@smoothbricks/cli 0.11.18 → 0.11.20

package/dist/secrets/index.d.ts

@@ -1,9 +1,11 @@
 /**
- * Reconciles the three places a repository's secrets are described, all of
- * which smoo already owns:
+ * Reads the three places a repository's secrets are described, all of which
+ * smoo already owns:
  *
  * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
- *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from —
+ *    and `smoo.wrangler.secretStages` beside it says which stages each name
+ *    belongs to.
  * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
  *    and `e2eSecrets` map an env name to a repository secret, and the managed
  *    workflows render exactly those into the job environment.
@@ -17,58 +19,12 @@
  * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
  * the repository holds no such secret, and the empty value surfaces as the
  * payment library's own `publishable_key_mismatch` refusal.
+ *
+ * The join itself is ./status.ts: pure, and the owner of the document type
+ * these readings are projected into.
  */
-/** Where an env name is described, which repository secret carries it, and whether that exists. */
-export interface SecretRow {
-    name: string;
-    /** The repository secret this env name reads from, by convention or declaration. */
-    repositorySecret: string;
-    /** Wrangler projects whose `.dev.vars.example` declares it. */
-    declaredByWorkers: string[];
-    /** True when a managed workflow renders `secrets.<name>` into a job. */
-    suppliedByWorkflow: boolean;
-    /** True when `smoo.secrets` can fetch it for a developer shell. */
-    fetchableLocally: boolean;
-    /** True when the repository holds a secret of this name. */
-    onRepository: boolean;
-    /**
-     * GitHub Environments holding their own value for this name. A job bound to
-     * an environment reads that value in preference to the repository's, which
-     * is how one name carries test credentials on a preview stage and live ones
-     * in production.
-     */
-    heldByEnvironment: string[];
-}
-export interface SecretSources {
-    /** Worker label -> env names it declares. */
-    workerSecrets: Record<string, readonly string[]>;
-    /** Env names a managed workflow passes into a job. */
-    workflowSecrets: readonly string[];
-    /** Env name -> repository secret, by convention with declared exceptions. */
-    secretNames: Readonly<Record<string, string>>;
-    /** Env names `smoo.secrets` can fetch locally. */
-    localCommands: readonly string[];
-    /** Repository secret names GitHub currently holds. */
-    repositorySecrets: readonly string[];
-    /** Environment name -> secret names that environment holds. */
-    environmentSecrets?: Readonly<Record<string, readonly string[]>>;
-}
-/**
- * One row per name known to any source, sorted, so a reader sees the whole
- * picture rather than one source's view of it.
- */
-export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
-/**
- * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
- * promises to pass it, and the repository has no value to pass. Reported
- * separately from "declared but not wired into any workflow", because the
- * remedies differ — set a secret, versus declare it in `smoo.github`.
- */
-export declare function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments?: readonly string[]): SecretRow[];
-/** Bound environments that lack their own value and cannot fall back to the repository. */
-export declare function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[];
-/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
-export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
+import { type SecretStageMap } from '../wrangler/stage-secrets.js';
+import { type GroupedSecret } from './resolver.js';
 /** Env names the managed workflows pass into a job, from the declarations that render them. */
 export declare function workflowSecretNames(root: string): string[];
 /**
@@ -87,8 +43,38 @@ export declare function workflowEnvironments(root: string): string[];
 export declare function secretNameMapping(root: string, envNames: readonly string[]): Record<string, string>;
 /** Every wrangler project's declared secret names, keyed by the project directory. */
 export declare function workerSecretNames(root: string, workspaceDirs: readonly string[]): Record<string, string[]>;
-/** Names `smoo.secrets` declares a fetch command for. */
-export declare function localSecretCommandNames(root: string): string[];
+/**
+ * Every wrangler project's `smoo.wrangler.secretStages`, keyed by the project
+ * directory — the same keys `workerSecretNames` uses, so a name's scopes and
+ * its declarations are joined on one label.
+ *
+ * A malformed block is a refusal rather than a throw: it is the same class of
+ * problem as a repository `gh` will not talk to, and `smoo secrets status`
+ * reports those instead of dying with a stack. Silently reading it as "no
+ * scopes" is the one thing this must not do — that is the direction where
+ * every secret quietly reaches every stage.
+ */
+export declare function workerSecretStages(root: string, workspaceDirs: readonly string[]): {
+    ok: true;
+    byWorker: Record<string, SecretStageMap>;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Every `smoo.secrets` entry with the group that resolves it, sorted by name,
+ * or a refusal naming the declaration that could not be read. The groups come
+ * from ./resolver.ts — the same file shell entry routes with — so a status
+ * table and a `smoo secrets run` cannot disagree about which group resolves
+ * a name.
+ */
+export declare function localSecretGroups(root: string): Promise<{
+    ok: true;
+    secrets: GroupedSecret[];
+} | {
+    ok: false;
+    reason: string;
+}>;
 /**
  * Resolve one declared secret through its command. The value is returned, never
  * logged: callers hand it to `gh secret set` over stdin.

