@geekmidas/cli 10.0.0-alpha.12 → 10.0.0-alpha.121

package/dist/add-C0kXOsWS.mjs

@@ -0,0 +1,717 @@
+import { t as GkmError } from "./errors-D8Gwp5kU.mjs";
+import { N as assertDeployedStage, U as stageProvider, ft as SERVER_IPV4_KEY, pt as SERVER_IPV6_KEY } from "./workspace-D1QbNd55.mjs";
+import { S as deploysWithCompose } from "./dns-agf2VCdV.mjs";
+import { _ as url, o as email } from "./schemas-BCwKKA42.mjs";
+import { It as secretsStoreFor, M as stageProviderNotes, at as appEnvKeys, ct as workerEnvKeys, dt as constructGlobs, j as provisionCommand, nt as requiredStageKeys, rt as stageServiceDeclarations, zt as initStageSecrets } from "./seeds-Cwtv-U9-.mjs";
+import { t as appKey } from "./derive-B4vDpzgP.mjs";
+import { i as discover } from "./discover-C5roJuc9.mjs";
+import { loadWorkspaceSettings } from "./config.mjs";
+import { i as issueLine, o as loadCredentialSchemas } from "./credentialSchemas-DDOLRCLF.mjs";
+import { isIPv4, isIPv6 } from "node:net";
+import { provideKey } from "@geekmidas/manifest";
+import prompts from "prompts";
+import { build, parse } from "@geekmidas/storage/s3-url";
+//#region src/secrets/stageKeys.ts
+/**
+* The keys a workspace's stage must be given — across every app, each once,
+* with who reads it and whether the stage holds it.
+*
+* The keys themselves are `requiredStageKeys`'s, and the mail and storage
+* constructs `stageServiceDeclarations`' — the lists a deploy's readiness
+* check refuses a stage by. What this adds is the workspace: which third
+* parties' credentials its apps and workers read (`appEnvKeys`,
+* `workerEnvKeys`) and which of the keys the stage has set.
+*/
+/**
+* Every key the stage must be given: each mail and storage construct's —
+* the deploy's own list, `stageServiceDeclarations` — and each third party's
+* credentials an app reads.
+*/
+function workspaceStageKeys(input) {
+	const { manifest } = input;
+	const reads = /* @__PURE__ */ new Map();
+	for (const [id, declaration] of Object.entries(manifest)) {
+		const { kind } = declaration;
+		const name = appKey(id);
+		const keys = kind === "rest-api" || kind === "site" || kind === "mobile-app" ? appEnvKeys(manifest, name, input.runnables) : kind === "worker" ? workerEnvKeys(manifest, id, input.runnables) : void 0;
+		if (keys) reads.set(name, keys);
+	}
+	const readers = (id) => {
+		const key = provideKey(id, "credentials");
+		return [...reads].filter(([, env]) => env.has(key)).map(([app]) => app).sort();
+	};
+	const credentials = [];
+	for (const [id, declaration] of Object.entries(manifest)) {
+		const { kind } = declaration;
+		if (kind !== "external-api" && kind !== "credential") continue;
+		const apps = readers(id);
+		if (apps.length > 0) credentials.push({
+			id,
+			kind,
+			apps
+		});
+	}
+	const services = stageServiceDeclarations({
+		manifest,
+		...input.runnables ? { runnables: input.runnables } : {}
+	});
+	return requiredStageKeys({
+		local: input.local,
+		services,
+		credentials,
+		...input.domain ? { domain: input.domain } : {},
+		...input.providers ? { providers: input.providers } : {},
+		...input.server ? { server: true } : {}
+	}).map((key) => ({
+		...key,
+		set: input.supplied[key.key] !== void 0
+	}));
+}
+//#endregion
+//#region src/secrets/add.ts
+/**
+* `gkm secrets:add --stage <stage>` — the secrets a stage must be given,
+* built key by key.
+*
+* It offers exactly the keys a deploy would refuse the stage without
+* (`requiredStageKeys`), across every app in the workspace, each once: the
+* stage's buckets, mail and file servers where it is deployed, and every
+* third party's credentials. A key is built by what it is — a bucket from its
+* provider, mail from its SMTP server, credentials field by field from their
+* construct's schema — checked, and saved through the stage's own store, the
+* one `gkm secrets:set` writes. No value is ever printed.
