@smoothbricks/cli 0.11.19 → 0.11.20

package/dist/secrets/commands.js

@@ -1,5 +1,5 @@
 /**
- * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ * `smoo secrets` — the operator side of the reconciliation in ./status.ts.
  *
  * Values are handed to `gh` over stdin, never through argv (a process list is
  * world-readable) and never printed. Reading one from the terminal disables
@@ -16,8 +16,9 @@
  */
 import { spawn, spawnSync } from 'node:child_process';
 import { getWorkspacePackages } from '../lib/workspace.js';
-import { environmentsMissing, fetchLocalSecret, localSecretCommandNames, reconcileSecrets, secretNameMapping, unsatisfiedSecrets, unwiredSecrets, workerSecretNames, workflowEnvironments, workflowSecretNames, } from './index.js';
+import { fetchLocalSecret, localSecretGroups, secretNameMapping, workerSecretNames, workerSecretStages, workflowEnvironments, workflowSecretNames, } from './index.js';
 import { resolveRepository } from './repository.js';
+import { projectSecretsStatus, reconcileSecrets, stringifySecretsStatusDocument, unwiredSecrets, } from './status.js';
 /**
  * Every secret this checkout declares that the repository does not hold, in
  * the order an operator should fix them: the ones a workflow already promises
@@ -108,19 +109,21 @@ export async function writeRepositorySecret(name, value, repo, environment) {
         ? { ok: true }
         : { ok: false, reason: `gh ${args.join(' ')} exited ${status ?? 'without status'}` };
 }
-function collectSources(root, repositorySecrets, environmentSecrets = {}) {
-    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+function collectSources(root, workspaceDirs, localSecrets, repositorySecrets, environmentSecrets = {}) {
     const workerSecrets = workerSecretNames(root, workspaceDirs);
     const workflowSecrets = workflowSecretNames(root);
-    const localCommands = localSecretCommandNames(root);
     const envNames = [
-        ...new Set([...Object.values(workerSecrets).flatMap((names) => [...names]), ...workflowSecrets, ...localCommands]),
+        ...new Set([
+            ...Object.values(workerSecrets).flatMap((names) => [...names]),
+            ...workflowSecrets,
+            ...localSecrets.map((secret) => secret.name),
+        ]),
     ];
     return {
         workerSecrets,
         workflowSecrets,
         secretNames: secretNameMapping(root, envNames),
-        localCommands,
+        localSecrets,
         repositorySecrets,
         environmentSecrets,
     };
@@ -141,47 +144,89 @@ function describe(row, scopeWidth) {
     ].join('  ');
 }
 /**
- * Print every known secret and the scopes holding it. Exit code 1 when a
- * workflow promises a value no scope a bound job reads can supply — that
- * combination is the one that fails a deploy, and it fails talking about the
- * value rather than the missing secret.
+ * Everything `status` reports, read from git, `gh` and the checkout before a
+ * single line is printed. Gathering ahead of rendering is what lets one run
+ * answer either a human or a machine from exactly the same facts: `--json`
+ * cannot drift from the table because there is nothing for it to drift from.
  */
-export function secretsStatus(root, options) {
+async function gatherSecretsStatus(root, options) {
     const resolved = resolveRepository(root, options.repo);
-    if (!resolved.ok) {
-        console.error(resolved.reason);
-        return 1;
-    }
+    if (!resolved.ok)
+        return resolved;
     const { repo, source } = resolved.choice;
     const repositorySecrets = readRepositorySecrets(repo);
-    if (!repositorySecrets.ok) {
-        console.error(repositorySecrets.reason);
-        return 1;
-    }
+    if (!repositorySecrets.ok)
+        return repositorySecrets;
     // The workflows decide which environments a job reads; an explicitly asked
     // for one is shown too, so an operator can inspect a scope before a workflow
     // binds it.
