@smoothbricks/cli 0.11.16 → 0.11.18

package/dist/secrets/index.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Reconciles the three places a repository's secrets are described, all of
+ * which smoo already owns:
+ *
+ * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
+ *    and `e2eSecrets` map an env name to a repository secret, and the managed
+ *    workflows render exactly those into the job environment.
+ * 3. **A developer shell declares how to fetch one locally.** `smoo.secrets`
+ *    names a command whose stdout is the value.
+ *
+ * Nothing joined them, so a Worker could declare a secret no workflow supplies
+ * and no repository holds. That fails at deploy time, on a stage, with a
+ * fail-closed message about the value rather than about the missing
+ * declaration — the shape that costs an afternoon: a Worker declares
+ * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
+ * the repository holds no such secret, and the empty value surfaces as the
+ * payment library's own `publishable_key_mismatch` refusal.
+ */
+/** Where an env name is described, which repository secret carries it, and whether that exists. */
+export interface SecretRow {
+    name: string;
+    /** The repository secret this env name reads from, by convention or declaration. */
+    repositorySecret: string;
+    /** Wrangler projects whose `.dev.vars.example` declares it. */
+    declaredByWorkers: string[];
+    /** True when a managed workflow renders `secrets.<name>` into a job. */
+    suppliedByWorkflow: boolean;
+    /** True when `smoo.secrets` can fetch it for a developer shell. */
+    fetchableLocally: boolean;
+    /** True when the repository holds a secret of this name. */
+    onRepository: boolean;
+    /**
+     * GitHub Environments holding their own value for this name. A job bound to
+     * an environment reads that value in preference to the repository's, which
+     * is how one name carries test credentials on a preview stage and live ones
+     * in production.
+     */
+    heldByEnvironment: string[];
+}
+export interface SecretSources {
+    /** Worker label -> env names it declares. */
+    workerSecrets: Record<string, readonly string[]>;
+    /** Env names a managed workflow passes into a job. */
+    workflowSecrets: readonly string[];
+    /** Env name -> repository secret, by convention with declared exceptions. */
+    secretNames: Readonly<Record<string, string>>;
+    /** Env names `smoo.secrets` can fetch locally. */
+    localCommands: readonly string[];
+    /** Repository secret names GitHub currently holds. */
+    repositorySecrets: readonly string[];
+    /** Environment name -> secret names that environment holds. */
+    environmentSecrets?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export declare function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments?: readonly string[]): SecretRow[];
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export declare function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[];
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
+/** Env names the managed workflows pass into a job, from the declarations that render them. */
+export declare function workflowSecretNames(root: string): string[];
+/**
+ * GitHub Environments the rendered workflows bind, read from the workflow
+ * files rather than from config: a binding may be hand-authored inside a
+ * `smoo-local` block, and the file is what GitHub executes either way. A job
+ * bound to an environment resolves `secrets.X` from that environment first and
+ * from the repository second, so these names are the scopes a value can live
+ * in. Expressions are skipped - a computed environment names no fixed scope.
+ */
+export declare function workflowEnvironments(root: string): string[];
+/**
+ * Env name -> repository secret for every name in play, following the naming
+ * convention and honouring the declared exceptions a repository still needs.
+ */
+export declare function secretNameMapping(root: string, envNames: readonly string[]): Record<string, string>;
+/** Every wrangler project's declared secret names, keyed by the project directory. */
+export declare function workerSecretNames(root: string, workspaceDirs: readonly string[]): Record<string, string[]>;
+/** Names `smoo.secrets` declares a fetch command for. */
+export declare function localSecretCommandNames(root: string): string[];
+/**
+ * Resolve one declared secret through its command. The value is returned, never
+ * logged: callers hand it to `gh secret set` over stdin.
