@rmartz/envctl 3.1.1

package/dist/lib/firebase.js

@@ -0,0 +1,189 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rotateFirebase = rotateFirebase;
+exports.initFirebase = initFirebase;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const logger_1 = require("./logger");
+const gcp_1 = require("./gcp");
+const firebase_credential_1 = require("./firebase-credential");
+const firebase_vars_1 = require("./firebase-vars");
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+function targetEnvs(targetEnv) {
+    if (targetEnv === "all")
+        return ["production", "preview", "development"];
+    return [targetEnv];
+}
+// Write the split credential for one environment under the resolved names.
+// `includeIdentity` also writes the projectId/clientEmail vars — needed on init,
+// skipped on a plain rotation where those identity vars are unchanged.
+async function writeCredential(client, names, vercelEnv, sa, minted, envs, includeIdentity) {
+    if (includeIdentity) {
+        await client.setEnvForTarget(names.projectId, sa.gcpProject, vercelEnv, envs);
+        await client.setEnvForTarget(names.clientEmail, sa.email, vercelEnv, envs);
+    }
+    await client.setEnvForTarget(names.privateKey, minted.private_key, vercelEnv, envs);
+    await client.setEnvForTarget(names.privateKeyId, minted.private_key_id, vercelEnv, envs);
+}
+// Read the SA identity (email + GCP project) currently in Vercel — the account
+// a rotation mints a fresh key for.
+async function detectSaIdentity(envs, names, client) {
+    for (const env of ["production", "preview", "development"]) {
+        const sa = await (0, firebase_vars_1.getFirebaseSaForEnv)(env, envs, names, client);
+        if (sa?.email) {
+            const gcpProject = process.env.GCLOUD_PROJECT ?? sa.gcpProject;
+            if (!gcpProject)
+                return (0, logger_1.err)("Could not determine GCP project: set GCLOUD_PROJECT or ensure the Firebase project id var is present in Vercel");
+            return { email: sa.email, gcpProject };
+        }
+    }
+    return (0, logger_1.err)("Could not determine Firebase service account identity from Vercel");
+}
+// The GCP project a service-account email belongs to:
+// `firebase-adminsdk-…@<project>.iam.gserviceaccount.com` → `<project>`.
+// Returns undefined for an unrecognized shape (the caller's guard is
+// best-effort — it only fires when the project is unambiguously encoded).
+function gcpProjectFromSaEmail(saEmail) {
+    return /@([^.@]+)\.iam\.gserviceaccount\.com$/.exec(saEmail)?.[1];
+}
+// ─── Firebase rotation ────────────────────────────────────────────────────────
+async function rotateFirebase(targetEnv, client, tempDir, spec = (0, firebase_credential_1.resolveFirebaseCredential)(), allowedTargets) {
+    (0, logger_1.log)("Rotating Firebase service account keys...");
+    const { names } = spec;
+    let allEnvs = await client.listEnvVars();
+    if (!(0, firebase_vars_1.hasFirebaseCredential)(allEnvs.envs, names))
+        return (0, logger_1.err)("No Firebase service account keys found in Vercel");
+    const identity = await detectSaIdentity(allEnvs.envs, names, client);
+    const fp = {
+        saEmail: identity.email,
+        gcpProject: identity.gcpProject,
+        names,
+    };
+    (0, logger_1.log)(`  Service account : ${fp.saEmail}`);
+    (0, logger_1.log)(`  GCP project     : ${fp.gcpProject}`);
+    const oldKeys = [];
+    let rotatedAny = false;
+    for (const vercelEnv of targetEnvs(targetEnv)) {
+        // Environment-scoped service (#89): skip targets outside the service's
+        // declared scope. rotation.run excludes a service that is wholly out of
+        // scope, so at least one target always survives here (no false "no keys
+        // rotated" error).
+        if (allowedTargets && !allowedTargets.includes(vercelEnv))
+            continue;
+        if (targetEnv === "all" &&
+            !(0, firebase_vars_1.hasFirebaseCredentialForEnv)(allEnvs.envs, names, vercelEnv)) {
+            (0, logger_1.log)(`  [${vercelEnv}] No existing key — skipping (use --env ${vercelEnv} to explicitly add)`);
+            continue;
+        }
+        const oldKeyId = await (0, firebase_vars_1.getFirebaseKeyIdForEnv)(vercelEnv, allEnvs.envs, names, client);
+        if (oldKeyId) {
+            (0, logger_1.log)(`  [${vercelEnv}] Current key ID: ${oldKeyId}`);
+        }
+        else {
+            (0, logger_1.log)(`  [${vercelEnv}] No key ID tracked — old key will be swept after redeployment`);
+        }
+        let envSa = await (0, firebase_vars_1.getFirebaseSaForEnv)(vercelEnv, allEnvs.envs, names, client);
+        if (!envSa) {
+            if (vercelEnv !== "production") {
+                envSa =
+                    (await (0, firebase_vars_1.getFirebaseSaForEnv)("preview", allEnvs.envs, names, client)) ??
