@smoothbricks/cli 0.11.17 → 0.11.19

package/dist/secrets/commands.js

@@ -5,15 +5,70 @@
  * world-readable) and never printed. Reading one from the terminal disables
  * echo, so a pasted key does not end up in a scrollback buffer or a screen
  * share.
+ *
+ * A value lives at repository scope or inside a named GitHub Environment, and
+ * a job bound to an environment resolves `secrets.X` from that environment
+ * first and from the repository second — which is how one name carries test
+ * credentials on a preview stage and live ones in production. Every scope the
+ * workflows bind is read before anything is called missing: reading only the
+ * repository reports values that do exist as absent, and sends an operator
+ * hunting for a secret that is already set.
  */
 import { spawn, spawnSync } from 'node:child_process';
 import { getWorkspacePackages } from '../lib/workspace.js';
-import { fetchLocalSecret, localSecretCommandNames, reconcileSecrets, secretNameMapping, unsatisfiedSecrets, unwiredSecrets, workerSecretNames, workflowSecretNames, } from './index.js';
-/** Repository secret names GitHub currently holds, or a refusal naming what failed. */
-export function readRepositorySecrets(repo) {
+import { environmentsMissing, fetchLocalSecret, localSecretCommandNames, reconcileSecrets, secretNameMapping, unsatisfiedSecrets, unwiredSecrets, workerSecretNames, workflowEnvironments, workflowSecretNames, } from './index.js';
+import { resolveRepository } from './repository.js';
+/**
+ * Every secret this checkout declares that the repository does not hold, in
+ * the order an operator should fix them: the ones a workflow already promises
+ * break a deploy today, the rest break the next one.
+ */
+export function secretsNeedingValues(rows) {
+    const missing = rows.filter((row) => !row.onRepository);
+    return [...missing.filter((row) => row.suppliedByWorkflow), ...missing.filter((row) => !row.suppliedByWorkflow)];
+}
+/**
+ * Every secret this checkout declares that the named environment does not
+ * hold. A name the repository already holds is still offered: an environment
+ * value overrides the repository's for a job bound to it, and overriding one
+ * stage's credentials is the reason to write at environment scope at all. A
+ * repository secret no source declares is not offered — that is a stale value
+ * to review, not one to copy into an environment.
+ */
+export function secretsMissingInEnvironment(rows, environment) {
+    const missing = rows.filter((row) => !row.heldByEnvironment.includes(environment) &&
+        (row.declaredByWorkers.length > 0 || row.suppliedByWorkflow || row.fetchableLocally));
+    return [...missing.filter((row) => row.suppliedByWorkflow), ...missing.filter((row) => !row.suppliedByWorkflow)];
+}
+/** Why a secret is wanted, so a prompt states what will break without it. */
+export function describeNeed(row) {
+    const parts = [];
+    if (row.declaredByWorkers.length > 0)
+        parts.push(`declared by ${row.declaredByWorkers.join(', ')}`);
+    if (row.suppliedByWorkflow)
+        parts.push('passed by a managed workflow');
+    if (row.fetchableLocally)
+        parts.push('fetchable locally via smoo.secrets');
+    if (row.repositorySecret !== row.name)
+        parts.push(`read as ${row.name}`);
+    // Naming the environments that already hold it stops an operator from
+    // answering a per-stage prompt with a repository-wide value.
+    if (row.heldByEnvironment.length > 0)
+        parts.push(`held by ${row.heldByEnvironment.join(', ')}`);
+    return parts.length > 0 ? ` - ${parts.join('; ')}` : '';
+}
+/**
+ * Secret names GitHub currently holds at the given scope, or a refusal naming
+ * what failed. With no environment that is repository scope; with one it is
+ * that environment's own secrets, which are the values a bound job reads
+ * first.