package/dist/secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAoCpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,iBAAiB,GAAE,SAAS,MAAM,EAAO,GAAG,SAAS,EAAE,CAUrH;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGlG;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D;AAoDD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG9D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAQH,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,eAAe,CAAC;AAErE,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D;AAoDD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAYxF;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAOjF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}

package/dist/secrets/index.js

@@ -1,9 +1,11 @@
 /**
- * Reconciles the three places a repository's secrets are described, all of
- * which smoo already owns:
+ * Reads the three places a repository's secrets are described, all of which
+ * smoo already owns:
  *
  * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
- *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from —
+ *    and `smoo.wrangler.secretStages` beside it says which stages each name
+ *    belongs to.
  * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
  *    and `e2eSecrets` map an env name to a repository secret, and the managed
  *    workflows render exactly those into the job environment.
@@ -17,6 +19,9 @@
  * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
  * the repository holds no such secret, and the empty value surfaces as the
  * payment library's own `publishable_key_mismatch` refusal.
+ *
+ * The join itself is ./status.ts: pure, and the owner of the document type
+ * these readings are projected into.
  */
 import { spawnSync } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
@@ -24,78 +29,8 @@ import { join } from 'node:path';
 import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
 import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
 import { parseDevVarsExample } from '../wrangler/prepare-env.js';
-/**
- * One row per name known to any source, sorted, so a reader sees the whole
- * picture rather than one source's view of it.
- */
-export function reconcileSecrets(sources) {
-    const declaredByAnyWorker = Object.values(sources.workerSecrets).flatMap((names) => [...names]);
-    const names = new Set([...declaredByAnyWorker, ...sources.workflowSecrets, ...sources.localCommands]);
-    // A repository secret that already carries a known env name is that name's
-    // row, not a row of its own: listing ACME_GITHUB_CLIENT_SECRET beside
-    // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
-    // permanently "declared by nothing".
-    const carriesKnownEnvName = new Set(names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : []);
-    // A value only an environment holds is still a value: leaving it out of the
-    // rows is how an operator ends up hunting for a secret that is already set.
-    const addUndeclared = (secret) => {
-        if (!carriesKnownEnvName.has(secret))
-            names.add(secret);
-    };
-    for (const secret of sources.repositorySecrets)
-        addUndeclared(secret);
-    for (const held of Object.values(sources.environmentSecrets ?? {})) {
-        for (const secret of held)
-            addUndeclared(secret);
-    }
-    return [...names]
-        .sort((left, right) => left.localeCompare(right))
-        .map((name) => ({
-        name,
-        repositorySecret: sources.secretNames[name] ?? name,
-        declaredByWorkers: Object.entries(sources.workerSecrets)
-            .filter(([, declared]) => declared.includes(name))
-            .map(([label]) => label)
-            .sort((left, right) => left.localeCompare(right)),
-        suppliedByWorkflow: sources.workflowSecrets.includes(name),
-        fetchableLocally: sources.localCommands.includes(name),
-        onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
-        heldByEnvironment: Object.entries(sources.environmentSecrets ?? {})
-            .filter(([, held]) => held.includes(sources.secretNames[name] ?? name))
