@heyditto/cli 2.5.1 → 2.6.0

package/dist/secret-stores/exec.js

@@ -0,0 +1,132 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** Keeps platform CLIs quiet and non-interactive; they must never prompt. */
+const QUIET_ENV = {
+    GH_NO_UPDATE_NOTIFIER: "1",
+    GH_PROMPT_DISABLED: "1",
+    GLAB_CHECK_UPDATE: "0",
+    NO_COLOR: "1",
+    AWS_PAGER: "",
+    CLOUDSDK_CORE_DISABLE_PROMPTS: "1",
+    AZURE_CORE_ONLY_SHOW_ERRORS: "true",
+    DO_NOT_TRACK: "1",
+};
+export function run(bin, args, input) {
+    const res = spawnSync(bin, args, {
+        encoding: "utf8",
+        // Always an explicit (possibly empty) stdin: a CLI that reads stdin on a
+        // probe like `gh auth status` must see EOF rather than wait for us.
+        input: input ?? "",
+        stdio: ["pipe", "pipe", "pipe"],
+        env: { ...process.env, ...QUIET_ENV },
+    });
+    const missing = res.error !== undefined && res.error.code === "ENOENT";
+    return { status: res.status, stdout: res.stdout ?? "", stderr: res.stderr ?? "", missing };
+}
+/** Last few stderr lines, clamped — platform CLIs can be very chatty on failure. */
+export function trimmedStderr(res) {
+    return (res.stderr || res.stdout).trim().split("\n").slice(-3).join(" ").slice(0, 300);
+}
+const presence = new Map();
+/**
+ * True when `bin` is on PATH. Memoized: `endpoints keys stores` asks about a
+ * dozen CLIs, and resolving alternate names asks again.
+ */
+export function installed(bin, versionArgs = ["--version"]) {
+    const cached = presence.get(bin);
+    if (cached !== undefined)
+        return cached;
+    const found = !run(bin, [...versionArgs]).missing;
+    presence.set(bin, found);
+    return found;
+}
+const resolvedBins = new Map();
+/**
+ * Some CLIs ship under more than one name (`fly` and `flyctl`). Picks the
+ * first that answers, remembering it so one command spawns the probe once.
+ */
+export function resolveBin(store) {
+    const cached = resolvedBins.get(store.bin);
+    if (cached)
+        return cached;
+    const candidates = [store.bin, ...(store.altBins ?? [])];
+    const found = candidates.find((bin) => installed(bin, store.versionArgs)) ?? store.bin;
+    resolvedBins.set(store.bin, found);
+    return found;
+}
+/**
+ * Standard preflight: the binary answers, and the account check exits 0.
+ * Runs before anything is minted so a missing CLI costs nothing.
+ */
+export function preflight(input) {
+    const bin = resolveBin(input);
+    const version = run(bin, [...(input.versionArgs ?? ["--version"])]);
+    if (version.missing) {
+        throw new Error(`storing a key in ${input.label} needs ${input.bin} on PATH; ${input.installHint}`);
+    }
+    const auth = run(bin, input.authArgs);
+    if (auth.missing) {
+        throw new Error(`storing a key in ${input.label} needs ${input.bin} on PATH; ${input.installHint}`);
+    }
+    if (auth.status !== 0) {
+        const detail = trimmedStderr(auth);
+        throw new Error(`${bin} is not signed in (\`${bin} ${input.authArgs.join(" ")}\` failed${detail ? `: ${detail}` : ""}). ${input.authHint}`);
+    }
+}
+/** Placeholder in `path` delivery argv, replaced with the file the CLI should read. */
+export const PATH_PLACEHOLDER = "{}";
+/** POSIX CLIs can read the piped stdin through this path; Windows cannot. */
+const STDIN_PATH = "/dev/stdin";
+function substitute(args, path) {
+    return args.map((arg) => arg.split(PATH_PLACEHOLDER).join(path));
+}
+/**
+ * Hands `value` to the store's CLI, trying each attempt in order. Throws with
+ * every attempt's own last stderr lines when all of them fail, so the caller
+ * can revoke the key it just minted and the operator can see why.
+ *
+ * `path` delivery uses `/dev/stdin` wherever it exists, keeping the plaintext
+ * off disk. Only on Windows does it fall back to a 0600 file in a private
+ * temp directory, which is overwritten and removed before returning.
+ */
+export function deliver(store, name, attempts, value) {
+    const failures = [];
+    for (const attempt of attempts) {
+        const payload = attempt.payload ? attempt.payload(value) : value;
+        const res = attempt.kind === "stdin" ? runStdin(store, attempt, payload) : runPath(store, attempt, payload);
+        if (res.missing) {
+            throw new Error(`${store.bin} disappeared from PATH while storing the secret; ${store.installHint}`);
+        }
+        if (res.status === 0)
+            return;
+        const detail = trimmedStderr(res);
+        failures.push(`${attempt.note}: ${detail || `exit ${res.status}`}`);
+    }
+    throw new Error(`${store.bin} could not store ${name} — ${failures.join("; ")}`);
+}
+function runStdin(store, attempt, payload) {
+    return run(resolveBin(store), attempt.args, payload);
+}
+function runPath(store, attempt, payload) {
+    if (process.platform !== "win32") {
+        return run(resolveBin(store), substitute(attempt.args, STDIN_PATH), payload);
+    }
+    const dir = mkdtempSync(join(tmpdir(), "heyditto-secret-"));
+    const file = join(dir, "value");
+    try {
+        writeFileSync(file, payload, { mode: 0o600 });
+        return run(resolveBin(store), substitute(attempt.args, file));
+    }
+    finally {
+        try {
+            writeFileSync(file, "0".repeat(payload.length), { mode: 0o600 });
+        }
+        catch {
+            // Best effort; the directory removal below is what matters.
+        }
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=exec.js.map