+                        (await (0, firebase_vars_1.getFirebaseSaForEnv)("development", allEnvs.envs, names, client));
+            }
+            envSa ??= { email: fp.saEmail, gcpProject: fp.gcpProject };
+        }
+        (0, logger_1.log)(`  [${vercelEnv}] Rotating... (SA: ${envSa.email})`);
+        const keyFile = path.join(tempDir, `key-${vercelEnv}.json`);
+        (0, gcp_1.createGcpKey)(keyFile, envSa.email, envSa.gcpProject);
+        const minted = JSON.parse(fs.readFileSync(keyFile, "utf-8"));
+        (0, logger_1.log)(`  [${vercelEnv}] New key ID: ${minted.private_key_id}`);
+        await writeCredential(client, names, vercelEnv, envSa, minted, (await client.listEnvVars()).envs, false);
+        if (oldKeyId) {
+            oldKeys.push({
+                vercelEnv,
+                keyId: oldKeyId,
+                saEmail: envSa.email,
+                gcpProject: envSa.gcpProject,
+            });
+        }
+        allEnvs = await client.listEnvVars();
+        rotatedAny = true;
+    }
+    if (!rotatedAny)
+        (0, logger_1.err)("No Firebase keys rotated — check --env and project configuration");
+    (0, logger_1.log)("Firebase key rotation complete.");
+    return { oldKeys, fp };
+}
+// ─── Firebase init ────────────────────────────────────────────────────────────
+async function initFirebase(targetEnv, client, tempDir, saEmailOverride, gcpProjectOverride, spec = (0, firebase_credential_1.resolveFirebaseCredential)(), allowedTargets) {
+    (0, logger_1.log)("Initializing Firebase service account keys...");
+    const currentEnvs = await client.listEnvVars();
+    // Resolve the SA identity strictly from THIS target's own declared identity
+    // (#126). `init` must never derive the SA from another target's credential (or
+    // a local `.env.local`): a blank production target must be minted from
+    // production's own `FIREBASE_SA_EMAIL`, not from whatever credential happens to
+    // be in scope — cross-deriving pushed staging creds to production. (The run
+    // guard already blocks init when the target itself has a credential, so there
+    // is nothing on the target to derive from anyway; `rotate` is where an
+    // existing credential's identity is reused.) FIREBASE_SA_EMAIL is the
+    // deprecated cold-start input; automatic discovery is gated on #70.
+    const saEmail = saEmailOverride ?? process.env.FIREBASE_SA_EMAIL;
+    if (!saEmail)
+        return (0, logger_1.err)(`FIREBASE_SA_EMAIL is required for --init firebase (target: ${targetEnv}). Set FIREBASE_SA_EMAIL in the ${targetEnv} deployment YAML or your shell environment.`);
+    const gcpProject = gcpProjectOverride ?? process.env.GCLOUD_PROJECT;
+    if (!gcpProject)
+        return (0, logger_1.err)(`GCLOUD_PROJECT is required for --init firebase (target: ${targetEnv}). Set FIREBASE_PROJECT_ID in the ${targetEnv} deployment YAML or GCLOUD_PROJECT in your shell environment.`);
+    // Refuse a cross-project mixup (#126): the SA's own project (encoded in its
+    // email) must match the target's declared GCP project. A mismatch means the
+    // wrong SA email is declared for this environment — never push a foreign
+    // project's credential to the target.
+    const saProject = gcpProjectFromSaEmail(saEmail);
+    if (saProject && saProject !== gcpProject)
+        return (0, logger_1.err)(`Refusing to init firebase for '${targetEnv}': FIREBASE_SA_EMAIL (${saEmail}) belongs to GCP project '${saProject}', but the target's project is '${gcpProject}'. They must match — check the ${targetEnv} deployment YAML (FIREBASE_SA_EMAIL vs FIREBASE_PROJECT_ID).`);
+    (0, logger_1.warn)("FIREBASE_SA_EMAIL is deprecated as a cold-start input — it is only needed for a first-ever (blank) init; `rotate` derives the service account from the target's own credential, and automatic discovery (#70) will remove even the init need.");
+    for (const vercelEnv of targetEnvs(targetEnv)) {
+        // Environment-scoped service (#89): skip targets outside the service's scope.
+        if (allowedTargets && !allowedTargets.includes(vercelEnv))
+            continue;
+        const keyFile = path.join(tempDir, `key-${vercelEnv}.json`);
+        (0, gcp_1.createGcpKey)(keyFile, saEmail, gcpProject);
+        const minted = JSON.parse(fs.readFileSync(keyFile, "utf-8"));
+        (0, logger_1.log)(`  [${vercelEnv}] Created key ID: ${minted.private_key_id}`);
+        await writeCredential(client, spec.names, vercelEnv, { email: saEmail, gcpProject }, minted, currentEnvs.envs, true);
+        (0, logger_1.log)(`  [${vercelEnv}] Pushed split Firebase credential vars`);
+    }
+    (0, logger_1.log)("Firebase initialization complete.");
+}
+//# sourceMappingURL=firebase.js.map

