@rmartz/envctl 3.1.1

package/dist/lib/commands/init.js

@@ -0,0 +1,59 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInit = runInit;
+const fs = __importStar(require("fs"));
+const logger_1 = require("../logger");
+const deployment_config_1 = require("./deployment-config");
+// `envctl init` — scaffold the in-repo deployment/ config with a starter
+// environments.yml and a sample environment file. No-op (with a warning) when
+// a config already exists, so it never clobbers hand-edited config.
+function runInit(ctx) {
+    const envsFile = (0, deployment_config_1.environmentsFile)(ctx.workingDir);
+    if (fs.existsSync(envsFile)) {
+        (0, logger_1.warn)(`Deployment config already exists at ${envsFile} — leaving it as is.`);
+        return;
+    }
+    fs.mkdirSync((0, deployment_config_1.deploymentDir)(ctx.workingDir), { recursive: true });
+    (0, deployment_config_1.writeActiveEnvs)(ctx.workingDir, ["production"]);
+    if (!fs.existsSync((0, deployment_config_1.envFile)(ctx.workingDir, "production"))) {
+        (0, deployment_config_1.writeEnvFile)(ctx.workingDir, "production", {
+            NEXT_PUBLIC_EXAMPLE: "replace-me",
+        });
+    }
+    (0, logger_1.log)(`Scaffolded ${envsFile} with a sample 'production' environment.`);
+    (0, logger_1.log)("Add more with: envctl env add <name> --target <production|preview|development>");
+}
+//# sourceMappingURL=init.js.map

package/dist/lib/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/lib/commands/init.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,0BAmBC;AAlCD,uCAAyB;AAGzB,sCAAsC;AACtC,2DAM6B;AAE7B,yEAAyE;AACzE,8EAA8E;AAC9E,oEAAoE;AACpE,SAAgB,OAAO,CAAC,GAAmB;IACzC,MAAM,QAAQ,GAAG,IAAA,oCAAgB,EAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAA,aAAI,EAAC,uCAAuC,QAAQ,sBAAsB,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAA,iCAAa,EAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,IAAA,mCAAe,EAAC,GAAG,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAA,2BAAO,EAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAC1D,IAAA,gCAAY,EAAC,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE;YACzC,mBAAmB,EAAE,YAAY;SAClC,CAAC,CAAC;IACL,CAAC;IAED,IAAA,YAAG,EAAC,cAAc,QAAQ,0CAA0C,CAAC,CAAC;IACtE,IAAA,YAAG,EACD,gFAAgF,CACjF,CAAC;AACJ,CAAC"}

package/dist/lib/commands/secrets-args.d.ts

@@ -0,0 +1,13 @@
+export interface SecretsOptions {
+    targetEnv: string;
+    workingDir: string;
+    deploymentDir: string;
+    invalidateKeys: boolean;
+    refreshPreviews: boolean;
+    init?: "all" | "auto" | "firebase" | "sentry";
+    provider?: "firebase" | "sentry";
+}
+export declare const ROTATE_USAGE = "Usage: envctl secrets rotate [firebase|sentry] [OPTIONS]\n\nAtomically rotate provider secrets: mint the new credential, redeploy, verify\nit, then invalidate the old one \u2014 so the project is never left without a working\ncredential. Rotates Firebase service-account keys (per environment) and the\nSentry auth token (once, project-wide), for whichever are present in the Vercel\nproject. Auth for every provider to be rotated is checked up front, so an\nunauthenticated provider fails fast instead of leaving a partial rotation.\n\nARGUMENTS:\n  firebase | sentry        Restrict the rotation to a single provider\n                           (default: every provider present in the project)\n\nOPTIONS:\n  --env <name>             Environment to rotate (a name from environments.yml,\n                           'development', or 'all') (default: all)\n  --deployment-dir <path>  Path to the deployment config directory, resolved\n                           against the project root (default: deployment)\n  --no-invalidate          Keep the old keys after the redeploy\n  --refresh-previews       Redeploy active PR previews after rotation\n  -h, --help               Show this help";
+export declare const INIT_USAGE = "Usage: envctl secrets init [firebase|sentry] [OPTIONS]\n\nBootstrap provider secrets for a fresh project (implies a rotation). Omit the\nservice to auto-detect which to initialize from the deployment config. Fails if\nthe target secrets already exist in the Vercel project.\n\nARGUMENTS:\n  firebase | sentry        Service to initialize (default: auto-detect)\n\nOPTIONS:\n  --env <name>             Environment to initialize (default: all)\n  --deployment-dir <path>  Path to the deployment config directory, resolved\n                           against the project root (default: deployment)\n  --no-invalidate          Keep the old keys after the redeploy\n  --refresh-previews       Redeploy active PR previews after initialization\n  -h, --help               Show this help";
+export declare function parseSecretsArgs(args: string[], workingDir: string, isInit: boolean): SecretsOptions;
+//# sourceMappingURL=secrets-args.d.ts.map

