@smoothbricks/cli 0.11.16 → 0.11.18

package/dist/release/github-release.d.ts

@@ -42,6 +42,16 @@ export declare function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previous
     dryRun: boolean;
     firstRelease: boolean;
 };
+/**
+ * The release body for a version that carries no commits of its own.
+ *
+ * Nx bumps a project when a dependency it depends on was bumped, and reports
+ * that reason itself ("because a dependency was bumped"). Such a version has no
+ * commits touching the project, so Nx generates no changelog for it — which is
+ * correct, not a failure. Treating the absence as fatal made one dependency-only
+ * package abort a whole publish after the versions had already been written.
+ */
+export declare const DEPENDENCY_ONLY_RELEASE_NOTES = "_No changelog entries for this package: this version was released because one of its dependencies was bumped._";
 export declare function projectChangelogContents(result: ProjectChangelogLookupResult, projectName: string): string;
 export declare function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean;
 export declare function githubReleaseCommandArgs(tag: string, notesFile: string, releaseExists: boolean, version: string): string[];

package/dist/release/github-release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-release.d.ts","sourceRoot":"","sources":["../../src/release/github-release.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,WAAW,CAAC;AAYhE,UAAU,4BAA4B;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5G;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAc1G;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAM1G;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShH;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAgBV;AAMD;;;;;;;;;GASG;AACH,UAAU,kBAAkB;IAC1B,6BAA6B,EAAE,cAAc,gCAAgC,CAAC,CAAC;IAC/E,qCAAqC,EAAE,cAAc,wCAAwC,CAAC,CAAC;IAC/F,uCAAuC,EAAE,cAAc,0CAA0C,CAAC,CAAC;CACpG;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,MAAM,kBAAkB,EAC9E,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAMtC;AAED,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAmB5F"}
+{"version":3,"file":"github-release.d.ts","sourceRoot":"","sources":["../../src/release/github-release.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,kBAAkB,EAAc,MAAM,WAAW,CAAC;AAYhE,UAAU,4BAA4B;IACpC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,6BAA6B,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACpG,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,6BAA6B,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5G;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,kBAAkB,EACvB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;EAc1G;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,mHACwE,CAAC;AAEnH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAE1G;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShH;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,OAAO,EACtB,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAgBV;AAMD;;;;;;;;;GASG;AACH,UAAU,kBAAkB;IAC1B,6BAA6B,EAAE,cAAc,gCAAgC,CAAC,CAAC;IAC/E,qCAAqC,EAAE,cAAc,wCAAwC,CAAC,CAAC;IAC/F,uCAAuC,EAAE,cAAc,0CAA0C,CAAC,CAAC;CACpG;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,MAAM,kBAAkB,EAC9E,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAMtC;AAED,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAmB5F"}

package/dist/release/github-release.js

@@ -49,12 +49,18 @@ export function nxProjectChangelogArgs(pkg, previousTag, dryRun) {
     };
     return previousTag ? { ...base, from: previousTag } : { ...base, firstRelease: true };
 }
+/**
+ * The release body for a version that carries no commits of its own.
+ *
+ * Nx bumps a project when a dependency it depends on was bumped, and reports
+ * that reason itself ("because a dependency was bumped"). Such a version has no
+ * commits touching the project, so Nx generates no changelog for it — which is
+ * correct, not a failure. Treating the absence as fatal made one dependency-only
+ * package abort a whole publish after the versions had already been written.
+ */
+export const DEPENDENCY_ONLY_RELEASE_NOTES = '_No changelog entries for this package: this version was released because one of its dependencies was bumped._';
 export function projectChangelogContents(result, projectName) {
-    const changelog = result.projectChangelogs?.[projectName];
-    if (!changelog) {
-        throw new Error(`Nx did not generate a project changelog for ${projectName}.`);
-    }
-    return changelog.contents;
+    return result.projectChangelogs?.[projectName]?.contents ?? DEPENDENCY_ONLY_RELEASE_NOTES;
 }
 export function githubReleaseLookupExists(tag, exitCode, stdout, stderr) {
     if (exitCode === 0) {

