@heyditto/cli 2.5.2 → 2.7.0

package/dist/secret-stores/aws.d.ts

@@ -0,0 +1,8 @@
+import type { SecretStore } from "./types.js";
+/**
+ * AWS Secrets Manager. `--secret-string` accepts the AWS CLI's `file://`
+ * paramfile syntax, so the plaintext is read from `/dev/stdin` rather than
+ * argv. `create-secret` refuses an existing name, so a second attempt stores
+ * a new version of it instead.
+ */
+export declare const aws: SecretStore;

package/dist/secret-stores/aws.js

@@ -0,0 +1,59 @@
+import { PATH_PLACEHOLDER, preflight } from "./exec.js";
+import { resourceName, slug } from "./naming.js";
+const INSTALL_HINT = "install the AWS CLI from https://aws.amazon.com/cli (brew install awscli), then configure credentials with `aws configure` or `aws sso login`";
+function target(options) {
+    const region = options.region ? slug("--region", options.region, /^[a-z0-9-]+$/) : undefined;
+    return {
+        describe: region ? `AWS Secrets Manager in ${region}` : "AWS Secrets Manager in the configured region",
+        fields: region ? { region } : {},
+    };
+}
+/**
+ * AWS Secrets Manager. `--secret-string` accepts the AWS CLI's `file://`
+ * paramfile syntax, so the plaintext is read from `/dev/stdin` rather than
+ * argv. `create-secret` refuses an existing name, so a second attempt stores
+ * a new version of it instead.
+ */
+export const aws = {
+    id: "aws",
+    label: "AWS Secrets Manager",
+    bin: "aws",
+    shorthand: "--aws-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["region"],
+    validateName: (name) => resourceName("AWS Secrets Manager secret", name, "_./+=@"),
+    preflight: () => preflight({
+        bin: "aws",
+        label: "AWS Secrets Manager",
+        installHint: INSTALL_HINT,
+        authArgs: ["sts", "get-caller-identity"],
+        authHint: "Configure credentials with `aws configure` or `aws sso login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const region = t.fields.region ? ["--region", t.fields.region] : [];
+        return [
+            {
+                note: "aws secretsmanager create-secret",
+                kind: "path",
+                args: ["secretsmanager", "create-secret", "--name", name, "--secret-string", `file://${PATH_PLACEHOLDER}`, ...region],
+            },
+            {
+                note: "aws secretsmanager put-secret-value",
+                kind: "path",
+                args: ["secretsmanager", "put-secret-value", "--secret-id", name, "--secret-string", `file://${PATH_PLACEHOLDER}`, ...region],
+            },
+        ];
+    },
+    usage: (name, t, gateway) => {
+        const region = t.fields.region ? ` --region ${t.fields.region}` : "";
+        return [
+            "Read it back at runtime:",
+            `  aws secretsmanager get-secret-value --secret-id ${name}${region} --query SecretString --output text`,
+            `  # export OPENAI_API_KEY=$(…) with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+            `  # or ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL=${gateway.anthropicBaseUrl}`,
+        ];
+    },
+};
+//# sourceMappingURL=aws.js.map

package/dist/secret-stores/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/secret-stores/aws.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,+IAA+I,CAAC;AAElJ,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC,CAAC,8CAA8C;QACtG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;KACjC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,GAAG,GAAgB;IAC9B,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,qBAAqB;IAC5B,GAAG,EAAE,KAAK;IACV,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,4BAA4B,EAAE,IAAI,EAAE,QAAQ,CAAC;IAClF,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,CAAC;QACxC,QAAQ,EAAE,sEAAsE;KACjF,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO;YACL;gBACE,IAAI,EAAE,kCAAkC;gBACxC,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,gBAAgB,EAAE,EAAE,GAAG,MAAM,CAAC;aACtH;YACD;gBACE,IAAI,EAAE,qCAAqC;gBAC3C,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,gBAAgB,EAAE,EAAE,GAAG,MAAM,CAAC;aAC9H;SACF,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,0BAA0B;YAC1B,qDAAqD,IAAI,GAAG,MAAM,qCAAqC;YACvG,uDAAuD,OAAO,CAAC,aAAa,EAAE;YAC9E,uDAAuD,OAAO,CAAC,gBAAgB,EAAE;SAClF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/secret-stores/azure.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Azure Key Vault. `az keyvault secret set --file` reads the value from a
+ * file, so the plaintext travels through `/dev/stdin` instead of `--value`
+ * in argv. `set` already creates a new version when the secret exists.
+ */
+export declare const azure: SecretStore;