     const boundEnvironments = workflowEnvironments(root);
     const asked = options.env !== undefined && !boundEnvironments.includes(options.env) ? [options.env] : [];
     const environmentSecrets = {};
-    const unreadable = [];
-    for (const environment of [...boundEnvironments, ...asked]) {
-        const held = readRepositorySecrets(repo, environment);
-        if (held.ok)
-            environmentSecrets[environment] = held.names;
-        else
-            unreadable.push({ environment, reason: held.reason });
+    const environments = [];
+    for (const name of [...boundEnvironments, ...asked]) {
+        const bound = boundEnvironments.includes(name);
+        const held = readRepositorySecrets(repo, name);
+        // An environment that cannot be read is reported, never assumed empty:
+        // guessing produces a refusal about a value that may well be set.
+        if (!held.ok) {
+            environments.push({ name, bound, readable: false, reason: held.reason });
+            continue;
+        }
+        environmentSecrets[name] = held.names;
+        environments.push({ name, bound, readable: true, secretCount: held.names.length });
+    }
+    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+    const stageScopes = workerSecretStages(root, workspaceDirs);
+    if (!stageScopes.ok)
+        return stageScopes;
+    // A `smoo.secrets` declaration smoo cannot read is a refusal, not an empty
+    // list: reporting "nothing is fetchable locally" for a manifest that says
+    // otherwise is the confident wrong answer.
+    const localSecrets = await localSecretGroups(root);
+    if (!localSecrets.ok)
+        return localSecrets;
+    return {
+        ok: true,
+        document: projectSecretsStatus({
+            repository: { repo, source, secretCount: repositorySecrets.names.length },
+            environments,
+            rows: reconcileSecrets(collectSources(root, workspaceDirs, localSecrets.secrets, repositorySecrets.names, environmentSecrets)),
+            stageScopes: stageScopes.byWorker,
+        }),
+    };
+}
+/**
+ * Print every known secret and the scopes holding it, or - with `json` - the
+ * same facts as one document on stdout and nothing else. Exit code 1 when a
+ * workflow promises a value no scope a bound job reads can supply — that
+ * combination is the one that fails a deploy, and it fails talking about the
+ * value rather than the missing secret. `--json` reports that refusal in
+ * `unsatisfied` and still exits 1: a machine-readable status that always
+ * succeeded would be a status nobody could gate on.
+ */
+export async function secretsStatus(root, options) {
+    const gathered = await gatherSecretsStatus(root, options);
+    if (!gathered.ok) {
+        console.error(gathered.reason);
+        return 1;
+    }
+    const { document } = gathered;
+    const { repo, source } = document.repository;
+    if (options.json) {
+        console.log(stringifySecretsStatusDocument(document));
+        return document.unsatisfied.length > 0 ? 1 : 0;
     }
-    // An environment that cannot be read is reported, never assumed empty:
-    // guessing produces a refusal about a value that may well be set.
-    const readable = boundEnvironments.filter((environment) => environment in environmentSecrets);
-    const rows = reconcileSecrets(collectSources(root, repositorySecrets.names, environmentSecrets));
-    console.log(`repository ${repo} (${source}), holding ${repositorySecrets.names.length} secrets`);
-    for (const [environment, names] of Object.entries(environmentSecrets)) {
-        console.log(`environment ${environment}, holding ${names.length} secrets`);
+    const rows = document.secrets;
+    console.log(`repository ${repo} (${source}), holding ${document.repository.secretCount} secrets`);
+    for (const environment of document.environments) {
+        if (environment.readable)
+            console.log(`environment ${environment.name}, holding ${environment.secretCount} secrets`);
     }
-    for (const { environment, reason } of unreadable) {
-        console.log(`environment ${environment} could not be read, so nothing below claims what it holds: ${reason}`);
+    for (const environment of document.environments) {
+        if (environment.readable)
+            continue;
+        console.log(`environment ${environment.name} could not be read, so nothing below claims what it holds: ${environment.reason}`);
     }
     const scopeWidth = Math.max('held by'.length, ...rows.map((row) => heldBy(row).length));
     console.log(`${'held by'.padEnd(scopeWidth)}  ${'name'.padEnd(32)}  workflow  local  declared by`);
@@ -195,6 +240,22 @@ export function secretsStatus(root, options) {
                 'declare it in smoo.github.deploySecrets to have CI supply it.');
         }
     }
+    // A declared `group` that disagrees with what this repository's own
+    // declarations derive is the override working — and a silent override is
+    // how the next reader loses an hour wondering why a `.npmrc` credential
+    // resolves at shell entry. It is stated here, where a human is already
+    // looking at every declared secret.