package/dist/lib/commands/secrets-args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-args.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/secrets-args.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,cAAc;IAG7B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,aAAa,EAAE,MAAM,CAAC;IAEtB,cAAc,EAAE,OAAO,CAAC;IAGxB,eAAe,EAAE,OAAO,CAAC;IAGzB,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,CAAC;IAG9C,QAAQ,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;CAClC;AAED,eAAO,MAAM,YAAY,yqCAoBiB,CAAC;AAE3C,eAAO,MAAM,UAAU,gxBAemB,CAAC;AAM3C,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EAAE,EACd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,cAAc,CA8ChB"}

package/dist/lib/commands/secrets-args.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INIT_USAGE = exports.ROTATE_USAGE = void 0;
+exports.parseSecretsArgs = parseSecretsArgs;
+const path = __importStar(require("path"));
+const logger_1 = require("../logger");
+exports.ROTATE_USAGE = `Usage: envctl secrets rotate [firebase|sentry] [OPTIONS]
+
+Atomically rotate provider secrets: mint the new credential, redeploy, verify
+it, then invalidate the old one — so the project is never left without a working
+credential. Rotates Firebase service-account keys (per environment) and the
+Sentry auth token (once, project-wide), for whichever are present in the Vercel
+project. Auth for every provider to be rotated is checked up front, so an
+unauthenticated provider fails fast instead of leaving a partial rotation.
+
+ARGUMENTS:
+  firebase | sentry        Restrict the rotation to a single provider
+                           (default: every provider present in the project)
+
+OPTIONS:
+  --env <name>             Environment to rotate (a name from environments.yml,
+                           'development', or 'all') (default: all)
+  --deployment-dir <path>  Path to the deployment config directory, resolved
+                           against the project root (default: deployment)
+  --no-invalidate          Keep the old keys after the redeploy
+  --refresh-previews       Redeploy active PR previews after rotation
+  -h, --help               Show this help`;
+exports.INIT_USAGE = `Usage: envctl secrets init [firebase|sentry] [OPTIONS]
+
+Bootstrap provider secrets for a fresh project (implies a rotation). Omit the
+service to auto-detect which to initialize from the deployment config. Fails if
+the target secrets already exist in the Vercel project.
+
+ARGUMENTS:
+  firebase | sentry        Service to initialize (default: auto-detect)
+
+OPTIONS:
+  --env <name>             Environment to initialize (default: all)
+  --deployment-dir <path>  Path to the deployment config directory, resolved
+                           against the project root (default: deployment)
+  --no-invalidate          Keep the old keys after the redeploy
+  --refresh-previews       Redeploy active PR previews after initialization
+  -h, --help               Show this help`;
+// Parses `secrets rotate` / `secrets init` args (the global -C/--working-dir
+// flag is already stripped by the router). `isInit` selects init mode: it seeds
+// `init` to "auto" and accepts a leading firebase|sentry positional. Prints
+// usage and exits 0 on -h/--help.
+function parseSecretsArgs(args, workingDir, isInit) {
+    let targetEnv = "all";
+    let deploymentDir = "deployment";
+    let invalidateKeys = true;
+    let refreshPreviews = false;
+    let init = isInit ? "auto" : undefined;
+    let provider;
+    let providerTargetSet = false;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--env") {
+            targetEnv =
+                args[++i] ?? (0, logger_1.err)('--env requires an environment name or "all"');
+            if (!targetEnv)
+                (0, logger_1.err)('--env requires an environment name or "all"');
+        }
+        else if (arg === "--deployment-dir") {
+            deploymentDir = args[++i] ?? (0, logger_1.err)("--deployment-dir requires a path");
+            if (!deploymentDir)
+                (0, logger_1.err)("--deployment-dir requires a path");
+        }
+        else if (arg === "--no-invalidate") {
+            invalidateKeys = false;
+        }
+        else if (arg === "--refresh-previews") {
+            refreshPreviews = true;
+        }
+        else if (arg === "-h" || arg === "--help") {
+            console.log(isInit ? exports.INIT_USAGE : exports.ROTATE_USAGE);
+            process.exit(0);
+        }
+        else if (!providerTargetSet && (arg === "firebase" || arg === "sentry")) {
+            // A leading firebase|sentry positional selects the init target in init
+            // mode, or scopes the rotation to that provider in rotate mode.
+            if (isInit)
+                init = arg;
+            else
+                provider = arg;
+            providerTargetSet = true;
+        }
+        else {
+            const cmd = isInit ? "secrets init" : "secrets rotate";
+            (0, logger_1.err)(`Unknown option: ${arg}. Run 'envctl ${cmd} --help' for usage.`);
+        }
+    }
+    return {
+        targetEnv,
+        workingDir,
+        deploymentDir: path.resolve(workingDir, deploymentDir),
+        invalidateKeys,
+        refreshPreviews,
+        init,
+        provider,
+    };
+}
+//# sourceMappingURL=secrets-args.js.map