package/dist/secret-stores/azure.js

@@ -0,0 +1,63 @@
+import { PATH_PLACEHOLDER, preflight } from "./exec.js";
+import { resourceName, slug } from "./naming.js";
+const INSTALL_HINT = "install the Azure CLI from https://learn.microsoft.com/cli/azure/install-azure-cli (brew install azure-cli), then run `az login`";
+function target(options) {
+    const vault = options.keyVault?.trim();
+    if (!vault)
+        throw new Error("Azure Key Vault needs --key-vault <name> (the vault the secret goes into)");
+    const name = slug("--key-vault", vault, /^[A-Za-z0-9-]+$/);
+    return { describe: `Azure Key Vault ${name}`, fields: { keyVault: name } };
+}
+/**
+ * Azure Key Vault. `az keyvault secret set --file` reads the value from a
+ * file, so the plaintext travels through `/dev/stdin` instead of `--value`
+ * in argv. `set` already creates a new version when the secret exists.
+ */
+export const azure = {
+    id: "azure",
+    label: "Azure Key Vault",
+    bin: "az",
+    shorthand: "--az-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    versionArgs: ["version"],
+    options: ["keyVault"],
+    validateName: (name) => resourceName("Azure Key Vault secret", name),
+    preflight: () => preflight({
+        bin: "az",
+        label: "Azure Key Vault",
+        installHint: INSTALL_HINT,
+        versionArgs: azure.versionArgs,
+        authArgs: ["account", "show"],
+        authHint: "Run `az login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => [
+        {
+            note: "az keyvault secret set",
+            kind: "path",
+            args: [
+                "keyvault",
+                "secret",
+                "set",
+                "--vault-name",
+                t.fields.keyVault,
+                "--name",
+                name,
+                "--file",
+                PATH_PLACEHOLDER,
+                "--encoding",
+                "utf-8",
+                "--output",
+                "none",
+            ],
+        },
+    ],
+    usage: (name, t, gateway) => [
+        "Read it back at runtime:",
+        `  az keyvault secret show --vault-name ${t.fields.keyVault} --name ${name} --query value -o tsv`,
+        `  # Container Apps / App Service: reference @Microsoft.KeyVault(SecretUri=…) as OPENAI_API_KEY`,
+        `  # with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=azure.js.map

package/dist/secret-stores/azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure.js","sourceRoot":"","sources":["../../src/secret-stores/azure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,kIAAkI,CAAC;AAErI,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IACzG,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC3D,OAAO,EAAE,QAAQ,EAAE,mBAAmB,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,KAAK,GAAgB;IAChC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,iBAAiB;IACxB,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,CAAC,SAAS,CAAC;IACxB,OAAO,EAAE,CAAC,UAAU,CAAC;IACrB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,wBAAwB,EAAE,IAAI,CAAC;IACpE,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,uBAAuB;KAClC,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACvB;YACE,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE;gBACJ,UAAU;gBACV,QAAQ;gBACR,KAAK;gBACL,cAAc;gBACd,CAAC,CAAC,MAAM,CAAC,QAAQ;gBACjB,QAAQ;gBACR,IAAI;gBACJ,QAAQ;gBACR,gBAAgB;gBAChB,YAAY;gBACZ,OAAO;gBACP,UAAU;gBACV,MAAM;aACP;SACF;KACF;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,0BAA0B;QAC1B,0CAA0C,CAAC,CAAC,MAAM,CAAC,QAAQ,WAAW,IAAI,uBAAuB;QACjG,gGAAgG;QAChG,4BAA4B,OAAO,CAAC,aAAa,EAAE;KACpD;CACF,CAAC"}