+ */
+export declare function fetchLocalSecret(root: string, name: string): {
+    ok: true;
+    value: string;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAoCpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,iBAAiB,GAAE,SAAS,MAAM,EAAO,GAAG,SAAS,EAAE,CAUrH;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGlG;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D;AAoDD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG9D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}

package/dist/secrets/index.js

@@ -0,0 +1,255 @@
+/**
+ * Reconciles the three places a repository's secrets are described, all of
+ * which smoo already owns:
+ *
+ * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
+ *    and `e2eSecrets` map an env name to a repository secret, and the managed
+ *    workflows render exactly those into the job environment.
+ * 3. **A developer shell declares how to fetch one locally.** `smoo.secrets`
+ *    names a command whose stdout is the value.
+ *
+ * Nothing joined them, so a Worker could declare a secret no workflow supplies
+ * and no repository holds. That fails at deploy time, on a stage, with a
+ * fail-closed message about the value rather than about the missing
+ * declaration — the shape that costs an afternoon: a Worker declares
+ * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
+ * the repository holds no such secret, and the empty value surfaces as the
+ * payment library's own `publishable_key_mismatch` refusal.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
+import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
+import { parseDevVarsExample } from '../wrangler/prepare-env.js';
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export function reconcileSecrets(sources) {
+    const declaredByAnyWorker = Object.values(sources.workerSecrets).flatMap((names) => [...names]);
+    const names = new Set([...declaredByAnyWorker, ...sources.workflowSecrets, ...sources.localCommands]);
+    // A repository secret that already carries a known env name is that name's
+    // row, not a row of its own: listing ACME_GITHUB_CLIENT_SECRET beside
+    // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
+    // permanently "declared by nothing".
+    const carriesKnownEnvName = new Set(names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : []);
+    // A value only an environment holds is still a value: leaving it out of the
+    // rows is how an operator ends up hunting for a secret that is already set.
+    const addUndeclared = (secret) => {
+        if (!carriesKnownEnvName.has(secret))
+            names.add(secret);
+    };
+    for (const secret of sources.repositorySecrets)
+        addUndeclared(secret);
+    for (const held of Object.values(sources.environmentSecrets ?? {})) {
+        for (const secret of held)
+            addUndeclared(secret);
+    }
+    return [...names]
+        .sort((left, right) => left.localeCompare(right))
+        .map((name) => ({
+        name,
+        repositorySecret: sources.secretNames[name] ?? name,
+        declaredByWorkers: Object.entries(sources.workerSecrets)
+            .filter(([, declared]) => declared.includes(name))
+            .map(([label]) => label)
+            .sort((left, right) => left.localeCompare(right)),
+        suppliedByWorkflow: sources.workflowSecrets.includes(name),
+        fetchableLocally: sources.localCommands.includes(name),
+        onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
+        heldByEnvironment: Object.entries(sources.environmentSecrets ?? {})
+            .filter(([, held]) => held.includes(sources.secretNames[name] ?? name))
+            .map(([environment]) => environment)
+            .sort((left, right) => left.localeCompare(right)),
+    }));
+}
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export function unsatisfiedSecrets(rows, boundEnvironments = []) {
+    return rows.filter((row) => {
+        if (!row.suppliedByWorkflow)
+            return false;
+        if (row.onRepository)
+            return false;
+        // With no environment bound, the repository is the only scope a job reads.
+        // With environments bound, each one can carry the value instead - so the
+        // name is satisfied only when every bound environment holds it.