package/dist/lib/commands/secrets-args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-args.js","sourceRoot":"","sources":["../../../src/lib/commands/secrets-args.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwEA,4CAkDC;AA1HD,2CAA6B;AAE7B,sCAAgC;AA2BnB,QAAA,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;0CAoBc,CAAC;AAE9B,QAAA,UAAU,GAAG;;;;;;;;;;;;;;;0CAegB,CAAC;AAE3C,6EAA6E;AAC7E,gFAAgF;AAChF,4EAA4E;AAC5E,kCAAkC;AAClC,SAAgB,gBAAgB,CAC9B,IAAc,EACd,UAAkB,EAClB,MAAe;IAEf,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,aAAa,GAAG,YAAY,CAAC;IACjC,IAAI,cAAc,GAAG,IAAI,CAAC;IAC1B,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,IAAI,GAA2B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,QAAoC,CAAC;IACzC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,SAAS;gBACP,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,YAAG,EAAC,6CAA6C,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS;gBAAE,IAAA,YAAG,EAAC,6CAA6C,CAAC,CAAC;QACrE,CAAC;aAAM,IAAI,GAAG,KAAK,kBAAkB,EAAE,CAAC;YACtC,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAA,YAAG,EAAC,kCAAkC,CAAC,CAAC;YACrE,IAAI,CAAC,aAAa;gBAAE,IAAA,YAAG,EAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;aAAM,IAAI,GAAG,KAAK,iBAAiB,EAAE,CAAC;YACrC,cAAc,GAAG,KAAK,CAAC;QACzB,CAAC;aAAM,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACxC,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;aAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAU,CAAC,CAAC,CAAC,oBAAY,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,CAAC,iBAAiB,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC1E,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,MAAM;gBAAE,IAAI,GAAG,GAAG,CAAC;;gBAClB,QAAQ,GAAG,GAAG,CAAC;YACpB,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACvD,IAAA,YAAG,EAAC,mBAAmB,GAAG,iBAAiB,GAAG,qBAAqB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,UAAU;QACV,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC;QACtD,cAAc;QACd,eAAe;QACf,IAAI;QACJ,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/lib/commands/secrets-plan.d.ts

@@ -0,0 +1,9 @@
+declare function sentrySourceEnv(targetEnv: string, envList: string[], devSource: string | undefined): string | undefined;
+export declare function detectConfiguredServices(deploymentDir: string, targetEnv: string, envList: string[], devSource: string | undefined): {
+    firebase: boolean;
+    sentry: boolean;
+};
+export declare function resolveAutoInit(deploymentDir: string, targetEnv: string, envList: string[], devSource: string | undefined): "all" | "firebase" | "sentry";
+export declare function validateInitConfig(init: "all" | "firebase" | "sentry", deploymentDir: string, targetEnv: string, envList: string[], devSource: string | undefined): void;
+export { sentrySourceEnv };
+//# sourceMappingURL=secrets-plan.d.ts.map