package/dist/secret-stores/cloudflare.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Cloudflare Workers. `wrangler secret put NAME` reads the value from stdin
+ * when it is not attached to a terminal, and replaces an existing secret.
+ * Without `--name` it uses the Worker in the local wrangler config.
+ */
+export declare const cloudflare: SecretStore;

package/dist/secret-stores/cloudflare.js

@@ -0,0 +1,46 @@
+import { preflight } from "./exec.js";
+import { envStyleName, slug } from "./naming.js";
+const INSTALL_HINT = "install Wrangler from https://developers.cloudflare.com/workers/wrangler/install-and-update (npm i -g wrangler), then run `wrangler login`";
+function target(options) {
+    const worker = options.worker ? slug("--worker", options.worker, /^[A-Za-z0-9_.-]+$/) : undefined;
+    return {
+        describe: worker ? `Cloudflare Worker ${worker}` : "the Worker in this directory's wrangler config",
+        fields: worker ? { worker } : {},
+    };
+}
+/**
+ * Cloudflare Workers. `wrangler secret put NAME` reads the value from stdin
+ * when it is not attached to a terminal, and replaces an existing secret.
+ * Without `--name` it uses the Worker in the local wrangler config.
+ */
+export const cloudflare = {
+    id: "cloudflare",
+    label: "Cloudflare Workers",
+    bin: "wrangler",
+    shorthand: "--cf-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["worker"],
+    validateName: (name) => envStyleName("Cloudflare Worker secret", name),
+    preflight: () => preflight({
+        bin: "wrangler",
+        label: "Cloudflare Workers",
+        installHint: INSTALL_HINT,
+        authArgs: ["whoami"],
+        authHint: "Run `wrangler login` first, or set CLOUDFLARE_API_TOKEN.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const args = ["secret", "put", name];
+        if (t.fields.worker)
+            args.push("--name", t.fields.worker);
+        return [{ note: "wrangler secret put", kind: "stdin", args }];
+    },
+    usage: (name, _t, gateway) => [
+        "Use it inside the Worker:",
+        `  const key = env.${name};`,
+        `  // OpenAI-compatible base: ${gateway.openaiBaseUrl}`,
+        `  // Anthropic base: ${gateway.anthropicBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=cloudflare.js.map

package/dist/secret-stores/cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare.js","sourceRoot":"","sources":["../../src/secret-stores/cloudflare.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,4IAA4I,CAAC;AAE/I,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC,CAAC,gDAAgD;QACnG,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;KACjC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,oBAAoB;IAC3B,GAAG,EAAE,UAAU;IACf,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,0BAA0B,EAAE,IAAI,CAAC;IACtE,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,0DAA0D;KACrE,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,2BAA2B;QAC3B,qBAAqB,IAAI,GAAG;QAC5B,gCAAgC,OAAO,CAAC,aAAa,EAAE;QACvD,wBAAwB,OAAO,CAAC,gBAAgB,EAAE;KACnD;CACF,CAAC"}

package/dist/secret-stores/doppler.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Doppler. `doppler secrets set NAME` reads the value from stdin;
+ * `--no-interactive` keeps it from prompting and `--silent` stops it echoing
+ * the value back into logs. Setting an existing secret updates it.
+ */
+export declare const doppler: SecretStore;