+    const overridden = rows.filter((row) => row.localGroup !== undefined && row.localGroup.resolves !== row.localGroup.derived);
+    if (overridden.length > 0) {
+        console.log('');
+        for (const row of overridden) {
+            const local = row.localGroup;
+            if (local === undefined)
+                continue;
+            console.log(`note: ${row.name} declares group \`${local.resolves}\`, overriding the \`${local.derived}\` this ` +
+                `repository's declarations derive; \`smoo secrets run ${local.resolves} <command>\` is what resolves it.`);
+        }
+    }
     // A value an environment holds is not a value to duplicate at repository
     // scope: offering it invites two sources of truth for one credential, and
     // the table above already shows where it lives. Only a name no scope holds
@@ -209,23 +270,21 @@ export function secretsStatus(root, options) {
         console.log(`set them all, one prompt each:  smoo secrets set -R ${repo}`);
         console.log(`set one:                        smoo secrets set ${needed[0]?.repositorySecret ?? 'NAME'} -R ${repo}`);
     }
-    const unsatisfied = unsatisfiedSecrets(rows, readable);
-    if (unsatisfied.length === 0)
+    if (document.unsatisfied.length === 0)
         return 0;
     console.log('');
-    for (const row of unsatisfied) {
-        const missing = environmentsMissing(row, readable);
-        const scopes = missing.length > 0 ? missing.join(', ') : 'the repository';
-        console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and no value exists in ${scopes}.`);
-        if (missing.length === 0) {
-            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo}`);
+    for (const { name, repositorySecret, missingIn } of document.unsatisfied) {
+        const scopes = missingIn.length > 0 ? missingIn.join(', ') : 'the repository';
+        console.error(`missing: ${name} — a workflow passes secrets.${name} and no value exists in ${scopes}.`);
+        if (missingIn.length === 0) {
+            console.error(`  smoo secrets set ${repositorySecret} -R ${repo}`);
             continue;
         }
-        for (const environment of missing) {
+        for (const environment of missingIn) {
             const named = environment.includes(' ') ? `'${environment}'` : environment;
-            console.error(`  smoo secrets set ${row.repositorySecret} -R ${repo} --env ${named}`);
+            console.error(`  smoo secrets set ${repositorySecret} -R ${repo} --env ${named}`);
         }
-        console.error(`  or one value for every environment:  smoo secrets set ${row.repositorySecret} -R ${repo}`);
+        console.error(`  or one value for every environment:  smoo secrets set ${repositorySecret} -R ${repo}`);
     }
     return 1;
 }
@@ -290,7 +349,13 @@ export async function secretsSet(root, name, options) {
         }
         environmentSecrets[environment] = inEnvironment.names;
     }
-    const rows = reconcileSecrets(collectSources(root, held.names, environmentSecrets));
+    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+    const local = await localSecretGroups(root);
+    if (!local.ok) {
+        console.error(local.reason);
+        return 1;
+    }
+    const rows = reconcileSecrets(collectSources(root, workspaceDirs, local.secrets, held.names, environmentSecrets));
     const needed = environment === undefined ? secretsNeedingValues(rows) : secretsMissingInEnvironment(rows, environment);
     const target = environment === undefined ? `${repo} (${source})` : `environment ${environment} on ${repo} (${source})`;
     if (needed.length === 0) {
@@ -349,7 +414,15 @@ export async function secretsSync(root, options) {
     }
     const { repo } = resolved.choice;
     const environment = options.env;
-    const names = localSecretCommandNames(root);
+    const local = await localSecretGroups(root);
+    if (!local.ok) {
+        console.error(local.reason);
+        return 1;
+    }
+    // Every group: a repository secret store holds the credential whatever
+    // resolves it locally, and a `smoo secrets run` group is about which
+    // command pays the provider prompt, not about which values CI needs.
