@smoothbricks/cli 0.11.15 → 0.11.17

package/dist/release/index.js

@@ -15,7 +15,8 @@ import { parseNxJsonText, parseNxProjectJsonText, parsePackageJsonText, } from '
 import { decode, run, runInteractiveStatus, runResult, runText } from '../lib/run.js';
 import { getWorkspacePackages, listPublicReleasePackages, listReleasePackages, readPackageJson, repositoryInfo, } from '../lib/workspace.js';
 export { assertPackedArtifact, releasePack, resolvePackClosure, } from './pack.js';
-export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmUserconfigContent, publishPrivateWithDiagnostics, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+export { assertPrivatePackage, checkPrivatePackage, isPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmTokenEnvForMode, privateNpmUserconfigContent, publishPrivateWithDiagnostics, requirePrivateNpmRegistry, resolvePrivateNpmRegistry, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { ciApiContext } from '../github-ci/api.js';
 import { readProjectTargets } from '../nx/index.js';
 import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
@@ -26,7 +27,7 @@ import { createOrUpdateGithubRelease, githubReleaseLookupExists, importWorkspace
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import { bumpStableReleaseToNext, collectRepairPlatformOutputs, completeReleaseAtHead as completeReleaseAtHeadWithShell, prepareReleaseCandidate, repairPendingTargets, runReleaseTag, runReleaseVersion, } from './orchestration.js';
 import { packReleaseTarball } from './pack.js';
-import { assertPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, publishPrivateWithDiagnostics, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
+import { assertPrivatePackage, npmPackageExists as npmPackageExistsOnRegistry, npmPublishedVersionExists as npmPublishedVersionExistsOnRegistry, privateNpmPublishArgs, privateNpmTokenEnvForMode, publishPrivateWithDiagnostics, selectPublishDestination, selectRegistryForPackage, withPrivateNpmUserconfig, } from './private-npm.js';
 import { retagUnpublished } from './retag-unpublished.js';
 import { forgejoAuthHeaders, forgejoReleaseLookupExists, resolveSourceReleaseEndpoint, resolveSourceRepository, sourceReleaseTokenEnvNames, sourceReleaseUrl, } from './source-release.js';
 export async function releaseVersion(root, options) {
@@ -426,7 +427,12 @@ async function publishPrivatePackedPackage(root, pkg, tag, dryRun, registry) {
         }
         await withPrivateNpmUserconfig(registry, 'publish', async (userconfig) => {
             await publishPrivateWithDiagnostics(pkg, {
-                publish: () => runNpm(root, args, { NPM_CONFIG_USERCONFIG: userconfig }),
+                publish: () => runNpm(root, args, {
+                    NPM_CONFIG_USERCONFIG: userconfig,
+                    // Env config outranks a committed project `.npmrc` auth line; see
+                    // npmStatusEnv in private-npm.ts for why that matters here.
+                    [`npm_config_${registry.authKey}`]: process.env[privateNpmTokenEnvForMode(registry, 'publish')] ?? '',
+                }),
                 // The open publish userconfig already authenticates this registry,
                 // so the failure probe reuses it. Opening a second read-mode
                 // userconfig here demanded a read credential the publishing job need
@@ -435,6 +441,7 @@ async function publishPrivatePackedPackage(root, pkg, tag, dryRun, registry) {
                 versionExists: () => npmPublishedVersionExistsOnRegistry(root, pkg.name, pkg.version, {
                     registry: registry.registry,
                     userconfig,
+                    credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'publish') },
                 }),
                 log: (message) => console.log(message),
                 error: (message) => console.error(message),
@@ -782,6 +789,17 @@ function releaseRepairShell(root, platformOutputs) {
             const sourceSha = await gitHead(root);
             const outputs = platformOutputs.map((base) => join(base, sourceSha));
             if (outputs.length === 0) {
+                // No producer job handed outputs over, so this runner is the producer:
+                // build the platform legs at the checked-out ref. `build` alone gives a
+                // package only the legs its own graph depends on — the host one and
+                // whatever it declares — and the release gate demands the whole declared
+                // native closure, so a foreign leg it never asked for was simply absent.
+                console.log('Repair pending releases: building cross-platform outputs on this runner.');
+                await githubCiNxRunMany(root, {
+                    targets: PLATFORM_TARGET_GLOBS.join(','),
+                    projects: releasePackageProjects(packages),
+                    allowEmptyProjects: true,
+                });
                 return;
             }
             console.log(`Repair pending releases: applying cross-platform outputs from ${outputs.join(', ')}.`);
@@ -1366,7 +1384,11 @@ async function npmVersionExists(root, name, version) {
         assertPublicStatusAllowed(root, name);
         return npmPublishedVersionExistsOnRegistry(root, name, version);
     }
-    return withPrivateNpmUserconfig(registry, 'read', (userconfig) => npmPublishedVersionExistsOnRegistry(root, name, version, { registry: registry.registry, userconfig }));
+    return withPrivateNpmUserconfig(registry, 'read', (userconfig) => npmPublishedVersionExistsOnRegistry(root, name, version, {
+        registry: registry.registry,
+        userconfig,
+        credential: { authKey: registry.authKey, tokenEnv: privateNpmTokenEnvForMode(registry, 'read') },
+    }));
 }
 async function npmPackageExists(root, name) {
     const registry = selectRegistryForPackage(root, name);