-            .map(([environment]) => environment)
-            .sort((left, right) => left.localeCompare(right)),
-    }));
-}
-/**
- * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
- * promises to pass it, and the repository has no value to pass. Reported
- * separately from "declared but not wired into any workflow", because the
- * remedies differ — set a secret, versus declare it in `smoo.github`.
- */
-export function unsatisfiedSecrets(rows, boundEnvironments = []) {
-    return rows.filter((row) => {
-        if (!row.suppliedByWorkflow)
-            return false;
-        if (row.onRepository)
-            return false;
-        // With no environment bound, the repository is the only scope a job reads.
-        // With environments bound, each one can carry the value instead - so the
-        // name is satisfied only when every bound environment holds it.
-        if (boundEnvironments.length === 0)
-            return true;
-        return !boundEnvironments.every((environment) => row.heldByEnvironment.includes(environment));
-    });
-}
-/** Bound environments that lack their own value and cannot fall back to the repository. */
-export function environmentsMissing(row, boundEnvironments) {
-    if (row.onRepository)
-        return [];
-    return boundEnvironments.filter((environment) => !row.heldByEnvironment.includes(environment));
-}
-/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
-export function unwiredSecrets(rows) {
-    return rows.filter((row) => row.declaredByWorkers.length > 0 && !row.suppliedByWorkflow);
-}
+import { readSecretStageMap } from '../wrangler/stage-secrets.js';
+import { readSecretGroups } from './resolver.js';
 /** Env names the managed workflows pass into a job, from the declarations that render them. */
 export function workflowSecretNames(root) {
     const manifest = readPackageJsonObject(join(root, 'package.json'));
@@ -222,10 +157,48 @@ export function workerSecretNames(root, workspaceDirs) {
     }
     return byWorker;
 }
-/** Names `smoo.secrets` declares a fetch command for. */
-export function localSecretCommandNames(root) {
-    const manifest = readPackageJsonObject(join(root, 'package.json'));
-    return Object.keys(manifest?.smoo?.secrets ?? {}).sort((left, right) => left.localeCompare(right));
+/**
+ * Every wrangler project's `smoo.wrangler.secretStages`, keyed by the project
+ * directory — the same keys `workerSecretNames` uses, so a name's scopes and
+ * its declarations are joined on one label.
+ *
+ * A malformed block is a refusal rather than a throw: it is the same class of
+ * problem as a repository `gh` will not talk to, and `smoo secrets status`
+ * reports those instead of dying with a stack. Silently reading it as "no
+ * scopes" is the one thing this must not do — that is the direction where
+ * every secret quietly reaches every stage.
+ */
+export function workerSecretStages(root, workspaceDirs) {
+    const byWorker = {};
+    for (const dir of workspaceDirs) {
+        if (!existsSync(join(root, dir, '.dev.vars.example')))
+            continue;
+        try {
+            const scopes = readSecretStageMap(join(root, dir));
+            if (Object.keys(scopes).length > 0)
+                byWorker[dir] = scopes;
+        }
+        catch (error) {
+            return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    return { ok: true, byWorker };
+}
+/**
+ * Every `smoo.secrets` entry with the group that resolves it, sorted by name,
+ * or a refusal naming the declaration that could not be read. The groups come
+ * from ./resolver.ts — the same file shell entry routes with — so a status
+ * table and a `smoo secrets run` cannot disagree about which group resolves
+ * a name.
+ */
+export async function localSecretGroups(root) {
+    try {
+        const secrets = await readSecretGroups(root);
+        return { ok: true, secrets: secrets.sort((left, right) => left.name.localeCompare(right.name)) };
+    }
+    catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+    }
 }
 /**
  * Resolve one declared secret through its command. The value is returned, never

