@sponson/adapters 0.0.0-stage → 0.4.0

package/dist/neon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"neon.js","sourceRoot":"","sources":["../src/neon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,EAA+F,MAAM,eAAe,CAAC;AACpK,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,sBAAsB,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzK,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAA6B,MAAM,WAAW,CAAC;AAE1G,mGAAmG;AACnG,MAAM,KAAK,GAAG,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAW,CAAC;AAErF,qFAAqF;AACrF,MAAM,CAAC,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAgBvE,SAAS,MAAM,CAAC,IAAoB;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACxI,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,4HAA4H;AAC5H,SAAS,UAAU,CAAC,CAA6C;IAC/D,OAAO,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,MAAM,CAAC,CAAa;IAC3B,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,aAAa,CAAC,CAAU,EAAE,IAAY;IAC7C,OAAO,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACnD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,YAAY,IAAI,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC1K,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAG,CAAC,CAAC,SAAuC,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;IAC7J,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iHAAiH;AACjH,SAAS,UAAU,CAAC,IAAa;IAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;IACvB,MAAM,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,IAAI,IAAK,CAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1F,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAS;IACnC,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,OAAO,WAAW,EAAE,UAAU,CAAC,CAAC;AACvE,CAAC;AAED,8HAA8H;AAC9H,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,CAAS,EAAE,CAAa;IAChD,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7F,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrE,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QACF,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;YACrG,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IACrG,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,OAAO,mBAAmB,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACjF,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,+BAA+B,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC3D,CAAC;AAQD,SAAS,YAAY,CAAC,IAAa;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,mBAAmB,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED,MAAM,MAAM,GAAW;IACrB,OAAO,EAAE;QACP,SAAS,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE;QACrC,iBAAiB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE;QAC9D,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE;KACjC;IAED,QAAQ,CAAC,MAAM,EAAE,GAAG;QAClB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM;QACrB,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM;QACf,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACvJ,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC3D,6HAA6H;QAC7H,IAAI,OAAO;YAAE,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI;QAC5B,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAEzH,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM;YAAE,MAAM,UAAU,CAAC,MAAM,EAAE,mBAAmB,UAAU,2BAA2B,CAAC,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;QAErH,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAU,CAAC;QACf,IAAI,CAAC;YACH,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACzJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,mBAAmB,CAAC;gBAAE,MAAM,CAAC,CAAC;YACtD,uGAAuG;YACvG,qDAAqD;YACrD,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK;gBAAE,MAAM,CAAC,CAAC;YACpB,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC1F,CAAC;QACD,8EAA8E;QAC9E,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACrI,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,MAAM,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,OAAO,aAAa,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChI,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,SAAS,CAAC,IAAI;QAClB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrF,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS;QACb,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACzB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,28 @@
+import { type SecretSource } from "@sponson/core";
+/** Runs a CLI and returns its stdout. Injected in tests so no real `doppler`/`op`/`aws` is needed. */
+export type Exec = (file: string, args: string[], env: NodeJS.ProcessEnv) => Promise<string>;
+/**
+ * Runs the real binary from PATH; rejects with its stderr when it fails. A binary that cannot be started keeps the
+ * system error's `code` (`ENOENT`, `EACCES`), so the caller can say what is wrong instead of echoing it.
+ */
+export declare const defaultExec: Exec;
+/** `env://NAME` → process environment. Zero configuration; the CI default. */
+export declare const envSecretSource: SecretSource;
+/** `doppler://project/config/NAME` → `doppler secrets get`. Uses the CLI's login or DOPPLER_TOKEN from the env. */
+export declare function dopplerSecretSource(exec?: Exec): SecretSource;
+/** `op://vault/item/field` → `op read`, which accepts the reference as-is. */
+export declare function opSecretSource(exec?: Exec): SecretSource;
+/**
+ * `aws-sm://<secret-id>` → `aws secretsmanager get-secret-value`, through the `aws` CLI so the AWS SDK stays out of
+ * the dependency tree. The secret id is a name or an ARN; region, profile and credentials come from the CLI's own
+ * conventions (`AWS_REGION`, `AWS_PROFILE`, ...). `aws-sm://<secret-id>#<key>` picks one key of a JSON secret, the
+ * shape the AWS console creates for key/value secrets.
+ */
+export declare function awsSecretsManagerSource(exec?: Exec): SecretSource;
+/**
+ * `gcp-sm://<project>/<secret>[/<version>]` → `gcloud secrets versions access`, through the `gcloud` CLI so the Google
+ * SDK stays out of the dependency tree. The version defaults to `latest`; credentials come from the CLI's own
+ * conventions (`gcloud auth`, `CLOUDSDK_*`, `GOOGLE_APPLICATION_CREDENTIALS`). The project is part of the reference
+ * so a plan never depends on whichever project the runner's gcloud happens to have configured.