+*
+* The keys are walked one at a time — unset ones first — and each is a
+* checkpoint: set it now, skip it, or stop here. A key is saved the moment it
+* is built, so stopping, Ctrl-C or a failure keeps every key before it, and
+* running the command again picks up what is still missing. A key a provider
+* on the stage creates (a bucket under `deploy.objects.<stage>`, written by
+* the deploy) is not a checkpoint: it is listed, with what creates it.
+*
+* `--json` asks nothing: it prints the keys, for a script or an agent to set
+* with `gkm secrets:set`.
+*/
+/** `gkm secrets:add` with nobody at a terminal to answer it. */
+var SecretsAddNeedsTerminal = class extends GkmError {
+	stage;
+	constructor(stage) {
+		super(`gkm secrets:add asks for each key, and there is no terminal to ask at. List what the stage needs with gkm secrets:add --stage ${stage} --missing --json, and set each with gkm secrets:set <KEY> <value> --stage ${stage}.`);
+		this.stage = stage;
+		this.name = "SecretsAddNeedsTerminal";
+	}
+};
+/**
+* The person stopped the builder at a prompt (Ctrl-C). Every key saved
+* before it is kept; the run ends with what was saved and what is missing.
+*/
+var SecretsAddCancelled = class extends Error {
+	stage;
+	constructor(stage) {
+		super(`Stopped. Every key saved to the stage '${stage}' before it is kept.`);
+		this.stage = stage;
+		this.name = "SecretsAddCancelled";
+	}
+};
+const defaultIo = () => ({
+	log: (line) => console.log(line),
+	write: (chunk) => {
+		process.stdout.write(chunk);
+	},
+	interactive: process.stdin.isTTY === true && process.stdout.isTTY === true
+});
+/** `gkm secrets:add`. */
+async function secretsAddCommand(options, io = defaultIo()) {
+	const { stage } = options;
+	const workspace = await loadWorkspaceSettings(options.cwd ?? process.cwd());
+	const local = stage === workspace.stages.local;
+	if (!local) assertDeployedStage(workspace.stages, stage);
+	const patterns = constructGlobs(workspace);
+	const runnables = {};
+	const manifest = await discover({
+		patterns,
+		cwd: workspace.root,
+		runnables
+	});
+	const store = await secretsStoreFor(workspace, stage, { ...options.home ? { home: options.home } : {} });
+	const stored = await store.read(stage);
+	const domain = workspace.domains?.[stage];
+	const all = workspaceStageKeys({
+		manifest,
+		runnables,
+		local,
+		supplied: stored?.custom ?? {},
+		...domain ? { domain } : {},
+		providers: stageProviderNotes(workspace, stage),
+		...!local && domain && deploysWithCompose(workspace) ? { server: true } : {}
+	});
+	const scope = [...all.filter((k) => !k.set), ...all.filter((k) => k.set)];
+	const keys = options.missing ? scope.filter((k) => !k.set) : scope;
+	const objects = stageProvider(workspace, "objects", stage);
+	const provisioned = (k) => objects.mode === "provider" && k.hint !== void 0 && (k.kind === "bucket" || k.kind === "file-server");
+	if (options.json) {
+		const listed = keys.map((k) => ({
+			key: k.key,
+			kind: k.kind,
+			construct: k.id,
+			apps: [...k.apps ?? []],
+			set: k.set,
+			...provisioned(k) ? { provisioned: true } : {}
+		}));
+		io.write(`${JSON.stringify(listed, null, 2)}\n`);
+		return {
+			keys,
+			saved: [],
+			skipped: [],
+			missing: []
+		};
+	}
+	if (!io.interactive) throw new SecretsAddNeedsTerminal(stage);
+	const offered = keys.filter((k) => !provisioned(k));
+	const created = keys.filter(provisioned);
+	if (created.length > 0 && objects.mode === "provider") {
+		io.log("Not offered — a provider on the stage creates them:");
+		for (const k of created) io.log(`  ${k.key} — created by ${provisionCommand(stage)} (deploy.objects.${stage} is ${objects.name})`);
+	}
+	if (offered.length === 0) {
+		io.log(all.every(provisioned) ? `Nothing to add: no construct on '${stage}' needs a key only the stage can supply.` : `Nothing to add: the stage '${stage}' has every key it needs.`);
+		return {
+			keys: offered,
+			saved: [],
+			skipped: [],
+			missing: []
+		};
+	}
+	const ask = asker(stage);
+	let current = stored ?? initStageSecrets(stage);
+	const saved = [];
+	const skipped = [];
+	const has = (key) => current.custom?.[key] !== void 0;
+	let schemas;
+	const save = async (values) => {
+		current = {
+			...current,
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			custom: {
+				...current.custom,
+				...values
+			}
+		};
+		await store.write(stage, current);
+		saved.push(...Object.keys(values));
+		io.log(`  ✓ Saved ${Object.keys(values).join(", ")}.`);
+	};
+	const walk = async () => {
+		for (const [index, entry] of offered.entries()) {