package/dist/release/private-npm.d.ts

@@ -103,6 +103,11 @@ export declare function withPrivateNpmUserconfig<T>(resolved: PrivateNpmRegistry
 export interface NpmStatusOptions {
     registry?: string;
     userconfig?: string;
+    /** Path-scoped auth key and token env, so the credential can ride env config. */
+    credential?: {
+        authKey: string;
+        tokenEnv: string;
+    };
 }
 /**
  * Failure-aware registry status: only a genuine not-found result means absent.

package/dist/release/private-npm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"private-npm.d.ts","sourceRoot":"","sources":["../../src/release/private-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAGL,KAAK,WAAW,EAIjB,MAAM,qBAAqB,CAAC;AAE7B,uEAAuE;AACvE,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,iCAAiC,GACzC,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,CAAC;AAEpB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,iCAAiC,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAMhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAwFtE;AAoFD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAqBjG;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAO9F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,6BAA6B,GAAG,IAAI,CAiBtC;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKhH;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,GAAG,MAAM,CAAC,GAC3D,kBAAkB,CAapB;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACpC,MAAM,CAMR;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUxG;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAWD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAanH;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAE1G;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,GAAG,SAAS,CAAC,EAChE,KAAK,EAAE,gCAAgC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAuCf"}
+{"version":3,"file":"private-npm.d.ts","sourceRoot":"","sources":["../../src/release/private-npm.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,OAAO,EAGL,KAAK,WAAW,EAIjB,MAAM,qBAAqB,CAAC;AAE7B,uEAAuE;AACvE,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,iCAAiC,GACzC,sBAAsB,GACtB,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,CAAC;AAEpB,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,iCAAiC,CAAC;IACxC,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,KAAK,cAAc,GAAG,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;AAMhF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAwFtE;AAoFD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CA0BjG;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAM1E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAE3G;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAO9F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,6BAA6B,GAAG,IAAI,CAiBtC;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAKhH;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAExG;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,EAAE,MAAM,GAAG,MAAM,CAAC,GAC3D,kBAAkB,CAapB;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACpC,MAAM,CAMR;AAED,yFAAyF;AACzF,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAUxG;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAC9C,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,EAAE,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iFAAiF;IACjF,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AA6BD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAalB;AAED,iFAAiF;AACjF,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAanH;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,oGAAoG;AACpG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAE1G;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,IAAI,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,MAAM,GAAG,SAAS,CAAC,EAChE,KAAK,EAAE,gCAAgC,EACvC,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAuCf"}