+    const names = local.secrets.map((secret) => secret.name);
     if (names.length === 0) {
         console.error('smoo.secrets declares no fetch commands; nothing to sync.');
         return 1;

package/dist/secrets/index.d.ts

@@ -1,9 +1,11 @@
 /**
- * Reconciles the three places a repository's secrets are described, all of
- * which smoo already owns:
+ * Reads the three places a repository's secrets are described, all of which
+ * smoo already owns:
  *
  * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
- *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from —
+ *    and `smoo.wrangler.secretStages` beside it says which stages each name
+ *    belongs to.
  * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
  *    and `e2eSecrets` map an env name to a repository secret, and the managed
  *    workflows render exactly those into the job environment.
@@ -17,58 +19,12 @@
  * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
  * the repository holds no such secret, and the empty value surfaces as the
  * payment library's own `publishable_key_mismatch` refusal.
+ *
+ * The join itself is ./status.ts: pure, and the owner of the document type
+ * these readings are projected into.
  */
-/** Where an env name is described, which repository secret carries it, and whether that exists. */
-export interface SecretRow {
-    name: string;
-    /** The repository secret this env name reads from, by convention or declaration. */
-    repositorySecret: string;
-    /** Wrangler projects whose `.dev.vars.example` declares it. */
-    declaredByWorkers: string[];
-    /** True when a managed workflow renders `secrets.<name>` into a job. */
-    suppliedByWorkflow: boolean;
-    /** True when `smoo.secrets` can fetch it for a developer shell. */
-    fetchableLocally: boolean;
-    /** True when the repository holds a secret of this name. */
-    onRepository: boolean;
-    /**
-     * GitHub Environments holding their own value for this name. A job bound to
-     * an environment reads that value in preference to the repository's, which
-     * is how one name carries test credentials on a preview stage and live ones
-     * in production.
-     */
-    heldByEnvironment: string[];
-}
-export interface SecretSources {
-    /** Worker label -> env names it declares. */
-    workerSecrets: Record<string, readonly string[]>;
-    /** Env names a managed workflow passes into a job. */
-    workflowSecrets: readonly string[];
-    /** Env name -> repository secret, by convention with declared exceptions. */
-    secretNames: Readonly<Record<string, string>>;
-    /** Env names `smoo.secrets` can fetch locally. */
-    localCommands: readonly string[];
-    /** Repository secret names GitHub currently holds. */
-    repositorySecrets: readonly string[];
-    /** Environment name -> secret names that environment holds. */
-    environmentSecrets?: Readonly<Record<string, readonly string[]>>;
-}
-/**
- * One row per name known to any source, sorted, so a reader sees the whole
- * picture rather than one source's view of it.
- */
-export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
-/**
- * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
- * promises to pass it, and the repository has no value to pass. Reported
- * separately from "declared but not wired into any workflow", because the
- * remedies differ — set a secret, versus declare it in `smoo.github`.