package/dist/lib/firebase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firebase.js","sourceRoot":"","sources":["../../src/lib/firebase.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoHA,wCAiHC;AAID,oCAoEC;AA7SD,uCAAyB;AACzB,2CAA6B;AAE7B,qCAA0C;AAC1C,+BAAqC;AACrC,+DAG+B;AAC/B,mDAMyB;AA0BzB,iFAAiF;AAEjF,SAAS,UAAU,CAAC,SAAiB;IACnC,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IACzE,OAAO,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,2EAA2E;AAC3E,iFAAiF;AACjF,uEAAuE;AACvE,KAAK,UAAU,eAAe,CAC5B,MAA0B,EAC1B,KAAsC,EACtC,SAAiB,EACjB,EAAkB,EAClB,MAAiB,EACjB,IAAoB,EACpB,eAAwB;IAExB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,eAAe,CAC1B,KAAK,CAAC,SAAS,EACf,EAAE,CAAC,UAAU,EACb,SAAS,EACT,IAAI,CACL,CAAC;QACF,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,CAAC,eAAe,CAC1B,KAAK,CAAC,UAAU,EAChB,MAAM,CAAC,WAAW,EAClB,SAAS,EACT,IAAI,CACL,CAAC;IACF,MAAM,MAAM,CAAC,eAAe,CAC1B,KAAK,CAAC,YAAY,EAClB,MAAM,CAAC,cAAc,EACrB,SAAS,EACT,IAAI,CACL,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,oCAAoC;AACpC,KAAK,UAAU,gBAAgB,CAC7B,IAAoB,EACpB,KAAsC,EACtC,MAA0B;IAE1B,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,CAAC;QAC3D,MAAM,EAAE,GAAG,MAAM,IAAA,mCAAmB,EAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,UAAU,CAAC;YAC/D,IAAI,CAAC,UAAU;gBACb,OAAO,IAAA,YAAG,EACR,gHAAgH,CACjH,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,IAAA,YAAG,EACR,mEAAmE,CACpE,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,yEAAyE;AACzE,qEAAqE;AACrE,0EAA0E;AAC1E,SAAS,qBAAqB,CAAC,OAAe;IAC5C,OAAO,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,iFAAiF;AAE1E,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,MAA0B,EAC1B,OAAe,EACf,OAA+B,IAAA,+CAAyB,GAAE,EAC1D,cAAyB;IAEzB,IAAA,YAAG,EAAC,2CAA2C,CAAC,CAAC;IAEjD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,IAAI,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,CAAC,IAAA,qCAAqB,EAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QAC7C,OAAO,IAAA,YAAG,EAAC,kDAAkD,CAAC,CAAC;IAEjE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,EAAE,GAAqB;QAC3B,OAAO,EAAE,QAAQ,CAAC,KAAK;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,KAAK;KACN,CAAC;IAEF,IAAA,YAAG,EAAC,uBAAuB,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACzC,IAAA,YAAG,EAAC,uBAAuB,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IAE5C,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,UAAU,GAAG,KAAK,CAAC;IAEvB,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,mBAAmB;QACnB,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACpE,IACE,SAAS,KAAK,KAAK;YACnB,CAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,EAC5D,CAAC;YACD,IAAA,YAAG,EACD,MAAM,SAAS,2CAA2C,SAAS,qBAAqB,CACzF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,sCAAsB,EAC3C,SAAS,EACT,OAAO,CAAC,IAAI,EACZ,KAAK,EACL,MAAM,CACP,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,IAAA,YAAG,EAAC,MAAM,SAAS,qBAAqB,QAAQ,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