package/dist/secret-stores/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/secret-stores/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiBjC,6EAA6E;AAC7E,MAAM,SAAS,GAA2B;IACxC,qBAAqB,EAAE,GAAG;IAC1B,kBAAkB,EAAE,GAAG;IACvB,iBAAiB,EAAE,GAAG;IACtB,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE,EAAE;IACb,6BAA6B,EAAE,GAAG;IAClC,2BAA2B,EAAE,MAAM;IACnC,YAAY,EAAE,GAAG;CAClB,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,KAAc;IAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,MAAM;QAChB,yEAAyE;QACzE,oEAAoE;QACpE,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAK,GAAG,CAAC,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAClG,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,cAAiC,CAAC,WAAW,CAAC;IACnF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAoF;IAC7G,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC;IACvF,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAQzB;IACC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,wBAAwB,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,6EAA6E;AAC7E,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,SAAS,UAAU,CAAC,IAAc,EAAE,IAAY;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,KAAkB,EAAE,IAAY,EAAE,QAAoB,EAAE,KAAa;IAC3F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5G,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,oDAAoD,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,oBAAoB,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAkB,EAAE,OAAqC,EAAE,OAAe;IAC1F,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,OAAoC,EAAE,OAAe;IACxF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/secret-stores/fly.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Fly.io. `fly secrets import` reads `KEY=VALUE` lines from stdin, which is
+ * the only way to set a secret without putting the value in argv. It replaces
+ * an existing secret and stages a release for the app.
+ */
+export declare const fly: SecretStore;