+			io.log(`\n[${index + 1}/${offered.length}] ${entry.key} — ${entry.what}`);
+			if (entry.hint) io.log(`  ${entry.hint}`);
+			const step = await ask({
+				type: "select",
+				message: `${entry.key}  ${KIND_LABEL[entry.kind]} '${entry.id}'${entry.apps?.length ? ` · ${entry.apps.join(", ")}` : ""}${entry.set ? " · set" : ""}`,
+				choices: [
+					{
+						title: "Set it now",
+						value: "set"
+					},
+					{
+						title: "Skip",
+						value: "skip"
+					},
+					{
+						title: "Stop here",
+						value: "stop"
+					}
+				],
+				initial: 0
+			});
+			if (step === "stop") return;
+			if (step !== "set") {
+				skipped.push(entry.key);
+				continue;
+			}
+			if (entry.set) {
+				if (!await ask({
+					type: "confirm",
+					message: `${entry.key} is set. Replace it?`,
+					initial: false
+				})) {
+					skipped.push(entry.key);
+					continue;
+				}
+			}
+			switch (entry.kind) {
+				case "bucket":
+					await save(await buildBucket(ask, io, entry, has));
+					break;
+				case "email":
+					await save({ [entry.key]: entry.key.endsWith("_FROM") ? await askFrom(ask, io) : await buildSmtpUrl(ask, io) });
+					break;
+				case "file-server":
+					await save({ [entry.key]: await askHttpUrl(ask, io, "Its public URL") });
+					break;
+				case "server":
+					await save(await buildServer(ask, io, has));
+					break;
+				case "external-api":
+				case "credential":
+					schemas ??= await loadCredentialSchemas({
+						root: workspace.root,
+						patterns
+					});
+					await save({ [entry.key]: await buildCredentials(ask, io, entry, schemas) });
+			}
+		}
+	};
+	try {
+		await walk();
+	} catch (error) {
+		if (!(error instanceof SecretsAddCancelled)) throw error;
+		io.log(`\n${error.message}`);
+	}
+	const missing = all.filter((k) => !provisioned(k) && !has(k.key)).map((k) => k.key);
+	io.log("");
+	io.log(saved.length > 0 ? `✓ Saved to the stage '${stage}' (${store.name} store): ${saved.join(", ")}` : "Nothing was saved.");
+	if (skipped.length > 0) io.log(`  Skipped: ${skipped.join(", ")}`);
+	if (missing.length > 0) {
+		io.log(`  Still missing: ${missing.join(", ")}`);
+		io.log(`  Run gkm secrets:add --stage ${stage} --missing again to pick up where this left off.`);
+	}
+	return {
+		keys: offered,
+		saved,
+		skipped,
+		missing
+	};
+}
+const KIND_LABEL = {
+	bucket: "bucket",
+	email: "email",
+	"file-server": "file server",
+	"external-api": "external API",
+	credential: "credential",
+	server: "server address"
+};
+/** The server's IPv4 address, and — if it has one — its IPv6 address. */
+async function buildServer(ask, io, has) {
+	const ipv4 = text(await askUntil(ask, io, {
+		type: "text",
+		message: "The server's public IPv4 address"
+	}, (value) => isIPv4(text(value)) ? void 0 : "An IPv4 address is required, e.g. 203.0.113.10."));
+	const values = { [SERVER_IPV4_KEY]: ipv4 };
+	if (has("GKM_SERVER_IPV6")) return values;
+	const ipv6 = text(await askUntil(ask, io, {
+		type: "text",
+		message: "Its public IPv6 address (empty for none — no AAAA records)"
+	}, (value) => !text(value) || isIPv6(text(value)) ? void 0 : "An IPv6 address, e.g. 2001:db8::10, or nothing."));
+	if (ipv6) values[SERVER_IPV6_KEY] = ipv6;
+	return values;
+}
+function asker(stage) {
+	return async (question) => {
+		return (await prompts({
+			...question,
+			name: "value"
+		}, { onCancel: () => {
+			throw new SecretsAddCancelled(stage);
+		} })).value;
+	};
+}
+/** Ask until `accept` takes the answer; `accept` returns why it did not. */
+async function askUntil(ask, io, question, accept) {
+	for (;;) {
+		const value = await ask(question);
+		const problem = accept(value);
+		if (!problem) return value;
+		io.log(`  ✗ ${problem}`);
+	}
+}
+const required = (what) => (value) => value?.trim() ? void 0 : `${what} is required.`;
+const text = (value) => String(value ?? "").trim();
+/** An `http(s)://` URL. */
+const HttpUrl = url({ protocol: /^https?$/ });
+async function askHttpUrl(ask, io, message) {
+	return text(await askUntil(ask, io, {
+		type: "text",
+		message
+	}, (value) => HttpUrl.safeParse(text(value)).success ? void 0 : "An http:// or https:// URL is required."));
+}
+async function askFrom(ask, io) {
+	return text(await askUntil(ask, io, {
+		type: "text",
+		message: "The address it sends from"
+	}, (value) => email().safeParse(text(value)).success ? void 0 : "An email address is required, e.g. noreply@example.com."));
+}
+/**
+* An SMTP server as the URL `@geekmidas/emailkit` reads: `smtp://` for
+* STARTTLS, `smtps://` for TLS from the first byte, with the user and
+* password percent-encoded.