package/dist/lib/commands/secrets-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-plan.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/secrets-plan.ts"],"names":[],"mappings":"AAWA,iBAAS,eAAe,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,GAAG,SAAS,CAKpB;AAID,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAyBxC;AAID,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,KAAK,GAAG,UAAU,GAAG,QAAQ,CA4B/B;AA2BD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,QAAQ,EACnC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,IAAI,CAyCN;AAED,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/commands/secrets-plan.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectConfiguredServices = detectConfiguredServices;
+exports.resolveAutoInit = resolveAutoInit;
+exports.validateInitConfig = validateInitConfig;
+exports.sentrySourceEnv = sentrySourceEnv;
+const environments_1 = require("../environments");
+const logger_1 = require("../logger");
+// Init-mode planning: resolve `--init auto` to a concrete service from the
+// deployment config, and validate that the config required to initialize the
+// chosen service(s) is present. Ported from the predecessor's sync-env
+// orchestration; rotation itself lives in the shared engine.
+// The Sentry secret is project-wide, so it is sourced from a single active
+// environment: the first non-development one, falling back to development's
+// source (staging) or the first env in the list.
+function sentrySourceEnv(targetEnv, envList, devSource) {
+    if (targetEnv === "all")
+        return envList.find((e) => e !== "development") ?? envList[0];
+    if (targetEnv === "development")
+        return devSource;
+    return targetEnv;
+}
+// Scans the deployment config's public vars to determine which secret-backed
+// services a project uses. Shared by `--init auto` resolution and `bootstrap`.
+function detectConfiguredServices(deploymentDir, targetEnv, envList, devSource) {
+    // development has no own YAML — scan its source (staging) instead.
+    const scanEnvs = targetEnv === "development"
+        ? devSource
+            ? [devSource]
+            : []
+        : targetEnv === "all"
+            ? envList
+            : [targetEnv];
+    const keys = scanEnvs.flatMap((envName) => Object.keys((0, environments_1.parseDeploymentEnv)(deploymentDir, envName)));
+    return {
+        firebase: keys.some((k) => [
+            "FIREBASE_PROJECT_ID",
+            "FIREBASE_SA_EMAIL",
+            "NEXT_PUBLIC_FIREBASE_PROJECT_ID",
+        ].includes(k)),
+        sentry: keys.some((k) => ["SENTRY_ORG", "SENTRY_PROJECT"].includes(k)),
+    };
+}
+// Resolves `--init auto` by scanning the deployment config for public vars that
+// indicate which services are in use. Errors if neither is configured.
+function resolveAutoInit(deploymentDir, targetEnv, envList, devSource) {
+    const { firebase: hasFirebase, sentry: hasSentry } = detectConfiguredServices(deploymentDir, targetEnv, envList, devSource);
+    (0, logger_1.log)("Auto-detecting secrets to initialize:");
+    (0, logger_1.log)(hasFirebase
+        ? "  Firebase: initialize (Firebase public vars found)"
+        : "  Firebase: skip (no Firebase public vars)");
+    (0, logger_1.log)(hasSentry
+        ? "  Sentry: initialize (Sentry public vars found)"
+        : "  Sentry: skip (no Sentry public vars)");
+    if (!hasFirebase && !hasSentry)
+        (0, logger_1.err)("secrets init: nothing to initialize — no Firebase or Sentry public config vars found in the deployment config");
+    if (hasFirebase && hasSentry)
+        return "all";
+    if (hasFirebase)
+        return "firebase";
+    return "sentry";
+}
+function firebaseConfigMissing(deploymentDir, envName, label) {
+    const envVars = (0, environments_1.parseDeploymentEnv)(deploymentDir, envName);
+    const missing = [];
+    // Both identity vars are statically required (#143): #127 made init resolve the
+    // service account strictly from the target's own declared FIREBASE_SA_EMAIL —
+    // never a sibling credential — so its absence must be reported up front here,
+    // alongside FIREBASE_PROJECT_ID, rather than surfacing as a mid-run error.
+    // (Automatic SA discovery that would retire this input is gated on #70.)
+    if (!envVars.FIREBASE_SA_EMAIL && !process.env.FIREBASE_SA_EMAIL)
+        missing.push(`FIREBASE_SA_EMAIL [${label}]: add to ${envName}.yml or export in shell`);
+    if (!envVars.FIREBASE_PROJECT_ID && !process.env.GCLOUD_PROJECT)
+        missing.push(`FIREBASE_PROJECT_ID [${label}]: add to ${envName}.yml or export GCLOUD_PROJECT in shell`);
+    return missing;
+}
+// Validates that the config needed to initialize the chosen service(s) is
+// present (in the deployment YAML or shell env), erroring with every gap at once.
+function validateInitConfig(init, deploymentDir, targetEnv, envList, devSource) {
+    const missing = [];
+    if (init === "firebase" || init === "all") {
+        const activeTargets = targetEnv === "all" || targetEnv === "development"
+            ? envList
+            : [targetEnv];
+        for (const envName of activeTargets)
+            missing.push(...firebaseConfigMissing(deploymentDir, envName, envName));
+        const includesDev = targetEnv === "all" || targetEnv === "development";
+        if (includesDev && devSource)
+            missing.push(...firebaseConfigMissing(deploymentDir, devSource, "development"));
+    }
+    if (init === "sentry" || init === "all") {
+        const source = sentrySourceEnv(targetEnv, envList, devSource);
+        if (!source) {
+            missing.push("Sentry: no preview/staging environment found — add staging to environments.yml");
+        }
+        else {
+            const envVars = (0, environments_1.parseDeploymentEnv)(deploymentDir, source);
+            if (!envVars.SENTRY_ORG && !process.env.SENTRY_ORG)
+                missing.push(`SENTRY_ORG [${source}]: add to deployment YAML or shell`);
+            if (!envVars.SENTRY_PROJECT && !process.env.SENTRY_PROJECT)
+                missing.push(`SENTRY_PROJECT [${source}]: add to deployment YAML or shell`);
+        }
+    }
+    if (missing.length > 0)
+        (0, logger_1.err)(`secrets init ${init}: missing required configuration:\n${missing
+            .map((m) => `  · ${m}`)
+            .join("\n")}`);
+}
+//# sourceMappingURL=secrets-plan.js.map