package/dist/release/private-npm.js

@@ -179,7 +179,12 @@ export function resolvePrivateNpmWorkflowConfig(root) {
         return undefined;
     }
     const npmrcEnv = npmrcAuthTokenEnv(root, declared.scope);
-    const readTokenEnv = consumes ? (declared.readTokenEnv ?? npmrcEnv) : undefined;
+    // A publishing workspace reads the registry too: every release after the
+    // first checks the previous tag's durable state, and that check runs in the
+    // producer jobs that never see the publish credential. A declared read token
+    // therefore always renders; only the .npmrc fallback stays consumer-only, so
+    // a publish token is never promoted into a read role by inference.
+    const readTokenEnv = declared.readTokenEnv ?? (consumes ? npmrcEnv : undefined);
     const publishTokenEnv = publishes ? (declared.publishTokenEnv ?? npmrcEnv) : undefined;
     if (!readTokenEnv && !publishTokenEnv) {
         return undefined;
@@ -312,8 +317,24 @@ export async function withPrivateNpmUserconfig(resolved, mode, fn) {
         await rm(dir, { recursive: true, force: true });
     }
 }
-function npmStatusEnv(userconfig) {
-    return userconfig ? { NPM_CONFIG_USERCONFIG: userconfig } : undefined;
+/**
+ * npm config precedence is cli > env > project `.npmrc` > userconfig. A
+ * repository that commits its own `//host/path:_authToken=${SOME_ENV}` line
+ * therefore OVERRIDES the userconfig this module writes, and when that env is
+ * unset npm sends the unexpanded value: the registry answers 401 on reads with
+ * a perfectly good read credential, naming nothing. So the credential also
+ * rides as env config, which the project file cannot outrank, and the token
+ * value stays out of every file on disk.
+ */
+function npmStatusEnv(userconfig, credential) {
+    if (!userconfig)
+        return undefined;
+    const env = { NPM_CONFIG_USERCONFIG: userconfig };
+    const token = credential ? process.env[credential.tokenEnv] : undefined;
+    if (credential && token) {
+        env[`npm_config_${credential.authKey}`] = token;
+    }
+    return env;
 }
 function npmCommandFailedMessage(npmArgs, exitCode, stdout = '', stderr = '') {
     const detail = `${stdout}\n${stderr}`.trim();
@@ -330,7 +351,7 @@ export async function npmPublishedVersionExists(root, name, version, options = {
     if (options.registry) {
         args.push('--registry', options.registry);
     }
-    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
     if (result.exitCode === 0) {
         return true;
     }
@@ -345,7 +366,7 @@ export async function npmPackageExists(root, name, options = {}) {
     if (options.registry) {
         args.push('--registry', options.registry);
     }
-    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig));
+    const result = await runResult('npm', args, root, npmStatusEnv(options.userconfig, options.credential));
     if (result.exitCode === 0) {
         return true;
     }

package/dist/secrets/commands.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ *
+ * Values are handed to `gh` over stdin, never through argv (a process list is
+ * world-readable) and never printed. Reading one from the terminal disables
+ * echo, so a pasted key does not end up in a scrollback buffer or a screen
+ * share.
+ */
+/** Repository secret names GitHub currently holds, or a refusal naming what failed. */
+export declare function readRepositorySecrets(repo: string | undefined): {
+    ok: true;
+    names: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+/** Write one secret, value over stdin so it never reaches argv. */
+export declare function writeRepositorySecret(name: string, value: string, repo: string | undefined): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
+/**
+ * Print every known secret with its sources. Exit code 1 when a workflow
+ * promises a value the repository does not hold — that combination is the one
+ * that fails a deploy, and it fails talking about the value rather than the
+ * missing secret.
+ */
+export declare function secretsStatus(root: string, options: {
+    repo?: string;
+}): number;
+/** Set one secret from a pasted value. */
+export declare function secretsSet(name: string, options: {
+    repo?: string;
+}): Promise<number>;
+/**
+ * Push every locally fetchable secret to the repository. Only names
+ * `smoo.secrets` declares a command for: everything else has no source here
+ * and must be pasted with `smoo secrets set`.
+ */
+export declare function secretsSync(root: string, options: {
+    repo?: string;
+}): Promise<number>;
+//# sourceMappingURL=commands.d.ts.map