+*
+* A known service fills in its own host, port and user; each from its docs:
+* - Resend: smtp.resend.com, 465 implicit TLS, user `resend`, password the
+*   API key — https://resend.com/docs/send-with-smtp
+* - Amazon SES: email-smtp.<region>.amazonaws.com, 587 STARTTLS, SMTP
+*   credentials — https://docs.aws.amazon.com/ses/latest/dg/smtp-connect.html,
+*   https://docs.aws.amazon.com/general/latest/gr/ses.html
+* - Postmark: smtp.postmarkapp.com, 587 STARTTLS, the server API token as
+*   user and password —
+*   https://postmarkapp.com/developer/user-guide/send-email-with-smtp
+* - Mailgun: smtp.mailgun.org (EU: smtp.eu.mailgun.org), 587 STARTTLS, the
+*   domain's SMTP credentials —
+*   https://documentation.mailgun.com/docs/mailgun/user-manual/sending-messages/send-smtp,
+*   https://documentation.mailgun.com/docs/mailgun/api-reference/api-overview
+*/
+async function buildSmtpUrl(ask, io) {
+	const service = await ask({
+		type: "select",
+		message: "Which mail service?",
+		choices: [
+			{
+				title: "Resend",
+				value: "resend"
+			},
+			{
+				title: "Amazon SES",
+				value: "ses"
+			},
+			{
+				title: "Postmark",
+				value: "postmark"
+			},
+			{
+				title: "Mailgun",
+				value: "mailgun"
+			},
+			{
+				title: "Other SMTP server",
+				value: "other"
+			}
+		],
+		initial: 0
+	});
+	const secret = async (message, what) => text(await askUntil(ask, io, {
+		type: "password",
+		message
+	}, required(what)));
+	const login = async (message, what) => text(await askUntil(ask, io, {
+		type: "text",
+		message
+	}, required(what)));
+	switch (service) {
+		case "resend": return smtpUrl({
+			tls: "tls",
+			host: "smtp.resend.com",
+			port: 465,
+			user: "resend",
+			password: await secret("API key (re_…)", "The API key")
+		});
+		case "ses": return smtpUrl({
+			tls: "starttls",
+			host: `email-smtp.${await login("Region", "The region")}.amazonaws.com`,
+			port: 587,
+			user: await login("SMTP user name", "The SMTP user name"),
+			password: await secret("SMTP password", "The SMTP password")
+		});
+		case "postmark": {
+			const token = await secret("Server API token", "The server API token");
+			return smtpUrl({
+				tls: "starttls",
+				host: "smtp.postmarkapp.com",
+				port: 587,
+				user: token,
+				password: token
+			});
+		}
+		case "mailgun": return smtpUrl({
+			tls: "starttls",
+			host: await ask({
+				type: "select",
+				message: "Region",
+				choices: [{
+					title: "US (smtp.mailgun.org)",
+					value: "us"
+				}, {
+					title: "EU (smtp.eu.mailgun.org)",
+					value: "eu"
+				}],
+				initial: 0
+			}) === "eu" ? "smtp.eu.mailgun.org" : "smtp.mailgun.org",
+			port: 587,
+			user: await login("SMTP login (e.g. postmaster@mg.example.com)", "The SMTP login"),
+			password: await secret("SMTP password", "The SMTP password")
+		});
+	}
+	const host = text(await askUntil(ask, io, {
+		type: "text",
+		message: "SMTP host"
+	}, required("The host")));
+	const port = await askUntil(ask, io, {
+		type: "text",
+		message: "Port",
+		initial: "587"
+	}, (value) => {
+		const n = Number(value);
+		return Number.isInteger(n) && n > 0 && n < 65536 ? void 0 : "A port number is required.";
+	});
+	const user = text(await ask({
+		type: "text",
+		message: "User (empty for none)"
+	}));
+	const password = user ? await ask({
+		type: "password",
+		message: "Password"
+	}) : "";
+	return smtpUrl({
+		tls: await ask({
+			type: "select",
+			message: "TLS",
+			choices: [{
+				title: "STARTTLS (smtp://, usually port 587)",
+				value: "starttls"
+			}, {
+				title: "TLS on connect (smtps://, usually port 465)",
+				value: "tls"
+			}],
+			initial: 0
+		}),