+ */
+export declare function gcpSecretManagerSource(exec?: Exec): SecretSource;

package/dist/secrets.js

@@ -0,0 +1,197 @@
+import { execFile } from "node:child_process";
+import { SponsonError } from "@sponson/core";
+/**
+ * Runs the real binary from PATH; rejects with its stderr when it fails. A binary that cannot be started keeps the
+ * system error's `code` (`ENOENT`, `EACCES`), so the caller can say what is wrong instead of echoing it.
+ */
+export const defaultExec = (file, args, env) => new Promise((resolve, reject) => {
+    execFile(file, args, { env, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
+        if (!err)
+            return resolve(stdout);
+        const spawnCode = typeof err.code === "string" ? err.code : undefined;
+        const failure = new Error(`${file} ${args[0] ?? ""} failed: ${String(stderr || err.message).trim()}`);
+        if (spawnCode)
+            failure.code = spawnCode;
+        reject(failure);
+    });
+});
+/**
+ * The one shape of every SECRET_UNRESOLVED a built-in source throws: the reason only. The engine prefixes the
+ * reference when it reports the line (`aws-sm://x: <reason>`), so the message never names the ref twice; the ref is
+ * in `details.ref` for callers that use a source directly. Never put the value, or any part of it, in `why`.
+ */
+function unresolved(ref, why, details = {}) {
+    return new SponsonError("SECRET_UNRESOLVED", why, { ref, ...details });
+}
+function stripScheme(ref, scheme) {
+    const prefix = `${scheme}://`;
+    if (!ref.startsWith(prefix))
+        throw unresolved(ref, `expected ${prefix}…`);
+    return ref.slice(prefix.length);
+}
+/** CLIs end their output with one newline (LF or CRLF); the secret is what comes before it. */
+function stripTrailingNewline(out) {
+    return out.replace(/(\r\n|\n|\r)$/, "");
+}
+/**
+ * Run a secret CLI; any failure is SECRET_UNRESOLVED. Every CLI-backed source goes through here, so a missing binary
+ * reads the same for all of them ("the `aws` CLI is not installed or not on PATH"), and any other failure (not signed
+ * in, unknown item) carries the CLI's own error text, which never contains the value it failed to read.
+ *
+ * `fromRef` lists every argument taken from the reference. A plan is reviewed as data, so none of them may read as an
+ * option to the CLI: one starting with `-` is refused before anything runs.
+ */
+async function runCli(exec, ref, file, args, env, fromRef) {
+    const flag = fromRef.find((a) => a.startsWith("-"));
+    if (flag !== undefined)
+        throw unresolved(ref, `a reference segment may not start with "-" (it would reach the \`${file}\` CLI as an option)`);
+    try {
+        return stripTrailingNewline(await exec(file, args, env));
+    }
+    catch (e) {
+        const code = e.code;
+        if (code === "ENOENT")
+            throw unresolved(ref, `the \`${file}\` CLI is not installed or not on PATH`);
+        if (code === "EACCES")
+            throw unresolved(ref, `the \`${file}\` CLI on PATH is not executable`);
+        throw unresolved(ref, e.message);
+    }
+}
+/** `env://NAME` → process environment. Zero configuration; the CI default. */
+export const envSecretSource = {
+    scheme: "env",
+    form: "`env://NAME`",
+    resolvedBy: "the process environment; unset or empty is `SECRET_UNRESOLVED`",
+    async resolve(ref, env) {
+        const name = stripScheme(ref, "env");
+        const v = env[name];
+        if (v === undefined || v === "")
+            throw unresolved(ref, `environment variable ${name} is not set`, { variable: name });
+        return v;
+    },
+};
+/** `doppler://project/config/NAME` → `doppler secrets get`. Uses the CLI's login or DOPPLER_TOKEN from the env. */
+export function dopplerSecretSource(exec = defaultExec) {
+    return {
+        scheme: "doppler",
+        form: "`doppler://project/config/NAME`",
+        resolvedBy: "`doppler secrets get NAME --project project --config config --plain` (Doppler CLI)",
+        async resolve(ref, env) {
+            const parts = stripScheme(ref, "doppler").split("/");
+            if (parts.length !== 3 || parts.some((p) => p === ""))
+                throw unresolved(ref, "expected doppler://project/config/NAME");
+            const [project, config, name] = parts;
+            return runCli(exec, ref, "doppler", ["secrets", "get", name, "--project", project, "--config", config, "--plain"], env, [name, project, config]);
+        },
+    };
+}
+/** `op://vault/item/field` → `op read`, which accepts the reference as-is. */
+export function opSecretSource(exec = defaultExec) {
+    return {
+        scheme: "op",
+        form: "`op://vault/item/field`",
+        resolvedBy: "`op read op://vault/item/field --no-newline` (1Password CLI)",
+        async resolve(ref, env) {
+            const path = stripScheme(ref, "op");
+            if (path.split("/").length < 3)
+                throw unresolved(ref, "expected op://vault/item/field");
+            // The reference is passed whole and always starts with `op://`, so it can never read as an option.