package/dist/lib/commands/secrets-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-plan.js","sourceRoot":"","sources":["../../../src/lib/commands/secrets-plan.ts"],"names":[],"mappings":";;AAwBA,4DA8BC;AAID,0CAiCC;AA2BD,gDA+CC;AAEQ,0CAAe;AAvKxB,kDAAqD;AACrD,sCAAqC;AAErC,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,6DAA6D;AAE7D,2EAA2E;AAC3E,4EAA4E;AAC5E,iDAAiD;AACjD,SAAS,eAAe,CACtB,SAAiB,EACjB,OAAiB,EACjB,SAA6B;IAE7B,IAAI,SAAS,KAAK,KAAK;QACrB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,SAAS,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,SAAgB,wBAAwB,CACtC,aAAqB,EACrB,SAAiB,EACjB,OAAiB,EACjB,SAA6B;IAE7B,mEAAmE;IACnE,MAAM,QAAQ,GACZ,SAAS,KAAK,aAAa;QACzB,CAAC,CAAC,SAAS;YACT,CAAC,CAAC,CAAC,SAAS,CAAC;YACb,CAAC,CAAC,EAAE;QACN,CAAC,CAAC,SAAS,KAAK,KAAK;YACnB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEpB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,MAAM,CAAC,IAAI,CAAC,IAAA,iCAAkB,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CACxD,CAAC;IAEF,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACxB;YACE,qBAAqB;YACrB,mBAAmB;YACnB,iCAAiC;SAClC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACd;QACD,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,uEAAuE;AACvE,SAAgB,eAAe,CAC7B,aAAqB,EACrB,SAAiB,EACjB,OAAiB,EACjB,SAA6B;IAE7B,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,wBAAwB,CAC3E,aAAa,EACb,SAAS,EACT,OAAO,EACP,SAAS,CACV,CAAC;IAEF,IAAA,YAAG,EAAC,uCAAuC,CAAC,CAAC;IAC7C,IAAA,YAAG,EACD,WAAW;QACT,CAAC,CAAC,qDAAqD;QACvD,CAAC,CAAC,4CAA4C,CACjD,CAAC;IACF,IAAA,YAAG,EACD,SAAS;QACP,CAAC,CAAC,iDAAiD;QACnD,CAAC,CAAC,wCAAwC,CAC7C,CAAC;IAEF,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS;QAC5B,IAAA,YAAG,EACD,+GAA+G,CAChH,CAAC;IAEJ,IAAI,WAAW,IAAI,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,WAAW;QAAE,OAAO,UAAU,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,aAAqB,EACrB,OAAe,EACf,KAAa;IAEb,MAAM,OAAO,GAAG,IAAA,iCAAkB,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC9D,OAAO,CAAC,IAAI,CACV,sBAAsB,KAAK,aAAa,OAAO,yBAAyB,CACzE,CAAC;IACJ,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;QAC7D,OAAO,CAAC,IAAI,CACV,wBAAwB,KAAK,aAAa,OAAO,wCAAwC,CAC1F,CAAC;IACJ,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,kFAAkF;AAClF,SAAgB,kBAAkB,CAChC,IAAmC,EACnC,aAAqB,EACrB,SAAiB,EACjB,OAAiB,EACjB,SAA6B;IAE7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,aAAa,GACjB,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,aAAa;YAChD,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAClB,KAAK,MAAM,OAAO,IAAI,aAAa;YACjC,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,aAAa,CAAC;QACvE,IAAI,WAAW,IAAI,SAAS;YAC1B,OAAO,CAAC,IAAI,CACV,GAAG,qBAAqB,CAAC,aAAa,EAAE,SAAS,EAAE,aAAa,CAAC,CAClE,CAAC;IACN,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CACV,gFAAgF,CACjF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAA,iCAAkB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;gBAChD,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,oCAAoC,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc;gBACxD,OAAO,CAAC,IAAI,CACV,mBAAmB,MAAM,oCAAoC,CAC9D,CAAC;QACN,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,IAAA,YAAG,EACD,gBAAgB,IAAI,sCAAsC,OAAO;aAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;aACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACN,CAAC"}