package/dist/secret-stores/doppler.js

@@ -0,0 +1,52 @@
+import { preflight } from "./exec.js";
+import { envStyleName, slug } from "./naming.js";
+const INSTALL_HINT = "install the Doppler CLI from https://docs.doppler.com/docs/install-cli (brew install dopplerhq/cli/doppler), then run `doppler login`";
+function target(options) {
+    const project = options.project ? slug("--project", options.project) : undefined;
+    const config = options.dopplerConfig ? slug("--doppler-config", options.dopplerConfig) : undefined;
+    if (config && !project)
+        throw new Error("--doppler-config needs --project (a config belongs to one project)");
+    const where = project ? `Doppler ${project}${config ? `/${config}` : ""}` : "the Doppler project configured for this directory";
+    return { describe: where, fields: { ...(project ? { project } : {}), ...(config ? { config } : {}) } };
+}
+/**
+ * Doppler. `doppler secrets set NAME` reads the value from stdin;
+ * `--no-interactive` keeps it from prompting and `--silent` stops it echoing
+ * the value back into logs. Setting an existing secret updates it.
+ */
+export const doppler = {
+    id: "doppler",
+    label: "Doppler",
+    bin: "doppler",
+    shorthand: "--doppler-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["project", "dopplerConfig"],
+    validateName: (name) => envStyleName("Doppler secret", name),
+    preflight: () => preflight({
+        bin: "doppler",
+        label: "Doppler",
+        installHint: INSTALL_HINT,
+        authArgs: ["me"],
+        authHint: "Run `doppler login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const args = ["secrets", "set", name, "--no-interactive", "--silent"];
+        if (t.fields.project)
+            args.push("--project", t.fields.project);
+        if (t.fields.config)
+            args.push("--config", t.fields.config);
+        return [{ note: "doppler secrets set", kind: "stdin", args }];
+    },
+    usage: (name, t, gateway) => {
+        const scope = `${t.fields.project ? ` -p ${t.fields.project}` : ""}${t.fields.config ? ` -c ${t.fields.config}` : ""}`;
+        return [
+            "Run anything with it injected:",
+            `  doppler run${scope} -- your-command`,
+            `  # ${name} is in the environment; point clients at OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+            `  doppler secrets get ${name} --plain${scope}   # read it back`,
+        ];
+    },
+};
+//# sourceMappingURL=doppler.js.map

package/dist/secret-stores/doppler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doppler.js","sourceRoot":"","sources":["../../src/secret-stores/doppler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,uIAAuI,CAAC;AAE1I,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnG,IAAI,MAAM,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mDAAmD,CAAC;IAChI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;AACzG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAgB;IAClC,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,SAAS;IACd,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC;IACrC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,CAAC;IAC5D,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,IAAI,CAAC;QAChB,QAAQ,EAAE,4BAA4B;KACvC,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvH,OAAO;YACL,gCAAgC;YAChC,gBAAgB,KAAK,kBAAkB;YACvC,OAAO,IAAI,4DAA4D,OAAO,CAAC,aAAa,EAAE;YAC9F,yBAAyB,IAAI,WAAW,KAAK,mBAAmB;SACjE,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/secret-stores/exec.d.ts

@@ -0,0 +1,55 @@
+import type { Delivery, SecretStore } from "./types.js";
+/**
+ * Subprocess plumbing shared by every store. Generalized from the original
+ * GitHub-only helper: the plaintext goes to the child's stdin, so it never
+ * appears in argv, `ps`, shell history or our own output.
+ */
+export interface RunResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    /** The binary is not on PATH. */
+    missing: boolean;
+}
+export declare function run(bin: string, args: string[], input?: string): RunResult;
+/** Last few stderr lines, clamped — platform CLIs can be very chatty on failure. */
+export declare function trimmedStderr(res: RunResult): string;
+/**
+ * True when `bin` is on PATH. Memoized: `endpoints keys stores` asks about a
+ * dozen CLIs, and resolving alternate names asks again.
+ */
+export declare function installed(bin: string, versionArgs?: readonly string[]): boolean;
+/**
+ * Some CLIs ship under more than one name (`fly` and `flyctl`). Picks the
+ * first that answers, remembering it so one command spawns the probe once.
+ */
+export declare function resolveBin(store: {
+    bin: string;
+    altBins?: readonly string[];
+    versionArgs?: readonly string[];
+}): string;
+/**
+ * Standard preflight: the binary answers, and the account check exits 0.
+ * Runs before anything is minted so a missing CLI costs nothing.
+ */
+export declare function preflight(input: {
+    bin: string;
+    altBins?: readonly string[];
+    label: string;
+    installHint: string;
+    versionArgs?: readonly string[];
+    authArgs: string[];
+    authHint: string;
+}): void;
+/** Placeholder in `path` delivery argv, replaced with the file the CLI should read. */
+export declare const PATH_PLACEHOLDER = "{}";
+/**
+ * Hands `value` to the store's CLI, trying each attempt in order. Throws with
+ * every attempt's own last stderr lines when all of them fail, so the caller
+ * can revoke the key it just minted and the operator can see why.
+ *
+ * `path` delivery uses `/dev/stdin` wherever it exists, keeping the plaintext
+ * off disk. Only on Windows does it fall back to a 0600 file in a private
+ * temp directory, which is overwritten and removed before returning.
+ */
+export declare function deliver(store: SecretStore, name: string, attempts: Delivery[], value: string): void;