+ */
+export function readRepositorySecrets(repo, environment) {
     const args = ['secret', 'list', '--json', 'name'];
     if (repo)
         args.push('--repo', repo);
+    if (environment)
+        args.push('--env', environment);
     const result = spawnSync('gh', args, { encoding: 'utf8' });
     if (result.status !== 0) {
         return {
@@ -37,11 +92,13 @@ export function readRepositorySecrets(repo) {
     }
     return { ok: true, names: names.sort((left, right) => left.localeCompare(right)) };
 }
-/** Write one secret, value over stdin so it never reaches argv. */
-export async function writeRepositorySecret(name, value, repo) {
+/** Write one secret at the given scope, value over stdin so it never reaches argv. */
+export async function writeRepositorySecret(name, value, repo, environment) {
     const args = ['secret', 'set', name];
     if (repo)
         args.push('--repo', repo);
+    if (environment)
+        args.push('--env', environment);
     const child = spawn('gh', args, { stdio: ['pipe', 'inherit', 'inherit'] });
     child.stdin.end(value);
     const status = await new Promise((resolvePromise) => {
@@ -51,7 +108,7 @@ export async function writeRepositorySecret(name, value, repo) {
         ? { ok: true }
         : { ok: false, reason: `gh ${args.join(' ')} exited ${status ?? 'without status'}` };
 }
-function collectSources(root, repositorySecrets) {
+function collectSources(root, repositorySecrets, environmentSecrets = {}) {
     const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
     const workerSecrets = workerSecretNames(root, workspaceDirs);
     const workflowSecrets = workflowSecretNames(root);
@@ -65,12 +122,18 @@ function collectSources(root, repositorySecrets) {
         secretNames: secretNameMapping(root, envNames),
         localCommands,
         repositorySecrets,
+        environmentSecrets,
     };
 }
-function describe(row) {
+/** Every scope holding a value for this name, repository first. */
+function heldBy(row) {
+    const scopes = row.onRepository ? ['repository', ...row.heldByEnvironment] : row.heldByEnvironment;
+    return scopes.length > 0 ? scopes.join(', ') : 'ABSENT';
+}
+function describe(row, scopeWidth) {
     const where = row.declaredByWorkers.length > 0 ? row.declaredByWorkers.join(', ') : '—';
     return [
-        row.onRepository ? 'set ' : 'ABSENT',
+        heldBy(row).padEnd(scopeWidth),
         row.name.padEnd(32),
         row.suppliedByWorkflow ? 'workflow' : '        ',
         row.fetchableLocally ? 'local' : '     ',
@@ -78,22 +141,52 @@ function describe(row) {
     ].join('  ');
 }
 /**
- * Print every known secret with its sources. Exit code 1 when a workflow
- * promises a value the repository does not hold — that combination is the one
- * that fails a deploy, and it fails talking about the value rather than the
- * missing secret.
+ * Print every known secret and the scopes holding it. Exit code 1 when a
+ * workflow promises a value no scope a bound job reads can supply — that
+ * combination is the one that fails a deploy, and it fails talking about the
+ * value rather than the missing secret.
  */
 export function secretsStatus(root, options) {
-    const repositorySecrets = readRepositorySecrets(options.repo);
+    const resolved = resolveRepository(root, options.repo);
+    if (!resolved.ok) {
+        console.error(resolved.reason);
+        return 1;
+    }
+    const { repo, source } = resolved.choice;
+    const repositorySecrets = readRepositorySecrets(repo);
     if (!repositorySecrets.ok) {
         console.error(repositorySecrets.reason);
         return 1;
     }
-    const rows = reconcileSecrets(collectSources(root, repositorySecrets.names));
-    console.log('state   name                              workflow  local  declared by');
+    // The workflows decide which environments a job reads; an explicitly asked
+    // for one is shown too, so an operator can inspect a scope before a workflow
+    // binds it.