,IAAA,YAAG,EACD,MAAM,SAAS,gEAAgE,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,GAAG,MAAM,IAAA,mCAAmB,EACnC,SAAS,EACT,OAAO,CAAC,IAAI,EACZ,KAAK,EACL,MAAM,CACP,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;gBAC/B,KAAK;oBACH,CAAC,MAAM,IAAA,mCAAmB,EAAC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;wBACnE,CAAC,MAAM,IAAA,mCAAmB,EACxB,aAAa,EACb,OAAO,CAAC,IAAI,EACZ,KAAK,EACL,MAAM,CACP,CAAC,CAAC;YACP,CAAC;YACD,KAAK,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QAC7D,CAAC;QAED,IAAA,YAAG,EAAC,MAAM,SAAS,sBAAsB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAEzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,SAAS,OAAO,CAAC,CAAC;QAC5D,IAAA,kBAAY,EAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAc,CAAC;QAC1E,IAAA,YAAG,EAAC,MAAM,SAAS,iBAAiB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QAE7D,MAAM,eAAe,CACnB,MAAM,EACN,KAAK,EACL,SAAS,EACT,KAAK,EACL,MAAM,EACN,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EACjC,KAAK,CACN,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS;gBACT,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,KAAK,CAAC,KAAK;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;QACrC,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,UAAU;QACb,IAAA,YAAG,EAAC,kEAAkE,CAAC,CAAC;IAC1E,IAAA,YAAG,EAAC,iCAAiC,CAAC,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AACzB,CAAC;AAED,iFAAiF;AAE1E,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,MAA0B,EAC1B,OAAe,EACf,eAAwB,EACxB,kBAA2B,EAC3B,OAA+B,IAAA,+CAAyB,GAAE,EAC1D,cAAyB;IAEzB,IAAA,YAAG,EAAC,+CAA+C,CAAC,CAAC;IAErD,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;IAE/C,4EAA4E;IAC5E,+EAA+E;IAC/E,uEAAuE;IACvE,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,OAAO,GAAG,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACjE,IAAI,CAAC,OAAO;QACV,OAAO,IAAA,YAAG,EACR,8DAA8D,SAAS,mCAAmC,SAAS,6CAA6C,CACjK,CAAC;IACJ,MAAM,UAAU,GAAG,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACpE,IAAI,CAAC,UAAU;QACb,OAAO,IAAA,YAAG,EACR,2DAA2D,SAAS,qCAAqC,SAAS,+DAA+D,CAClL,CAAC;IAEJ,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,SAAS,IAAI,SAAS,KAAK,UAAU;QACvC,OAAO,IAAA,YAAG,EACR,kCAAkC,SAAS,yBAAyB,OAAO,6BAA6B,SAAS,mCAAmC,UAAU,kCAAkC,SAAS,8DAA8D,CACxQ,CAAC;IAEJ,IAAA,aAAI,EACF,+OAA+O,CAChP,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,8EAA8E;QAC9E,IAAI,cAAc,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,SAAS;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,SAAS,OAAO,CAAC,CAAC;QAC5D,IAAA,kBAAY,EAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAc,CAAC;QAC1E,IAAA,YAAG,EAAC,MAAM,SAAS,qBAAqB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,CACnB,MAAM,EACN,IAAI,CAAC,KAAK,EACV,SAAS,EACT,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAC9B,MAAM,EACN,WAAW,CAAC,IAAI,EAChB,IAAI,CACL,CAAC;QACF,IAAA,YAAG,EAAC,MAAM,SAAS,yCAAyC,CAAC,CAAC;IAChE,CAAC;IAED,IAAA,YAAG,EAAC,mCAAmC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/lib/gcp.d.ts