package/dist/secrets/resolver.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The bootstrap secret resolver, as the CLI sees it.
+ *
+ * `managed/raw/tooling/direnv/secret-references.ts` holds the one
+ * implementation of THE RULE — which group resolves where, and what CI and a
+ * cowshed workspace refuse instead. A managed repository runs the copy smoo
+ * writes into its own `tooling/direnv/secret-references.ts` at shell entry;
+ * `smoo secrets run` runs THIS package's copy of the same file. One
+ * implementation, so the command and the shell cannot disagree about a group.
+ *
+ * It is loaded, not statically imported, and that is forced rather than
+ * chosen: the file is a raw bootstrap script that must load before any
+ * workspace package and before the Typia transform exists, so it lives
+ * outside `src` — outside this package's compiled `rootDir`, which a static
+ * import may not cross. A dynamic `import()` reaches it in both layouts
+ * (`src/secrets/` and `dist/secrets/` are each two directories below the
+ * package root), and typia validates what comes back: the same boundary
+ * ../monorepo/packed-package.ts puts around a foreign module. `require` is
+ * not the alternative — under a Bun loader plugin, which this package's own
+ * tests preload, every module is async and `require` of one throws.
+ */
+/** A declared `smoo.secrets` entry with its group settled. */
+export interface GroupedSecret {
+    name: string;
+    /** The group that resolves it: the declared one when stated, `derivedGroup` otherwise. */
+    group: string;
+    /**
+     * What the repository's own declarations imply: `registry` for a variable
+     * `.npmrc` interpolates, `nx-cache` for the declared cache token, `shell`
+     * for everything else. Differs from `group` exactly when an entry overrides
+     * the derivation.
+     */
+    derivedGroup: string;
+}
+/** A declared secret a request declined to resolve, and how to supply it. */
+export interface DeferredSecret {
+    name: string;
+    group: string;
+    guidance: string;
+}
+/** What belongs in a child's environment, and what was deliberately left out of it. */
+export interface SecretResolution {
+    values: Record<string, string>;
+    deferred: DeferredSecret[];
+}
+/**
+ * Every `smoo.secrets` entry of the repository at `root`, each with the group
+ * that resolves it. Rejects with the offending declaration named — never a
+ * value — when the manifest or `.npmrc` cannot be read.
+ */
+export declare function readSecretGroups(root: string): Promise<GroupedSecret[]>;
+/**
+ * Resolve exactly one group's secrets for one child process. Everything
+ * outside the group comes back deferred rather than resolved, so a run for
+ * one group never triggers another group's provider command. Rejects with the
+ * resolver's aggregated refusal, which names variables and groups only.
+ */
+export declare function resolveSecretGroup(root: string, group: string): Promise<SecretResolution>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/secrets/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/secrets/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAoDD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAO7E;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAO/F"}

