@heyditto/cli 2.5.2 → 2.7.0

package/dist/secret-stores/github.js

@@ -0,0 +1,74 @@
+import { preflight, run, trimmedStderr } from "./exec.js";
+import { validateRepo, validateSecretName } from "./naming.js";
+export const GH_INSTALL_HINT = "install the GitHub CLI from https://cli.github.com (brew install gh / winget install GitHub.cli), then run `gh auth login`";
+/** Resolves owner/repo for the current directory the same way `gh` does (git remotes + gh config). */
+export function resolveRepoFromCwd() {
+    const res = run("gh", ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"]);
+    const repo = res.stdout.trim();
+    if (res.status !== 0 || !repo) {
+        const detail = trimmedStderr(res);
+        throw new Error(`could not determine the GitHub repository from the current directory${detail ? ` (${detail})` : ""}. Pass --repo owner/repo, or run from inside a clone with a GitHub remote.`);
+    }
+    return repo;
+}
+/** Where the secret lands: a repository, one of its environments, or an organization. */
+function target(options) {
+    const org = options.org?.trim();
+    const env = options.env?.trim();
+    if (org) {
+        if (options.repo || env) {
+            throw new Error("--org cannot be combined with --repo or --env (organization secrets are not scoped to one repository)");
+        }
+        if (!/^[A-Za-z0-9_.-]+$/.test(org))
+            throw new Error(`--org must be an organization login, got "${options.org}"`);
+        return { describe: `organization ${org}`, fields: { kind: "org", org } };
+    }
+    const repo = options.repo ? validateRepo(options.repo) : resolveRepoFromCwd();
+    if (env)
+        return { describe: `${repo}, environment ${env}`, fields: { kind: "env", repo, env } };
+    return { describe: `${repo} (repository secret)`, fields: { kind: "repo", repo } };
+}
+/**
+ * GitHub Actions. `gh secret set` reads the value from stdin when `--body` is
+ * omitted, so the key never appears in argv, `ps`, shell history or our output.
+ */
+export const github = {
+    id: "github",
+    label: "GitHub Actions",
+    bin: "gh",
+    shorthand: "--gh-secret",
+    nameLabel: "NAME",
+    installHint: GH_INSTALL_HINT,
+    options: ["repo", "env", "org"],
+    validateName: validateSecretName,
+    preflight: () => preflight({
+        bin: "gh",
+        label: "GitHub Actions",
+        installHint: GH_INSTALL_HINT,
+        authArgs: ["auth", "status"],
+        authHint: "Run `gh auth login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const args = ["secret", "set", name];
+        if (t.fields.kind === "org")
+            args.push("--org", t.fields.org);
+        else if (t.fields.kind === "env")
+            args.push("--repo", t.fields.repo, "--env", t.fields.env);
+        else
+            args.push("--repo", t.fields.repo);
+        return [{ note: "gh secret set", kind: "stdin", args }];
+    },
+    // Both predate the multi-store registry and are part of the published
+    // contract: key labels in the app and the `snippet` field in --output json.
+    keyName: (name, t) => (t.fields.kind === "org" ? `gh-secret:${name}` : `gh:${t.fields.repo}:${name}`),
+    snippet: (name) => `\${{ secrets.${name} }}`,
+    usage: (name, _t, gateway) => [
+        "Use it in a workflow step:",
+        "  env:",
+        `    ANTHROPIC_AUTH_TOKEN: \${{ secrets.${name} }}`,
+        `    ANTHROPIC_BASE_URL: ${gateway.anthropicBaseUrl}`,
+        `  # OpenAI-compatible clients: OPENAI_API_KEY: \${{ secrets.${name} }} with OPENAI_BASE_URL: ${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=github.js.map