package/dist/secret-stores/exec.js

@@ -0,0 +1,132 @@
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+/** Keeps platform CLIs quiet and non-interactive; they must never prompt. */
+const QUIET_ENV = {
+    GH_NO_UPDATE_NOTIFIER: "1",
+    GH_PROMPT_DISABLED: "1",
+    GLAB_CHECK_UPDATE: "0",
+    NO_COLOR: "1",
+    AWS_PAGER: "",
+    CLOUDSDK_CORE_DISABLE_PROMPTS: "1",
+    AZURE_CORE_ONLY_SHOW_ERRORS: "true",
+    DO_NOT_TRACK: "1",
+};
+export function run(bin, args, input) {
+    const res = spawnSync(bin, args, {
+        encoding: "utf8",
+        // Always an explicit (possibly empty) stdin: a CLI that reads stdin on a
+        // probe like `gh auth status` must see EOF rather than wait for us.
+        input: input ?? "",
+        stdio: ["pipe", "pipe", "pipe"],
+        env: { ...process.env, ...QUIET_ENV },
+    });
+    const missing = res.error !== undefined && res.error.code === "ENOENT";
+    return { status: res.status, stdout: res.stdout ?? "", stderr: res.stderr ?? "", missing };
+}
+/** Last few stderr lines, clamped — platform CLIs can be very chatty on failure. */
+export function trimmedStderr(res) {
+    return (res.stderr || res.stdout).trim().split("\n").slice(-3).join(" ").slice(0, 300);
+}
+const presence = new Map();
+/**
+ * True when `bin` is on PATH. Memoized: `endpoints keys stores` asks about a
+ * dozen CLIs, and resolving alternate names asks again.
+ */
+export function installed(bin, versionArgs = ["--version"]) {
+    const cached = presence.get(bin);
+    if (cached !== undefined)
+        return cached;
+    const found = !run(bin, [...versionArgs]).missing;
+    presence.set(bin, found);
+    return found;
+}
+const resolvedBins = new Map();
+/**
+ * Some CLIs ship under more than one name (`fly` and `flyctl`). Picks the
+ * first that answers, remembering it so one command spawns the probe once.
+ */
+export function resolveBin(store) {
+    const cached = resolvedBins.get(store.bin);
+    if (cached)
+        return cached;
+    const candidates = [store.bin, ...(store.altBins ?? [])];
+    const found = candidates.find((bin) => installed(bin, store.versionArgs)) ?? store.bin;
+    resolvedBins.set(store.bin, found);
+    return found;
+}
+/**
+ * Standard preflight: the binary answers, and the account check exits 0.
+ * Runs before anything is minted so a missing CLI costs nothing.
+ */
+export function preflight(input) {
+    const bin = resolveBin(input);
+    const version = run(bin, [...(input.versionArgs ?? ["--version"])]);
+    if (version.missing) {
+        throw new Error(`storing a key in ${input.label} needs ${input.bin} on PATH; ${input.installHint}`);
+    }
+    const auth = run(bin, input.authArgs);
+    if (auth.missing) {
+        throw new Error(`storing a key in ${input.label} needs ${input.bin} on PATH; ${input.installHint}`);
+    }
+    if (auth.status !== 0) {
+        const detail = trimmedStderr(auth);
+        throw new Error(`${bin} is not signed in (\`${bin} ${input.authArgs.join(" ")}\` failed${detail ? `: ${detail}` : ""}). ${input.authHint}`);
+    }
+}
+/** Placeholder in `path` delivery argv, replaced with the file the CLI should read. */
+export const PATH_PLACEHOLDER = "{}";
+/** POSIX CLIs can read the piped stdin through this path; Windows cannot. */
+const STDIN_PATH = "/dev/stdin";
+function substitute(args, path) {
+    return args.map((arg) => arg.split(PATH_PLACEHOLDER).join(path));
+}
+/**
+ * Hands `value` to the store's CLI, trying each attempt in order. Throws with
+ * every attempt's own last stderr lines when all of them fail, so the caller
+ * can revoke the key it just minted and the operator can see why.
+ *
+ * `path` delivery uses `/dev/stdin` wherever it exists, keeping the plaintext
+ * off disk. Only on Windows does it fall back to a 0600 file in a private
+ * temp directory, which is overwritten and removed before returning.
+ */
+export function deliver(store, name, attempts, value) {
+    const failures = [];
+    for (const attempt of attempts) {
+        const payload = attempt.payload ? attempt.payload(value) : value;
+        const res = attempt.kind === "stdin" ? runStdin(store, attempt, payload) : runPath(store, attempt, payload);
+        if (res.missing) {
+            throw new Error(`${store.bin} disappeared from PATH while storing the secret; ${store.installHint}`);
+        }
+        if (res.status === 0)
+            return;
+        const detail = trimmedStderr(res);
+        failures.push(`${attempt.note}: ${detail || `exit ${res.status}`}`);
+    }
+    throw new Error(`${store.bin} could not store ${name} — ${failures.join("; ")}`);
+}
+function runStdin(store, attempt, payload) {
+    return run(resolveBin(store), attempt.args, payload);
+}
+function runPath(store, attempt, payload) {
+    if (process.platform !== "win32") {
+        return run(resolveBin(store), substitute(attempt.args, STDIN_PATH), payload);
+    }
+    const dir = mkdtempSync(join(tmpdir(), "heyditto-secret-"));
+    const file = join(dir, "value");
+    try {
+        writeFileSync(file, payload, { mode: 0o600 });
+        return run(resolveBin(store), substitute(attempt.args, file));
+    }
+    finally {
+        try {
+            writeFileSync(file, "0".repeat(payload.length), { mode: 0o600 });
+        }
+        catch {
+            // Best effort; the directory removal below is what matters.
+        }
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=exec.js.map