package/dist/secrets/resolver.js

@@ -0,0 +1,100 @@
+/**
+ * The bootstrap secret resolver, as the CLI sees it.
+ *
+ * `managed/raw/tooling/direnv/secret-references.ts` holds the one
+ * implementation of THE RULE — which group resolves where, and what CI and a
+ * cowshed workspace refuse instead. A managed repository runs the copy smoo
+ * writes into its own `tooling/direnv/secret-references.ts` at shell entry;
+ * `smoo secrets run` runs THIS package's copy of the same file. One
+ * implementation, so the command and the shell cannot disagree about a group.
+ *
+ * It is loaded, not statically imported, and that is forced rather than
+ * chosen: the file is a raw bootstrap script that must load before any
+ * workspace package and before the Typia transform exists, so it lives
+ * outside `src` — outside this package's compiled `rootDir`, which a static
+ * import may not cross. A dynamic `import()` reaches it in both layouts
+ * (`src/secrets/` and `dist/secrets/` are each two directories below the
+ * package root), and typia validates what comes back: the same boundary
+ * ../monorepo/packed-package.ts puts around a foreign module. `require` is
+ * not the alternative — under a Bun loader plugin, which this package's own
+ * tests preload, every module is async and `require` of one throws.
+ */
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import typia from 'typia';
+const isSecretReferencesModule = (() => {
+    const _io0 = input => true && true;
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isGroupedSecrets = (() => {
+    const _io0 = input => "string" === typeof input.name && "string" === typeof input.group && "string" === typeof input.derivedGroup;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
+const isSecretResolution = (() => {
+    const _io0 = input => "object" === typeof input.values && null !== input.values && false === Array.isArray(input.values) && _io1(input.values) && (Array.isArray(input.deferred) && input.deferred.every(elem => "object" === typeof elem && null !== elem && _io2(elem)));
+    const _io1 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return "string" === typeof value;
+    });
+    const _io2 = input => "string" === typeof input.name && "string" === typeof input.group && "string" === typeof input.guidance;
+    return input => "object" === typeof input && null !== input && _io0(input);
+})();
+const RESOLVER_PATH = fileURLToPath(new URL('../../managed/raw/tooling/direnv/secret-references.ts', import.meta.url));
+/**
+ * A loaded export, narrowed to the signature this file calls it with. typia
+ * validates data, not functions — it reports a module missing both of these
+ * as valid — so presence is checked here, and what each one RETURNS is
+ * validated below, where it is data again.
+ */
+function isSecretGroupsReader(value) {
+    return typeof value === 'function';
+}
+function isSecretGroupResolver(value) {
+    return typeof value === 'function';
+}
+let loaded;
+async function secretReferences() {
+    if (loaded !== undefined) {
+        return loaded;
+    }
+    // Dynamic by necessity: the target is a managed raw script outside this
+    // package's compiled rootDir, so no static import can name it.
+    const imported = await import(pathToFileURL(RESOLVER_PATH).href);
+    if (!isSecretReferencesModule(imported)) {
+        throw new Error(`${RESOLVER_PATH} did not load as a module`);
+    }
+    const { readSecretGroups: read, resolveSecretEnvironment: resolve } = imported;
+    if (!isSecretGroupsReader(read) || !isSecretGroupResolver(resolve)) {
+        throw new Error(`${RESOLVER_PATH} does not expose the expected secret resolver API`);
+    }
+    loaded = { readSecretGroups: read, resolveSecretEnvironment: resolve };
+    return loaded;
+}
+/**
+ * Every `smoo.secrets` entry of the repository at `root`, each with the group
+ * that resolves it. Rejects with the offending declaration named — never a
+ * value — when the manifest or `.npmrc` cannot be read.
+ */
+export async function readSecretGroups(root) {
+    const references = await secretReferences();
+    const groups = references.readSecretGroups(root);
+    if (!isGroupedSecrets(groups)) {
+        throw new Error(`${RESOLVER_PATH} returned an unexpected group listing`);
+    }
+    return groups;
+}
+/**
+ * Resolve exactly one group's secrets for one child process. Everything
+ * outside the group comes back deferred rather than resolved, so a run for
+ * one group never triggers another group's provider command. Rejects with the
+ * resolver's aggregated refusal, which names variables and groups only.
+ */
+export async function resolveSecretGroup(root, group) {
+    const references = await secretReferences();
+    const resolution = await references.resolveSecretEnvironment({ root, group });
+    if (!isSecretResolution(resolution)) {
+        throw new Error(`${RESOLVER_PATH} returned an unexpected resolution`);
+    }
+    return resolution;
+}

package/dist/secrets/run.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `smoo secrets run <group> <command...>` — the half of THE RULE that shell
+ * entry is not.
+ *
+ * The rule lives in tooling/direnv/secret-references.ts: shell entry resolves
+ * the `shell` group and nothing else, because a provider authorises per
+ * requesting process lineage and every direnv reload is a new one. Every
+ * other group belongs to the command that needs it, and this is that command.
+ * One deliberate `smoo secrets run registry bun install` instead of a
+ * credential prompt on every shell.
+ *
+ * Exactly one group is resolved. A repository that declares a registry
+ * credential and a cache token runs one provider command here, not two: a
+ * wrapper that resolved everything declared would fire provider commands for
+ * credentials the command never touches, which is the prompt this exists to
+ * remove.
+ *
+ * The value reaches the child the only way that leaves no trace: its
+ * environment. Never a file, never argv — argv is world-readable through
+ * `ps` — and never this process's stdout.
+ */
+export declare function secretsRun(root: string, group: string | undefined, command: readonly string[]): Promise<number>;
+//# sourceMappingURL=run.d.ts.map

package/dist/secrets/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/secrets/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiBH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0CrH"}