- */
-export declare function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments?: readonly string[]): SecretRow[];
-/** Bound environments that lack their own value and cannot fall back to the repository. */
-export declare function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[];
-/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
-export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
+import { type SecretStageMap } from '../wrangler/stage-secrets.js';
+import { type GroupedSecret } from './resolver.js';
 /** Env names the managed workflows pass into a job, from the declarations that render them. */
 export declare function workflowSecretNames(root: string): string[];
 /**
@@ -87,8 +43,38 @@ export declare function workflowEnvironments(root: string): string[];
 export declare function secretNameMapping(root: string, envNames: readonly string[]): Record<string, string>;
 /** Every wrangler project's declared secret names, keyed by the project directory. */
 export declare function workerSecretNames(root: string, workspaceDirs: readonly string[]): Record<string, string[]>;
-/** Names `smoo.secrets` declares a fetch command for. */
-export declare function localSecretCommandNames(root: string): string[];
+/**
+ * Every wrangler project's `smoo.wrangler.secretStages`, keyed by the project
+ * directory — the same keys `workerSecretNames` uses, so a name's scopes and
+ * its declarations are joined on one label.
+ *
+ * A malformed block is a refusal rather than a throw: it is the same class of
+ * problem as a repository `gh` will not talk to, and `smoo secrets status`
+ * reports those instead of dying with a stack. Silently reading it as "no
+ * scopes" is the one thing this must not do — that is the direction where
+ * every secret quietly reaches every stage.
+ */
+export declare function workerSecretStages(root: string, workspaceDirs: readonly string[]): {
+    ok: true;
+    byWorker: Record<string, SecretStageMap>;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Every `smoo.secrets` entry with the group that resolves it, sorted by name,
+ * or a refusal naming the declaration that could not be read. The groups come
+ * from ./resolver.ts — the same file shell entry routes with — so a status
+ * table and a `smoo secrets run` cannot disagree about which group resolves
+ * a name.
+ */
+export declare function localSecretGroups(root: string): Promise<{
+    ok: true;
+    secrets: GroupedSecret[];
+} | {
+    ok: false;
+    reason: string;
+}>;
 /**
  * Resolve one declared secret through its command. The value is returned, never
  * logged: callers hand it to `gh secret set` over stdin.

package/dist/secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAClE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CAoCpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,iBAAiB,GAAE,SAAS,MAAM,EAAO,GAAG,SAAS,EAAE,CAUrH;AAED,2FAA2F;AAC3F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAGlG;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D;AAoDD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG9D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAQH,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,KAAK,aAAa,EAAoB,MAAM,eAAe,CAAC;AAErE,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAW3D;AAoDD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAYxF;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAOjF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}

package/dist/secrets/index.js

@@ -1,9 +1,11 @@
 /**
- * Reconciles the three places a repository's secrets are described, all of
- * which smoo already owns:
+ * Reads the three places a repository's secrets are described, all of which
+ * smoo already owns:
  *
  * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
- *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from —
+ *    and `smoo.wrangler.secretStages` beside it says which stages each name
+ *    belongs to.
  * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
  *    and `e2eSecrets` map an env name to a repository secret, and the managed
  *    workflows render exactly those into the job environment.
@@ -17,6 +19,9 @@
  * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
  * the repository holds no such secret, and the empty value surfaces as the
  * payment library's own `publishable_key_mismatch` refusal.
+ *
+ * The join itself is ./status.ts: pure, and the owner of the document type
+ * these readings are projected into.
  */
 import { spawnSync } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
@@ -24,78 +29,8 @@ import { join } from 'node:path';
 import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
 import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
 import { parseDevVarsExample } from '../wrangler/prepare-env.js';
-/**
- * One row per name known to any source, sorted, so a reader sees the whole
- * picture rather than one source's view of it.
- */
-export function reconcileSecrets(sources) {
-    const declaredByAnyWorker = Object.values(sources.workerSecrets).flatMap((names) => [...names]);
-    const names = new Set([...declaredByAnyWorker, ...sources.workflowSecrets, ...sources.localCommands]);
-    // A repository secret that already carries a known env name is that name's
-    // row, not a row of its own: listing ACME_GITHUB_CLIENT_SECRET beside
-    // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
-    // permanently "declared by nothing".