package/dist/release/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAiDnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AA8UD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAkhCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/release/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,WAAW,EACX,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,gBAAgB,IAAI,0BAA0B,EAC9C,yBAAyB,IAAI,mCAAmC,EAChE,KAAK,kBAAkB,EACvB,KAAK,6BAA6B,EAClC,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,MAAM,IAAI,gBAAgB,EAC/B,yBAAyB,EACzB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,KAAK,2BAA2B,EAIjC,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAQL,KAAK,kBAAkB,EAGxB,MAAM,WAAW,CAAC;AAkDnB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,kCAAkC;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAe/F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiDhG;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAM/F;AAKD,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAc5G;AAED,wBAAsB,6BAA6B,CACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC9G;AAED,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GACd,MAAM,EAAE,CAMV;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,IAAI,OAAO,EAAE,CAAC;IACjC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9C,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3G,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC;AAE/E,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAuEf;AAkED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAelH;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnE;AA8UD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,EAAE,CAAC,CAgBpB;AAihCD,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAShF;AA8CD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAkB9F"}

package/dist/release/index.js

@@ -23,7 +23,7 @@ import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, }
 import { resolveBuildInputPatterns } from './build-inputs.js';
 import { parseReleaseProjectSelection, releaseCandidatePackages, } from './candidates.js';
 import { classifyReleaseBranchPush, collectOwnedReleaseTagRecords, divergedReleaseBranchMessage, pendingReleaseTargets, releaseTag, releaseTagAliases, } from './core.js';
-import { createOrUpdateGithubRelease, githubReleaseLookupExists, importWorkspaceNx, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
+import { createOrUpdateGithubRelease, DEPENDENCY_ONLY_RELEASE_NOTES, githubReleaseLookupExists, importWorkspaceNx, renderNxProjectChangelogContents, withNxWorkspaceRoot, } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
 import { bumpStableReleaseToNext, collectRepairPlatformOutputs, completeReleaseAtHead as completeReleaseAtHeadWithShell, prepareReleaseCandidate, repairPendingTargets, runReleaseTag, runReleaseVersion, } from './orchestration.js';
 import { packReleaseTarball } from './pack.js';
@@ -1128,10 +1128,9 @@ async function writeReleasePreviewSummary(root, currentPackages, previewPackages
             lines.push(`  - \`${pkg.name}\`: \`${currentByName.get(pkg.name)?.version ?? 'unknown'}\` -> \`${pkg.version}\``);
         }
         for (const pkg of previewPackages) {
-            const contents = releasePreviewChangelogs.get(pkg.projectName);
-            if (!contents) {
-                throw new Error(`Nx did not generate a project changelog for ${pkg.projectName}.`);
-            }
+            // A dependency-only bump has no commits of its own, so Nx generates no
+            // changelog for it. The preview says so rather than refusing to render.
+            const contents = releasePreviewChangelogs.get(pkg.projectName) ?? DEPENDENCY_ONLY_RELEASE_NOTES;
             lines.push('', `### ${pkg.name} ${pkg.version}`, '', contents.trim());
         }
     }