@@ -0,0 +1,4 @@
+export declare function createGcpKey(outputFile: string, saEmail: string, gcpProject: string): void;
+export declare function listUserManagedGcpKeys(saEmail: string, gcpProject: string): string[];
+export declare function deleteGcpKey(keyId: string, saEmail: string, gcpProject: string): void;
+//# sourceMappingURL=gcp.d.ts.map

package/dist/lib/gcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/lib/gcp.ts"],"names":[],"mappings":"AAIA,wBAAgB,YAAY,CAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,IAAI,CAaN;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAgBV;AAED,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,IAAI,CAaN"}

package/dist/lib/gcp.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createGcpKey = createGcpKey;
+exports.listUserManagedGcpKeys = listUserManagedGcpKeys;
+exports.deleteGcpKey = deleteGcpKey;
+const subprocess_1 = require("./subprocess");
+// ─── GCP helpers ──────────────────────────────────────────────────────────────
+function createGcpKey(outputFile, saEmail, gcpProject) {
+    (0, subprocess_1.run)("gcloud", [
+        "iam",
+        "service-accounts",
+        "keys",
+        "create",
+        outputFile,
+        "--iam-account",
+        saEmail,
+        "--project",
+        gcpProject,
+        "--quiet",
+    ]);
+}
+function listUserManagedGcpKeys(saEmail, gcpProject) {
+    const output = (0, subprocess_1.run)("gcloud", [
+        "iam",
+        "service-accounts",
+        "keys",
+        "list",
+        "--iam-account",
+        saEmail,
+        "--project",
+        gcpProject,
+        "--managed-by",
+        "user",
+        "--format",
+        "value(name.basename())",
+    ]);
+    return output.trim().split("\n").filter(Boolean);
+}
+function deleteGcpKey(keyId, saEmail, gcpProject) {
+    (0, subprocess_1.run)("gcloud", [
+        "iam",
+        "service-accounts",
+        "keys",
+        "delete",
+        keyId,
+        "--iam-account",
+        saEmail,
+        "--project",
+        gcpProject,
+        "--quiet",
+    ]);
+}
+//# sourceMappingURL=gcp.js.map

package/dist/lib/gcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp.js","sourceRoot":"","sources":["../../src/lib/gcp.ts"],"names":[],"mappings":";;AAIA,oCAiBC;AAED,wDAmBC;AAED,oCAiBC;AA7DD,6CAA6C;AAE7C,iFAAiF;AAEjF,SAAgB,YAAY,CAC1B,UAAkB,EAClB,OAAe,EACf,UAAkB;IAElB,IAAA,gBAAM,EAAC,QAAQ,EAAE;QACf,KAAK;QACL,kBAAkB;QAClB,MAAM;QACN,QAAQ;QACR,UAAU;QACV,eAAe;QACf,OAAO;QACP,WAAW;QACX,UAAU;QACV,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,sBAAsB,CACpC,OAAe,EACf,UAAkB;IAElB,MAAM,MAAM,GAAG,IAAA,gBAAM,EAAC,QAAQ,EAAE;QAC9B,KAAK;QACL,kBAAkB;QAClB,MAAM;QACN,MAAM;QACN,eAAe;QACf,OAAO;QACP,WAAW;QACX,UAAU;QACV,cAAc;QACd,MAAM;QACN,UAAU;QACV,wBAAwB;KACzB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,YAAY,CAC1B,KAAa,EACb,OAAe,EACf,UAAkB;IAElB,IAAA,gBAAM,EAAC,QAAQ,EAAE;QACf,KAAK;QACL,kBAAkB;QAClB,MAAM;QACN,QAAQ;QACR,KAAK;QACL,eAAe;QACf,OAAO;QACP,WAAW;QACX,UAAU;QACV,SAAS;KACV,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/generated-secrets.d.ts