+		host,
+		port: Number(port),
+		user,
+		password
+	});
+}
+function smtpUrl(server) {
+	const url = new URL(`${server.tls === "tls" ? "smtps" : "smtp"}://${server.host}`);
+	url.port = String(server.port);
+	if (server.user) {
+		url.username = encodeURIComponent(server.user);
+		url.password = encodeURIComponent(server.password ?? "");
+	}
+	return url.toString().replace(/\/$/, "");
+}
+/**
+* A bucket's URL, from its provider — and, optionally, a key for it alone in
+* the URL, or the stage's shared pair. Credentials are never required: without
+* them the SDK's own chain signs, a role included.
+*/
+async function buildBucket(ask, io, entry, has) {
+	const provider = await ask({
+		type: "select",
+		message: "Where is the bucket?",
+		choices: [
+			{
+				title: "AWS S3",
+				value: "s3"
+			},
+			{
+				title: "Cloudflare R2",
+				value: "r2"
+			},
+			{
+				title: "MinIO, or another S3-compatible store",
+				value: "compatible"
+			},
+			{
+				title: "Paste an s3:// URL",
+				value: "url"
+			}
+		],
+		initial: 0
+	});
+	const bucketName = async () => text(await askUntil(ask, io, {
+		type: "text",
+		message: "Bucket name"
+	}, required("The bucket name")));
+	let address;
+	switch (provider) {
+		case "s3":
+			address = {
+				bucket: await bucketName(),
+				region: text(await askUntil(ask, io, {
+					type: "text",
+					message: "Region",
+					initial: "eu-west-1"
+				}, required("The region")))
+			};
+			break;
+		case "r2": {
+			const account = text(await askUntil(ask, io, {
+				type: "text",
+				message: "Cloudflare account id, or the R2 endpoint URL"
+			}, required("The account id or endpoint")));
+			address = {
+				bucket: await bucketName(),
+				region: "auto",
+				endpoint: /^https?:\/\//.test(account) ? account : `https://${account}.r2.cloudflarestorage.com`
+			};
+			break;
+		}
+		case "compatible": {
+			const endpoint = await askHttpUrl(ask, io, "Endpoint URL");
+			const bucket = await bucketName();
+			const region = text(await ask({
+				type: "text",
+				message: "Region",
+				initial: "us-east-1"
+			}));
+			const forcePathStyle = await ask({
+				type: "confirm",
+				message: "Path-style addressing? (MinIO needs it)",
+				initial: true
+			});
+			address = {
+				bucket,
+				...region ? { region } : {},
+				endpoint,
+				...forcePathStyle ? { forcePathStyle } : {}
+			};
+			break;
+		}
+		case "url": {
+			const pasted = await askUntil(ask, io, {
+				type: "password",
+				message: "The s3:// URL"
+			}, (value) => {
+				try {
+					parse(text(value));
+					return;
+				} catch (error) {
+					return `Not an s3:// URL the storage client can read (${error.name}).`;
+				}
+			});
+			address = parse(text(pasted));
+			break;
+		}
+	}
+	if (!address.accessKeyId) {
+		if (await ask({
+			type: "confirm",
+			message: `A key for '${entry.id}' alone, in its URL? (optional)`,
+			initial: false
+		})) {
+			const accessKeyId = text(await askUntil(ask, io, {
+				type: "text",
+				message: "Access key id"
+			}, required("The access key id")));
+			const secretAccessKey = await askUntil(ask, io, {
+				type: "password",
+				message: "Secret access key"
+			}, required("The secret access key"));
+			address = {
+				...address,
+				accessKeyId,
+				secretAccessKey
+			};
+		}
+	}
+	const values = { [entry.key]: build(address) };
+	if (!address.accessKeyId && !has("AWS_ACCESS_KEY_ID")) {
+		if (await ask({
+			type: "confirm",
+			message: "Set the stage's shared AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY? (optional: without them a role signs)",
+			initial: false
+		})) {
+			values.AWS_ACCESS_KEY_ID = text(await askUntil(ask, io, {