package/dist/secret-stores/fly.js

@@ -0,0 +1,54 @@
+import { preflight } from "./exec.js";
+import { envStyleName, slug } from "./naming.js";
+const INSTALL_HINT = "install flyctl from https://fly.io/docs/flyctl/install (brew install flyctl), then run `fly auth login`";
+function target(options) {
+    const app = options.app ? slug("--app", options.app, /^[a-z0-9-]+$/) : undefined;
+    return {
+        describe: app ? `Fly app ${app}` : "the Fly app in this directory's fly.toml",
+        fields: app ? { app } : {},
+    };
+}
+/**
+ * Fly.io. `fly secrets import` reads `KEY=VALUE` lines from stdin, which is
+ * the only way to set a secret without putting the value in argv. It replaces
+ * an existing secret and stages a release for the app.
+ */
+export const fly = {
+    id: "fly",
+    label: "Fly.io",
+    bin: "fly",
+    altBins: ["flyctl"],
+    shorthand: "--fly-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["app"],
+    validateName: (name) => envStyleName("Fly secret", name),
+    preflight: () => preflight({
+        bin: "fly",
+        altBins: ["flyctl"],
+        label: "Fly.io",
+        installHint: INSTALL_HINT,
+        authArgs: ["auth", "whoami"],
+        authHint: "Run `fly auth login` first, or set FLY_API_TOKEN.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const args = ["secrets", "import"];
+        if (t.fields.app)
+            args.push("--app", t.fields.app);
+        return [
+            {
+                note: "fly secrets import",
+                kind: "stdin",
+                args,
+                payload: (value) => `${name}=${value}\n`,
+            },
+        ];
+    },
+    usage: (name, _t, gateway) => [
+        `${name} is in the app's environment after the release finishes:`,
+        `  OPENAI_API_KEY=$${name} with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+        `  # or ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL=${gateway.anthropicBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=fly.js.map

package/dist/secret-stores/fly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly.js","sourceRoot":"","sources":["../../src/secret-stores/fly.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,yGAAyG,CAAC;AAE5G,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,0CAA0C;QAC7E,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAgB;IAC9B,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC;IACxD,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,KAAK;QACV,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5B,QAAQ,EAAE,mDAAmD;KAC9D,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO;YACL;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE,OAAO;gBACb,IAAI;gBACJ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI;aACzC;SACF,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,GAAG,IAAI,0DAA0D;QACjE,qBAAqB,IAAI,yBAAyB,OAAO,CAAC,aAAa,EAAE;QACzE,uDAAuD,OAAO,CAAC,gBAAgB,EAAE;KAClF;CACF,CAAC"}

package/dist/secret-stores/gcloud.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Google Secret Manager. Both `secrets create` and `versions add` read the
+ * payload from stdin with `--data-file=-`; creation fails when the secret
+ * already exists, so the second attempt adds a version to it.
+ */
+export declare const gcloud: SecretStore;

package/dist/secret-stores/gcloud.js

@@ -0,0 +1,62 @@
+import { preflight, run, trimmedStderr } from "./exec.js";
+import { resourceName, slug } from "./naming.js";
+const INSTALL_HINT = "install the Google Cloud CLI from https://cloud.google.com/sdk/docs/install (brew install --cask google-cloud-sdk), then run `gcloud auth login`";
+/** The project gcloud is currently configured for, so --project stays optional. */
+function resolveProjectFromConfig() {
+    const res = run("gcloud", ["config", "get-value", "project"]);
+    const project = res.stdout.trim();
+    if (res.status !== 0 || !project || project === "(unset)") {
+        const detail = trimmedStderr(res);
+        throw new Error(`gcloud has no active project${detail ? ` (${detail})` : ""}. Pass --project my-project, or run \`gcloud config set project my-project\`.`);
+    }
+    return project;
+}
+function target(options) {
+    const project = options.project ? slug("--project", options.project) : resolveProjectFromConfig();
+    return { describe: `Google Secret Manager in project ${project}`, fields: { project } };
+}
+/**
+ * Google Secret Manager. Both `secrets create` and `versions add` read the
+ * payload from stdin with `--data-file=-`; creation fails when the secret
+ * already exists, so the second attempt adds a version to it.
+ */
+export const gcloud = {
+    id: "gcloud",
+    label: "Google Secret Manager",
+    bin: "gcloud",
+    shorthand: "--gcp-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["project"],
+    validateName: (name) => resourceName("Google Secret Manager secret", name, "_"),
+    preflight: () => preflight({
+        bin: "gcloud",
+        label: "Google Secret Manager",
+        installHint: INSTALL_HINT,
+        authArgs: ["auth", "print-access-token"],
+        authHint: "Run `gcloud auth login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const project = ["--project", t.fields.project];
+        return [
+            {
+                note: "gcloud secrets create",
+                kind: "stdin",
+                args: ["secrets", "create", name, "--data-file=-", "--replication-policy=automatic", ...project],
+            },
+            {
+                note: "gcloud secrets versions add",
+                kind: "stdin",
+                args: ["secrets", "versions", "add", name, "--data-file=-", ...project],
+            },
+        ];
+    },
+    usage: (name, t, gateway) => [
+        "Read it back at runtime:",
+        `  gcloud secrets versions access latest --secret=${name} --project=${t.fields.project}`,
+        `  # export OPENAI_API_KEY=$(…) with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+        `  # Cloud Run: gcloud run deploy … --set-secrets OPENAI_API_KEY=${name}:latest`,
+    ],
+};
+//# sourceMappingURL=gcloud.js.map