@@ -0,0 +1,16 @@
+import type { DeploymentProvider } from "./providers/deployment";
+export declare function generateSecretValue(): string;
+export interface GeneratedSecret {
+    name: string;
+    /** The distinct provider targets this secret is scoped to. */
+    targets: string[];
+}
+export declare function resolveGeneratedSecrets(deploymentDir: string): GeneratedSecret[];
+export interface GeneratedSecretPushOptions {
+    /** rotate re-mints every value; init only fills targets that lack one. */
+    overwrite: boolean;
+    /** The run's requested environment target ("all" or a specific target). */
+    targetEnv: string;
+}
+export declare function pushGeneratedSecrets(deployment: DeploymentProvider, secrets: GeneratedSecret[], opts: GeneratedSecretPushOptions): Promise<boolean>;
+//# sourceMappingURL=generated-secrets.d.ts.map

package/dist/lib/generated-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secrets.d.ts","sourceRoot":"","sources":["../../src/lib/generated-secrets.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AASjE,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAQD,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,GACpB,eAAe,EAAE,CAsBnB;AAED,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,kBAAkB,EAC9B,OAAO,EAAE,eAAe,EAAE,EAC1B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,OAAO,CAAC,CA0BlB"}

package/dist/lib/generated-secrets.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSecretValue = generateSecretValue;
+exports.resolveGeneratedSecrets = resolveGeneratedSecrets;
+exports.pushGeneratedSecrets = pushGeneratedSecrets;
+const crypto_1 = require("crypto");
+const logger_1 = require("./logger");
+const manifest_1 = require("./manifest");
+const targets_1 = require("./targets");
+// Project-owned generated secrets (#88): variables declared `generate: true` in
+// the manifest that envctl itself mints — a strong random value per environment,
+// pushed to the deployment target, never stored in git. The motivating case is a
+// Vercel-cron `CRON_SECRET`.
+// One strong built-in format, no knobs (v1): 32 random bytes, base64url-encoded.
+function generateSecretValue() {
+    return (0, crypto_1.randomBytes)(32).toString("base64url");
+}
+// Resolve the manifest's `generate: true` variables into (name → target set),
+// honoring variable-group environment scoping: a top-level generated variable
+// applies to every environment; one inside a scoped group applies only to the
+// group's environments. Each environment maps to its provider target
+// (`resolveEnvTarget`); duplicate targets collapse. A project with no manifest
+// (or no generated variables) yields an empty list — a no-op.
+function resolveGeneratedSecrets(deploymentDir) {
+    const manifest = (0, manifest_1.parseManifest)(deploymentDir);
+    const resolveTarget = (0, targets_1.envTargetResolver)(deploymentDir);
+    const secrets = [];
+    const record = (name, environments) => {
+        const targets = [...new Set(environments.map((env) => resolveTarget(env)))];
+        if (targets.length > 0)
+            secrets.push({ name, targets });
+    };
+    for (const variable of manifest.variables)
+        if (variable.source.kind === "generate")
+            record(variable.name, manifest.environments);
+    for (const group of manifest.variableGroups) {
+        const environments = group.environments ?? manifest.environments;
+        for (const variable of group.variables)
+            if (variable.source.kind === "generate")
+                record(variable.name, environments);
+    }
+    return secrets;
+}
+// Mint and push generated secrets to their scoped targets, minting a **distinct**
+// value per target. On init (`overwrite: false`) a target that already has the
+// value is left untouched (idempotent); on rotate (`overwrite: true`) every
+// scoped target gets a fresh value. Returns whether anything was written (so the
+// caller can decide whether a redeploy is needed). Does not redeploy itself.
+async function pushGeneratedSecrets(deployment, secrets, opts) {
+    if (secrets.length === 0)
+        return false;
+    const { envs } = await deployment.listEnvVars();
+    let wrote = false;
+    for (const secret of secrets) {
+        for (const target of secret.targets) {
+            if (opts.targetEnv !== "all" && target !== opts.targetEnv)
+                continue;
+            const existing = deployment.findEnvVar(envs, secret.name, target);
+            if (existing && !opts.overwrite)
+                continue;
+            await deployment.setEnvForTarget(secret.name, generateSecretValue(), target, envs, "encrypted");
+            (0, logger_1.log)(`  [${target}] ${existing ? "Rotated" : "Minted"} generated secret ${secret.name}`);
+            wrote = true;
+        }
+    }
+    return wrote;
+}
+//# sourceMappingURL=generated-secrets.js.map

