slskit-cli 1.0.0

package/dist/commands/env/action.js

@@ -0,0 +1,274 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stackNameFor = void 0;
+exports.envListAction = envListAction;
+exports.envAddAction = envAddAction;
+exports.envUseAction = envUseAction;
+exports.envRemoveAction = envRemoveAction;
+exports.envSetAction = envSetAction;
+exports.envUnsetAction = envUnsetAction;
+exports.envVarsAction = envVarsAction;
+exports.seedDotenv = seedDotenv;
+const errors_js_1 = require("../../core/errors.js");
+const is_ci_js_1 = require("../../core/is-ci.js");
+const logger_js_1 = require("../../core/logger.js");
+const environments_js_1 = require("../../core/environments.js");
+Object.defineProperty(exports, "stackNameFor", { enumerable: true, get: function () { return environments_js_1.stackNameFor; } });
+const action_js_1 = require("../configure/action.js");
+const keys_js_1 = require("./keys.js");
+const dotenv_js_1 = require("./dotenv.js");
+const templates_js_1 = require("./templates.js");
+const KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function requireName(name) {
+    const parsed = (0, environments_js_1.parseEnvironmentName)(name);
+    if (!parsed) {
+        throw new errors_js_1.CliError("An environment name is required.");
+    }
+    return parsed;
+}
+function parseKey(key) {
+    const trimmed = key.trim();
+    if (!KEY_PATTERN.test(trimmed)) {
+        throw new errors_js_1.CliError(`Invalid variable name "${key}". Use letters, digits and underscores, starting with a letter or underscore.`);
+    }
+    if (trimmed === environments_js_1.APP_ENVIRONMENT_KEY) {
+        throw new errors_js_1.CliError(`${environments_js_1.APP_ENVIRONMENT_KEY} is managed by slskit and always equals the environment name. Use "slskit env add <name>" to create another environment instead.`);
+    }
+    return trimmed;
+}
+// Every function's physical name is <project>-<environment>-<function>, so a long
+// environment name can push it past Lambda's limit. Caught before anything is written.
+function assertNamesFit(manifest, environment) {
+    const applications = manifest.applications ?? [];
+    for (const app of applications) {
+        for (const fn of app.functions ?? []) {
+            (0, environments_js_1.assertFunctionNameFits)(manifest.name, environment, fn.name);
+        }
+    }
+}
+async function envListAction() {
+    const cwd = process.cwd();
+    const manifest = (0, environments_js_1.readManifest)(cwd, "slskit env list");
+    const names = (0, environments_js_1.environmentNames)(manifest);
+    if (names.length === 0) {
+        logger_js_1.logger.info('\nThis project has no environments yet. Add one with "slskit env add dev".');
+        return;
+    }
+    const active = manifest.environments?.default;
+    logger_js_1.logger.info(`\nEnvironments for "${manifest.name}":\n`);
+    for (const name of names) {
+        const config = (0, environments_js_1.requireEnvironment)(manifest, name);
+        const marker = name === active ? "*" : " ";
+        const count = Object.keys(config.variables ?? {}).length;
+        logger_js_1.logger.info(`${marker} ${name}`);
+        logger_js_1.logger.info(`    ${environments_js_1.APP_ENVIRONMENT_KEY}: ${name}`);
+        logger_js_1.logger.info(`    stack:     ${config.stackName}`);
+        logger_js_1.logger.info(`    region:    ${config.region ?? "(not configured)"}`);
+        logger_js_1.logger.info(`    profile:   ${config.profile ?? "(environment)"}`);
+        logger_js_1.logger.info(`    variables: ${count}`);
+    }
+    logger_js_1.logger.info("\n* default environment");
+}
+// An environment is a deploy target plus a name, so creating one runs the same
+// credential flow as configure rather than duplicating it.