package/dist/lib/commands/secrets.d.ts

@@ -0,0 +1,7 @@
+import type { CommandContext } from "../cli/registry";
+import { type SecretsOptions } from "./secrets-args";
+export type { SecretsOptions };
+export declare function runSecrets(opts: SecretsOptions): Promise<void>;
+export declare function runSecretsRotate(ctx: CommandContext, args: string[]): Promise<void>;
+export declare function runSecretsInit(ctx: CommandContext, args: string[]): Promise<void>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/lib/commands/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/lib/commands/secrets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AA0BtD,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQvE,YAAY,EAAE,cAAc,EAAE,CAAC;AAoJ/B,wBAAsB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAiFpE;AAID,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,EAAE,GACb,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/lib/commands/secrets.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSecrets = runSecrets;
+exports.runSecretsRotate = runSecretsRotate;
+exports.runSecretsInit = runSecretsInit;
+const auth_1 = require("../auth");
+const deployments_1 = require("../deployments");
+const firebase_credential_1 = require("../firebase-credential");
+const generated_secrets_1 = require("../generated-secrets");
+const manifest_1 = require("../manifest");
+const environments_1 = require("../environments");
+const logger_1 = require("../logger");
+const registry_1 = require("../providers/registry");
+const service_1 = require("../providers/service");
+const project_1 = require("../project");
+const rotation_1 = require("../rotation");
+const targets_1 = require("../targets");
+const vercel_api_1 = require("../vercel-api");
+const env_plan_1 = require("./env-plan");
+const secrets_args_1 = require("./secrets-args");
+const secrets_plan_1 = require("./secrets-plan");
+// Dispatches the rotation engine, mirroring the predecessor's key-rotation
+// orchestration: on `init --env all`, Sentry is initialized once (project-wide)
+// while Firebase is initialized per Vercel target (each gets its own key, with
+// development sourced from staging); otherwise a single engine call handles the
+// requested environment (rotation auto-detects services from existing keys).
+async function dispatchRotation(opts, init, envList, devSource, firebaseCredential) {
+    const { deploymentDir, invalidateKeys, workingDir, targetEnv } = opts;
+    const resolveTarget = (0, targets_1.envTargetResolver)(deploymentDir);
+    if (init && targetEnv === "all") {
+        if (init === "sentry" || init === "all") {
+            const source = (0, secrets_plan_1.sentrySourceEnv)("all", envList, devSource);
+            const vars = source ? (0, environments_1.parseDeploymentEnv)(deploymentDir, source) : {};
+            await (0, rotation_1.run)({
+                targetEnv: "all",
+                invalidateKeys,
+                workingDir,
+                init: "sentry",
+                sentryOrg: vars.SENTRY_ORG || undefined,
+                sentryProject: vars.SENTRY_PROJECT || undefined,
+            });
+        }
+        if (init === "firebase" || init === "all") {
+            const seenTargets = new Set();
+            for (const envName of envList) {
+                const target = resolveTarget(envName);
+                if (seenTargets.has(target))
+                    continue;
+                seenTargets.add(target);
+                const vars = (0, environments_1.parseDeploymentEnv)(deploymentDir, envName);
+                await (0, rotation_1.run)({
+                    targetEnv: target,
+                    invalidateKeys,
+                    workingDir,
+                    init: "firebase",
+                    firebaseSaEmail: vars.FIREBASE_SA_EMAIL || undefined,
+                    gcpProject: vars.FIREBASE_PROJECT_ID || undefined,
+                    firebaseCredential,
+                });
+            }
+            // development shares staging's Firebase project but gets its own key.
+            if (devSource) {
+                const vars = (0, environments_1.parseDeploymentEnv)(deploymentDir, devSource);
+                await (0, rotation_1.run)({
+                    targetEnv: "development",
+                    invalidateKeys,
+                    workingDir,
+                    init: "firebase",
+                    firebaseSaEmail: vars.FIREBASE_SA_EMAIL || undefined,
+                    gcpProject: vars.FIREBASE_PROJECT_ID || undefined,
+                    firebaseCredential,
+                });
+            }
+        }
+        return;
+    }
+    const source = targetEnv === "development"
+        ? devSource
+        : targetEnv === "all"
+            ? envList[0]
+            : targetEnv;
+    const vars = source ? (0, environments_1.parseDeploymentEnv)(deploymentDir, source) : {};
+    await (0, rotation_1.run)({
+        targetEnv: targetEnv === "all" ? "all" : resolveTarget(targetEnv),
+        invalidateKeys,
+        workingDir,
+        init,
+        // provider scopes rotate mode only; it is inert when init is set.
+        provider: init ? undefined : opts.provider,
+        firebaseSaEmail: vars.FIREBASE_SA_EMAIL || undefined,
+        gcpProject: vars.FIREBASE_PROJECT_ID || undefined,
+        firebaseCredential,
+        sentryOrg: vars.SENTRY_ORG || undefined,
+        sentryProject: vars.SENTRY_PROJECT || undefined,