+            return runCli(exec, ref, "op", ["read", ref, "--no-newline"], env, [ref]);
+        },
+    };
+}
+/**
+ * `aws-sm://<secret-id>` → `aws secretsmanager get-secret-value`, through the `aws` CLI so the AWS SDK stays out of
+ * the dependency tree. The secret id is a name or an ARN; region, profile and credentials come from the CLI's own
+ * conventions (`AWS_REGION`, `AWS_PROFILE`, ...). `aws-sm://<secret-id>#<key>` picks one key of a JSON secret, the
+ * shape the AWS console creates for key/value secrets.
+ */
+export function awsSecretsManagerSource(exec = defaultExec) {
+    return {
+        scheme: "aws-sm",
+        form: "`aws-sm://secret-id` or `aws-sm://secret-id#KEY`",
+        resolvedBy: "`aws secretsmanager get-secret-value --secret-id secret-id --query SecretString --output json` (AWS CLI; region and credentials from `AWS_REGION`, `AWS_PROFILE` and the CLI's other conventions). `secret-id` is a name or an ARN; `#KEY` picks one key of a JSON key/value secret. Binary secrets are not supported.",
+        async resolve(ref, env) {
+            const path = stripScheme(ref, "aws-sm");
+            const hash = path.indexOf("#");
+            const id = hash < 0 ? path : path.slice(0, hash);
+            const key = hash < 0 ? undefined : path.slice(hash + 1);
+            if (id === "" || key === "")
+                throw unresolved(ref, "expected aws-sm://<secret-id> or aws-sm://<secret-id>#<key>");
+            // JSON output, not text: text prints a binary secret's missing SecretString as the word "None".
+            const out = await runCli(exec, ref, "aws", ["secretsmanager", "get-secret-value", "--secret-id", id, "--query", "SecretString", "--output", "json"], env, [id]);
+            const value = parseJson(out);
+            if (typeof value !== "string")
+                throw unresolved(ref, "the secret has no string value (binary secrets are not supported)");
+            if (key === undefined)
+                return value;
+            // Never echo the secret (or a fragment of it) in these messages: they end up in the receipt.
+            const fields = parseJson(value);
+            if (typeof fields !== "object" || fields === null || Array.isArray(fields))
+                throw unresolved(ref, `#${key} needs a JSON object secret, and this one is not`);
+            const picked = fields[key];
+            if (picked === undefined)
+                throw unresolved(ref, `the secret has no key ${key}`);
+            if (typeof picked !== "string" && typeof picked !== "number" && typeof picked !== "boolean")
+                throw unresolved(ref, `key ${key} is not a string, number or boolean`);
+            return String(picked);
+        },
+    };
+}
+const GCP_SM_FORM = "expected gcp-sm://<project>/<secret> or gcp-sm://<project>/<secret>/<version>";
+/** Project ids (including domain-scoped `example.com:proj`) and project numbers; no leading `-`, so never a flag. */
+const GCP_PROJECT = /^[a-z0-9][a-z0-9.:-]*$/;
+/** Secret Manager's own rule for secret ids. */
+const GCP_SECRET = /^[A-Za-z0-9_-]{1,255}$/;
+const GCP_VERSION = /^(latest|[1-9][0-9]*)$/;
+/**
+ * `gcp-sm://<project>/<secret>[/<version>]` → `gcloud secrets versions access`, through the `gcloud` CLI so the Google
+ * SDK stays out of the dependency tree. The version defaults to `latest`; credentials come from the CLI's own
+ * conventions (`gcloud auth`, `CLOUDSDK_*`, `GOOGLE_APPLICATION_CREDENTIALS`). The project is part of the reference
+ * so a plan never depends on whichever project the runner's gcloud happens to have configured.
+ */
+export function gcpSecretManagerSource(exec = defaultExec) {
+    return {
+        scheme: "gcp-sm",
+        form: "`gcp-sm://project/secret` or `gcp-sm://project/secret/version`",
+        resolvedBy: "`gcloud secrets versions access version --secret=secret --project=project --format=json` (Google Cloud CLI; credentials from `gcloud auth` and the CLI's other conventions). `version` is a number or `latest` (the default). The payload must be UTF-8 text.",
+        async resolve(ref, env) {
+            const parts = stripScheme(ref, "gcp-sm").split("/");
+            if (parts.length < 2 || parts.length > 3)
+                throw unresolved(ref, GCP_SM_FORM);
+            const [project, secret, version = "latest"] = parts;
+            if (!GCP_PROJECT.test(project) || !GCP_SECRET.test(secret) || !GCP_VERSION.test(version))
+                throw unresolved(ref, GCP_SM_FORM);
+            // JSON, not the default raw output: the payload arrives base64-encoded, so a value ending in a newline survives
+            // and a binary payload is recognised instead of being passed on as mangled text.