package/dist/secret-stores/gcloud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../../src/secret-stores/gcloud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,kJAAkJ,CAAC;AAErJ,mFAAmF;AACnF,SAAS,wBAAwB;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,+EAA+E,CAC3I,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;IAClG,OAAO,EAAE,QAAQ,EAAE,oCAAoC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,uBAAuB;IAC9B,GAAG,EAAE,QAAQ;IACb,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,8BAA8B,EAAE,IAAI,EAAE,GAAG,CAAC;IAC/E,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACxC,QAAQ,EAAE,gCAAgC;KAC3C,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO;YACL;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,gCAAgC,EAAE,GAAG,OAAO,CAAC;aACjG;YACD;gBACE,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;aACxE;SACF,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,0BAA0B;QAC1B,oDAAoD,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE;QACxF,uDAAuD,OAAO,CAAC,aAAa,EAAE;QAC9E,mEAAmE,IAAI,SAAS;KACjF;CACF,CAAC"}

package/dist/secret-stores/github.d.ts

@@ -0,0 +1,9 @@
+import type { SecretStore } from "./types.js";
+export declare const GH_INSTALL_HINT = "install the GitHub CLI from https://cli.github.com (brew install gh / winget install GitHub.cli), then run `gh auth login`";
+/** Resolves owner/repo for the current directory the same way `gh` does (git remotes + gh config). */
+export declare function resolveRepoFromCwd(): string;
+/**
+ * GitHub Actions. `gh secret set` reads the value from stdin when `--body` is
+ * omitted, so the key never appears in argv, `ps`, shell history or our output.
+ */
+export declare const github: SecretStore;