package/dist/secret-stores/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../src/secret-stores/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG/D,MAAM,CAAC,MAAM,eAAe,GAC1B,4HAA4H,CAAC;AAE/H,sGAAsG;AACtG,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,4EAA4E,CAChL,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yFAAyF;AACzF,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAC;QAC3H,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACjH,OAAO,EAAE,QAAQ,EAAE,gBAAgB,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IAC9E,IAAI,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,iBAAiB,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;IAChG,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,sBAAsB,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,gBAAgB;IACvB,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,aAAa;IACxB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,eAAe;IAC5B,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;IAC/B,YAAY,EAAE,kBAAkB;IAChC,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,eAAe;QAC5B,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5B,QAAQ,EAAE,4BAA4B;KACvC,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;aACzD,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;YACvF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,sEAAsE;IACtE,4EAA4E;IAC5E,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IACrG,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,IAAI,KAAK;IAC5C,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,4BAA4B;QAC5B,QAAQ;QACR,0CAA0C,IAAI,KAAK;QACnD,2BAA2B,OAAO,CAAC,gBAAgB,EAAE;QACrD,+DAA+D,IAAI,6BAA6B,OAAO,CAAC,aAAa,EAAE;KACxH;CACF,CAAC"}

package/dist/secret-stores/gitlab.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * GitLab CI/CD variables. `glab variable set KEY` reads the value from stdin
+ * when no value argument is given (`cat file | glab variable set KEY`), and
+ * `--masked` keeps it out of job logs.
+ */
+export declare const gitlab: SecretStore;

package/dist/secret-stores/gitlab.js

@@ -0,0 +1,82 @@
+import { preflight, run, trimmedStderr } from "./exec.js";
+import { envStyleName, slug } from "./naming.js";
+const INSTALL_HINT = "install the GitLab CLI from https://gitlab.com/gitlab-org/cli (brew install glab), then run `glab auth login`";
+/** Resolves the project for the current directory the way glab itself does. */
+function resolveProjectFromCwd() {
+    const res = run("glab", ["repo", "view", "-F", "json"]);
+    if (res.status === 0) {
+        try {
+            const parsed = JSON.parse(res.stdout);
+            if (parsed.path_with_namespace)
+                return parsed.path_with_namespace;
+        }
+        catch {
+            // Fall through to the shared error below.
+        }
+    }
+    const detail = trimmedStderr(res);
+    throw new Error(`could not determine the GitLab project from the current directory${detail ? ` (${detail})` : ""}. Pass --project group/project, or run from inside a clone with a GitLab remote.`);
+}
+function target(options) {
+    const group = options.org?.trim();
+    const env = options.env?.trim();
+    if (group) {
+        if (options.project)
+            throw new Error("--org (GitLab group) cannot be combined with --project");
+        const g = slug("--org", group, /^[A-Za-z0-9_.\-/]+$/);
+        return { describe: `group ${g}`, fields: { kind: "group", group: g, ...(env ? { env } : {}) } };
+    }
+    const project = options.project ? slug("--project", options.project, /^[A-Za-z0-9_.\-/]+$/) : resolveProjectFromCwd();
+    return {
+        describe: `${project}${env ? `, environment scope ${env}` : ""} (CI/CD variable)`,
+        fields: { kind: "project", project, ...(env ? { env } : {}) },
+    };
+}
+/**
+ * GitLab CI/CD variables. `glab variable set KEY` reads the value from stdin
+ * when no value argument is given (`cat file | glab variable set KEY`), and
+ * `--masked` keeps it out of job logs.
+ */
+export const gitlab = {
+    id: "gitlab",
+    label: "GitLab CI/CD",
+    bin: "glab",
+    shorthand: "--gitlab-var",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    options: ["project", "org", "env"],
+    validateName: (name) => envStyleName("GitLab CI/CD variable", name),
+    preflight: () => preflight({
+        bin: "glab",
+        label: "GitLab CI/CD",
+        installHint: INSTALL_HINT,
+        authArgs: ["auth", "status"],
+        authHint: "Run `glab auth login` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const scope = (verb) => {
+            const args = ["variable", verb, name, "--masked"];
+            if (t.fields.kind === "group")
+                args.push("--group", t.fields.group);
+            else
+                args.push("--repo", t.fields.project);
+            if (t.fields.env)
+                args.push("--scope", t.fields.env);
+            return args;
+        };
+        // `set` refuses an existing variable, so fall back to `update`.
+        return [
+            { note: "glab variable set", kind: "stdin", args: scope("set") },
+            { note: "glab variable update", kind: "stdin", args: scope("update") },
+        ];
+    },
+    usage: (name, _t, gateway) => [
+        "Use it in .gitlab-ci.yml:",
+        "  variables:",
+        `    ANTHROPIC_BASE_URL: ${gateway.anthropicBaseUrl}`,
+        `  # ${name} is injected into every job; for OpenAI-compatible clients set`,
+        `  # OPENAI_API_KEY: $${name} with OPENAI_BASE_URL: ${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=gitlab.js.map