+    const boundEnvironments = workflowEnvironments(root);
+    const asked = options.env !== undefined && !boundEnvironments.includes(options.env) ? [options.env] : [];
+    const environmentSecrets = {};
+    const unreadable = [];
+    for (const environment of [...boundEnvironments, ...asked]) {
+        const held = readRepositorySecrets(repo, environment);
+        if (held.ok)
+            environmentSecrets[environment] = held.names;
+        else
+            unreadable.push({ environment, reason: held.reason });
+    }
+    // An environment that cannot be read is reported, never assumed empty:
+    // guessing produces a refusal about a value that may well be set.
+    const readable = boundEnvironments.filter((environment) => environment in environmentSecrets);
+    const rows = reconcileSecrets(collectSources(root, repositorySecrets.names, environmentSecrets));
+    console.log(`repository ${repo} (${source}), holding ${repositorySecrets.names.length} secrets`);
+    for (const [environment, names] of Object.entries(environmentSecrets)) {
+        console.log(`environment ${environment}, holding ${names.length} secrets`);
+    }
+    for (const { environment, reason } of unreadable) {
+        console.log(`environment ${environment} could not be read, so nothing below claims what it holds: ${reason}`);
+    }
+    const scopeWidth = Math.max('held by'.length, ...rows.map((row) => heldBy(row).length));
+    console.log(`${'held by'.padEnd(scopeWidth)}  ${'name'.padEnd(32)}  workflow  local  declared by`);
     for (const row of rows)
-        console.log(describe(row));
-    const unsatisfied = unsatisfiedSecrets(rows);
+        console.log(describe(row, scopeWidth));
     const unwired = unwiredSecrets(rows);
     if (unwired.length > 0) {
         console.log('');
@@ -102,15 +195,39 @@ export function secretsStatus(root, options) {
                 'declare it in smoo.github.deploySecrets to have CI supply it.');
         }
     }
-    if (unsatisfied.length > 0) {
+    // A value an environment holds is not a value to duplicate at repository
+    // scope: offering it invites two sources of truth for one credential, and
+    // the table above already shows where it lives. Only a name no scope holds
+    // is a name to set here.
+    const needed = secretsNeedingValues(rows).filter((row) => !row.onRepository && row.heldByEnvironment.length === 0);
+    if (needed.length > 0) {
+        console.log('');
+        console.log(`${needed.length} secret(s) have no value in any scope on ${repo}:`);
+        for (const row of needed)
+            console.log(`  ${row.repositorySecret}${describeNeed(row)}`);
         console.log('');
-        for (const row of unsatisfied) {
-            console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and the repository has no value.`);
-            console.error(`         set it with: smoo secrets set ${row.name}${options.repo ? ` --repo ${options.repo}` : ''}`);
+        console.log(`set them all, one prompt each:  smoo secrets set -R ${repo}`);
+        console.log(`set one:                        smoo secrets set ${needed[0]?.repositorySecret ?? 'NAME'} -R ${repo}`);
+    }
+    const unsatisfied = unsatisfiedSecrets(rows, readable);
+    if (unsatisfied.length === 0)
+        return 0;
+    console.log('');
+    for (const row of unsatisfied) {
+        const missing = environmentsMissing(row, readable);
+        const scopes = missing.length > 0 ? missing.join(', ') : 'the repository';
+        console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and no value exists in ${scopes}.`);
+        if (missing.length === 0) {
+            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo}`);
+            continue;
         }
-        return 1;
+        for (const environment of missing) {
+            const named = environment.includes(' ') ? `'${environment}'` : environment;
+            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo} --env ${named}`);
+        }
+        console.error(`  or one value for every environment:  smoo secrets set ${row.repositorySecret} -R ${repo}`);
     }
-    return 0;
+    return 1;
 }
 /** Read a value with echo disabled when stdin is a terminal; otherwise read piped input. */
 async function readSecretValue(prompt) {
@@ -143,32 +260,101 @@ async function readSecretValue(prompt) {
     }
     return value;
 }
-/** Set one secret from a pasted value. */
-export async function secretsSet(name, options) {
-    const value = await readSecretValue(`Value for ${name} (not echoed): `);
+/**
+ * Set one secret, or - with no name - walk every secret this checkout declares
+ * and the target scope does not hold, prompting once each. The walk is the
+ * point of the command: an operator should never have to transcribe names out
+ * of a status table to know what to paste.