package/dist/secret-stores/github.js

@@ -0,0 +1,74 @@
+import { preflight, run, trimmedStderr } from "./exec.js";
+import { validateRepo, validateSecretName } from "./naming.js";
+export const GH_INSTALL_HINT = "install the GitHub CLI from https://cli.github.com (brew install gh / winget install GitHub.cli), then run `gh auth login`";
+/** Resolves owner/repo for the current directory the same way `gh` does (git remotes + gh config). */
+export function resolveRepoFromCwd() {
+    const res = run("gh", ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"]);
+    const repo = res.stdout.trim();
+    if (res.status !== 0 || !repo) {
+        const detail = trimmedStderr(res);
+        throw new Error(`could not determine the GitHub repository from the current directory${detail ? ` (${detail})` : ""}. Pass --repo owner/repo, or run from inside a clone with a GitHub remote.`);
+    }
+    return repo;
+}
+/** Where the secret lands: a repository, one of its environments, or an organization. */
+function target(options) {
+    const org = options.org?.trim();
+    const env = options.env?.trim();
+    if (org) {
+        if (options.repo || env) {
+            throw new Error("--org cannot be combined with --repo or --env (organization secrets are not scoped to one repository)");
+        }
+        if (!/^[A-Za-z0-9_.-]+$/.test(org))
+            throw new Error(`--org must be an organization login, got "${options.org}"`);
+        return { describe: `organization ${org}`, fields: { kind: "org", org } };
+    }
+    const repo = options.repo ? validateRepo(options.repo) : resolveRepoFromCwd();
+    if (env)
+        return { describe: `${repo}, environment ${env}`, fields: { kind: "env", repo, env } };
+    return { describe: `${repo} (repository secret)`, fields: { kind: "repo", repo } };
+}
+/**
+ * GitHub Actions. `gh secret set` reads the value from stdin when `--body` is
+ * omitted, so the key never appears in argv, `ps`, shell history or our output.
+ */
+export const github = {
+    id: "github",
+    label: "GitHub Actions",
+    bin: "gh",
+    shorthand: "--gh-secret",
+    nameLabel: "NAME",
+    installHint: GH_INSTALL_HINT,
+    options: ["repo", "env", "org"],
+    validateName: validateSecretName,
+    preflight: () => preflight({
+        bin: "gh",
+        label: "GitHub Actions",
+        installHint: GH_INSTALL_HINT,
+        authArgs: ["auth", "status"],
+        authHint: "Run `gh auth login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const args = ["secret", "set", name];
+        if (t.fields.kind === "org")
+            args.push("--org", t.fields.org);
+        else if (t.fields.kind === "env")
+            args.push("--repo", t.fields.repo, "--env", t.fields.env);
+        else
+            args.push("--repo", t.fields.repo);
+        return [{ note: "gh secret set", kind: "stdin", args }];
+    },
+    // Both predate the multi-store registry and are part of the published
+    // contract: key labels in the app and the `snippet` field in --output json.
+    keyName: (name, t) => (t.fields.kind === "org" ? `gh-secret:${name}` : `gh:${t.fields.repo}:${name}`),
+    snippet: (name) => `\${{ secrets.${name} }}`,
+    usage: (name, _t, gateway) => [
+        "Use it in a workflow step:",
+        "  env:",
+        `    ANTHROPIC_AUTH_TOKEN: \${{ secrets.${name} }}`,
+        `    ANTHROPIC_BASE_URL: ${gateway.anthropicBaseUrl}`,
+        `  # OpenAI-compatible clients: OPENAI_API_KEY: \${{ secrets.${name} }} with OPENAI_BASE_URL: ${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=github.js.map

package/dist/secret-stores/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/secret-stores/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG/D,MAAM,CAAC,MAAM,eAAe,GAC1B,4HAA4H,CAAC;AAE/H,sGAAsG;AACtG,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,4EAA4E,CAChL,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AACzF,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACjH,OAAO,EAAE,QAAQ,EAAE,gBAAgB,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAC9E,IAAI,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,iBAAiB,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;IAChG,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,gBAAgB;IACvB,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,eAAe;IAC5B,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;IAC/B,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5B,QAAQ,EAAE,4BAA4B;KACvC,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aACzD,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;YACvF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,sEAAsE;IACtE,4EAA4E;IAC5E,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IACrG,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,IAAI,KAAK;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,4BAA4B;QAC5B,QAAQ;QACR,0CAA0C,IAAI,KAAK;QACnD,2BAA2B,OAAO,CAAC,gBAAgB,EAAE;QACrD,+DAA+D,IAAI,6BAA6B,OAAO,CAAC,aAAa,EAAE;KACxH;CACF,CAAC"}

package/dist/secret-stores/gitlab.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * GitLab CI/CD variables. `glab variable set KEY` reads the value from stdin
+ * when no value argument is given (`cat file | glab variable set KEY`), and
+ * `--masked` keeps it out of job logs.
+ */
+export declare const gitlab: SecretStore;