+        if (boundEnvironments.length === 0)
+            return true;
+        return !boundEnvironments.every((environment) => row.heldByEnvironment.includes(environment));
+    });
+}
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export function environmentsMissing(row, boundEnvironments) {
+    if (row.onRepository)
+        return [];
+    return boundEnvironments.filter((environment) => !row.heldByEnvironment.includes(environment));
+}
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export function unwiredSecrets(rows) {
+    return rows.filter((row) => row.declaredByWorkers.length > 0 && !row.suppliedByWorkflow);
+}
+/** Env names the managed workflows pass into a job, from the declarations that render them. */
+export function workflowSecretNames(root) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const smoo = manifest?.smoo;
+    const github = smoo?.github;
+    const names = new Set([
+        ...Object.keys(github?.deploySecrets ?? {}),
+        ...Object.keys(github?.e2eSecrets ?? {}),
+    ]);
+    if (smoo?.remoteCache?.tokenSecret)
+        names.add(smoo.remoteCache.tokenSecret);
+    for (const origin of github?.cargoCredentials?.gitOrigins ?? []) {
+        if (origin.tokenEnv)
+            names.add(origin.tokenEnv);
+    }
+    for (const source of github?.sourceCheckouts ?? []) {
+        if (source.tokenEnv)
+            names.add(source.tokenEnv);
+    }
+    if (smoo?.privateNpm?.readTokenEnv)
+        names.add(smoo.privateNpm.readTokenEnv);
+    if (smoo?.privateNpm?.publishTokenEnv)
+        names.add(smoo.privateNpm.publishTokenEnv);
+    return [...names].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * GitHub Environments the rendered workflows bind, read from the workflow
+ * files rather than from config: a binding may be hand-authored inside a
+ * `smoo-local` block, and the file is what GitHub executes either way. A job
+ * bound to an environment resolves `secrets.X` from that environment first and
+ * from the repository second, so these names are the scopes a value can live
+ * in. Expressions are skipped - a computed environment names no fixed scope.
+ */
+export function workflowEnvironments(root) {
+    const directory = join(root, '.github', 'workflows');
+    if (!existsSync(directory))
+        return [];
+    const environments = new Set();
+    for (const entry of readdirSync(directory)) {
+        if (!entry.endsWith('.yml') && !entry.endsWith('.yaml'))
+            continue;
+        for (const bound of environmentBindings(readFileSync(join(directory, entry), 'utf8'))) {
+            environments.add(bound);
+        }
+    }
+    return [...environments].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * The environments one workflow file binds, in both spellings GitHub accepts:
+ * `environment: staging`, and the block form whose `name:` sits under it when
+ * the job also records a deployment URL. Only a `name:` indented inside an
+ * `environment:` block is a binding - a workflow's, a job's and a step's are
+ * not, and reading those as environments would send an operator to set
+ * secrets in scopes that do not exist.
+ */
+function environmentBindings(text) {
+    const lines = text.split('\n');
+    const bound = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const binding = /^(\s*)environment:(.*)$/.exec(lines[index] ?? '');
+        if (!binding)
+            continue;
+        const indent = (binding[1] ?? '').length;
+        const value = binding[2] ?? '';
+        // Nothing but a comment after the colon is the block form; anything else
+        // is the value itself.
+        if (!/^\s*(?:#.*)?$/.test(value)) {
+            const name = literalEnvironmentName(value);
+            if (name !== null)
+                bound.push(name);
+            continue;
+        }
+        for (let next = index + 1; next < lines.length; next += 1) {
+            const line = lines[next] ?? '';
+            const content = line.trimStart();
+            if (content.length === 0 || content.startsWith('#'))
+                continue;
+            if (line.length - content.length <= indent)
+                break;
+            const named = /^name:(.*)$/.exec(content);
+            if (!named)
+                continue;
+            const name = literalEnvironmentName(named[1] ?? '');
+            if (name !== null)
+                bound.push(name);
+            break;
+        }
+    }
+    return bound;
+}
+/**
+ * The fixed name a YAML value denotes, or null when it denotes no fixed scope:
+ * an expression is computed per run, and a flow mapping or a list is not a
+ * name. Names may contain spaces, which is why the renderer quotes them.
+ */
+function literalEnvironmentName(value) {
+    const scalar = value.replace(/\s+#.*$/, '').trim();
+    if (scalar.length === 0 || scalar.includes('${{'))
+        return null;
+    const unquoted = /^(['"])(.*)\1$/.exec(scalar)?.[2] ?? scalar;
+    return /^[A-Za-z0-9._-][A-Za-z0-9._ -]*$/.test(unquoted) ? unquoted : null;
+}
+/**
+ * Env name -> repository secret for every name in play, following the naming
+ * convention and honouring the declared exceptions a repository still needs.