+ */
+export async function secretsSet(root, name, options) {
+    const resolved = resolveRepository(root, options.repo);
+    if (!resolved.ok) {
+        console.error(resolved.reason);
+        return 1;
+    }
+    const { repo, source } = resolved.choice;
+    const environment = options.env;
+    if (name !== undefined)
+        return setOne(name, name, repo, environment);
+    const held = readRepositorySecrets(repo);
+    if (!held.ok) {
+        console.error(held.reason);
+        return 1;
+    }
+    const environmentSecrets = {};
+    if (environment !== undefined) {
+        const inEnvironment = readRepositorySecrets(repo, environment);
+        if (!inEnvironment.ok) {
+            console.error(inEnvironment.reason);
+            return 1;
+        }
+        environmentSecrets[environment] = inEnvironment.names;
+    }
+    const rows = reconcileSecrets(collectSources(root, held.names, environmentSecrets));
+    const needed = environment === undefined ? secretsNeedingValues(rows) : secretsMissingInEnvironment(rows, environment);
+    const target = environment === undefined ? `${repo} (${source})` : `environment ${environment} on ${repo} (${source})`;
+    if (needed.length === 0) {
+        console.log(`${target} already holds every secret this checkout declares.`);
+        return 0;
+    }
+    console.log(`${needed.length} secret(s) to set on ${target}. Empty input skips one.`);
+    let failed = 0;
+    let set = 0;
+    for (const row of needed) {
+        console.log('');
+        console.log(`${row.repositorySecret}${describeNeed(row)}`);
+        const value = await readSecretValue('  paste value (not echoed, empty to skip): ');
+        if (value.length === 0) {
+            console.log(`skip    ${row.repositorySecret}`);
+            continue;
+        }
+        const written = await writeRepositorySecret(row.repositorySecret, value, repo, environment);
+        if (!written.ok) {
+            console.error(`fail    ${row.repositorySecret}: ${written.reason}`);
+            failed += 1;
+            continue;
+        }
+        console.log(`set     ${row.repositorySecret}`);
+        set += 1;
+    }
+    console.log('');
+    console.log(`${set} set, ${needed.length - set - failed} skipped, ${failed} failed.`);
+    return failed === 0 ? 0 : 1;
+}
+async function setOne(envName, repositorySecret, repo, environment) {
+    const scope = environment === undefined ? '' : ` in ${environment}`;
+    const value = await readSecretValue(`Value for ${repositorySecret}${scope} (not echoed): `);
     if (value.length === 0) {
-        console.error(`${name}: refusing to set an empty value.`);
+        console.error(`${repositorySecret}: refusing to set an empty value.`);
         return 1;
     }
-    const written = await writeRepositorySecret(name, value, options.repo);
+    const written = await writeRepositorySecret(repositorySecret, value, repo, environment);
     if (!written.ok) {
         console.error(written.reason);
         return 1;
     }
-    console.log(`set     ${name}`);
+    console.log(`set     ${repositorySecret}${scope}${envName === repositorySecret ? '' : ` (reads as ${envName})`}`);
     return 0;
 }
 /**
- * Push every locally fetchable secret to the repository. Only names
- * `smoo.secrets` declares a command for: everything else has no source here
- * and must be pasted with `smoo secrets set`.
+ * Push every locally fetchable secret to the repository, or to one environment.
+ * Only names `smoo.secrets` declares a command for: everything else has no
+ * source here and must be pasted with `smoo secrets set`.