package/dist/secret-stores/gitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab.js","sourceRoot":"","sources":["../../src/secret-stores/gitlab.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,YAAY,GAChB,+GAA+G,CAAC;AAElH,+EAA+E;AAC/E,SAAS,qBAAqB;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAqC,CAAC;YAC1E,IAAI,MAAM,CAAC,mBAAmB;gBAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,KAAK,CACb,oEAAoE,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,kFAAkF,CACnL,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;QACtD,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC;IACtH,OAAO;QACL,QAAQ,EAAE,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB;QACjF,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB;IACjC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,cAAc;IACrB,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC;IAClC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC;IACnE,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QAC5B,QAAQ,EAAE,8BAA8B;KACzC,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;gBAC/D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,gEAAgE;QAChE,OAAO;YACL,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YAChE,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,2BAA2B;QAC3B,cAAc;QACd,2BAA2B,OAAO,CAAC,gBAAgB,EAAE;QACrD,OAAO,IAAI,gEAAgE;QAC3E,wBAAwB,IAAI,0BAA0B,OAAO,CAAC,aAAa,EAAE;KAC9E;CACF,CAAC"}

package/dist/secret-stores/index.d.ts

@@ -0,0 +1,42 @@
+import { type SecretStore, type StoreId, type StoreOptions } from "./types.js";
+export { deliver, installed, resolveBin } from "./exec.js";
+export { GH_INSTALL_HINT, resolveRepoFromCwd } from "./github.js";
+export { validateRepo, validateSecretName } from "./naming.js";
+export { STORE_IDS } from "./types.js";
+export type { Delivery, Gateway, SecretStore, StoreId, StoreOptions, StoreTarget } from "./types.js";
+export { VERCEL_TARGETS } from "./vercel.js";
+/** Every store, in the order they are listed to the operator. */
+export declare const STORES: readonly SecretStore[];
+export declare function storeById(id: string): SecretStore;
+/** `--store <id>` is the canonical selector; every store also has a shorthand. */
+export interface StoreSelection {
+    store: SecretStore;
+    /** Secret / variable / item / path name. */
+    name: string;
+    /** The flag the operator actually used, for error messages. */
+    flag: string;
+}
+/**
+ * Resolves which store gets the key from `--store`/`--secret` or exactly one
+ * shorthand, and rejects flags that belong to a different store — silently
+ * ignoring `--repo` on an AWS run would store the secret somewhere the
+ * operator did not intend.
+ */
+export declare function selectStore(options: StoreOptions & {
+    store?: string;
+    shorthands: Partial<Record<StoreId, string>>;
+}): StoreSelection;
+export interface StoreProbe {
+    id: StoreId;
+    label: string;
+    bin: string;
+    /** The binary actually found on PATH (fly vs flyctl). */
+    resolvedBin: string;
+    installed: boolean;
+    shorthand: string;
+    nameLabel: string;
+    flags: string[];
+    installHint: string;
+}
+/** Which platform CLIs this machine has — the answer to "what can I delegate to?". */
+export declare function probeStores(): StoreProbe[];