-    const carriesKnownEnvName = new Set(names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : []);
-    // A value only an environment holds is still a value: leaving it out of the
-    // rows is how an operator ends up hunting for a secret that is already set.
-    const addUndeclared = (secret) => {
-        if (!carriesKnownEnvName.has(secret))
-            names.add(secret);
-    };
-    for (const secret of sources.repositorySecrets)
-        addUndeclared(secret);
-    for (const held of Object.values(sources.environmentSecrets ?? {})) {
-        for (const secret of held)
-            addUndeclared(secret);
-    }
-    return [...names]
-        .sort((left, right) => left.localeCompare(right))
-        .map((name) => ({
-        name,
-        repositorySecret: sources.secretNames[name] ?? name,
-        declaredByWorkers: Object.entries(sources.workerSecrets)
-            .filter(([, declared]) => declared.includes(name))
-            .map(([label]) => label)
-            .sort((left, right) => left.localeCompare(right)),
-        suppliedByWorkflow: sources.workflowSecrets.includes(name),
-        fetchableLocally: sources.localCommands.includes(name),
-        onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
-        heldByEnvironment: Object.entries(sources.environmentSecrets ?? {})
-            .filter(([, held]) => held.includes(sources.secretNames[name] ?? name))
-            .map(([environment]) => environment)
-            .sort((left, right) => left.localeCompare(right)),
-    }));
-}
-/**
- * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
- * promises to pass it, and the repository has no value to pass. Reported
- * separately from "declared but not wired into any workflow", because the
- * remedies differ — set a secret, versus declare it in `smoo.github`.
- */
-export function unsatisfiedSecrets(rows, boundEnvironments = []) {
-    return rows.filter((row) => {
-        if (!row.suppliedByWorkflow)
-            return false;
-        if (row.onRepository)
-            return false;
-        // With no environment bound, the repository is the only scope a job reads.
-        // With environments bound, each one can carry the value instead - so the
-        // name is satisfied only when every bound environment holds it.
-        if (boundEnvironments.length === 0)
-            return true;
-        return !boundEnvironments.every((environment) => row.heldByEnvironment.includes(environment));
-    });
-}
-/** Bound environments that lack their own value and cannot fall back to the repository. */
-export function environmentsMissing(row, boundEnvironments) {
-    if (row.onRepository)
-        return [];
-    return boundEnvironments.filter((environment) => !row.heldByEnvironment.includes(environment));
-}
-/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
-export function unwiredSecrets(rows) {
-    return rows.filter((row) => row.declaredByWorkers.length > 0 && !row.suppliedByWorkflow);
-}
+import { readSecretStageMap } from '../wrangler/stage-secrets.js';
+import { readSecretGroups } from './resolver.js';
 /** Env names the managed workflows pass into a job, from the declarations that render them. */
 export function workflowSecretNames(root) {
     const manifest = readPackageJsonObject(join(root, 'package.json'));
@@ -222,10 +157,48 @@ export function workerSecretNames(root, workspaceDirs) {
     }
     return byWorker;
 }
-/** Names `smoo.secrets` declares a fetch command for. */
-export function localSecretCommandNames(root) {
-    const manifest = readPackageJsonObject(join(root, 'package.json'));
-    return Object.keys(manifest?.smoo?.secrets ?? {}).sort((left, right) => left.localeCompare(right));
+/**
+ * Every wrangler project's `smoo.wrangler.secretStages`, keyed by the project
+ * directory — the same keys `workerSecretNames` uses, so a name's scopes and
+ * its declarations are joined on one label.
+ *
+ * A malformed block is a refusal rather than a throw: it is the same class of
+ * problem as a repository `gh` will not talk to, and `smoo secrets status`
+ * reports those instead of dying with a stack. Silently reading it as "no
+ * scopes" is the one thing this must not do — that is the direction where
+ * every secret quietly reaches every stage.