package/dist/secrets/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/secrets/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,uFAAuF;AACvF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuB/D;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAWvD;AA8BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgC9E;AA8BD,0CAA0C;AAC1C,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAa1F;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB3F"}

package/dist/secrets/commands.js

@@ -0,0 +1,189 @@
+/**
+ * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ *
+ * Values are handed to `gh` over stdin, never through argv (a process list is
+ * world-readable) and never printed. Reading one from the terminal disables
+ * echo, so a pasted key does not end up in a scrollback buffer or a screen
+ * share.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { getWorkspacePackages } from '../lib/workspace.js';
+import { fetchLocalSecret, localSecretCommandNames, reconcileSecrets, secretNameMapping, unsatisfiedSecrets, unwiredSecrets, workerSecretNames, workflowSecretNames, } from './index.js';
+/** Repository secret names GitHub currently holds, or a refusal naming what failed. */
+export function readRepositorySecrets(repo) {
+    const args = ['secret', 'list', '--json', 'name'];
+    if (repo)
+        args.push('--repo', repo);
+    const result = spawnSync('gh', args, { encoding: 'utf8' });
+    if (result.status !== 0) {
+        return {
+            ok: false,
+            reason: `gh ${args.join(' ')} exited ${result.status ?? 'without status'}: ${result.stderr.trim()}`,
+        };
+    }
+    const parsed = JSON.parse(result.stdout);
+    if (!Array.isArray(parsed)) {
+        return { ok: false, reason: 'gh secret list did not return a list' };
+    }
+    const names = [];
+    for (const row of parsed) {
+        if (typeof row !== 'object' || row === null || !('name' in row))
+            continue;
+        // `in` narrows the property to unknown, so the typeof check below is the
+        // only thing that admits it — no assertion about gh's output shape.
+        const name = row.name;
+        if (typeof name === 'string')
+            names.push(name);
+    }
+    return { ok: true, names: names.sort((left, right) => left.localeCompare(right)) };
+}
+/** Write one secret, value over stdin so it never reaches argv. */
+export async function writeRepositorySecret(name, value, repo) {
+    const args = ['secret', 'set', name];
+    if (repo)
+        args.push('--repo', repo);
+    const child = spawn('gh', args, { stdio: ['pipe', 'inherit', 'inherit'] });
+    child.stdin.end(value);
+    const status = await new Promise((resolvePromise) => {
+        child.on('close', (code) => resolvePromise(code));
+    });
+    return status === 0
+        ? { ok: true }
+        : { ok: false, reason: `gh ${args.join(' ')} exited ${status ?? 'without status'}` };
+}
+function collectSources(root, repositorySecrets) {
+    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+    const workerSecrets = workerSecretNames(root, workspaceDirs);
+    const workflowSecrets = workflowSecretNames(root);
+    const localCommands = localSecretCommandNames(root);
+    const envNames = [
+        ...new Set([...Object.values(workerSecrets).flatMap((names) => [...names]), ...workflowSecrets, ...localCommands]),
+    ];
+    return {
+        workerSecrets,
+        workflowSecrets,
+        secretNames: secretNameMapping(root, envNames),
+        localCommands,
+        repositorySecrets,
+    };
+}
+function describe(row) {
+    const where = row.declaredByWorkers.length > 0 ? row.declaredByWorkers.join(', ') : '—';
+    return [
+        row.onRepository ? 'set ' : 'ABSENT',
+        row.name.padEnd(32),
+        row.suppliedByWorkflow ? 'workflow' : '        ',
+        row.fetchableLocally ? 'local' : '     ',
+        where,
+    ].join('  ');
+}
+/**
+ * Print every known secret with its sources. Exit code 1 when a workflow