package/dist/secrets/commands.d.ts

@@ -0,0 +1,84 @@
+/**
+ * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ *
+ * Values are handed to `gh` over stdin, never through argv (a process list is
+ * world-readable) and never printed. Reading one from the terminal disables
+ * echo, so a pasted key does not end up in a scrollback buffer or a screen
+ * share.
+ *
+ * A value lives at repository scope or inside a named GitHub Environment, and
+ * a job bound to an environment resolves `secrets.X` from that environment
+ * first and from the repository second — which is how one name carries test
+ * credentials on a preview stage and live ones in production. Every scope the
+ * workflows bind is read before anything is called missing: reading only the
+ * repository reports values that do exist as absent, and sends an operator
+ * hunting for a secret that is already set.
+ */
+import { type SecretRow } from './index.js';
+/**
+ * Every secret this checkout declares that the repository does not hold, in
+ * the order an operator should fix them: the ones a workflow already promises
+ * break a deploy today, the rest break the next one.
+ */
+export declare function secretsNeedingValues(rows: readonly SecretRow[]): SecretRow[];
+/**
+ * Every secret this checkout declares that the named environment does not
+ * hold. A name the repository already holds is still offered: an environment
+ * value overrides the repository's for a job bound to it, and overriding one
+ * stage's credentials is the reason to write at environment scope at all. A
+ * repository secret no source declares is not offered — that is a stale value
+ * to review, not one to copy into an environment.
+ */
+export declare function secretsMissingInEnvironment(rows: readonly SecretRow[], environment: string): SecretRow[];
+/** Why a secret is wanted, so a prompt states what will break without it. */
+export declare function describeNeed(row: SecretRow): string;
+/**
+ * Secret names GitHub currently holds at the given scope, or a refusal naming
+ * what failed. With no environment that is repository scope; with one it is
+ * that environment's own secrets, which are the values a bound job reads
+ * first.
+ */
+export declare function readRepositorySecrets(repo: string | undefined, environment?: string): {
+    ok: true;
+    names: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+/** Write one secret at the given scope, value over stdin so it never reaches argv. */
+export declare function writeRepositorySecret(name: string, value: string, repo: string | undefined, environment?: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
+/**
+ * Print every known secret and the scopes holding it. Exit code 1 when a
+ * workflow promises a value no scope a bound job reads can supply — that
+ * combination is the one that fails a deploy, and it fails talking about the
+ * value rather than the missing secret.
+ */
+export declare function secretsStatus(root: string, options: {
+    repo?: string;
+    env?: string;
+}): number;
+/**
+ * Set one secret, or - with no name - walk every secret this checkout declares
+ * and the target scope does not hold, prompting once each. The walk is the
+ * point of the command: an operator should never have to transcribe names out
+ * of a status table to know what to paste.
+ */
+export declare function secretsSet(root: string, name: string | undefined, options: {
+    repo?: string;
+    env?: string;
+}): Promise<number>;
+/**
+ * Push every locally fetchable secret to the repository, or to one environment.
+ * Only names `smoo.secrets` declares a command for: everything else has no
+ * source here and must be pasted with `smoo secrets set`.
+ */
+export declare function secretsSync(root: string, options: {
+    repo?: string;
+    env?: string;
+}): Promise<number>;
+//# sourceMappingURL=commands.d.ts.map

package/dist/secrets/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/secrets/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAKL,KAAK,SAAS,EAOf,MAAM,YAAY,CAAC;AAGpB;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAG5E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,EAAE,CAOxG;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAUnD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAwB/D;AAED,sFAAsF;AACtF,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAYvD;AAyCD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAkF5F;AA8BD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACvC,OAAO,CAAC,MAAM,CAAC,CAwDjB;AAuBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BzG"}