package/dist/secret-stores/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/secret-stores/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiBjC,6EAA6E;AAC7E,MAAM,SAAS,GAA2B;IACxC,qBAAqB,EAAE,GAAG;IAC1B,kBAAkB,EAAE,GAAG;IACvB,iBAAiB,EAAE,GAAG;IACtB,QAAQ,EAAE,GAAG;IACb,SAAS,EAAE,EAAE;IACb,6BAA6B,EAAE,GAAG;IAClC,2BAA2B,EAAE,MAAM;IACnC,YAAY,EAAE,GAAG;CAClB,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,KAAc;IAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;QAC/B,QAAQ,EAAE,MAAM;QAChB,yEAAyE;QACzE,oEAAoE;QACpE,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAK,GAAG,CAAC,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;IAClG,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,GAAc;IAC1C,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE5C;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,cAAiC,CAAC,WAAW,CAAC;IACnF,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAoF;IAC7G,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC;IACvF,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAQzB;IACC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,GAAG,aAAa,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,wBAAwB,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAC3H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,6EAA6E;AAC7E,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,SAAS,UAAU,CAAC,IAAc,EAAE,IAAY;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,KAAkB,EAAE,IAAY,EAAE,QAAoB,EAAE,KAAa;IAC3F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5G,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,oDAAoD,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,oBAAoB,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAkB,EAAE,OAAqC,EAAE,OAAe;IAC1F,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,OAAO,CAAC,KAAkB,EAAE,OAAoC,EAAE,OAAe;IACxF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/secret-stores/fly.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Fly.io. `fly secrets import` reads `KEY=VALUE` lines from stdin, which is
+ * the only way to set a secret without putting the value in argv. It replaces
+ * an existing secret and stages a release for the app.
+ */
+export declare const fly: SecretStore;