+ * promises a value the repository does not hold — that combination is the one
+ * that fails a deploy, and it fails talking about the value rather than the
+ * missing secret.
+ */
+export function secretsStatus(root, options) {
+    const repositorySecrets = readRepositorySecrets(options.repo);
+    if (!repositorySecrets.ok) {
+        console.error(repositorySecrets.reason);
+        return 1;
+    }
+    const rows = reconcileSecrets(collectSources(root, repositorySecrets.names));
+    console.log('state   name                              workflow  local  declared by');
+    for (const row of rows)
+        console.log(describe(row));
+    const unsatisfied = unsatisfiedSecrets(rows);
+    const unwired = unwiredSecrets(rows);
+    if (unwired.length > 0) {
+        console.log('');
+        for (const row of unwired) {
+            console.log(`note: ${row.name} is declared by ${row.declaredByWorkers.join(', ')} but no managed workflow passes it; ` +
+                'declare it in smoo.github.deploySecrets to have CI supply it.');
+        }
+    }
+    if (unsatisfied.length > 0) {
+        console.log('');
+        for (const row of unsatisfied) {
+            console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and the repository has no value.`);
+            console.error(`         set it with: smoo secrets set ${row.name}${options.repo ? ` --repo ${options.repo}` : ''}`);
+        }
+        return 1;
+    }
+    return 0;
+}
+/** Read a value with echo disabled when stdin is a terminal; otherwise read piped input. */
+async function readSecretValue(prompt) {
+    if (!process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(Buffer.from(chunk));
+        return Buffer.concat(chunks).toString('utf8').replace(/\n$/, '');
+    }
+    process.stderr.write(prompt);
+    process.stdin.setRawMode(true);
+    let value = '';
+    try {
+        for await (const chunk of process.stdin) {
+            const text = Buffer.from(chunk).toString('utf8');
+            if (text === '\r' || text === '\n' || text === '\u0004')
+                break;
+            if (text === '\u0003')
+                throw new Error('cancelled');
+            if (text === '\u007f') {
+                value = value.slice(0, -1);
+                continue;
+            }
+            value += text;
+        }
+    }
+    finally {
+        process.stdin.setRawMode(false);
+        process.stderr.write('\n');
+    }
+    return value;
+}
+/** Set one secret from a pasted value. */
+export async function secretsSet(name, options) {
+    const value = await readSecretValue(`Value for ${name} (not echoed): `);
+    if (value.length === 0) {
+        console.error(`${name}: refusing to set an empty value.`);
+        return 1;
+    }
+    const written = await writeRepositorySecret(name, value, options.repo);
+    if (!written.ok) {
+        console.error(written.reason);
+        return 1;
+    }
+    console.log(`set     ${name}`);
+    return 0;
+}
+/**
+ * Push every locally fetchable secret to the repository. Only names
+ * `smoo.secrets` declares a command for: everything else has no source here
+ * and must be pasted with `smoo secrets set`.
+ */
+export async function secretsSync(root, options) {
+    const names = localSecretCommandNames(root);
+    if (names.length === 0) {
+        console.error('smoo.secrets declares no fetch commands; nothing to sync.');
+        return 1;
+    }
+    let failed = 0;
+    for (const name of names) {
+        const fetched = fetchLocalSecret(root, name);
+        if (!fetched.ok) {
+            console.error(`skip    ${name}: ${fetched.reason}`);
+            failed += 1;
+            continue;
+        }
+        const written = await writeRepositorySecret(name, fetched.value, options.repo);
+        if (!written.ok) {
+            console.error(`fail    ${name}: ${written.reason}`);
+            failed += 1;
+            continue;
+        }
+        console.log(`set     ${name}`);
+    }
+    return failed === 0 ? 0 : 1;
+}