+ */
+export function workerSecretStages(root, workspaceDirs) {
+    const byWorker = {};
+    for (const dir of workspaceDirs) {
+        if (!existsSync(join(root, dir, '.dev.vars.example')))
+            continue;
+        try {
+            const scopes = readSecretStageMap(join(root, dir));
+            if (Object.keys(scopes).length > 0)
+                byWorker[dir] = scopes;
+        }
+        catch (error) {
+            return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+        }
+    }
+    return { ok: true, byWorker };
+}
+/**
+ * Every `smoo.secrets` entry with the group that resolves it, sorted by name,
+ * or a refusal naming the declaration that could not be read. The groups come
+ * from ./resolver.ts — the same file shell entry routes with — so a status
+ * table and a `smoo secrets run` cannot disagree about which group resolves
+ * a name.
+ */
+export async function localSecretGroups(root) {
+    try {
+        const secrets = await readSecretGroups(root);
+        return { ok: true, secrets: secrets.sort((left, right) => left.name.localeCompare(right.name)) };
+    }
+    catch (error) {
+        return { ok: false, reason: error instanceof Error ? error.message : String(error) };
+    }
 }
 /**
  * Resolve one declared secret through its command. The value is returned, never

package/dist/secrets/resolver.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The bootstrap secret resolver, as the CLI sees it.
+ *
+ * `managed/raw/tooling/direnv/secret-references.ts` holds the one
+ * implementation of THE RULE — which group resolves where, and what CI and a
+ * cowshed workspace refuse instead. A managed repository runs the copy smoo
+ * writes into its own `tooling/direnv/secret-references.ts` at shell entry;
+ * `smoo secrets run` runs THIS package's copy of the same file. One
+ * implementation, so the command and the shell cannot disagree about a group.
+ *
+ * It is loaded, not statically imported, and that is forced rather than
+ * chosen: the file is a raw bootstrap script that must load before any
+ * workspace package and before the Typia transform exists, so it lives
+ * outside `src` — outside this package's compiled `rootDir`, which a static
+ * import may not cross. A dynamic `import()` reaches it in both layouts
+ * (`src/secrets/` and `dist/secrets/` are each two directories below the
+ * package root), and typia validates what comes back: the same boundary
+ * ../monorepo/packed-package.ts puts around a foreign module. `require` is
+ * not the alternative — under a Bun loader plugin, which this package's own
+ * tests preload, every module is async and `require` of one throws.
+ */
+/** A declared `smoo.secrets` entry with its group settled. */
+export interface GroupedSecret {
+    name: string;
+    /** The group that resolves it: the declared one when stated, `derivedGroup` otherwise. */
+    group: string;
+    /**
+     * What the repository's own declarations imply: `registry` for a variable
+     * `.npmrc` interpolates, `nx-cache` for the declared cache token, `shell`
+     * for everything else. Differs from `group` exactly when an entry overrides
+     * the derivation.
+     */
+    derivedGroup: string;
+}
+/** A declared secret a request declined to resolve, and how to supply it. */
+export interface DeferredSecret {
+    name: string;
+    group: string;
+    guidance: string;
+}
+/** What belongs in a child's environment, and what was deliberately left out of it. */
+export interface SecretResolution {
+    values: Record<string, string>;
+    deferred: DeferredSecret[];
+}
+/**
+ * Every `smoo.secrets` entry of the repository at `root`, each with the group
+ * that resolves it. Rejects with the offending declaration named — never a
+ * value — when the manifest or `.npmrc` cannot be read.
+ */
+export declare function readSecretGroups(root: string): Promise<GroupedSecret[]>;
+/**
+ * Resolve exactly one group's secrets for one child process. Everything
+ * outside the group comes back deferred rather than resolved, so a run for
+ * one group never triggers another group's provider command. Rejects with the
+ * resolver's aggregated refusal, which names variables and groups only.
+ */
+export declare function resolveSecretGroup(root: string, group: string): Promise<SecretResolution>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/secrets/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/secrets/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,uFAAuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAoDD;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAO7E;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAO/F"}