  */
 export async function secretsSync(root, options) {
+    const resolved = resolveRepository(root, options.repo);
+    if (!resolved.ok) {
+        console.error(resolved.reason);
+        return 1;
+    }
+    const { repo } = resolved.choice;
+    const environment = options.env;
     const names = localSecretCommandNames(root);
     if (names.length === 0) {
         console.error('smoo.secrets declares no fetch commands; nothing to sync.');
         return 1;
     }
+    const scope = environment === undefined ? '' : ` in ${environment}`;
     let failed = 0;
     for (const name of names) {
         const fetched = fetchLocalSecret(root, name);
@@ -177,13 +363,13 @@ export async function secretsSync(root, options) {
             failed += 1;
             continue;
         }
-        const written = await writeRepositorySecret(name, fetched.value, options.repo);
+        const written = await writeRepositorySecret(name, fetched.value, repo, environment);
         if (!written.ok) {
             console.error(`fail    ${name}: ${written.reason}`);
             failed += 1;
             continue;
         }
-        console.log(`set     ${name}`);
+        console.log(`set     ${name}${scope}`);
     }
     return failed === 0 ? 0 : 1;
 }

package/dist/secrets/index.d.ts

@@ -31,6 +31,13 @@ export interface SecretRow {
     fetchableLocally: boolean;
     /** True when the repository holds a secret of this name. */
     onRepository: boolean;
+    /**
+     * GitHub Environments holding their own value for this name. A job bound to
+     * an environment reads that value in preference to the repository's, which
+     * is how one name carries test credentials on a preview stage and live ones
+     * in production.
+     */
+    heldByEnvironment: string[];
 }
 export interface SecretSources {
     /** Worker label -> env names it declares. */
@@ -43,6 +50,8 @@ export interface SecretSources {
     localCommands: readonly string[];
     /** Repository secret names GitHub currently holds. */
     repositorySecrets: readonly string[];
+    /** Environment name -> secret names that environment holds. */
+    environmentSecrets?: Readonly<Record<string, readonly string[]>>;
 }
 /**
  * One row per name known to any source, sorted, so a reader sees the whole
@@ -55,11 +64,22 @@ export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
  * separately from "declared but not wired into any workflow", because the
  * remedies differ — set a secret, versus declare it in `smoo.github`.
  */
-export declare function unsatisfiedSecrets(rows: readonly SecretRow[]): SecretRow[];
+export declare function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments?: readonly string[]): SecretRow[];
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export declare function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[];
 /** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
 export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
 /** Env names the managed workflows pass into a job, from the declarations that render them. */
 export declare function workflowSecretNames(root: string): string[];
+/**
+ * GitHub Environments the rendered workflows bind, read from the workflow
+ * files rather than from config: a binding may be hand-authored inside a
+ * `smoo-local` block, and the file is what GitHub executes either way. A job
+ * bound to an environment resolves `secrets.X` from that environment first and
+ * from the repository second, so these names are the scopes a value can live
+ * in. Expressions are skipped - a computed environment names no fixed scope.
+ */
+export declare function workflowEnvironments(root: string): string[];
 /**
  * Env name -> repository secret for every name in play, following the naming
  * convention and honouring the declared exceptions a repository still needs.

package/dist/secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CA0BpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAE1E;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG9D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAoCpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,iBAAiB,GAAE,SAAS,MAAM,EAAO,GAAG,SAAS,EAAE,CAUrH;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGlG;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D;AAoDD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG9D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}

package/dist/secrets/index.js

@@ -19,7 +19,7 @@
  * payment library's own `publishable_key_mismatch` refusal.
  */
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
 import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
@@ -36,9 +36,17 @@ export function reconcileSecrets(sources) {
     // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
     // permanently "declared by nothing".
     const carriesKnownEnvName = new Set(names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : []);
-    for (const secret of sources.repositorySecrets) {
+    // A value only an environment holds is still a value: leaving it out of the
+    // rows is how an operator ends up hunting for a secret that is already set.