package/dist/secrets/index.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Reconciles the three places a repository's secrets are described, all of
+ * which smoo already owns:
+ *
+ * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
+ *    and `e2eSecrets` map an env name to a repository secret, and the managed
+ *    workflows render exactly those into the job environment.
+ * 3. **A developer shell declares how to fetch one locally.** `smoo.secrets`
+ *    names a command whose stdout is the value.
+ *
+ * Nothing joined them, so a Worker could declare a secret no workflow supplies
+ * and no repository holds. That fails at deploy time, on a stage, with a
+ * fail-closed message about the value rather than about the missing
+ * declaration — the shape that costs an afternoon: a Worker declares
+ * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
+ * the repository holds no such secret, and the empty value surfaces as the
+ * payment library's own `publishable_key_mismatch` refusal.
+ */
+/** Where an env name is described, which repository secret carries it, and whether that exists. */
+export interface SecretRow {
+    name: string;
+    /** The repository secret this env name reads from, by convention or declaration. */
+    repositorySecret: string;
+    /** Wrangler projects whose `.dev.vars.example` declares it. */
+    declaredByWorkers: string[];
+    /** True when a managed workflow renders `secrets.<name>` into a job. */
+    suppliedByWorkflow: boolean;
+    /** True when `smoo.secrets` can fetch it for a developer shell. */
+    fetchableLocally: boolean;
+    /** True when the repository holds a secret of this name. */
+    onRepository: boolean;
+}
+export interface SecretSources {
+    /** Worker label -> env names it declares. */
+    workerSecrets: Record<string, readonly string[]>;
+    /** Env names a managed workflow passes into a job. */
+    workflowSecrets: readonly string[];
+    /** Env name -> repository secret, by convention with declared exceptions. */
+    secretNames: Readonly<Record<string, string>>;
+    /** Env names `smoo.secrets` can fetch locally. */
+    localCommands: readonly string[];
+    /** Repository secret names GitHub currently holds. */
+    repositorySecrets: readonly string[];
+}
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export declare function unsatisfiedSecrets(rows: readonly SecretRow[]): SecretRow[];
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
+/** Env names the managed workflows pass into a job, from the declarations that render them. */
+export declare function workflowSecretNames(root: string): string[];
+/**
+ * Env name -> repository secret for every name in play, following the naming
+ * convention and honouring the declared exceptions a repository still needs.
+ */
+export declare function secretNameMapping(root: string, envNames: readonly string[]): Record<string, string>;
+/** Every wrangler project's declared secret names, keyed by the project directory. */
+export declare function workerSecretNames(root: string, workspaceDirs: readonly string[]): Record<string, string[]>;
+/** Names `smoo.secrets` declares a fetch command for. */
+export declare function localSecretCommandNames(root: string): string[];
+/**
+ * Resolve one declared secret through its command. The value is returned, never
+ * logged: callers hand it to `gh secret set` over stdin.
+ */
+export declare function fetchLocalSecret(root: string, name: string): {
+    ok: true;
+    value: string;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CA0BpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAE1E;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG9D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}