+ */
+export function secretNameMapping(root, envNames) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const declared = { ...(manifest?.smoo?.github?.deploySecrets ?? {}), ...(manifest?.smoo?.github?.e2eSecrets ?? {}) };
+    const repository = manifest ? repositoryInfo(manifest) : null;
+    const owner = repository ? (repositoryOwnerFromUrl(repository.url) ?? '') : '';
+    return repositorySecretMapping(envNames, owner, declared);
+}
+/** Every wrangler project's declared secret names, keyed by the project directory. */
+export function workerSecretNames(root, workspaceDirs) {
+    const byWorker = {};
+    for (const dir of workspaceDirs) {
+        const examplePath = join(root, dir, '.dev.vars.example');
+        if (!existsSync(examplePath))
+            continue;
+        const names = parseDevVarsExample(readFileSync(examplePath, 'utf8'));
+        if (names.length > 0)
+            byWorker[dir] = names;
+    }
+    return byWorker;
+}
+/** Names `smoo.secrets` declares a fetch command for. */
+export function localSecretCommandNames(root) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    return Object.keys(manifest?.smoo?.secrets ?? {}).sort((left, right) => left.localeCompare(right));
+}
+/**
+ * Resolve one declared secret through its command. The value is returned, never
+ * logged: callers hand it to `gh secret set` over stdin.
+ */
+export function fetchLocalSecret(root, name) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const declared = manifest?.smoo?.secrets?.[name];
+    if (!declared) {
+        return { ok: false, reason: `smoo.secrets declares no command for ${name}` };
+    }
+    const [command, ...args] = declared.command;
+    const result = spawnSync(command, args, { encoding: 'utf8' });
+    if (result.status !== 0) {
+        // Name the command, never its output: a failing secret fetch prints
+        // credentials often enough that it is worth refusing to.
+        return {
+            ok: false,
+            reason: `${name}: \`${declared.command.join(' ')}\` exited ${result.status ?? 'without status'}`,
+        };
+    }
+    const value = result.stdout.replace(/\n$/, '');
+    if (value.length === 0) {
+        return { ok: false, reason: `${name}: \`${declared.command.join(' ')}\` produced no value` };
+    }
+    return { ok: true, value };
+}

package/dist/secrets/repository.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Which GitHub repository `smoo secrets` reads and writes.
+ *
+ * `gh` refuses on a checkout with more than one remote ("multiple remotes
+ * detected"), which is exactly the public/private mirror layout this CLI's own
+ * users run — so the repository has to be resolved here, from the checkout,
+ * before `gh` is spawned. The current branch's upstream decides it: a branch
+ * that pushes to the private mirror is a branch whose secrets live there. That
+ * is a fact the checkout already records, not a preference to configure.
+ */
+export interface RepositoryChoice {
+    /** `owner/name`, the form `gh --repo` takes. */
+    readonly repo: string;
+    /** Why this repository, for the operator to read back. */
+    readonly source: string;
+}
+/** `owner/name` from any git remote URL form, or null when it names no repository. */
+export declare function repositorySlugFromUrl(url: string): string | null;
+/**
+ * Pure resolution, so the precedence is testable without a checkout.
+ *
+ * A requested value is either a remote name or an `owner/name` slug; naming a
+ * remote is what an operator reaches for first (`-R private-repo`), and
+ * refusing it because it lacks a slash would be pedantry.
+ *
+ * With no request and no upstream - a branch pushed by explicit refspec, which
+ * is how the mirror layout is driven - the remote-tracking refs still record
+ * where this branch has been pushed. One remote carrying it is an answer; two
+ * is a genuine ambiguity worth refusing.