+    const addUndeclared = (secret) => {
         if (!carriesKnownEnvName.has(secret))
             names.add(secret);
+    };
+    for (const secret of sources.repositorySecrets)
+        addUndeclared(secret);
+    for (const held of Object.values(sources.environmentSecrets ?? {})) {
+        for (const secret of held)
+            addUndeclared(secret);
     }
     return [...names]
         .sort((left, right) => left.localeCompare(right))
@@ -52,6 +60,10 @@ export function reconcileSecrets(sources) {
         suppliedByWorkflow: sources.workflowSecrets.includes(name),
         fetchableLocally: sources.localCommands.includes(name),
         onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
+        heldByEnvironment: Object.entries(sources.environmentSecrets ?? {})
+            .filter(([, held]) => held.includes(sources.secretNames[name] ?? name))
+            .map(([environment]) => environment)
+            .sort((left, right) => left.localeCompare(right)),
     }));
 }
 /**
@@ -60,8 +72,25 @@ export function reconcileSecrets(sources) {
  * separately from "declared but not wired into any workflow", because the
  * remedies differ — set a secret, versus declare it in `smoo.github`.
  */
-export function unsatisfiedSecrets(rows) {
-    return rows.filter((row) => row.suppliedByWorkflow && !row.onRepository);
+export function unsatisfiedSecrets(rows, boundEnvironments = []) {
+    return rows.filter((row) => {
+        if (!row.suppliedByWorkflow)
+            return false;
+        if (row.onRepository)
+            return false;
+        // With no environment bound, the repository is the only scope a job reads.
+        // With environments bound, each one can carry the value instead - so the
+        // name is satisfied only when every bound environment holds it.
+        if (boundEnvironments.length === 0)
+            return true;
+        return !boundEnvironments.every((environment) => row.heldByEnvironment.includes(environment));
+    });
+}
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export function environmentsMissing(row, boundEnvironments) {
+    if (row.onRepository)
+        return [];
+    return boundEnvironments.filter((environment) => !row.heldByEnvironment.includes(environment));
 }
 /** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
 export function unwiredSecrets(rows) {
@@ -92,6 +121,83 @@ export function workflowSecretNames(root) {
         names.add(smoo.privateNpm.publishTokenEnv);
     return [...names].sort((left, right) => left.localeCompare(right));
 }
+/**
+ * GitHub Environments the rendered workflows bind, read from the workflow
+ * files rather than from config: a binding may be hand-authored inside a
+ * `smoo-local` block, and the file is what GitHub executes either way. A job
+ * bound to an environment resolves `secrets.X` from that environment first and
+ * from the repository second, so these names are the scopes a value can live
+ * in. Expressions are skipped - a computed environment names no fixed scope.
+ */
+export function workflowEnvironments(root) {
+    const directory = join(root, '.github', 'workflows');
+    if (!existsSync(directory))
+        return [];
+    const environments = new Set();
+    for (const entry of readdirSync(directory)) {
+        if (!entry.endsWith('.yml') && !entry.endsWith('.yaml'))
+            continue;
+        for (const bound of environmentBindings(readFileSync(join(directory, entry), 'utf8'))) {
+            environments.add(bound);
+        }
+    }
+    return [...environments].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * The environments one workflow file binds, in both spellings GitHub accepts:
+ * `environment: staging`, and the block form whose `name:` sits under it when
+ * the job also records a deployment URL. Only a `name:` indented inside an
+ * `environment:` block is a binding - a workflow's, a job's and a step's are
+ * not, and reading those as environments would send an operator to set
+ * secrets in scopes that do not exist.
+ */
+function environmentBindings(text) {
+    const lines = text.split('\n');
+    const bound = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const binding = /^(\s*)environment:(.*)$/.exec(lines[index] ?? '');
+        if (!binding)
+            continue;
+        const indent = (binding[1] ?? '').length;
+        const value = binding[2] ?? '';
+        // Nothing but a comment after the colon is the block form; anything else
+        // is the value itself.