package/dist/secrets/index.js

@@ -0,0 +1,149 @@
+/**
+ * Reconciles the three places a repository's secrets are described, all of
+ * which smoo already owns:
+ *
+ * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
+ *    and `e2eSecrets` map an env name to a repository secret, and the managed
+ *    workflows render exactly those into the job environment.
+ * 3. **A developer shell declares how to fetch one locally.** `smoo.secrets`
+ *    names a command whose stdout is the value.
+ *
+ * Nothing joined them, so a Worker could declare a secret no workflow supplies
+ * and no repository holds. That fails at deploy time, on a stage, with a
+ * fail-closed message about the value rather than about the missing
+ * declaration — the shape that costs an afternoon: a Worker declares
+ * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
+ * the repository holds no such secret, and the empty value surfaces as the
+ * payment library's own `publishable_key_mismatch` refusal.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
+import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
+import { parseDevVarsExample } from '../wrangler/prepare-env.js';
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export function reconcileSecrets(sources) {
+    const declaredByAnyWorker = Object.values(sources.workerSecrets).flatMap((names) => [...names]);
+    const names = new Set([...declaredByAnyWorker, ...sources.workflowSecrets, ...sources.localCommands]);
+    // A repository secret that already carries a known env name is that name's
+    // row, not a row of its own: listing ACME_GITHUB_CLIENT_SECRET beside
+    // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
+    // permanently "declared by nothing".
+    const carriesKnownEnvName = new Set(names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : []);
+    for (const secret of sources.repositorySecrets) {
+        if (!carriesKnownEnvName.has(secret))
+            names.add(secret);
+    }
+    return [...names]
+        .sort((left, right) => left.localeCompare(right))
+        .map((name) => ({
+        name,
+        repositorySecret: sources.secretNames[name] ?? name,
+        declaredByWorkers: Object.entries(sources.workerSecrets)
+            .filter(([, declared]) => declared.includes(name))
+            .map(([label]) => label)
+            .sort((left, right) => left.localeCompare(right)),
+        suppliedByWorkflow: sources.workflowSecrets.includes(name),
+        fetchableLocally: sources.localCommands.includes(name),
+        onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
+    }));
+}
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export function unsatisfiedSecrets(rows) {
+    return rows.filter((row) => row.suppliedByWorkflow && !row.onRepository);
+}
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export function unwiredSecrets(rows) {
+    return rows.filter((row) => row.declaredByWorkers.length > 0 && !row.suppliedByWorkflow);
+}
+/** Env names the managed workflows pass into a job, from the declarations that render them. */
+export function workflowSecretNames(root) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const smoo = manifest?.smoo;
+    const github = smoo?.github;
+    const names = new Set([
+        ...Object.keys(github?.deploySecrets ?? {}),
+        ...Object.keys(github?.e2eSecrets ?? {}),
+    ]);
+    if (smoo?.remoteCache?.tokenSecret)
+        names.add(smoo.remoteCache.tokenSecret);
+    for (const origin of github?.cargoCredentials?.gitOrigins ?? []) {
+        if (origin.tokenEnv)
+            names.add(origin.tokenEnv);
+    }
+    for (const source of github?.sourceCheckouts ?? []) {
+        if (source.tokenEnv)
+            names.add(source.tokenEnv);
+    }
+    if (smoo?.privateNpm?.readTokenEnv)
+        names.add(smoo.privateNpm.readTokenEnv);
+    if (smoo?.privateNpm?.publishTokenEnv)
+        names.add(smoo.privateNpm.publishTokenEnv);
+    return [...names].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * Env name -> repository secret for every name in play, following the naming
+ * convention and honouring the declared exceptions a repository still needs.
+ */
+export function secretNameMapping(root, envNames) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const declared = { ...(manifest?.smoo?.github?.deploySecrets ?? {}), ...(manifest?.smoo?.github?.e2eSecrets ?? {}) };
+    const repository = manifest ? repositoryInfo(manifest) : null;
+    const owner = repository ? (repositoryOwnerFromUrl(repository.url) ?? '') : '';
+    return repositorySecretMapping(envNames, owner, declared);
+}
+/** Every wrangler project's declared secret names, keyed by the project directory. */
+export function workerSecretNames(root, workspaceDirs) {
+    const byWorker = {};
+    for (const dir of workspaceDirs) {
+        const examplePath = join(root, dir, '.dev.vars.example');
+        if (!existsSync(examplePath))
+            continue;
+        const names = parseDevVarsExample(readFileSync(examplePath, 'utf8'));
+        if (names.length > 0)
+            byWorker[dir] = names;
+    }
+    return byWorker;
+}
+/** Names `smoo.secrets` declares a fetch command for. */
+export function localSecretCommandNames(root) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    return Object.keys(manifest?.smoo?.secrets ?? {}).sort((left, right) => left.localeCompare(right));
+}
+/**
+ * Resolve one declared secret through its command. The value is returned, never
+ * logged: callers hand it to `gh secret set` over stdin.
+ */
+export function fetchLocalSecret(root, name) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const declared = manifest?.smoo?.secrets?.[name];
+    if (!declared) {
+        return { ok: false, reason: `smoo.secrets declares no command for ${name}` };
+    }
+    const [command, ...args] = declared.command;
+    const result = spawnSync(command, args, { encoding: 'utf8' });
+    if (result.status !== 0) {
+        // Name the command, never its output: a failing secret fetch prints
+        // credentials often enough that it is worth refusing to.
+        return {
+            ok: false,
+            reason: `${name}: \`${declared.command.join(' ')}\` exited ${result.status ?? 'without status'}`,
+        };
+    }
+    const value = result.stdout.replace(/\n$/, '');
+    if (value.length === 0) {
+        return { ok: false, reason: `${name}: \`${declared.command.join(' ')}\` produced no value` };
+    }
+    return { ok: true, value };
+}