package/dist/secret-stores/fly.js

@@ -0,0 +1,54 @@
+import { preflight } from "./exec.js";
+import { envStyleName, slug } from "./naming.js";
+const INSTALL_HINT = "install flyctl from https://fly.io/docs/flyctl/install (brew install flyctl), then run `fly auth login`";
+function target(options) {
+    const app = options.app ? slug("--app", options.app, /^[a-z0-9-]+$/) : undefined;
+    return {
+        describe: app ? `Fly app ${app}` : "the Fly app in this directory's fly.toml",
+        fields: app ? { app } : {},
+    };
+}
+/**
+ * Fly.io. `fly secrets import` reads `KEY=VALUE` lines from stdin, which is
+ * the only way to set a secret without putting the value in argv. It replaces
+ * an existing secret and stages a release for the app.
+ */
+export const fly = {
+    id: "fly",
+    label: "Fly.io",
+    bin: "fly",
+    altBins: ["flyctl"],
+    shorthand: "--fly-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["app"],
+    validateName: (name) => envStyleName("Fly secret", name),
+    preflight: () => preflight({
+        bin: "fly",
+        altBins: ["flyctl"],
+        label: "Fly.io",
+        installHint: INSTALL_HINT,
+        authArgs: ["auth", "whoami"],
+        authHint: "Run `fly auth login` first, or set FLY_API_TOKEN.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const args = ["secrets", "import"];
+        if (t.fields.app)
+            args.push("--app", t.fields.app);
+        return [
+            {
+                note: "fly secrets import",
+                kind: "stdin",
+                args,
+                payload: (value) => `${name}=${value}\n`,
+            },
+        ];
+    },
+    usage: (name, _t, gateway) => [
+        `${name} is in the app's environment after the release finishes:`,
+        `  OPENAI_API_KEY=$${name} with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+        `  # or ANTHROPIC_AUTH_TOKEN with ANTHROPIC_BASE_URL=${gateway.anthropicBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=fly.js.map

package/dist/secret-stores/fly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fly.js","sourceRoot":"","sources":["../../src/secret-stores/fly.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,yGAAyG,CAAC;AAE5G,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,0CAA0C;QAC7E,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,GAAG,GAAgB;IAC9B,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,CAAC,QAAQ,CAAC;IACnB,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,KAAK,CAAC;IAChB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,CAAC;IACxD,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,KAAK;QACV,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5B,QAAQ,EAAE,mDAAmD;KAC9D,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO;YACL;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE,OAAO;gBACb,IAAI;gBACJ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI;aACzC;SACF,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,GAAG,IAAI,0DAA0D;QACjE,qBAAqB,IAAI,yBAAyB,OAAO,CAAC,aAAa,EAAE;QACzE,uDAAuD,OAAO,CAAC,gBAAgB,EAAE;KAClF;CACF,CAAC"}

package/dist/secret-stores/gcloud.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Google Secret Manager. Both `secrets create` and `versions add` read the
+ * payload from stdin with `--data-file=-`; creation fails when the secret
+ * already exists, so the second attempt adds a version to it.
+ */
+export declare const gcloud: SecretStore;