package/dist/secret-stores/gitlab.js

@@ -0,0 +1,82 @@
+import { preflight, run, trimmedStderr } from "./exec.js";
+import { envStyleName, slug } from "./naming.js";
+const INSTALL_HINT = "install the GitLab CLI from https://gitlab.com/gitlab-org/cli (brew install glab), then run `glab auth login`";
+/** Resolves the project for the current directory the way glab itself does. */
+function resolveProjectFromCwd() {
+    const res = run("glab", ["repo", "view", "-F", "json"]);
+    if (res.status === 0) {
+        try {
+            const parsed = JSON.parse(res.stdout);
+            if (parsed.path_with_namespace)
+                return parsed.path_with_namespace;
+        }
+        catch {
+            // Fall through to the shared error below.
+        }
+    }
+    const detail = trimmedStderr(res);
+    throw new Error(`could not determine the GitLab project from the current directory${detail ? ` (${detail})` : ""}. Pass --project group/project, or run from inside a clone with a GitLab remote.`);
+}
+function target(options) {
+    const group = options.org?.trim();
+    const env = options.env?.trim();
+    if (group) {
+        if (options.project)
+            throw new Error("--org (GitLab group) cannot be combined with --project");
+        const g = slug("--org", group, /^[A-Za-z0-9_.\-/]+$/);
+        return { describe: `group ${g}`, fields: { kind: "group", group: g, ...(env ? { env } : {}) } };
+    }
+    const project = options.project ? slug("--project", options.project, /^[A-Za-z0-9_.\-/]+$/) : resolveProjectFromCwd();
+    return {
+        describe: `${project}${env ? `, environment scope ${env}` : ""} (CI/CD variable)`,
+        fields: { kind: "project", project, ...(env ? { env } : {}) },
+    };
+}
+/**
+ * GitLab CI/CD variables. `glab variable set KEY` reads the value from stdin
+ * when no value argument is given (`cat file | glab variable set KEY`), and
+ * `--masked` keeps it out of job logs.
+ */
+export const gitlab = {
+    id: "gitlab",
+    label: "GitLab CI/CD",
+    bin: "glab",
+    shorthand: "--gitlab-var",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["project", "org", "env"],
+    validateName: (name) => envStyleName("GitLab CI/CD variable", name),
+    preflight: () => preflight({
+        bin: "glab",
+        label: "GitLab CI/CD",
+        installHint: INSTALL_HINT,
+        authArgs: ["auth", "status"],
+        authHint: "Run `glab auth login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const scope = (verb) => {
+            const args = ["variable", verb, name, "--masked"];
+            if (t.fields.kind === "group")
+                args.push("--group", t.fields.group);
+            else
+                args.push("--repo", t.fields.project);
+            if (t.fields.env)
+                args.push("--scope", t.fields.env);
+            return args;
+        };
+        // `set` refuses an existing variable, so fall back to `update`.
+        return [
+            { note: "glab variable set", kind: "stdin", args: scope("set") },
+            { note: "glab variable update", kind: "stdin", args: scope("update") },
+        ];
+    },
+    usage: (name, _t, gateway) => [
+        "Use it in .gitlab-ci.yml:",
+        "  variables:",
+        `    ANTHROPIC_BASE_URL: ${gateway.anthropicBaseUrl}`,
+        `  # ${name} is injected into every job; for OpenAI-compatible clients set`,
+        `  # OPENAI_API_KEY: $${name} with OPENAI_BASE_URL: ${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=gitlab.js.map

package/dist/secret-stores/gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/secret-stores/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,+GAA+G,CAAC;AAElH,+EAA+E;AAC/E,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC;YAC1E,IAAI,MAAM,CAAC,mBAAmB;gBAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,kFAAkF,CACnL,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC;IACtH,OAAO;QACL,QAAQ,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB;QACjF,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,cAAc;IACrB,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC;IAClC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACnE,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5B,QAAQ,EAAE,8BAA8B;KACzC,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;gBAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,gEAAgE;QAChE,OAAO;YACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YAChE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,2BAA2B;QAC3B,cAAc;QACd,2BAA2B,OAAO,CAAC,gBAAgB,EAAE;QACrD,OAAO,IAAI,gEAAgE;QAC3E,wBAAwB,IAAI,0BAA0B,OAAO,CAAC,aAAa,EAAE;KAC9E;CACF,CAAC"}