package/dist/secrets/run.js

@@ -0,0 +1,130 @@
+/**
+ * `smoo secrets run <group> <command...>` — the half of THE RULE that shell
+ * entry is not.
+ *
+ * The rule lives in tooling/direnv/secret-references.ts: shell entry resolves
+ * the `shell` group and nothing else, because a provider authorises per
+ * requesting process lineage and every direnv reload is a new one. Every
+ * other group belongs to the command that needs it, and this is that command.
+ * One deliberate `smoo secrets run registry bun install` instead of a
+ * credential prompt on every shell.
+ *
+ * Exactly one group is resolved. A repository that declares a registry
+ * credential and a cache token runs one provider command here, not two: a
+ * wrapper that resolved everything declared would fire provider commands for
+ * credentials the command never touches, which is the prompt this exists to
+ * remove.
+ *
+ * The value reaches the child the only way that leaves no trace: its
+ * environment. Never a file, never argv — argv is world-readable through
+ * `ps` — and never this process's stdout.
+ */
+import { spawn } from 'node:child_process';
+import { constants } from 'node:os';
+import { readSecretGroups, resolveSecretGroup } from './resolver.js';
+/**
+ * Nothing ran, and the listing is the answer: no group named, a group this
+ * repository does not declare, or a group with no command to run. Distinct
+ * from 1, which is a resolution that refused, and from any other code, which
+ * is the child's own.
+ */
+const REFUSED = 2;
+/** A command that could not be started at all, as a shell reports it. */
+const NOT_EXECUTABLE = 127;
+export async function secretsRun(root, group, command) {
+    let declared;
+    try {
+        declared = await readSecretGroups(root);
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    if (group === undefined) {
+        console.error('smoo secrets run <group> <command...> runs one command with one group of secrets in its environment.');
+        printGroups(declared);
+        return REFUSED;
+    }
+    const members = declared.filter((secret) => secret.group === group);
+    if (members.length === 0) {
+        console.error(`smoo secrets run: no declared secret is in group \`${group}\`.`);
+        printGroups(declared);
+        return REFUSED;
+    }
+    const [program, ...args] = command;
+    if (program === undefined) {
+        console.error(`smoo secrets run ${group} <command...>: name the command to run with ` +
+            `${members.map((secret) => secret.name).join(', ')} in its environment.`);
+        return REFUSED;
+    }
+    let values;
+    try {
+        ({ values } = await resolveSecretGroup(root, group));
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        return 1;
+    }
+    return await runWithSecrets(program, args, values);
+}
+/**
+ * The child's exit status, reproduced: a code as itself, death by signal as
+ * 128+signum, and a program that could not be started as 127. It shares this
+ * process group, so terminal signals reach it directly; it is spawned rather
+ * than exec'd only because neither Bun nor Node exposes `execve`.
+ */
+async function runWithSecrets(program, args, values) {
+    return await new Promise((resolve) => {
+        const child = spawn(program, [...args], { stdio: 'inherit', env: { ...process.env, ...values } });
+        child.on('error', (error) => {
+            console.error(`smoo secrets run: cannot run \`${program}\`: ${error.message}`);
+            resolve(NOT_EXECUTABLE);
+        });
+        child.on('close', (code, signal) => {
+            if (signal !== null) {
+                resolve(128 + constants.signals[signal]);
+                return;
+            }
+            resolve(code ?? 1);
+        });
+    });
+}
+/**
+ * The groups this repository declares and the secrets in each. Most people
+ * meet this command exactly once, at a 401, after reading a message that
+ * named it — so the refusal answers "which group?" from this checkout's own
+ * declarations rather than printing a usage line that sends them to the
+ * manifest to work it out.
+ */
+function printGroups(declared) {
+    if (declared.length === 0) {
+        console.error('This repository declares no smoo.secrets, so there is no group to run.');
+        return;
+    }
+    const members = new Map();
+    for (const secret of declared) {
+        const named = members.get(secret.group);
+        if (named === undefined) {
+            members.set(secret.group, [secret.name]);
+            continue;
+        }
+        named.push(secret.name);
+    }
+    const groups = [...members.keys()].sort((left, right) => left.localeCompare(right));
+    const width = Math.max(...groups.map((group) => group.length));
+    console.error('');
+    console.error('Groups this repository declares:');
+    for (const group of groups) {
+        console.error(`  ${group.padEnd(width)}  ${(members.get(group) ?? []).join(', ')}`);
+    }
+    // An override is stated, never left for the next reader to discover by
+    // wondering why a `.npmrc` credential resolves at shell entry.
+    for (const secret of declared) {
+        if (secret.group === secret.derivedGroup)
+            continue;
+        console.error(`  note: ${secret.name} declares group \`${secret.group}\`, overriding the \`${secret.derivedGroup}\` ` +
+            "this repository's declarations derive.");
+    }
+    console.error('');
+    console.error(`  smoo secrets run ${groups[0] ?? '<group>'} <command...>`);
+}