componentName]) === null || _a === void 0 ? void 0 : _a[env]) !== null && _b !== void 0 ? _b : {});
+            keys
+                .filter((key) => !provided.includes(key))
+                .forEach((key) => problems.push(`"${env}:${componentName}": "${key}" has not been provided`));
+        }
+    }
+    return problems;
+};
+exports.checkSecretsDocument = checkSecretsDocument;
+/**
+ * turns a (validated) document into writes. FILL_ME placeholders and
+ * empty (null) values are skipped, so an untouched placeholder can
+ * never end up as a live secret value.
+ */
+const collectSecretsWrites = (document, scoped) => {
+    var _a, _b;
+    const writes = [];
+    const skipped = [];
+    for (const { env, componentName, keys } of scoped) {
+        const provided = (_b = (_a = document === null || document === void 0 ? void 0 : document[componentName]) === null || _a === void 0 ? void 0 : _a[env]) !== null && _b !== void 0 ? _b : {};
+        const secrets = {};
+        for (const key of keys) {
+            if (!(key in provided)) {
+                continue;
+            }
+            const value = provided[key];
+            if (value === exports.FILL_ME || value === null || value === undefined) {
+                skipped.push(`${env}:${componentName} ${key}`);
+                continue;
+            }
+            secrets[key] = value;
+        }
+        if (Object.keys(secrets).length > 0) {
+            writes.push({ env, componentName, secrets });
+        }
+    }
+    return { writes, skipped };
+};
+exports.collectSecretsWrites = collectSecretsWrites;
+/**
+ * writes secrets to the vault (the source of truth) and mirrors them
+ * to every enabled CI backend — which backends exist is invisible to
+ * the caller
+ */
+const writeSecretsAndMirror = async (io, writes) => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
+    }
+    io.log("");
+    io.log("writing secrets to the vault, please wait...");
+    io.log("");
+    for (const { env, componentName, secrets } of writes) {
+        io.log("writing " + env + ":" + componentName + "...\n");
+        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets);
+        io.log("");
+        io.log("✅ " + env + ":" + componentName);
+        io.log("--------------------------------\n");
+    }
+    await mirrorSecretsToCiBackends(io, config, writes);
+};
+exports.writeSecretsAndMirror = writeSecretsAndMirror;
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the written secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (io, config, writes) => {
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    // gitlab mirror (unless gitlab is the vault itself, then it is
+    // already written)
+    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
+        for (const { env, componentName, secrets } of writes) {
+            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+        }
+        io.log("✅ mirrored to gitlab");
+    }
+    if (!enabled.includes("github")) {
+        return;
+    }
+    const kinds = new Map();
+    for (const { env, componentName } of writes) {
+        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+        [
+            ...secretEnvVarKeys,
+            ...jobOnlyVars.build.secretEnvVarKeys,
+            ...jobOnlyVars.deploy.secretEnvVarKeys,
+        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
+        var _a;
+        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
+        return {
+            name,
+            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        };
+    }));
+    if (secrets.length === 0) {
+        return;
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    if (!repo) {
+        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+    await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(io, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
+};
+//# sourceMappingURL=document.js.map