+ */
+export declare function chooseRepository(inputs: {
+    readonly remotes: ReadonlyMap<string, string>;
+    readonly upstreamRemote: string | null;
+    /** Remotes that already carry the current branch, from its remote-tracking refs. */
+    readonly remotesCarryingBranch?: readonly string[];
+    /** Current branch name, for the refusal to say which branch decided nothing. */
+    readonly branch?: string | null;
+    readonly requested: string | undefined;
+}): {
+    ok: true;
+    choice: RepositoryChoice;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Remote name -> URL, in config order. */
+export declare function readRemotes(root: string): Map<string, string>;
+/** Remotes with a remote-tracking ref for the current branch: where it has been pushed. */
+export declare function readRemotesCarryingBranch(root: string, remotes: ReadonlyMap<string, string>): string[];
+/** The remote the current branch tracks, or null when it tracks nothing. */
+export declare function readUpstreamRemote(root: string): string | null;
+/** The repository to operate on, resolved from the checkout. */
+export declare function resolveRepository(root: string, requested: string | undefined): {
+    ok: true;
+    choice: RepositoryChoice;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=repository.d.ts.map

package/dist/secrets/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/secrets/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAehE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoDzE;AAOD,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAS7D;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUtG;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9D;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUxE"}

package/dist/secrets/repository.js

@@ -0,0 +1,145 @@
+/**
+ * Which GitHub repository `smoo secrets` reads and writes.
+ *
+ * `gh` refuses on a checkout with more than one remote ("multiple remotes
+ * detected"), which is exactly the public/private mirror layout this CLI's own
+ * users run — so the repository has to be resolved here, from the checkout,
+ * before `gh` is spawned. The current branch's upstream decides it: a branch
+ * that pushes to the private mirror is a branch whose secrets live there. That
+ * is a fact the checkout already records, not a preference to configure.
+ */
+import { spawnSync } from 'node:child_process';
+/** `owner/name` from any git remote URL form, or null when it names no repository. */
+export function repositorySlugFromUrl(url) {
+    const withoutProtocol = url
+        .trim()
+        .replace(/^[a-z+]+:\/\//i, '')
+        .replace(/^[^@/]+@/, '');
+    // A remainder starting with `/` or `.` carries no host, so it is a path on
+    // this machine - a valid git remote, never a GitHub repository.
+    if (withoutProtocol.startsWith('/') || withoutProtocol.startsWith('.'))
+        return null;
+    const path = withoutProtocol.replace(/^[^/:]+(?::\d+)?[/:]/, '');
+    const segments = path
+        .replace(/\.git$/i, '')
+        .split('/')
+        .filter((segment) => segment.length > 0);
+    if (segments.length < 2)
+        return null;
+    return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;
+}
+/**
+ * Pure resolution, so the precedence is testable without a checkout.
+ *
+ * A requested value is either a remote name or an `owner/name` slug; naming a
+ * remote is what an operator reaches for first (`-R private-repo`), and
+ * refusing it because it lacks a slash would be pedantry.
+ *
+ * With no request and no upstream - a branch pushed by explicit refspec, which
+ * is how the mirror layout is driven - the remote-tracking refs still record
+ * where this branch has been pushed. One remote carrying it is an answer; two
+ * is a genuine ambiguity worth refusing.