package/dist/secret-stores/index.js

@@ -0,0 +1,106 @@
+import { aws } from "./aws.js";
+import { azure } from "./azure.js";
+import { cloudflare } from "./cloudflare.js";
+import { doppler } from "./doppler.js";
+import { installed, resolveBin } from "./exec.js";
+import { fly } from "./fly.js";
+import { gcloud } from "./gcloud.js";
+import { github } from "./github.js";
+import { gitlab } from "./gitlab.js";
+import { kubernetes } from "./kubernetes.js";
+import { onepassword } from "./onepassword.js";
+import { vault } from "./vault.js";
+import { vercel } from "./vercel.js";
+import { STORE_IDS } from "./types.js";
+export { deliver, installed, resolveBin } from "./exec.js";
+export { GH_INSTALL_HINT, resolveRepoFromCwd } from "./github.js";
+export { validateRepo, validateSecretName } from "./naming.js";
+export { STORE_IDS } from "./types.js";
+export { VERCEL_TARGETS } from "./vercel.js";
+/** Every store, in the order they are listed to the operator. */
+export const STORES = [
+    github,
+    gitlab,
+    aws,
+    gcloud,
+    azure,
+    onepassword,
+    vault,
+    doppler,
+    cloudflare,
+    vercel,
+    kubernetes,
+    fly,
+];
+/** Human label for every flag, so "unsupported flag" errors name the flag the operator typed. */
+const OPTION_FLAGS = {
+    repo: "--repo",
+    env: "--env",
+    org: "--org",
+    region: "--region",
+    project: "--project",
+    keyVault: "--key-vault",
+    opVault: "--op-vault",
+    mount: "--mount",
+    field: "--field",
+    dopplerConfig: "--doppler-config",
+    worker: "--worker",
+    vercelTarget: "--vercel-target",
+    namespace: "--namespace",
+    k8sKey: "--k8s-key",
+    app: "--app",
+};
+const OPTION_KEYS = Object.keys(OPTION_FLAGS);
+export function storeById(id) {
+    const store = STORES.find((s) => s.id === id);
+    if (!store)
+        throw new Error(`unknown --store "${id}". Available: ${STORE_IDS.join(", ")}`);
+    return store;
+}
+/**
+ * Resolves which store gets the key from `--store`/`--secret` or exactly one
+ * shorthand, and rejects flags that belong to a different store — silently
+ * ignoring `--repo` on an AWS run would store the secret somewhere the
+ * operator did not intend.
+ */
+export function selectStore(options) {
+    const used = STORES.filter((s) => options.shorthands[s.id] !== undefined);
+    if (used.length > 1) {
+        throw new Error(`pick one destination: ${used.map((s) => s.shorthand).join(" and ")} cannot both be set`);
+    }
+    const shorthand = used[0];
+    if (shorthand && options.store && options.store !== shorthand.id) {
+        throw new Error(`--store ${options.store} contradicts ${shorthand.shorthand} (which implies --store ${shorthand.id})`);
+    }
+    const store = shorthand ?? (options.store ? storeById(options.store) : undefined);
+    if (!store) {
+        throw new Error(`pick a destination: --store <${STORE_IDS.join("|")}> with --secret <NAME>, or a shorthand such as ${github.shorthand} NAME. See \`heyditto endpoints keys stores\`.`);
+    }
+    const raw = shorthand ? options.shorthands[store.id] : options.secret;