package/dist/secret-stores/index.d.ts

@@ -0,0 +1,42 @@
+import { type SecretStore, type StoreId, type StoreOptions } from "./types.js";
+export { deliver, installed, resolveBin } from "./exec.js";
+export { GH_INSTALL_HINT, resolveRepoFromCwd } from "./github.js";
+export { validateRepo, validateSecretName } from "./naming.js";
+export { STORE_IDS } from "./types.js";
+export type { Delivery, Gateway, SecretStore, StoreId, StoreOptions, StoreTarget } from "./types.js";
+export { VERCEL_TARGETS } from "./vercel.js";
+/** Every store, in the order they are listed to the operator. */
+export declare const STORES: readonly SecretStore[];
+export declare function storeById(id: string): SecretStore;
+/** `--store <id>` is the canonical selector; every store also has a shorthand. */
+export interface StoreSelection {
+    store: SecretStore;
+    /** Secret / variable / item / path name. */
+    name: string;
+    /** The flag the operator actually used, for error messages. */
+    flag: string;
+}
+/**
+ * Resolves which store gets the key from `--store`/`--secret` or exactly one
+ * shorthand, and rejects flags that belong to a different store — silently
+ * ignoring `--repo` on an AWS run would store the secret somewhere the
+ * operator did not intend.
+ */
+export declare function selectStore(options: StoreOptions & {
+    store?: string;
+    shorthands: Partial<Record<StoreId, string>>;
+}): StoreSelection;
+export interface StoreProbe {
+    id: StoreId;
+    label: string;
+    bin: string;
+    /** The binary actually found on PATH (fly vs flyctl). */
+    resolvedBin: string;
+    installed: boolean;
+    shorthand: string;
+    nameLabel: string;
+    flags: string[];
+    installHint: string;
+}
+/** Which platform CLIs this machine has — the answer to "what can I delegate to?". */
+export declare function probeStores(): StoreProbe[];