+ */
+export function chooseRepository(inputs) {
+    const { remotes, upstreamRemote, requested } = inputs;
+    const remotesCarryingBranch = inputs.remotesCarryingBranch ?? [];
+    if (requested !== undefined && requested.length > 0) {
+        const url = remotes.get(requested);
+        if (url !== undefined) {
+            const slug = repositorySlugFromUrl(url);
+            if (slug === null)
+                return { ok: false, reason: `remote ${requested} (${url}) names no owner/name` };
+            return { ok: true, choice: { repo: slug, source: `remote ${requested}` } };
+        }
+        if (requested.includes('/'))
+            return { ok: true, choice: { repo: requested, source: 'requested' } };
+        return {
+            ok: false,
+            reason: `${requested} is neither a remote of this checkout nor an owner/name. ` +
+                `Remotes: ${[...remotes.keys()].join(', ') || 'none'}`,
+        };
+    }
+    if (upstreamRemote !== null) {
+        const url = remotes.get(upstreamRemote);
+        const slug = url === undefined ? null : repositorySlugFromUrl(url);
+        if (slug !== null) {
+            return { ok: true, choice: { repo: slug, source: `upstream of the current branch (${upstreamRemote})` } };
+        }
+    }
+    if (remotesCarryingBranch.length === 1) {
+        const name = remotesCarryingBranch[0] ?? '';
+        const url = remotes.get(name);
+        const slug = url === undefined ? null : repositorySlugFromUrl(url);
+        if (slug !== null) {
+            return { ok: true, choice: { repo: slug, source: `the only remote carrying this branch (${name})` } };
+        }
+    }
+    if (remotes.size === 1) {
+        const [name, url] = [...remotes][0];
+        const slug = repositorySlugFromUrl(url);
+        if (slug !== null)
+            return { ok: true, choice: { repo: slug, source: `the only remote (${name})` } };
+    }
+    const origin = remotes.get('origin');
+    const originSlug = origin === undefined ? null : repositorySlugFromUrl(origin);
+    if (originSlug !== null)
+        return { ok: true, choice: { repo: originSlug, source: 'remote origin' } };
+    const candidates = [...remotes].map(([name, url]) => `${name} -> ${repositorySlugFromUrl(url) ?? url}`).join(', ');
+    const branchClause = inputs.branch === undefined || inputs.branch === null
+        ? 'this checkout has no current branch'
+        : `branch ${inputs.branch} has no upstream and no remote carries it`;
+    return {
+        ok: false,
+        reason: `${branchClause}, and there is no origin, so the repository is ambiguous. ` +
+            `Pass -R with one of: ${candidates || 'no remotes at all'}`,
+    };
+}
+function git(root, args) {
+    const result = spawnSync('git', [...args], { cwd: root, encoding: 'utf8' });
+    return result.status === 0 ? result.stdout.trim() : null;
+}
+/** Remote name -> URL, in config order. */
+export function readRemotes(root) {
+    const remotes = new Map();
+    const config = git(root, ['config', '--get-regexp', '^remote\\..*\\.url']);
+    if (config === null)
+        return remotes;
+    for (const line of config.split('\n')) {
+        const match = /^remote\.(.+)\.url\s+(.+)$/.exec(line.trim());
+        if (match !== null && match[1] !== undefined && match[2] !== undefined)
+            remotes.set(match[1], match[2]);
+    }
+    return remotes;
+}
+/** Remotes with a remote-tracking ref for the current branch: where it has been pushed. */
+export function readRemotesCarryingBranch(root, remotes) {
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (branch === null || branch === 'HEAD')
+        return [];
+    const carrying = [];
+    for (const name of remotes.keys()) {
+        if (git(root, ['rev-parse', '--verify', '--quiet', `refs/remotes/${name}/${branch}`]) !== null) {
+            carrying.push(name);
+        }
+    }
+    return carrying;
+}
+/** The remote the current branch tracks, or null when it tracks nothing. */
+export function readUpstreamRemote(root) {
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (branch === null || branch === 'HEAD')
+        return null;
+    return git(root, ['config', '--get', `branch.${branch}.remote`]);
+}
+/** The repository to operate on, resolved from the checkout. */
+export function resolveRepository(root, requested) {
+    const remotes = readRemotes(root);
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    return chooseRepository({
+        remotes,
+        upstreamRemote: readUpstreamRemote(root),
+        remotesCarryingBranch: readRemotesCarryingBranch(root, remotes),
+        branch: branch === 'HEAD' ? null : branch,
+        requested,
+    });
+}

package/dist/wrangler/cloudflare.d.ts

@@ -5,6 +5,10 @@ export interface R2Bucket {
 export interface WorkerScript {
     id: string;
 }
+/** One secret bound to a Worker. Cloudflare answers names and types only; a value is never readable. */
+export interface WorkerSecret {
+    name: string;
+}
 export interface WorkerRoute {
     id: string;
     pattern: string;
@@ -40,6 +44,8 @@ export interface CloudflareClient {
     deleteR2Object(bucket: string, key: string): Promise<void>;