package/dist/secrets/commands.js

@@ -0,0 +1,375 @@
+/**
+ * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ *
+ * Values are handed to `gh` over stdin, never through argv (a process list is
+ * world-readable) and never printed. Reading one from the terminal disables
+ * echo, so a pasted key does not end up in a scrollback buffer or a screen
+ * share.
+ *
+ * A value lives at repository scope or inside a named GitHub Environment, and
+ * a job bound to an environment resolves `secrets.X` from that environment
+ * first and from the repository second — which is how one name carries test
+ * credentials on a preview stage and live ones in production. Every scope the
+ * workflows bind is read before anything is called missing: reading only the
+ * repository reports values that do exist as absent, and sends an operator
+ * hunting for a secret that is already set.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { getWorkspacePackages } from '../lib/workspace.js';
+import { environmentsMissing, fetchLocalSecret, localSecretCommandNames, reconcileSecrets, secretNameMapping, unsatisfiedSecrets, unwiredSecrets, workerSecretNames, workflowEnvironments, workflowSecretNames, } from './index.js';
+import { resolveRepository } from './repository.js';
+/**
+ * Every secret this checkout declares that the repository does not hold, in
+ * the order an operator should fix them: the ones a workflow already promises
+ * break a deploy today, the rest break the next one.
+ */
+export function secretsNeedingValues(rows) {
+    const missing = rows.filter((row) => !row.onRepository);
+    return [...missing.filter((row) => row.suppliedByWorkflow), ...missing.filter((row) => !row.suppliedByWorkflow)];
+}
+/**
+ * Every secret this checkout declares that the named environment does not
+ * hold. A name the repository already holds is still offered: an environment
+ * value overrides the repository's for a job bound to it, and overriding one
+ * stage's credentials is the reason to write at environment scope at all. A
+ * repository secret no source declares is not offered — that is a stale value
+ * to review, not one to copy into an environment.
+ */
+export function secretsMissingInEnvironment(rows, environment) {
+    const missing = rows.filter((row) => !row.heldByEnvironment.includes(environment) &&
+        (row.declaredByWorkers.length > 0 || row.suppliedByWorkflow || row.fetchableLocally));
+    return [...missing.filter((row) => row.suppliedByWorkflow), ...missing.filter((row) => !row.suppliedByWorkflow)];
+}
+/** Why a secret is wanted, so a prompt states what will break without it. */
+export function describeNeed(row) {
+    const parts = [];
+    if (row.declaredByWorkers.length > 0)
+        parts.push(`declared by ${row.declaredByWorkers.join(', ')}`);
+    if (row.suppliedByWorkflow)
+        parts.push('passed by a managed workflow');
+    if (row.fetchableLocally)
+        parts.push('fetchable locally via smoo.secrets');
+    if (row.repositorySecret !== row.name)
+        parts.push(`read as ${row.name}`);
+    // Naming the environments that already hold it stops an operator from
+    // answering a per-stage prompt with a repository-wide value.
+    if (row.heldByEnvironment.length > 0)
+        parts.push(`held by ${row.heldByEnvironment.join(', ')}`);
+    return parts.length > 0 ? ` - ${parts.join('; ')}` : '';
+}
+/**
+ * Secret names GitHub currently holds at the given scope, or a refusal naming
+ * what failed. With no environment that is repository scope; with one it is
+ * that environment's own secrets, which are the values a bound job reads
+ * first.
+ */
+export function readRepositorySecrets(repo, environment) {
+    const args = ['secret', 'list', '--json', 'name'];
+    if (repo)
+        args.push('--repo', repo);
+    if (environment)
+        args.push('--env', environment);
+    const result = spawnSync('gh', args, { encoding: 'utf8' });
+    if (result.status !== 0) {
+        return {
+            ok: false,
+            reason: `gh ${args.join(' ')} exited ${result.status ?? 'without status'}: ${result.stderr.trim()}`,
+        };
+    }
+    const parsed = JSON.parse(result.stdout);
+    if (!Array.isArray(parsed)) {
+        return { ok: false, reason: 'gh secret list did not return a list' };
+    }