+    });
+}
+// Whether any secret-source provider is provisioned in Vercel — the rotate-mode
+// signal for whether the provider dispatch has work to do (so a project with
+// only generated secrets doesn't hit the engine's "nothing to rotate" guard).
+async function anyServicePresent(deployment, firebaseCredential) {
+    const keys = new Set((await deployment.listEnvVars()).envs.map((e) => e.key));
+    const ctx = {
+        targetEnv: "all",
+        deployment,
+        tempDir: "",
+        firebaseCredential,
+    };
+    return (0, service_1.serviceProviders)().some((p) => p.presenceKeys(ctx).some((k) => keys.has(k)));
+}
+// Drive a run that includes project-owned generated secrets (#88). Generated
+// values are minted and pushed first (no redeploy), then the provider dispatch
+// runs when there is provider work — its redeploy proves the generated values
+// live too, so they share one redeploy. When only generated secrets exist (no
+// provider work), a redeploy is triggered here instead.
+async function runWithGeneratedSecrets(opts, init, isInit, envList, devSource, firebaseCredential, generated) {
+    const deployment = (0, registry_1.resolveProjectDeployment)(opts.deploymentDir, opts.workingDir);
+    const runTarget = opts.targetEnv === "all"
+        ? "all"
+        : (0, targets_1.envTargetResolver)(opts.deploymentDir)(opts.targetEnv);
+    const wrote = await (0, generated_secrets_1.pushGeneratedSecrets)(deployment, generated, {
+        overwrite: !isInit,
+        targetEnv: runTarget,
+    });
+    const providerWork = isInit
+        ? init !== undefined
+        : await anyServicePresent(deployment, firebaseCredential);
+    if (providerWork) {
+        await dispatchRotation(opts, init, envList, devSource, firebaseCredential);
+    }
+    else if (wrote) {
+        await deployment.triggerAndWaitRedeployments(runTarget);
+    }
+}
+// Orchestrates `secrets rotate` / `secrets init` from fully-resolved options:
+// validates prerequisites, resolves the environment plan (and, for init, the
+// concrete service + its required config), drives the rotation engine, and
+// optionally refreshes active PR previews.
+async function runSecrets(opts) {
+    const token = (0, auth_1.resolveVercelToken)();
+    (0, env_plan_1.assertDeploymentPrereqs)(opts.deploymentDir, token);
+    const activeEnvs = (0, environments_1.listActiveEnvs)(opts.deploymentDir);
+    if (activeEnvs.length === 0)
+        (0, logger_1.err)(`No active environments found in ${opts.deploymentDir}/environments.yml`);
+    const devSource = (0, env_plan_1.findDevSource)(opts.deploymentDir, activeEnvs);
+    const envList = (0, env_plan_1.resolveEnvList)(activeEnvs, opts.targetEnv, devSource);
+    const generated = (0, generated_secrets_1.resolveGeneratedSecrets)(opts.deploymentDir);
+    const isInit = opts.init !== undefined;
+    let init = opts.init;
+    if (init === "auto") {
+        // Auto-detect the provider(s) to initialize. A project with only generated
+        // secrets (no Firebase/Sentry config) has no provider to init but is not an
+        // error — it proceeds to mint its generated secrets.
+        const configured = (0, secrets_plan_1.detectConfiguredServices)(opts.deploymentDir, opts.targetEnv, envList, devSource);
+        if (!configured.firebase && !configured.sentry) {
+            if (generated.length === 0)
+                (0, logger_1.err)("secrets init: nothing to initialize — no Firebase or Sentry public config vars found in the deployment config");
+            init = undefined;
+        }
+        else {
+            init = (0, secrets_plan_1.resolveAutoInit)(opts.deploymentDir, opts.targetEnv, envList, devSource);
+        }
+    }
+    if (init)
+        (0, secrets_plan_1.validateInitConfig)(init, opts.deploymentDir, opts.targetEnv, envList, devSource);
+    // Resolve the Firebase credential contract from the manifest (the resolved
+    // var names). With no manifest / no firebase service declared, this is the
+    // default names.
+    const firebaseService = (0, manifest_1.parseManifest)(opts.deploymentDir).services.find((s) => s.provider === "firebase");
+    const firebaseCredential = (0, firebase_credential_1.resolveFirebaseCredential)(firebaseService);
+    (0, logger_1.log)(`Target: ${opts.targetEnv} | ${isInit ? `Initializing${init ? ` ${init}` : ""}` : `Rotating (invalidate old: ${opts.invalidateKeys})`}`);
+    if (generated.length === 0) {
+        await dispatchRotation(opts, init, envList, devSource, firebaseCredential);
+    }
+    else {
+        await runWithGeneratedSecrets(opts, init, isInit, envList, devSource, firebaseCredential, generated);
+    }
+    if (opts.refreshPreviews) {
+        const project = (0, project_1.detectProject)(opts.workingDir);
+        const client = new vercel_api_1.VercelClient(token, project.projectId, project.teamId);
+        await (0, deployments_1.refreshPreviewDeployments)(client);
+    }
+}
+// Command adapters: parse args (the global -C is already stripped by the
+// router) and dispatch to the shared orchestrator.
+async function runSecretsRotate(ctx, args) {
+    await runSecrets((0, secrets_args_1.parseSecretsArgs)(args, ctx.workingDir, false));
+}
+async function runSecretsInit(ctx, args) {
+    await runSecrets((0, secrets_args_1.parseSecretsArgs)(args, ctx.workingDir, true));
+}
+//# sourceMappingURL=secrets.js.map