     deleteR2Bucket(name: string): Promise<void>;
     listWorkerScripts(): Promise<WorkerScript[]>;
+    /** Names only; the Worker's stored values are write-only from outside. */
+    listWorkerSecrets(workerName: string): Promise<string[]>;
     deleteWorkerScript(name: string): Promise<void>;
     listWorkerDomains(): Promise<WorkerDomain[]>;
     createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;
@@ -75,6 +81,7 @@ export declare class CloudflareRestClient implements CloudflareClient {
     deleteR2Object(bucket: string, key: string): Promise<void>;
     deleteR2Bucket(name: string): Promise<void>;
     listWorkerScripts(): Promise<WorkerScript[]>;
+    listWorkerSecrets(workerName: string): Promise<string[]>;
     deleteWorkerScript(name: string): Promise<void>;
     listWorkerDomains(): Promise<WorkerDomain[]>;
     createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;

package/dist/wrangler/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/wrangler/cloudflare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AA6ED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IAH1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EAGzB;CACF;AAED,KAAK,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,qBAAa,oBAAqB,YAAW,gBAAgB;IAKzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACE,SAAS,EAAE,MAAM,EACA,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAyB,EAMpD;IAED,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAE7C;IAEK,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAS/D;IAED,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMnC;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMrD;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAG3C;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAE3C;IAED,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAErC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAGvD;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEnD;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;IAED,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7C;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9D;IAED,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,6DAA6D;YAC/C,QAAQ;YAQR,SAAS;YAkBT,UAAU;IAgCxB,yFAAyF;YAC3E,OAAO;IAQrB;;;;OAIG;YACW,MAAM;YAMN,IAAI;CAWnB"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/wrangler/cloudflare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AA8ED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IAH1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EAGzB;CACF;AAED,KAAK,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,qBAAa,oBAAqB,YAAW,gBAAgB;IAKzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACE,SAAS,EAAE,MAAM,EACA,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAyB,EAMpD;IAED,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAE7C;IAEK,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAS/D;IAED,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMnC;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMrD;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAG3C;IAEK,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ7D;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAE3C;IAED,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAErC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAGvD;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEnD;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;IAED,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7C;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9D;IAED,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,6DAA6D;YAC/C,QAAQ;YAQR,SAAS;YAkBT,UAAU;IAgCxB,yFAAyF;YAC3E,OAAO;IAQrB;;;;OAIG;YACW,MAAM;YAMN,IAAI;CAWnB"}

package/dist/wrangler/cloudflare.js

@@ -29,6 +29,10 @@ const isWorkerScripts = (() => {
     const _io0 = input => "string" === typeof input.id;
     return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
 })();
+const isWorkerSecrets = (() => {
+    const _io0 = input => "string" === typeof input.name;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
 const isWorkerDomains = (() => {
     const _io0 = input => "string" === typeof input.id && "string" === typeof input.hostname && (undefined === input.service || "string" === typeof input.service);
     return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
@@ -158,6 +162,12 @@ export class CloudflareRestClient {
         // `workers/scripts` takes no pagination parameters: the account's scripts arrive in one answer.
         return this.listOnce(`${this.accountPath}/workers/scripts`, isWorkerScripts);
     }
+    async listWorkerSecrets(workerName) {
+        // Unpaginated, like the script listing itself. A Worker that does not exist answers 404 rather
+        // than an empty list, so the caller must establish that the Worker is there before asking.
+        const secrets = await this.listOnce(`${this.accountPath}/workers/scripts/${encodeURIComponent(workerName)}/secrets`, isWorkerSecrets);
+        return secrets.map((secret) => secret.name);
+    }
     deleteWorkerScript(name) {
         return this.mutate(`${this.accountPath}/workers/scripts/${encodeURIComponent(name)}`, { method: 'DELETE' });
     }