package/dist/lib/generated-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secrets.js","sourceRoot":"","sources":["../../src/lib/generated-secrets.ts"],"names":[],"mappings":";;AAaA,kDAEC;AAcD,0DAwBC;AAcD,oDA8BC;AAjGD,mCAAqC;AAErC,qCAA+B;AAC/B,yCAA2C;AAE3C,uCAA8C;AAE9C,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,6BAA6B;AAE7B,iFAAiF;AACjF,SAAgB,mBAAmB;IACjC,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAQD,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,qEAAqE;AACrE,+EAA+E;AAC/E,8DAA8D;AAC9D,SAAgB,uBAAuB,CACrC,aAAqB;IAErB,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAA,2BAAiB,EAAC,aAAa,CAAC,CAAC;IACvD,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,YAA+B,EAAQ,EAAE;QACrE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS;QACvC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;YACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAEjD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;QACjE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS;YACpC,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;gBACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AASD,kFAAkF;AAClF,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,6EAA6E;AACtE,KAAK,UAAU,oBAAoB,CACxC,UAA8B,EAC9B,OAA0B,EAC1B,IAAgC;IAEhC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,MAAM,KAAK,IAAI,CAAC,SAAS;gBAAE,SAAS;YACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,SAAS;YAC1C,MAAM,UAAU,CAAC,eAAe,CAC9B,MAAM,CAAC,IAAI,EACX,mBAAmB,EAAE,EACrB,MAAM,EACN,IAAI,EACJ,WAAW,CACZ,CAAC;YACF,IAAA,YAAG,EACD,MAAM,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,qBAAqB,MAAM,CAAC,IAAI,EAAE,CACnF,CAAC;YACF,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/logger.d.ts

@@ -0,0 +1,7 @@
+export declare class FatalError extends Error {
+    constructor(message: string);
+}
+export declare const log: (msg: string) => void;
+export declare const warn: (msg: string) => void;
+export declare const err: (msg: string) => never;
+//# sourceMappingURL=logger.d.ts.map

package/dist/lib/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAMA,qBAAa,UAAW,SAAQ,KAAK;gBACvB,OAAO,EAAE,MAAM;CAI5B;AAED,eAAO,MAAM,GAAG,GAAI,KAAK,MAAM,SAE9B,CAAC;AACF,eAAO,MAAM,IAAI,GAAI,KAAK,MAAM,SAE/B,CAAC;AACF,eAAO,MAAM,GAAG,GAAI,KAAK,MAAM,KAAG,KAEjC,CAAC"}

package/dist/lib/logger.js

@@ -0,0 +1,60 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.err = exports.warn = exports.log = exports.FatalError = void 0;
+const path = __importStar(require("path"));
+const scriptName = process.argv[1]
+    ? path.basename(process.argv[1], ".js")
+    : "vercel-scripts";
+class FatalError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "FatalError";
+    }
+}
+exports.FatalError = FatalError;
+const log = (msg) => {
+    console.log(`[${scriptName}] ${msg}`);
+};
+exports.log = log;
+const warn = (msg) => {
+    console.error(`[${scriptName}] WARNING: ${msg}`);
+};
+exports.warn = warn;
+const err = (msg) => {
+    throw new FatalError(msg);
+};
+exports.err = err;
+//# sourceMappingURL=logger.js.map