+    const flag = shorthand ? store.shorthand : "--secret";
+    if (!raw)
+        throw new Error(`--store ${store.id} needs --secret <${store.nameLabel}>`);
+    const stray = OPTION_KEYS.filter((key) => options[key] !== undefined && !store.options.includes(key));
+    if (stray.length > 0) {
+        throw new Error(`${stray.map((key) => OPTION_FLAGS[key]).join(", ")} ${stray.length > 1 ? "do" : "does"} not apply to ${store.label}; it accepts ${store.options.map((key) => OPTION_FLAGS[key]).join(", ") || "no scoping flags"}`);
+    }
+    return { store, name: store.validateName(raw), flag };
+}
+/** Which platform CLIs this machine has — the answer to "what can I delegate to?". */
+export function probeStores() {
+    return STORES.map((store) => {
+        const bin = resolveBin(store);
+        return {
+            id: store.id,
+            label: store.label,
+            bin: store.bin,
+            resolvedBin: bin,
+            installed: installed(bin, store.versionArgs),
+            shorthand: store.shorthand,
+            nameLabel: store.nameLabel,
+            flags: store.options.map((key) => OPTION_FLAGS[key]),
+            installHint: store.installHint,
+        };
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/secret-stores/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secret-stores/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAoB,SAAS,EAAwD,MAAM,YAAY,CAAC;AAE/G,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,MAAM,GAA2B;IAC5C,MAAM;IACN,MAAM;IACN,GAAG;IACH,MAAM;IACN,KAAK;IACL,WAAW;IACX,KAAK;IACL,OAAO;IACP,UAAU;IACV,MAAM;IACN,UAAU;IACV,GAAG;CACJ,CAAC;AAEF,iGAAiG;AACjG,MAAM,YAAY,GAAmC;IACnD,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,aAAa;IACvB,OAAO,EAAE,YAAY;IACrB,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,SAAS;IAChB,aAAa,EAAE,kBAAkB;IACjC,MAAM,EAAE,UAAU;IAClB,YAAY,EAAE,iBAAiB;IAC/B,SAAS,EAAE,aAAa;IACxB,MAAM,EAAE,WAAW;IACnB,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAqB,CAAC;AAElE,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC;AAWD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAwF;IAClH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5G,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,SAAS,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,KAAK,gBAAgB,SAAS,CAAC,SAAS,2BAA2B,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gCAAgC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,kDAAkD,MAAM,CAAC,SAAS,gDAAgD,CACtK,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACtE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACtD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,EAAE,oBAAoB,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,iBAAiB,KAAK,CAAC,KAAK,gBAAgB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,kBAAkB,EAAE,CACpN,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AACxD,CAAC;AAeD,sFAAsF;AACtF,MAAM,UAAU,WAAW;IACzB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,WAAW,EAAE,GAAG;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACpD,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/secret-stores/kubernetes.d.ts

