@smoothbricks/cli 0.11.18 → 0.11.20

package/dist/secrets/status.d.ts

@@ -0,0 +1,177 @@
+/**
+ * The value model behind `smoo secrets`: one row per secret name, reconciled
+ * from every source that has an opinion about it, plus the machine-readable
+ * document `smoo secrets status --json` emits.
+ *
+ * Everything here is pure and depends on nothing but typia, which is what lets
+ * `@smoothbricks/cli/secrets` be imported for the types alone — a consumer
+ * driving a UI or a repository's own operations CLI gets the document type and
+ * a validator without pulling in `gh`, the filesystem readers, or commander.
+ * The readers that produce these facts live in ./index.ts; the operator
+ * commands that print them live in ./commands.ts.
+ */
+import typia from 'typia';
+import type { SecretStageMap, SecretStageScope } from '../wrangler/stage-secrets.js';
+export type { SecretStageScope };
+/** Where an env name is described, which repository secret carries it, and whether that exists. */
+export interface SecretRow {
+    name: string;
+    /** The repository secret this env name reads from, by convention or declaration. */
+    repositorySecret: string;
+    /** Wrangler projects whose `.dev.vars.example` declares it. */
+    declaredByWorkers: string[];
+    /** True when a managed workflow renders `secrets.<name>` into a job. */
+    suppliedByWorkflow: boolean;
+    /** True when `smoo.secrets` can fetch it for a developer shell; equivalently, `localGroup` is set. */
+    fetchableLocally: boolean;
+    /**
+     * How `smoo.secrets` resolves it locally: the group that resolves it, and
+     * the group this repository's own declarations derive. They differ exactly
+     * when the entry overrides the derivation, which is the one thing a reader
+     * must never have to infer. Absent when nothing fetches the name locally.
+     */
+    localGroup?: {
+        resolves: string;
+        derived: string;
+    };
+    /** True when the repository holds a secret of this name. */
+    onRepository: boolean;
+    /**
+     * GitHub Environments holding their own value for this name. A job bound to
+     * an environment reads that value in preference to the repository's, which
+     * is how one name carries test credentials on a preview stage and live ones
+     * in production.
+     */
+    heldByEnvironment: string[];
+}
+/**
+ * One `smoo.secrets` entry as the reconciliation needs it: the name, the
+ * group that resolves it, and the group this repository's declarations
+ * derive. ../secrets/resolver.ts produces these from the same file shell
+ * entry routes with.
+ */
+export interface LocalSecret {
+    name: string;
+    group: string;
+    derivedGroup: string;
+}
+export interface SecretSources {
+    /** Worker label -> env names it declares. */
+    workerSecrets: Record<string, readonly string[]>;
+    /** Env names a managed workflow passes into a job. */
+    workflowSecrets: readonly string[];
+    /** Env name -> repository secret, by convention with declared exceptions. */
+    secretNames: Readonly<Record<string, string>>;
+    /** Every `smoo.secrets` entry with the group that resolves it. */
+    localSecrets: readonly LocalSecret[];
+    /** Repository secret names GitHub currently holds. */
+    repositorySecrets: readonly string[];
+    /** Environment name -> secret names that environment holds. */
+    environmentSecrets?: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export declare function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments?: readonly string[]): SecretRow[];
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export declare function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[];
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
+/** The repository the status was read from, and how that repository was chosen. */
+export interface SecretsStatusRepository {
+    /** `owner/name`, the form `gh --repo` takes. */
+    repo: string;
+    /** Why this repository — the checkout fact that decided it, verbatim from the resolver. */
+    source: string;
+    /** How many secrets it holds at repository scope. */
+    secretCount: number;
+}
+/**
+ * One GitHub Environment the status looked at. Discriminated on `readable`
+ * because an environment `gh` refused to list is not an empty one: reporting
+ * it as empty would call values missing that may well be set, and the reason
+ * is the only thing that lets an operator tell the two apart.
+ */
+export type SecretsStatusEnvironment = {
+    name: string;
+    /** True when a managed workflow binds a job to it, so a job reads it before the repository. */
+    bound: boolean;
+    readable: true;
+    secretCount: number;
+} | {
+    name: string;
+    bound: boolean;
+    readable: false;
+    /** What `gh` said, so nothing below claims what this environment holds. */
+    reason: string;
+};
+/** A reconciled row, plus which deployment stages require the name to have a value. */