package/dist/lib/commands/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/lib/commands/secrets.ts"],"names":[],"mappings":";;AAuLA,gCAiFC;AAID,4CAKC;AAED,wCAKC;AAxRD,kCAA6C;AAE7C,gDAA2D;AAC3D,gEAGgC;AAChC,4DAI8B;AAC9B,0CAA4C;AAC5C,kDAAqE;AACrE,sCAAqC;AAErC,oDAAiE;AACjE,kDAA6E;AAC7E,wCAA2C;AAC3C,0CAAmD;AACnD,wCAA+C;AAC/C,8CAA6C;AAC7C,yCAIoB;AACpB,iDAAuE;AACvE,iDAKwB;AAIxB,2EAA2E;AAC3E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,KAAK,UAAU,gBAAgB,CAC7B,IAAoB,EACpB,IAA+C,EAC/C,OAAiB,EACjB,SAA6B,EAC7B,kBAA0C;IAE1C,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IACtE,MAAM,aAAa,GAAG,IAAA,2BAAiB,EAAC,aAAa,CAAC,CAAC;IAEvD,IAAI,IAAI,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAA,8BAAe,EAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,iCAAkB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAA,cAAa,EAAC;gBAClB,SAAS,EAAE,KAAK;gBAChB,cAAc;gBACd,UAAU;gBACV,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;gBACvC,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,SAAS;aAChD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACtC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACxB,MAAM,IAAI,GAAG,IAAA,iCAAkB,EAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gBACxD,MAAM,IAAA,cAAa,EAAC;oBAClB,SAAS,EAAE,MAAM;oBACjB,cAAc;oBACd,UAAU;oBACV,IAAI,EAAE,UAAU;oBAChB,eAAe,EAAE,IAAI,CAAC,iBAAiB,IAAI,SAAS;oBACpD,UAAU,EAAE,IAAI,CAAC,mBAAmB,IAAI,SAAS;oBACjD,kBAAkB;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,sEAAsE;YACtE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,GAAG,IAAA,iCAAkB,EAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBAC1D,MAAM,IAAA,cAAa,EAAC;oBAClB,SAAS,EAAE,aAAa;oBACxB,cAAc;oBACd,UAAU;oBACV,IAAI,EAAE,UAAU;oBAChB,eAAe,EAAE,IAAI,CAAC,iBAAiB,IAAI,SAAS;oBACpD,UAAU,EAAE,IAAI,CAAC,mBAAmB,IAAI,SAAS;oBACjD,kBAAkB;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GACV,SAAS,KAAK,aAAa;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,KAAK,KAAK;YACnB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,iCAAkB,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,IAAA,cAAa,EAAC;QAClB,SAAS,EAAE,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC;QACjE,cAAc;QACd,UAAU;QACV,IAAI;QACJ,kEAAkE;QAClE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;QAC1C,eAAe,EAAE,IAAI,CAAC,iBAAiB,IAAI,SAAS;QACpD,UAAU,EAAE,IAAI,CAAC,mBAAmB,IAAI,SAAS;QACjD,kBAAkB;QAClB,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;QACvC,aAAa,EAAE,IAAI,CAAC,cAAc,IAAI,SAAS;KAChD,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,KAAK,UAAU,iBAAiB,CAC9B,UAA8B,EAC9B,kBAA0C;IAE1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAmB;QAC1B,SAAS,EAAE,KAAK;QAChB,UAAU;QACV,OAAO,EAAE,EAAE;QACX,kBAAkB;KACnB,CAAC;IACF,OAAO,IAAA,0BAAgB,GAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACnC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,wDAAwD;AACxD,KAAK,UAAU,uBAAuB,CACpC,IAAoB,EACpB,IAA+C,EAC/C,MAAe,EACf,OAAiB,EACjB,SAA6B,EAC7B,kBAA0C,EAC1C,SAA4B;IAE5B,MAAM,UAAU,GAAG,IAAA,mCAAwB,EACzC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,UAAU,CAChB,CAAC;IACF,MAAM,SAAS,GACb,IAAI,CAAC,SAAS,KAAK,KAAK;QACtB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAA,2BAAiB,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE5D,MAAM,KAAK,GAAG,MAAM,IAAA,wCAAoB,EAAC,UAAU,EAAE,SAAS,EAAE;QAC9D,SAAS,EAAE,CAAC,MAAM;QAClB,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM;QACzB,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,CAAC,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAE5D,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC7E,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,MAAM,UAAU,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,2CAA2C;AACpC,KAAK,UAAU,UAAU,CAAC,IAAoB;IACnD,MAAM,KAAK,GAAG,IAAA,yBAAkB,GAAE,CAAC;IACnC,IAAA,kCAAuB,EAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAEnD,MAAM,UAAU,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACzB,IAAA,YAAG,EACD,mCAAmC,IAAI,CAAC,aAAa,mBAAmB,CACzE,CAAC;IAEJ,MAAM,SAAS,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,IAAA,yBAAc,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,IAAA,2CAAuB,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;IAEvC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,2EAA2E;QAC3E,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,UAAU,GAAG,IAAA,uCAAwB,EACzC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,EACd,OAAO,EACP,SAAS,CACV,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YAC/C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBACxB,IAAA,YAAG,EACD,+GAA+G,CAChH,CAAC;YACJ,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,IAAA,8BAAe,EACpB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,EACd,OAAO,EACP,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QACN,IAAA,iCAAkB,EAChB,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,EACd,OAAO,EACP,SAAS,CACV,CAAC;IAEJ,2EAA2E;IAC3E,2EAA2E;IAC3E,iBAAiB;IACjB,MAAM,eAAe,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,IAAI,CACrE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CACjC,CAAC;IACF,MAAM,kBAAkB,GAAG,IAAA,+CAAyB,EAAC,eAAe,CAAC,CAAC;IAEtE,IAAA,YAAG,EACD,WAAW,IAAI,CAAC,SAAS,MAAM,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,6BAA6B,IAAI,CAAC,cAAc,GAAG,EAAE,CACxI,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,MAAM,uBAAuB,CAC3B,IAAI,EACJ,IAAI,EACJ,MAAM,EACN,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,SAAS,CACV,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,yBAAY,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,IAAA,uCAAyB,EAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,mDAAmD;AAC5C,KAAK,UAAU,gBAAgB,CACpC,GAAmB,EACnB,IAAc;IAEd,MAAM,UAAU,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,GAAmB,EACnB,IAAc;IAEd,MAAM,UAAU,CAAC,IAAA,+BAAgB,EAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC"}

package/dist/lib/deployments.d.ts

@@ -0,0 +1,4 @@
+import type { VercelClient } from "./vercel-api";
+export declare function triggerAndWaitRedeployments(targetEnv: string, client: VercelClient): Promise<void>;
+export declare function refreshPreviewDeployments(client: VercelClient): Promise<void>;
+//# sourceMappingURL=deployments.d.ts.map

package/dist/lib/deployments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployments.d.ts","sourceRoot":"","sources":["../../src/lib/deployments.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAiCjD,wBAAsB,2BAA2B,CAC/C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,IAAI,CAAC,CA0Bf"}