+            const out = await runCli(exec, ref, "gcloud", ["secrets", "versions", "access", version, `--secret=${secret}`, `--project=${project}`, "--format=json"], env, [version, secret, project]);
+            const response = parseJson(out);
+            const data = isRecord(response) && isRecord(response.payload) ? response.payload.data : undefined;
+            if (typeof data !== "string")
+                throw unresolved(ref, "gcloud returned no payload");
+            // Never echo the payload (or a fragment of it) in these messages: they end up in the receipt.
+            let value;
+            try {
+                value = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(data, "base64"));
+            }
+            catch {
+                throw unresolved(ref, "the secret is not UTF-8 text (binary secrets are not supported)");
+            }
+            if (value === "")
+                throw unresolved(ref, "the secret is empty");
+            return value;
+        },
+    };
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqB,MAAM,eAAe,CAAC;AAKhE;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CACnD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC5E,IAAI,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAA0B,CAAC;QAC/H,IAAI,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW,EAAE,UAAmC,EAAE;IACjF,OAAO,IAAI,YAAY,CAAC,mBAAmB,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,MAAc;IAC9C,MAAM,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,YAAY,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,+FAA+F;AAC/F,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,MAAM,CAAC,IAAU,EAAE,GAAW,EAAE,IAAY,EAAE,IAAc,EAAE,GAAsB,EAAE,OAAiB;IACpH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,UAAU,CAAC,GAAG,EAAE,oEAAoE,IAAI,sBAAsB,CAAC,CAAC;IAC9I,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,IAAI,wCAAwC,CAAC,CAAC;QACpG,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,SAAS,IAAI,kCAAkC,CAAC,CAAC;QAC9F,MAAM,UAAU,CAAC,GAAG,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAiB;IAC3C,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,cAAc;IACpB,UAAU,EAAE,gEAAgE;IAC5E,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;QACpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM,UAAU,CAAC,GAAG,EAAE,wBAAwB,IAAI,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtH,OAAO,CAAC,CAAC;IACX,CAAC;CACF,CAAC;AAEF,mHAAmH;AACnH,MAAM,UAAU,mBAAmB,CAAC,OAAa,WAAW;IAC1D,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,iCAAiC;QACvC,UAAU,EAAE,oFAAoF;QAChG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,wCAAwC,CAAC,CAAC;YACvH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,KAAiC,CAAC;YAClE,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACnJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,OAAa,WAAW;IACrD,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,yBAAyB;QAC/B,UAAU,EAAE,8DAA8D;QAC1E,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;YACxF,mGAAmG;YACnG,OAAO,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAa,WAAW;IAC9D,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,kDAAkD;QACxD,UAAU,EACR,wTAAwT;QAC1T,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,6DAA6D,CAAC,CAAC;YAClH,gGAAgG;YAChG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAChK,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,mEAAmE,CAAC,CAAC;YAC1H,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACpC,6FAA6F;YAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,GAAG,kDAAkD,CAAC,CAAC;YAC7J,MAAM,MAAM,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,yBAAyB,GAAG,EAAE,CAAC,CAAC;YAChF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,qCAAqC,CAAC,CAAC;YACpK,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,+EAA+E,CAAC;AACpG,qHAAqH;AACrH,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,gDAAgD;AAChD,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAC5C,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAa,WAAW;IAC7D,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,gEAAgE;QACtE,UAAU,EACR,+PAA+P;QACjQ,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG;YACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7E,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC,GAAG,KAAkC,CAAC;YACjF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAC7H,gHAAgH;YAChH,iFAAiF;YACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,MAAM,EAAE,EAAE,aAAa,OAAO,EAAE,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1L,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YAClG,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YAClF,8FAA8F;YAC9F,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxF,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,UAAU,CAAC,GAAG,EAAE,iEAAiE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,KAAK,KAAK,EAAE;gBAAE,MAAM,UAAU,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/vercel.d.ts

@@ -0,0 +1,8 @@
+import { type ResourceAdapter } from "@sponson/core";
+/** Vercel's API base URL; `VERCEL_API_URL` overrides it (the sim and tests use that). */
+export declare const VERCEL_DEFAULT_API_URL = "https://api.vercel.com";
+/**
+ * Vercel: op `env` manages environment variables per target and git branch; op `deploy` triggers or watches a
+ * deployment and outputs its `preview_url`. Needs `VERCEL_TOKEN` and `providers.vercel.project`.
+ */
+export declare const vercelAdapter: ResourceAdapter;