+				type: "text",
+				message: "AWS_ACCESS_KEY_ID"
+			}, required("The access key id")));
+			values.AWS_SECRET_ACCESS_KEY = await askUntil(ask, io, {
+				type: "password",
+				message: "AWS_SECRET_ACCESS_KEY"
+			}, required("The secret access key"));
+		}
+	}
+	return values;
+}
+/** A field whose name says it is a secret, asked for without echo. */
+const SECRET_FIELD = /secret|key|token|password/i;
+/** The properties of an object schema, or nothing for any other shape. */
+function objectProperties(info) {
+	const schema = info?.jsonSchema;
+	if (!schema || schema.type !== "object") return void 0;
+	const properties = schema.properties;
+	if (!properties || typeof properties !== "object") return void 0;
+	return {
+		properties,
+		required: Array.isArray(schema.required) ? schema.required : []
+	};
+}
+function typesOf(property) {
+	if (Array.isArray(property.type)) return property.type;
+	return property.type ? [property.type] : [];
+}
+/**
+* Credentials, field by field where the construct's schema is an object it
+* can describe, and as JSON otherwise — checked against the schema itself
+* before anything is kept, and asked again, with each issue's path, until
+* the schema takes it.
+*/
+async function buildCredentials(ask, io, entry, schemas) {
+	const info = schemas.schemas.find((s) => s.key === entry.key);
+	const shape = objectProperties(info);
+	if (!info) io.log(`  '${entry.id}' exposes no schema to check against; the value is stored as given.`);
+	for (;;) {
+		const raw = shape ? JSON.stringify(await askFields(ask, io, shape)) : text(await ask({
+			type: "password",
+			message: "The value, as JSON (or one opaque string)"
+		}));
+		const check = await schemas.check(entry.key, raw);
+		if (check.ok) return raw;
+		io.log(`  ✗ The schema of '${entry.id}' refuses it:`);
+		for (const issue of check.issues) io.log(`      ${issueLine(entry.key, issue)}`);
+		io.log("    Again:");
+	}
+}
+async function askFields(ask, io, shape) {
+	const value = {};
+	for (const [name, property] of Object.entries(shape.properties)) {
+		const optional = !shape.required.includes(name);
+		const label = `${name}${optional ? " (optional)" : ""}${property.description ? ` — ${property.description}` : ""}`;
+		const types = typesOf(property);
+		if (property.enum?.length) {
+			const choices = property.enum.map((option) => ({
+				title: String(option),
+				value: option
+			}));
+			const picked = await ask({
+				type: "select",
+				message: label,
+				choices: optional ? [{
+					title: "(none)",
+					value: void 0
+				}, ...choices] : choices
+			});
+			if (picked !== void 0) value[name] = picked;
+			continue;
+		}
+		if (types.includes("boolean")) {
+			value[name] = await ask({
+				type: "confirm",
+				message: label,
+				initial: false
+			});
+			continue;
+		}
+		const numeric = types.includes("number") || types.includes("integer");
+		const plain = types.length === 0 || types.includes("string");
+		const answer = await askUntil(ask, io, {
+			type: SECRET_FIELD.test(name) ? "password" : "text",
+			message: label
+		}, (given) => {
+			const typed = text(given);
+			if (!typed) return optional ? void 0 : `${name} is required.`;
+			if (numeric && !plain && Number.isNaN(Number(typed))) return `${name} is a number.`;
+			if (!numeric && !plain) try {
+				JSON.parse(typed);
+			} catch {
+				return `${name} is JSON (${types.join(" or ")}).`;
+			}
+		});
+		const typed = text(answer);
+		if (!typed) continue;
+		value[name] = plain ? typed : numeric ? Number(typed) : JSON.parse(typed);
+	}
+	return value;
+}
+//#endregion
+export { secretsAddCommand };
+
+//# sourceMappingURL=add-C0kXOsWS.mjs.map