package/dist/secret-stores/gcloud.js

@@ -0,0 +1,62 @@
+import { preflight, run, trimmedStderr } from "./exec.js";
+import { resourceName, slug } from "./naming.js";
+const INSTALL_HINT = "install the Google Cloud CLI from https://cloud.google.com/sdk/docs/install (brew install --cask google-cloud-sdk), then run `gcloud auth login`";
+/** The project gcloud is currently configured for, so --project stays optional. */
+function resolveProjectFromConfig() {
+    const res = run("gcloud", ["config", "get-value", "project"]);
+    const project = res.stdout.trim();
+    if (res.status !== 0 || !project || project === "(unset)") {
+        const detail = trimmedStderr(res);
+        throw new Error(`gcloud has no active project${detail ? ` (${detail})` : ""}. Pass --project my-project, or run \`gcloud config set project my-project\`.`);
+    }
+    return project;
+}
+function target(options) {
+    const project = options.project ? slug("--project", options.project) : resolveProjectFromConfig();
+    return { describe: `Google Secret Manager in project ${project}`, fields: { project } };
+}
+/**
+ * Google Secret Manager. Both `secrets create` and `versions add` read the
+ * payload from stdin with `--data-file=-`; creation fails when the secret
+ * already exists, so the second attempt adds a version to it.
+ */
+export const gcloud = {
+    id: "gcloud",
+    label: "Google Secret Manager",
+    bin: "gcloud",
+    shorthand: "--gcp-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["project"],
+    validateName: (name) => resourceName("Google Secret Manager secret", name, "_"),
+    preflight: () => preflight({
+        bin: "gcloud",
+        label: "Google Secret Manager",
+        installHint: INSTALL_HINT,
+        authArgs: ["auth", "print-access-token"],
+        authHint: "Run `gcloud auth login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const project = ["--project", t.fields.project];
+        return [
+            {
+                note: "gcloud secrets create",
+                kind: "stdin",
+                args: ["secrets", "create", name, "--data-file=-", "--replication-policy=automatic", ...project],
+            },
+            {
+                note: "gcloud secrets versions add",
+                kind: "stdin",
+                args: ["secrets", "versions", "add", name, "--data-file=-", ...project],
+            },
+        ];
+    },
+    usage: (name, t, gateway) => [
+        "Read it back at runtime:",
+        `  gcloud secrets versions access latest --secret=${name} --project=${t.fields.project}`,
+        `  # export OPENAI_API_KEY=$(…) with OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+        `  # Cloud Run: gcloud run deploy … --set-secrets OPENAI_API_KEY=${name}:latest`,
+    ],
+};
+//# sourceMappingURL=gcloud.js.map

package/dist/secret-stores/gcloud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcloud.js","sourceRoot":"","sources":["../../src/secret-stores/gcloud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,kJAAkJ,CAAC;AAErJ,mFAAmF;AACnF,SAAS,wBAAwB;IAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,+BAA+B,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,+EAA+E,CAC3I,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC;IAClG,OAAO,EAAE,QAAQ,EAAE,oCAAoC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,uBAAuB;IAC9B,GAAG,EAAE,QAAQ;IACb,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,8BAA8B,EAAE,IAAI,EAAE,GAAG,CAAC;IAC/E,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACxC,QAAQ,EAAE,gCAAgC;KAC3C,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO;YACL;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,gCAAgC,EAAE,GAAG,OAAO,CAAC;aACjG;YACD;gBACE,IAAI,EAAE,6BAA6B;gBACnC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;aACxE;SACF,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,0BAA0B;QAC1B,oDAAoD,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE;QACxF,uDAAuD,OAAO,CAAC,aAAa,EAAE;QAC9E,mEAAmE,IAAI,SAAS;KACjF;CACF,CAAC"}

package/dist/secret-stores/github.d.ts

@@ -0,0 +1,9 @@
+import type { SecretStore } from "./types.js";
+export declare const GH_INSTALL_HINT = "install the GitHub CLI from https://cli.github.com (brew install gh / winget install GitHub.cli), then run `gh auth login`";
+/** Resolves owner/repo for the current directory the same way `gh` does (git remotes + gh config). */
+export declare function resolveRepoFromCwd(): string;
+/**
+ * GitHub Actions. `gh secret set` reads the value from stdin when `--body` is
+ * omitted, so the key never appears in argv, `ps`, shell history or our output.
+ */
+export declare const github: SecretStore;