package/dist/lib/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA6B;AAE7B,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACvC,CAAC,CAAC,gBAAgB,CAAC;AAErB,MAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AALD,gCAKC;AAEM,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE;IACjC,OAAO,CAAC,GAAG,CAAC,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;AACxC,CAAC,CAAC;AAFW,QAAA,GAAG,OAEd;AACK,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE;IAClC,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,cAAc,GAAG,EAAE,CAAC,CAAC;AACnD,CAAC,CAAC;AAFW,QAAA,IAAI,QAEf;AACK,MAAM,GAAG,GAAG,CAAC,GAAW,EAAS,EAAE;IACxC,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC,CAAC;AAFW,QAAA,GAAG,OAEd"}

package/dist/lib/manifest/index.d.ts

@@ -0,0 +1,6 @@
+export type { DeploymentDecl, ResolvedManifest, ServiceDecl, VariableDecl, VariableGroup, VariableSource, Visibility, } from "./types";
+export { variableVisibility } from "./types";
+export { MANIFEST_FILENAME, manifestFilePath, parseManifest } from "./parse";
+export { effectiveValue } from "./resolve";
+export { setManifestEnvironments, setManifestTarget } from "./write";
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/manifest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/manifest/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}

package/dist/lib/manifest/index.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setManifestTarget = exports.setManifestEnvironments = exports.effectiveValue = exports.parseManifest = exports.manifestFilePath = exports.MANIFEST_FILENAME = exports.variableVisibility = void 0;
+var types_1 = require("./types");
+Object.defineProperty(exports, "variableVisibility", { enumerable: true, get: function () { return types_1.variableVisibility; } });
+var parse_1 = require("./parse");
+Object.defineProperty(exports, "MANIFEST_FILENAME", { enumerable: true, get: function () { return parse_1.MANIFEST_FILENAME; } });
+Object.defineProperty(exports, "manifestFilePath", { enumerable: true, get: function () { return parse_1.manifestFilePath; } });
+Object.defineProperty(exports, "parseManifest", { enumerable: true, get: function () { return parse_1.parseManifest; } });
+var resolve_1 = require("./resolve");
+Object.defineProperty(exports, "effectiveValue", { enumerable: true, get: function () { return resolve_1.effectiveValue; } });
+var write_1 = require("./write");
+Object.defineProperty(exports, "setManifestEnvironments", { enumerable: true, get: function () { return write_1.setManifestEnvironments; } });
+Object.defineProperty(exports, "setManifestTarget", { enumerable: true, get: function () { return write_1.setManifestTarget; } });
+//# sourceMappingURL=index.js.map

package/dist/lib/manifest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/manifest/index.ts"],"names":[],"mappings":";;;AASA,iCAA6C;AAApC,2GAAA,kBAAkB,OAAA;AAC3B,iCAA6E;AAApE,0GAAA,iBAAiB,OAAA;AAAE,yGAAA,gBAAgB,OAAA;AAAE,sGAAA,aAAa,OAAA;AAC3D,qCAA2C;AAAlC,yGAAA,cAAc,OAAA;AACvB,iCAAqE;AAA5D,gHAAA,uBAAuB,OAAA;AAAE,0GAAA,iBAAiB,OAAA"}

package/dist/lib/manifest/parse.d.ts

@@ -0,0 +1,11 @@
+import type { ResolvedManifest } from "./types";
+export declare const MANIFEST_FILENAME = "manifest.yml";
+export declare function manifestFilePath(deploymentDir: string): string;
+/**
+ * Parse a project's deployment configuration into the resolved model. Reads
+ * `deployment/manifest.yml` when present; otherwise falls back to the legacy
+ * flat format (`environments.yml` + per-env value files) mapped onto the same
+ * model, so existing projects parse unchanged.
+ */
+export declare function parseManifest(deploymentDir: string): ResolvedManifest;
+//# sourceMappingURL=parse.d.ts.map

package/dist/lib/manifest/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../../src/lib/manifest/parse.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAEV,gBAAgB,EAKjB,MAAM,SAAS,CAAC;AAEjB,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE9D;AAuHD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAKrE"}