+    const names = [];
+    for (const row of parsed) {
+        if (typeof row !== 'object' || row === null || !('name' in row))
+            continue;
+        // `in` narrows the property to unknown, so the typeof check below is the
+        // only thing that admits it — no assertion about gh's output shape.
+        const name = row.name;
+        if (typeof name === 'string')
+            names.push(name);
+    }
+    return { ok: true, names: names.sort((left, right) => left.localeCompare(right)) };
+}
+/** Write one secret at the given scope, value over stdin so it never reaches argv. */
+export async function writeRepositorySecret(name, value, repo, environment) {
+    const args = ['secret', 'set', name];
+    if (repo)
+        args.push('--repo', repo);
+    if (environment)
+        args.push('--env', environment);
+    const child = spawn('gh', args, { stdio: ['pipe', 'inherit', 'inherit'] });
+    child.stdin.end(value);
+    const status = await new Promise((resolvePromise) => {
+        child.on('close', (code) => resolvePromise(code));
+    });
+    return status === 0
+        ? { ok: true }
+        : { ok: false, reason: `gh ${args.join(' ')} exited ${status ?? 'without status'}` };
+}
+function collectSources(root, repositorySecrets, environmentSecrets = {}) {
+    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+    const workerSecrets = workerSecretNames(root, workspaceDirs);
+    const workflowSecrets = workflowSecretNames(root);
+    const localCommands = localSecretCommandNames(root);
+    const envNames = [
+        ...new Set([...Object.values(workerSecrets).flatMap((names) => [...names]), ...workflowSecrets, ...localCommands]),
+    ];
+    return {
+        workerSecrets,
+        workflowSecrets,
+        secretNames: secretNameMapping(root, envNames),
+        localCommands,
+        repositorySecrets,
+        environmentSecrets,
+    };
+}
+/** Every scope holding a value for this name, repository first. */
+function heldBy(row) {
+    const scopes = row.onRepository ? ['repository', ...row.heldByEnvironment] : row.heldByEnvironment;
+    return scopes.length > 0 ? scopes.join(', ') : 'ABSENT';
+}
+function describe(row, scopeWidth) {
+    const where = row.declaredByWorkers.length > 0 ? row.declaredByWorkers.join(', ') : '—';
+    return [
+        heldBy(row).padEnd(scopeWidth),
+        row.name.padEnd(32),
+        row.suppliedByWorkflow ? 'workflow' : '        ',
+        row.fetchableLocally ? 'local' : '     ',
+        where,
+    ].join('  ');
+}
+/**
+ * Print every known secret and the scopes holding it. Exit code 1 when a
+ * workflow promises a value no scope a bound job reads can supply — that
+ * combination is the one that fails a deploy, and it fails talking about the
+ * value rather than the missing secret.
+ */
+export function secretsStatus(root, options) {
+    const resolved = resolveRepository(root, options.repo);
+    if (!resolved.ok) {
+        console.error(resolved.reason);
+        return 1;
+    }
+    const { repo, source } = resolved.choice;
+    const repositorySecrets = readRepositorySecrets(repo);
+    if (!repositorySecrets.ok) {
+        console.error(repositorySecrets.reason);
+        return 1;
+    }
+    // The workflows decide which environments a job reads; an explicitly asked
+    // for one is shown too, so an operator can inspect a scope before a workflow
+    // binds it.
+    const boundEnvironments = workflowEnvironments(root);
+    const asked = options.env !== undefined && !boundEnvironments.includes(options.env) ? [options.env] : [];
+    const environmentSecrets = {};
+    const unreadable = [];
+    for (const environment of [...boundEnvironments, ...asked]) {
+        const held = readRepositorySecrets(repo, environment);
+        if (held.ok)
+            environmentSecrets[environment] = held.names;
+        else
+            unreadable.push({ environment, reason: held.reason });
+    }
+    // An environment that cannot be read is reported, never assumed empty:
+    // guessing produces a refusal about a value that may well be set.
+    const readable = boundEnvironments.filter((environment) => environment in environmentSecrets);
+    const rows = reconcileSecrets(collectSources(root, repositorySecrets.names, environmentSecrets));