@@ -0,0 +1,8 @@
+import type { SecretStore } from "./types.js";
+/**
+ * Kubernetes. The manifest is built here and piped in, so the plaintext never
+ * reaches argv (`--from-literal` would) and never touches disk. A merge patch
+ * comes first because it leaves the secret's other keys alone; `apply` is the
+ * fallback that creates the secret when it does not exist yet.
+ */
+export declare const kubernetes: SecretStore;

package/dist/secret-stores/kubernetes.js

@@ -0,0 +1,76 @@
+import { PATH_PLACEHOLDER, preflight } from "./exec.js";
+import { resourceName, slug } from "./naming.js";
+/** The merge patch the first attempt sends: adds this key, leaves the rest. */
+function mergePatch(key, value) {
+    return `${JSON.stringify({ stringData: { [key]: value } })}\n`;
+}
+const INSTALL_HINT = "install kubectl from https://kubernetes.io/docs/tasks/tools (brew install kubectl), then point it at a cluster with `kubectl config use-context`";
+function target(options) {
+    const namespace = options.namespace ? slug("--namespace", options.namespace, /^[a-z0-9-]+$/) : "default";
+    const key = options.k8sKey ? slug("--k8s-key", options.k8sKey, /^[A-Za-z0-9_.-]+$/) : "key";
+    return { describe: `Kubernetes secret in namespace ${namespace} (key ${key})`, fields: { namespace, key } };
+}
+/**
+ * Kubernetes. The manifest is built here and piped in, so the plaintext never
+ * reaches argv (`--from-literal` would) and never touches disk. A merge patch
+ * comes first because it leaves the secret's other keys alone; `apply` is the
+ * fallback that creates the secret when it does not exist yet.
+ */
+export const kubernetes = {
+    id: "kubernetes",
+    label: "Kubernetes",
+    bin: "kubectl",
+    shorthand: "--k8s-secret",
+    nameLabel: "NAME",
+    installHint: INSTALL_HINT,
+    versionArgs: ["version", "--client=true"],
+    options: ["namespace", "k8sKey"],
+    validateName: (name) => {
+        const trimmed = name.trim();
+        if (trimmed !== trimmed.toLowerCase()) {
+            throw new Error(`"${name}" is not a valid Kubernetes secret name (lowercase letters, digits, dashes and dots only)`);
+        }
+        return resourceName("Kubernetes secret", trimmed, ".");
+    },
+    preflight: () => preflight({
+        bin: "kubectl",
+        label: "Kubernetes",
+        installHint: INSTALL_HINT,
+        versionArgs: kubernetes.versionArgs,
+        authArgs: ["config", "current-context"],
+        authHint: "Select a cluster with `kubectl config use-context <name>` first.",
+    }),
+    resolveTarget: target,
+    deliveries: (name, t) => {
+        const { namespace, key } = t.fields;
+        return [
+            {
+                note: "kubectl patch secret",
+                kind: "path",
+                args: ["patch", "secret", name, "--namespace", namespace, "--type", "merge", "--patch-file", PATH_PLACEHOLDER],
+                payload: (value) => mergePatch(key, value),
+            },
+            {
+                note: "kubectl apply",
+                kind: "stdin",
+                args: ["apply", "--namespace", namespace, "-f", "-"],
+                payload: (value) => `${JSON.stringify({
+                    apiVersion: "v1",
+                    kind: "Secret",
+                    type: "Opaque",
+                    metadata: { name, namespace },
+                    stringData: { [key]: value },
+                })}\n`,
+            },
+        ];
+    },
+    usage: (name, t, gateway) => [
+        "Mount it into a pod:",
+        "  env:",
+        "    - name: OPENAI_API_KEY",
+        `      valueFrom: { secretKeyRef: { name: ${name}, key: ${t.fields.key} } }`,
+        `    - name: OPENAI_BASE_URL`,
+        `      value: ${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=kubernetes.js.map

package/dist/secret-stores/kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kubernetes.js","sourceRoot":"","sources":["../../src/secret-stores/kubernetes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa;IAC5C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,YAAY,GAChB,kJAAkJ,CAAC;AAErJ,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5F,OAAO,EAAE,QAAQ,EAAE,kCAAkC,SAAS,SAAS,GAAG,GAAG,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,SAAS;IACd,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,MAAM;IACjB,WAAW,EAAE,YAAY;IACzB,WAAW,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC;IACzC,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;IAChC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,2FAA2F,CAAC,CAAC;QACvH,CAAC;QACD,OAAO,YAAY,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IACD,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,QAAQ,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QACvC,QAAQ,EAAE,kEAAkE;KAC7E,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC;QACpC,OAAO;YACL;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,CAAC;gBAC9G,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC;aAC3C;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC;gBACpD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,GAAG,IAAI,CAAC,SAAS,CAAC;oBAChB,UAAU,EAAE,IAAI;oBAChB,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC7B,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE;iBAC7B,CAAC,IAAI;aACT;SACF,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC3B,sBAAsB;QACtB,QAAQ;QACR,4BAA4B;QAC5B,4CAA4C,IAAI,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM;QAC5E,6BAA6B;QAC7B,gBAAgB,OAAO,CAAC,aAAa,EAAE;KACxC;CACF,CAAC"}