package/dist/secret-stores/index.js

@@ -0,0 +1,106 @@
+import { aws } from "./aws.js";
+import { azure } from "./azure.js";
+import { cloudflare } from "./cloudflare.js";
+import { doppler } from "./doppler.js";
+import { installed, resolveBin } from "./exec.js";
+import { fly } from "./fly.js";
+import { gcloud } from "./gcloud.js";
+import { github } from "./github.js";
+import { gitlab } from "./gitlab.js";
+import { kubernetes } from "./kubernetes.js";
+import { onepassword } from "./onepassword.js";
+import { vault } from "./vault.js";
+import { vercel } from "./vercel.js";
+import { STORE_IDS } from "./types.js";
+export { deliver, installed, resolveBin } from "./exec.js";
+export { GH_INSTALL_HINT, resolveRepoFromCwd } from "./github.js";
+export { validateRepo, validateSecretName } from "./naming.js";
+export { STORE_IDS } from "./types.js";
+export { VERCEL_TARGETS } from "./vercel.js";
+/** Every store, in the order they are listed to the operator. */
+export const STORES = [
+    github,
+    gitlab,
+    aws,
+    gcloud,
+    azure,
+    onepassword,
+    vault,
+    doppler,
+    cloudflare,
+    vercel,
+    kubernetes,
+    fly,
+];
+/** Human label for every flag, so "unsupported flag" errors name the flag the operator typed. */
+const OPTION_FLAGS = {
+    repo: "--repo",
+    env: "--env",
+    org: "--org",
+    region: "--region",
+    project: "--project",
+    keyVault: "--key-vault",
+    opVault: "--op-vault",
+    mount: "--mount",
+    field: "--field",
+    dopplerConfig: "--doppler-config",
+    worker: "--worker",
+    vercelTarget: "--vercel-target",
+    namespace: "--namespace",
+    k8sKey: "--k8s-key",
+    app: "--app",
+};
+const OPTION_KEYS = Object.keys(OPTION_FLAGS);
+export function storeById(id) {
+    const store = STORES.find((s) => s.id === id);
+    if (!store)
+        throw new Error(`unknown --store "${id}". Available: ${STORE_IDS.join(", ")}`);
+    return store;
+}
+/**
+ * Resolves which store gets the key from `--store`/`--secret` or exactly one
+ * shorthand, and rejects flags that belong to a different store — silently
+ * ignoring `--repo` on an AWS run would store the secret somewhere the
+ * operator did not intend.
+ */
+export function selectStore(options) {
+    const used = STORES.filter((s) => options.shorthands[s.id] !== undefined);
+    if (used.length > 1) {
+        throw new Error(`pick one destination: ${used.map((s) => s.shorthand).join(" and ")} cannot both be set`);
+    }
+    const shorthand = used[0];
+    if (shorthand && options.store && options.store !== shorthand.id) {
+        throw new Error(`--store ${options.store} contradicts ${shorthand.shorthand} (which implies --store ${shorthand.id})`);
+    }
+    const store = shorthand ?? (options.store ? storeById(options.store) : undefined);
+    if (!store) {
+        throw new Error(`pick a destination: --store <${STORE_IDS.join("|")}> with --secret <NAME>, or a shorthand such as ${github.shorthand} NAME. See \`heyditto endpoints keys stores\`.`);
+    }
+    const raw = shorthand ? options.shorthands[store.id] : options.secret;
+    const flag = shorthand ? store.shorthand : "--secret";
+    if (!raw)
+        throw new Error(`--store ${store.id} needs --secret <${store.nameLabel}>`);
+    const stray = OPTION_KEYS.filter((key) => options[key] !== undefined && !store.options.includes(key));
+    if (stray.length > 0) {
+        throw new Error(`${stray.map((key) => OPTION_FLAGS[key]).join(", ")} ${stray.length > 1 ? "do" : "does"} not apply to ${store.label}; it accepts ${store.options.map((key) => OPTION_FLAGS[key]).join(", ") || "no scoping flags"}`);
+    }
+    return { store, name: store.validateName(raw), flag };
+}
+/** Which platform CLIs this machine has — the answer to "what can I delegate to?". */
+export function probeStores() {
+    return STORES.map((store) => {
+        const bin = resolveBin(store);
+        return {
+            id: store.id,
+            label: store.label,
+            bin: store.bin,
+            resolvedBin: bin,
+            installed: installed(bin, store.versionArgs),
+            shorthand: store.shorthand,
+            nameLabel: store.nameLabel,
+            flags: store.options.map((key) => OPTION_FLAGS[key]),
+            installHint: store.installHint,
+        };
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/secret-stores/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secret-stores/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAoB,SAAS,EAAwD,MAAM,YAAY,CAAC;AAE/G,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,MAAM,GAA2B;IAC5C,MAAM;IACN,MAAM;IACN,GAAG;IACH,MAAM;IACN,KAAK;IACL,WAAW;IACX,KAAK;IACL,OAAO;IACP,UAAU;IACV,MAAM;IACN,UAAU;IACV,GAAG;CACJ,CAAC;AAEF,iGAAiG;AACjG,MAAM,YAAY,GAAmC;IACnD,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,aAAa;IACvB,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,aAAa,EAAE,kBAAkB;IACjC,MAAM,EAAE,UAAU;IAClB,YAAY,EAAE,iBAAiB;IAC/B,SAAS,EAAE,aAAa;IACxB,MAAM,EAAE,WAAW;IACnB,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAqB,CAAC;AAElE,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAwF;IAClH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,KAAK,gBAAgB,SAAS,CAAC,SAAS,2BAA2B,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gCAAgC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,kDAAkD,MAAM,CAAC,SAAS,gDAAgD,CACtK,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,oBAAoB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,iBAAiB,KAAK,CAAC,KAAK,gBAAgB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,EAAE,CACpN,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAeD,sFAAsF;AACtF,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACpD,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}