+    console.log(`repository ${repo} (${source}), holding ${repositorySecrets.names.length} secrets`);
+    for (const [environment, names] of Object.entries(environmentSecrets)) {
+        console.log(`environment ${environment}, holding ${names.length} secrets`);
+    }
+    for (const { environment, reason } of unreadable) {
+        console.log(`environment ${environment} could not be read, so nothing below claims what it holds: ${reason}`);
+    }
+    const scopeWidth = Math.max('held by'.length, ...rows.map((row) => heldBy(row).length));
+    console.log(`${'held by'.padEnd(scopeWidth)}  ${'name'.padEnd(32)}  workflow  local  declared by`);
+    for (const row of rows)
+        console.log(describe(row, scopeWidth));
+    const unwired = unwiredSecrets(rows);
+    if (unwired.length > 0) {
+        console.log('');
+        for (const row of unwired) {
+            console.log(`note: ${row.name} is declared by ${row.declaredByWorkers.join(', ')} but no managed workflow passes it; ` +
+                'declare it in smoo.github.deploySecrets to have CI supply it.');
+        }
+    }
+    // A value an environment holds is not a value to duplicate at repository
+    // scope: offering it invites two sources of truth for one credential, and
+    // the table above already shows where it lives. Only a name no scope holds
+    // is a name to set here.
+    const needed = secretsNeedingValues(rows).filter((row) => !row.onRepository && row.heldByEnvironment.length === 0);
+    if (needed.length > 0) {
+        console.log('');
+        console.log(`${needed.length} secret(s) have no value in any scope on ${repo}:`);
+        for (const row of needed)
+            console.log(`  ${row.repositorySecret}${describeNeed(row)}`);
+        console.log('');
+        console.log(`set them all, one prompt each:  smoo secrets set -R ${repo}`);
+        console.log(`set one:                        smoo secrets set ${needed[0]?.repositorySecret ?? 'NAME'} -R ${repo}`);
+    }
+    const unsatisfied = unsatisfiedSecrets(rows, readable);
+    if (unsatisfied.length === 0)
+        return 0;
+    console.log('');
+    for (const row of unsatisfied) {
+        const missing = environmentsMissing(row, readable);
+        const scopes = missing.length > 0 ? missing.join(', ') : 'the repository';
+        console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and no value exists in ${scopes}.`);
+        if (missing.length === 0) {
+            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo}`);
+            continue;
+        }
+        for (const environment of missing) {
+            const named = environment.includes(' ') ? `'${environment}'` : environment;
+            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo} --env ${named}`);
+        }
+        console.error(`  or one value for every environment:  smoo secrets set ${row.repositorySecret} -R ${repo}`);
+    }
+    return 1;
+}
+/** Read a value with echo disabled when stdin is a terminal; otherwise read piped input. */
+async function readSecretValue(prompt) {
+    if (!process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(Buffer.from(chunk));
+        return Buffer.concat(chunks).toString('utf8').replace(/\n$/, '');
+    }
+    process.stderr.write(prompt);
+    process.stdin.setRawMode(true);
+    let value = '';
+    try {
+        for await (const chunk of process.stdin) {
+            const text = Buffer.from(chunk).toString('utf8');
+            if (text === '\r' || text === '\n' || text === '\u0004')
+                break;
+            if (text === '\u0003')
+                throw new Error('cancelled');
+            if (text === '\u007f') {
+                value = value.slice(0, -1);
+                continue;
+            }
+            value += text;
+        }
+    }
+    finally {
+        process.stdin.setRawMode(false);
+        process.stderr.write('\n');
+    }
+    return value;
+}
+/**
+ * Set one secret, or - with no name - walk every secret this checkout declares
+ * and the target scope does not hold, prompting once each. The walk is the
+ * point of the command: an operator should never have to transcribe names out
+ * of a status table to know what to paste.
+ */
+export async function secretsSet(root, name, options) {