package/dist/cli/src/commands/project/secrets/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/document.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uEAG0C;AAE1C,kDAA0D;AAC1D,kDAA2D;AAC3D,0EAIqC;AAGrC,kEAAkE;AACrD,QAAA,OAAO,GAAG,YAAY,CAAC;AAmBpC,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,KAAa,EAAW,EAAE;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,EAAM,EACN,MAAwB,EACE,EAAE;;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC5D,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAC7D,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAA,QAAQ,CAAC,aAAa,qCAAtB,QAAQ,CAAC,aAAa,IAAM,EAAE,EAAC;QAC/B,QAAQ,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAC/C,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,eAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AApBW,QAAA,oBAAoB,wBAoB/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACxB,EAAE,eAAe,EAAgC,EACvC,EAAE;;IACZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9C,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,EAAE,IAAI,CAAC,CAChD,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAErE,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CACX,IAAI,aAAa,mEAAmE,CACrF,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,uDAAuD,CAChF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAC7B,CAAC;YACF,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACzB,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,4DAA4D,CAC/F,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC;YACrE,IAAI;iBACD,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;iBACxC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACf,QAAQ,CAAC,IAAI,CACX,IAAI,GAAG,IAAI,aAAa,OAAO,GAAG,yBAAyB,CAC5D,CACF,CAAC;QACN,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AArDW,QAAA,oBAAoB,wBAqD/B;AAEF;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAClC,QAAyB,EACzB,MAAwB,EACuB,EAAE;;IACjD,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAA,MAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAG,aAAa,CAAC,0CAAG,GAAG,CAAC,mCAAI,EAAE,CAAC;QACxD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC;gBACvB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,eAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC/D,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,aAAa,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC,CAAC;AAzBW,QAAA,oBAAoB,wBAyB/B;AAEF;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,KAAK,EACxC,EAAM,EACN,MAAsB,EACP,EAAE;IACjB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACvD,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACX,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;QACzD,MAAM,CACJ,MAAM,EAAE,CAAC,eAAe,EAAE,CAC3B,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC5C,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACX,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;QACzC,EAAE,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,yBAAyB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC,CAAC;AAvBW,QAAA,qBAAqB,yBAuBhC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,EAAM,EACN,MAAc,EACd,MAAsB,EACtB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,MAAM,EAAE,CAAC;YACrD,MAAM,IAAA,2BAAkB,EAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC5D,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,MAAM,EAAE,CAAC;QAC5C,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;QACF;YACE,GAAG,gBAAgB;YACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;YACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;SACvC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CACjE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;QAC3C,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACvD,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;YACtE,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;SAC7C,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,GAAG,CACJ,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,EAAE,CAAC,GAAG,CACJ,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,EAAE,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IACvE,MAAM,IAAA,8CAAmB,EACvB,EAAE,EACF,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;AACJ,CAAC,CAAC"}

package/dist/cli/src/commands/project/secrets/parseKeysInput.d.ts

@@ -0,0 +1,2 @@
+/** parses a comma-separated `--key` input into a list of keys */
+export declare const parseKeysInput: (input?: string) => string[] | undefined;

package/dist/cli/src/commands/project/secrets/parseKeysInput.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeysInput = void 0;
+/** parses a comma-separated `--key` input into a list of keys */
+const parseKeysInput = (input) => {
+    const keys = input === null || input === void 0 ? void 0 : input.split(",").map((key) => key.trim()).filter(Boolean);
+    return keys && keys.length > 0 ? keys : undefined;
+};
+exports.parseKeysInput = parseKeysInput;
+//# sourceMappingURL=parseKeysInput.js.map

package/dist/cli/src/commands/project/secrets/parseKeysInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseKeysInput.js","sourceRoot":"","sources":["../../../../../../src/commands/project/secrets/parseKeysInput.ts"],"names":[],"mappings":";;;AAAA,iEAAiE;AAC1D,MAAM,cAAc,GAAG,CAAC,KAAc,EAAwB,EAAE;IACrE,MAAM,IAAI,GAAG,KAAK,aAAL,KAAK,uBAAL,KAAK,CACd,KAAK,CAAC,GAAG,EACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EACvB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC,CAAC;AANW,QAAA,cAAc,kBAMzB"}

package/dist/cli/src/commands/project/secrets/scope.d.ts

@@ -0,0 +1,35 @@
+/** which envs of which components a secrets command operates on */
+export type SecretsScope = {
+    [componentName: string]: string[];
+};
+/**
+ * resolves a scope expression to component → envs:
+ * - (empty): all components, all envs
+ * - `env:component`: one env of one component
+ * - `env` / `env:`: one env, every component that has it
+ * - `:component`: every env of one component
+ */
+export declare const resolveSecretsScope: (scope?: string) => Promise<SecretsScope>;
+/**
+ * all valid scope expressions, for autocompletion: `env:component`
+ * pairs plus the `env:` (one env, all components) and `:component`
+ * (one component, all envs) forms
+ */
+export declare const secretsScopeChoices: () => Promise<string[]>;
+/** one env of one component together with its (filtered) secret keys */
+export type ScopedSecretKeys = Array<{
+    env: string;
+    componentName: string;
+    keys: string[];
+}>;
+/** the secret keys declared in the config for one env of one component */
+export declare const getDeclaredSecretKeys: (env: string, componentName: string) => Promise<string[]>;
+/**
+ * expands a scope to its declared secret keys, optionally filtered to
+ * `onlyKeys`. Throws when a requested key is not declared anywhere in
+ * the scope (typo protection); env/component pairs without matching
+ * keys are dropped.
+ */
+export declare const getScopedSecretKeys: (scope: SecretsScope, onlyKeys?: string[]) => Promise<ScopedSecretKeys>;
+/** human-readable one-line-per-component summary of a scope */
+export declare const formatScope: (scoped: ScopedSecretKeys) => string;