package/dist/secret-stores/naming.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Per-platform name rules. Each store rejects names its platform would refuse
+ * anyway, before a key is minted, with a message that says what is allowed.
+ */
+/** Env-var style: letters, digits, underscores; not leading with a digit. */
+export declare function envStyleName(label: string, name: string): string;
+/** GitHub Actions additionally reserves the GITHUB_ prefix. */
+export declare function validateSecretName(name: string): string;
+export declare function validateRepo(repo: string): string;
+/**
+ * RFC 1123-ish resource names used by Google Secret Manager, Azure Key Vault
+ * and Kubernetes: letters, digits, dashes (Google also allows underscores).
+ */
+export declare function resourceName(label: string, name: string, extra?: string): string;
+/** Free-form single-line title (1Password items). */
+export declare function titleName(label: string, name: string): string;
+/** A Vault kv path: slash-separated segments, no leading or trailing slash. */
+export declare function secretPath(label: string, name: string): string;
+/** Rejects a scoping flag's value that the platform would not accept. */
+export declare function slug(flag: string, value: string, pattern?: RegExp): string;

package/dist/secret-stores/naming.js

@@ -0,0 +1,62 @@
+/**
+ * Per-platform name rules. Each store rejects names its platform would refuse
+ * anyway, before a key is minted, with a message that says what is allowed.
+ */
+/** Env-var style: letters, digits, underscores; not leading with a digit. */
+export function envStyleName(label, name) {
+    const trimmed = name.trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed)) {
+        throw new Error(`"${name}" is not a valid ${label} name (letters, digits and underscores; cannot start with a digit)`);
+    }
+    return trimmed;
+}
+/** GitHub Actions additionally reserves the GITHUB_ prefix. */
+export function validateSecretName(name) {
+    const trimmed = envStyleName("GitHub Actions secret", name);
+    if (/^GITHUB_/i.test(trimmed)) {
+        throw new Error(`"${name}" is reserved: GitHub Actions secret names cannot start with GITHUB_`);
+    }
+    return trimmed;
+}
+export function validateRepo(repo) {
+    const trimmed = repo.trim();
+    if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(trimmed)) {
+        throw new Error(`--repo must be owner/repo, got "${repo}"`);
+    }
+    return trimmed;
+}
+/**
+ * RFC 1123-ish resource names used by Google Secret Manager, Azure Key Vault
+ * and Kubernetes: letters, digits, dashes (Google also allows underscores).
+ */
+export function resourceName(label, name, extra = "") {
+    const trimmed = name.trim();
+    const pattern = new RegExp(`^[A-Za-z0-9][A-Za-z0-9${extra}-]{0,253}$`);
+    if (!pattern.test(trimmed)) {
+        throw new Error(`"${name}" is not a valid ${label} name (letters, digits${extra.includes("_") ? ", underscores" : ""} and dashes, starting with a letter or digit)`);
+    }
+    return trimmed;
+}
+/** Free-form single-line title (1Password items). */
+export function titleName(label, name) {
+    const trimmed = name.trim();
+    if (!trimmed || /[\n\r]/.test(trimmed))
+        throw new Error(`"${name}" is not a valid ${label} (one non-empty line)`);
+    return trimmed;
+}
+/** A Vault kv path: slash-separated segments, no leading or trailing slash. */
+export function secretPath(label, name) {
+    const trimmed = name.trim().replace(/^\/+|\/+$/g, "");
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.\-/]*$/.test(trimmed)) {
+        throw new Error(`"${name}" is not a valid ${label} (letters, digits, dashes, dots, underscores and slashes)`);
+    }
+    return trimmed;
+}
+/** Rejects a scoping flag's value that the platform would not accept. */
+export function slug(flag, value, pattern = /^[A-Za-z0-9_.-]+$/) {
+    const trimmed = value.trim();
+    if (!pattern.test(trimmed))
+        throw new Error(`${flag} must be a valid name, got "${value}"`);
+    return trimmed;
+}
+//# sourceMappingURL=naming.js.map

package/dist/secret-stores/naming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.js","sourceRoot":"","sources":["../../src/secret-stores/naming.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,oEAAoE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,sEAAsE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,KAAK,GAAG,EAAE;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,yBAAyB,KAAK,YAAY,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,yBAAyB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,+CAA+C,CAAC,CAAC;IACvK,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,uBAAuB,CAAC,CAAC;IAClH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAY;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,oBAAoB,KAAK,2DAA2D,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,KAAa,EAAE,OAAO,GAAG,mBAAmB;IAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,+BAA+B,KAAK,GAAG,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/secret-stores/onepassword.d.ts