+    const resolved = resolveRepository(root, options.repo);
+    if (!resolved.ok) {
+        console.error(resolved.reason);
+        return 1;
+    }
+    const { repo, source } = resolved.choice;
+    const environment = options.env;
+    if (name !== undefined)
+        return setOne(name, name, repo, environment);
+    const held = readRepositorySecrets(repo);
+    if (!held.ok) {
+        console.error(held.reason);
+        return 1;
+    }
+    const environmentSecrets = {};
+    if (environment !== undefined) {
+        const inEnvironment = readRepositorySecrets(repo, environment);
+        if (!inEnvironment.ok) {
+            console.error(inEnvironment.reason);
+            return 1;
+        }
+        environmentSecrets[environment] = inEnvironment.names;
+    }
+    const rows = reconcileSecrets(collectSources(root, held.names, environmentSecrets));
+    const needed = environment === undefined ? secretsNeedingValues(rows) : secretsMissingInEnvironment(rows, environment);
+    const target = environment === undefined ? `${repo} (${source})` : `environment ${environment} on ${repo} (${source})`;
+    if (needed.length === 0) {
+        console.log(`${target} already holds every secret this checkout declares.`);
+        return 0;
+    }
+    console.log(`${needed.length} secret(s) to set on ${target}. Empty input skips one.`);
+    let failed = 0;
+    let set = 0;
+    for (const row of needed) {
+        console.log('');
+        console.log(`${row.repositorySecret}${describeNeed(row)}`);
+        const value = await readSecretValue('  paste value (not echoed, empty to skip): ');
+        if (value.length === 0) {
+            console.log(`skip    ${row.repositorySecret}`);
+            continue;
+        }
+        const written = await writeRepositorySecret(row.repositorySecret, value, repo, environment);
+        if (!written.ok) {
+            console.error(`fail    ${row.repositorySecret}: ${written.reason}`);
+            failed += 1;
+            continue;
+        }
+        console.log(`set     ${row.repositorySecret}`);
+        set += 1;
+    }
+    console.log('');
+    console.log(`${set} set, ${needed.length - set - failed} skipped, ${failed} failed.`);
+    return failed === 0 ? 0 : 1;
+}
+async function setOne(envName, repositorySecret, repo, environment) {
+    const scope = environment === undefined ? '' : ` in ${environment}`;
+    const value = await readSecretValue(`Value for ${repositorySecret}${scope} (not echoed): `);
+    if (value.length === 0) {
+        console.error(`${repositorySecret}: refusing to set an empty value.`);
+        return 1;
+    }
+    const written = await writeRepositorySecret(repositorySecret, value, repo, environment);
+    if (!written.ok) {
+        console.error(written.reason);
+        return 1;
+    }
+    console.log(`set     ${repositorySecret}${scope}${envName === repositorySecret ? '' : ` (reads as ${envName})`}`);
+    return 0;
+}
+/**
+ * Push every locally fetchable secret to the repository, or to one environment.
+ * Only names `smoo.secrets` declares a command for: everything else has no
+ * source here and must be pasted with `smoo secrets set`.
+ */
+export async function secretsSync(root, options) {
+    const resolved = resolveRepository(root, options.repo);
+    if (!resolved.ok) {
+        console.error(resolved.reason);
+        return 1;
+    }
+    const { repo } = resolved.choice;
+    const environment = options.env;
+    const names = localSecretCommandNames(root);
+    if (names.length === 0) {
+        console.error('smoo.secrets declares no fetch commands; nothing to sync.');
+        return 1;
+    }
+    const scope = environment === undefined ? '' : ` in ${environment}`;
+    let failed = 0;
+    for (const name of names) {
+        const fetched = fetchLocalSecret(root, name);
+        if (!fetched.ok) {
+            console.error(`skip    ${name}: ${fetched.reason}`);
+            failed += 1;
+            continue;
+        }
+        const written = await writeRepositorySecret(name, fetched.value, repo, environment);
+        if (!written.ok) {
+            console.error(`fail    ${name}: ${written.reason}`);
+            failed += 1;
+            continue;
+        }
+        console.log(`set     ${name}${scope}`);
+    }
+    return failed === 0 ? 0 : 1;
+}