+        if (!/^\s*(?:#.*)?$/.test(value)) {
+            const name = literalEnvironmentName(value);
+            if (name !== null)
+                bound.push(name);
+            continue;
+        }
+        for (let next = index + 1; next < lines.length; next += 1) {
+            const line = lines[next] ?? '';
+            const content = line.trimStart();
+            if (content.length === 0 || content.startsWith('#'))
+                continue;
+            if (line.length - content.length <= indent)
+                break;
+            const named = /^name:(.*)$/.exec(content);
+            if (!named)
+                continue;
+            const name = literalEnvironmentName(named[1] ?? '');
+            if (name !== null)
+                bound.push(name);
+            break;
+        }
+    }
+    return bound;
+}
+/**
+ * The fixed name a YAML value denotes, or null when it denotes no fixed scope:
+ * an expression is computed per run, and a flow mapping or a list is not a
+ * name. Names may contain spaces, which is why the renderer quotes them.
+ */
+function literalEnvironmentName(value) {
+    const scalar = value.replace(/\s+#.*$/, '').trim();
+    if (scalar.length === 0 || scalar.includes('${{'))
+        return null;
+    const unquoted = /^(['"])(.*)\1$/.exec(scalar)?.[2] ?? scalar;
+    return /^[A-Za-z0-9._-][A-Za-z0-9._ -]*$/.test(unquoted) ? unquoted : null;
+}
 /**
  * Env name -> repository secret for every name in play, following the naming
  * convention and honouring the declared exceptions a repository still needs.

package/dist/secrets/repository.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Which GitHub repository `smoo secrets` reads and writes.
+ *
+ * `gh` refuses on a checkout with more than one remote ("multiple remotes
+ * detected"), which is exactly the public/private mirror layout this CLI's own
+ * users run — so the repository has to be resolved here, from the checkout,
+ * before `gh` is spawned. The current branch's upstream decides it: a branch
+ * that pushes to the private mirror is a branch whose secrets live there. That
+ * is a fact the checkout already records, not a preference to configure.
+ */
+export interface RepositoryChoice {
+    /** `owner/name`, the form `gh --repo` takes. */
+    readonly repo: string;
+    /** Why this repository, for the operator to read back. */
+    readonly source: string;
+}
+/** `owner/name` from any git remote URL form, or null when it names no repository. */
+export declare function repositorySlugFromUrl(url: string): string | null;
+/**
+ * Pure resolution, so the precedence is testable without a checkout.
+ *
+ * A requested value is either a remote name or an `owner/name` slug; naming a
+ * remote is what an operator reaches for first (`-R private-repo`), and
+ * refusing it because it lacks a slash would be pedantry.
+ *
+ * With no request and no upstream - a branch pushed by explicit refspec, which
+ * is how the mirror layout is driven - the remote-tracking refs still record
+ * where this branch has been pushed. One remote carrying it is an answer; two
+ * is a genuine ambiguity worth refusing.
+ */
+export declare function chooseRepository(inputs: {
+    readonly remotes: ReadonlyMap<string, string>;
+    readonly upstreamRemote: string | null;
+    /** Remotes that already carry the current branch, from its remote-tracking refs. */
+    readonly remotesCarryingBranch?: readonly string[];
+    /** Current branch name, for the refusal to say which branch decided nothing. */
+    readonly branch?: string | null;
+    readonly requested: string | undefined;
+}): {
+    ok: true;
+    choice: RepositoryChoice;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Remote name -> URL, in config order. */
+export declare function readRemotes(root: string): Map<string, string>;
+/** Remotes with a remote-tracking ref for the current branch: where it has been pushed. */
+export declare function readRemotesCarryingBranch(root: string, remotes: ReadonlyMap<string, string>): string[];
+/** The remote the current branch tracks, or null when it tracks nothing. */
+export declare function readUpstreamRemote(root: string): string | null;
+/** The repository to operate on, resolved from the checkout. */
+export declare function resolveRepository(root: string, requested: string | undefined): {
+    ok: true;
+    choice: RepositoryChoice;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=repository.d.ts.map

package/dist/secrets/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/secrets/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAehE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoDzE;AAOD,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAS7D;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUtG;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9D;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUxE"}