@@ -0,0 +1,7 @@
+import type { SecretStore } from "./types.js";
+/**
+ * 1Password. Assignment statements (`credential=…`) put the value in argv and
+ * the docs say so explicitly, so this pipes an item JSON template into
+ * `op item create -` instead: the plaintext only ever crosses stdin.
+ */
+export declare const onepassword: SecretStore;

package/dist/secret-stores/onepassword.js

@@ -0,0 +1,50 @@
+import { preflight } from "./exec.js";
+import { slug, titleName } from "./naming.js";
+const INSTALL_HINT = "install the 1Password CLI from https://developer.1password.com/docs/cli/get-started (brew install 1password-cli), then sign in with `op signin`";
+function target(options) {
+    const vault = options.opVault ? slug("--op-vault", options.opVault, /^[^\n\r]+$/) : "Private";
+    return { describe: `1Password vault ${vault}`, fields: { vault } };
+}
+/**
+ * 1Password. Assignment statements (`credential=…`) put the value in argv and
+ * the docs say so explicitly, so this pipes an item JSON template into
+ * `op item create -` instead: the plaintext only ever crosses stdin.
+ */
+export const onepassword = {
+    id: "1password",
+    label: "1Password",
+    bin: "op",
+    shorthand: "--op-item",
+    nameLabel: "TITLE",
+    installHint: INSTALL_HINT,
+    options: ["opVault"],
+    validateName: (name) => titleName("1Password item title", name),
+    preflight: () => preflight({
+        bin: "op",
+        label: "1Password",
+        installHint: INSTALL_HINT,
+        authArgs: ["whoami"],
+        authHint: "Run `op signin` first (or enable the desktop app's CLI integration).",
+    }),
+    resolveTarget: target,
+    deliveries: (title, t) => [
+        {
+            note: "op item create",
+            kind: "stdin",
+            args: ["item", "create", "--vault", t.fields.vault, "-"],
+            payload: (value) => `${JSON.stringify({
+                title,
+                category: "API_CREDENTIAL",
+                fields: [{ id: "credential", label: "credential", type: "CONCEALED", value }],
+            })}\n`,
+        },
+    ],
+    usage: (title, t, gateway) => [
+        "Read it back without ever printing it:",
+        `  op read "op://${t.fields.vault}/${title}/credential"`,
+        `  # op run --env-file=.env -- your-command, with .env holding`,
+        `  #   OPENAI_API_KEY=op://${t.fields.vault}/${title}/credential`,
+        `  #   OPENAI_BASE_URL=${gateway.openaiBaseUrl}`,
+    ],
+};
+//# sourceMappingURL=onepassword.js.map

package/dist/secret-stores/onepassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onepassword.js","sourceRoot":"","sources":["../../src/secret-stores/onepassword.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,YAAY,GAChB,iJAAiJ,CAAC;AAEpJ,SAAS,MAAM,CAAC,OAAqB;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,OAAO,EAAE,QAAQ,EAAE,mBAAmB,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,WAAW;IAClB,GAAG,EAAE,IAAI;IACT,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,OAAO;IAClB,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC;IAC/D,SAAS,EAAE,GAAG,EAAE,CACd,SAAS,CAAC;QACR,GAAG,EAAE,IAAI;QACT,KAAK,EAAE,WAAW;QAClB,WAAW,EAAE,YAAY;QACzB,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,QAAQ,EAAE,sEAAsE;KACjF,CAAC;IACJ,aAAa,EAAE,MAAM;IACrB,UAAU,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QACxB;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC;YACxD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,KAAK;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;aAC9E,CAAC,IAAI;SACT;KACF;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5B,wCAAwC;QACxC,mBAAmB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,cAAc;QACxD,+DAA+D;QAC/D,6BAA6B,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,aAAa;QACjE,yBAAyB,OAAO,CAAC,aAAa,EAAE;KACjD;CACF,CAAC"}