+export interface SecretsStatusRow extends SecretRow {
+    /**
+     * Stages that refuse to deploy without a value, from `smoo.wrangler.secretStages`
+     * unioned over every wrangler project declaring the name: absent from the map
+     * means every stage, mapped to `[]` means none. A name no wrangler project
+     * declares is `[]` too — `declaredByWorkers` tells those two apart.
+     */
+    requiredByStages: SecretStageScope[];
+}
+/** A name a workflow passes that no scope the job reads can supply: this is what fails a deploy. */
+export interface UnsatisfiedSecret {
+    name: string;
+    repositorySecret: string;
+    /**
+     * Bound environments holding no value for it. Empty means no environment is
+     * bound and the repository itself is the scope to set it in.
+     */
+    missingIn: string[];
+}
+/**
+ * Everything `smoo secrets status` learned, in one document.
+ *
+ * `unsatisfied` is the exit code's reason and not a convenience: the rule that
+ * decides whether a value exists in a scope a bound job reads is smoo's, and a
+ * consumer re-deriving it from `secrets` would be maintaining a second copy of
+ * it.
+ */
+export interface SecretsStatusDocument {
+    /** Document shape, so a consumer refuses a document it does not understand instead of misreading it. */
+    version: 1;
+    repository: SecretsStatusRepository;
+    /** Every environment looked at: those the workflows bind, then any asked for with `--env`. */
+    environments: SecretsStatusEnvironment[];
+    /** One row per name any source knows, sorted by name. */
+    secrets: SecretsStatusRow[];
+    /** Empty exactly when the command exits 0. */
+    unsatisfied: UnsatisfiedSecret[];
+}
+/** The facts a document is projected from, all gathered before anything is printed. */
+export interface SecretsStatusFacts {
+    repository: SecretsStatusRepository;
+    environments: readonly SecretsStatusEnvironment[];
+    rows: readonly SecretRow[];
+    /** Worker label -> its `smoo.wrangler.secretStages` declaration; a worker with no block is absent. */
+    stageScopes: Readonly<Record<string, SecretStageMap>>;
+}
+/** The document, from facts. Pure: every read happened before this was called. */
+export declare function projectSecretsStatus(facts: SecretsStatusFacts): SecretsStatusDocument;
+/**
+ * The consumer's boundary: text off a `smoo secrets status --json` run into a
+ * validated document, or typia's own account of every field that disagreed.
+ */
+export declare const parseSecretsStatusDocument: (input: string) => typia.IValidation<SecretsStatusDocument>;
+/**
+ * The emitter's boundary: the projection is checked against its declared type
+ * before it becomes text. A shape bug then fails here, naming the field, rather
+ * than reaching a consumer as a document its validator rejects with no idea who
+ * produced it.
+ */
+export declare const stringifySecretsStatusDocument: (input: unknown, errorFactory?: undefined | ((props: typia.TypeGuardError.IProps) => Error)) => string;
+//# sourceMappingURL=status.d.ts.map

package/dist/secrets/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/secrets/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErF,YAAY,EAAE,gBAAgB,EAAE,CAAC;AAEjC,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sGAAsG;IACtG,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kEAAkE;IAClE,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;IACrC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAyCpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,iBAAiB,GAAE,SAAS,MAAM,EAAO,GAAG,SAAS,EAAE,CAUrH;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGlG;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AASD,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACtC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC;IACE,IAAI,EAAE,MAAM,CAAC;IACb,+FAA+F;IAC/F,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,IAAI,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,KAAK,CAAC;IAChB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEN,uFAAuF;AACvF,MAAM,WAAW,gBAAiB,SAAQ,SAAS;IACjD;;;;;OAKG;IACH,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;CACtC;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,wGAAwG;IACxG,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,uBAAuB,CAAC;IACpC,8FAA8F;IAC9F,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,yDAAyD;IACzD,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,8CAA8C;IAC9C,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,uBAAuB,CAAC;IACpC,YAAY,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAClD,IAAI,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3B,sGAAsG;IACtG,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CACvD;AAsBD,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,GAAG,qBAAqB,CAqBrF;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,6DAA0D,CAAC;AAElG;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,wGAA4D,CAAC"}