+async function envAddAction(name, options) {
+    const cwd = process.cwd();
+    const manifest = (0, environments_js_1.readManifest)(cwd, "slskit env add");
+    const environment = requireName(name);
+    if (manifest.environments?.list?.[environment]) {
+        throw new errors_js_1.CliError(`Environment "${environment}" already exists. Use "slskit configure --env ${environment}" to change it.`);
+    }
+    assertNamesFit(manifest, environment);
+    await (0, action_js_1.configureAction)({ ...options, env: environment });
+}
+async function envUseAction(name) {
+    const cwd = process.cwd();
+    const manifest = (0, environments_js_1.readManifest)(cwd, "slskit env use");
+    const environment = requireName(name);
+    (0, environments_js_1.requireEnvironment)(manifest, environment);
+    (0, environments_js_1.writeManifest)(cwd, {
+        ...manifest,
+        environments: {
+            default: environment,
+            list: manifest.environments?.list ?? {},
+        },
+    });
+    logger_js_1.logger.info(`\nDefault environment is now "${environment}".`);
+    logger_js_1.logger.info(`  ${environments_js_1.APP_ENVIRONMENT_KEY}=${environment}`);
+}
+async function envRemoveAction(name, options) {
+    const cwd = process.cwd();
+    const manifest = (0, environments_js_1.readManifest)(cwd, "slskit env remove");
+    const environment = requireName(name);
+    const config = (0, environments_js_1.requireEnvironment)(manifest, environment);
+    const remaining = (0, environments_js_1.environmentNames)(manifest).filter((each) => each !== environment);
+    if (!options.yes) {
+        if (!(0, is_ci_js_1.isInteractive)()) {
+            throw new errors_js_1.CliError(`Removing an environment cannot be undone. Re-run with --yes to remove "${environment}".`);
+        }
+        const { confirm } = await import("@inquirer/prompts");
+        const count = Object.keys(config.variables ?? {}).length;
+        const proceed = await confirm({
+            message: `Remove environment "${environment}" and its ${count} variable(s) from slskit.json?`,
+            default: false,
+        });
+        if (!proceed) {
+            logger_js_1.logger.info("\nNothing was removed.");
+            return;
+        }
+    }
+    const list = { ...manifest.environments?.list };
+    delete list[environment];
+    const wasDefault = manifest.environments?.default === environment;
+    (0, environments_js_1.writeManifest)(cwd, {
+        ...manifest,
+        environments: {
+            default: wasDefault ? remaining[0] ?? environment : manifest.environments.default,
+            list,
+        },
+    });
+    const written = (0, templates_js_1.regenerateTemplates)(cwd, (0, environments_js_1.readManifest)(cwd, "slskit env remove"));
+    logger_js_1.logger.info(`\nRemoved environment "${environment}".`);
+    if (wasDefault && remaining.length > 0) {
+        logger_js_1.logger.info(`  default environment is now "${remaining[0]}"`);
+    }
+    logger_js_1.logger.info(`  ${(0, dotenv_js_1.dotenvFileName)(environment)} was left in place — delete it yourself if you no longer need those values.`);
+    if (written.length > 0) {
+        logger_js_1.logger.info(`  regenerated ${written.length} template(s)`);
+    }
+}
+async function envSetAction(assignment, options) {
+    const cwd = process.cwd();
+    const manifest = (0, environments_js_1.readManifest)(cwd, "slskit env set");
+    const environment = (0, environments_js_1.resolveEnvironmentName)(manifest, options.env);
+    const config = (0, environments_js_1.requireEnvironment)(manifest, environment);
+    const eq = assignment.indexOf("=");
+    const hasValue = eq > 0;
+    const key = parseKey(hasValue ? assignment.slice(0, eq) : assignment);
+    const value = hasValue ? assignment.slice(eq + 1) : undefined;
+    if (options.ssm && options.secret) {
+        throw new errors_js_1.CliError('Pass either "--secret" or "--ssm", not both.');
+    }
+    let def;
+    let where;
+    if (options.ssm) {
+        def = { ssm: options.ssm };
+        where = `SSM parameter ${options.ssm}`;
+    }
+    else if (options.secret) {
+        if (value === undefined) {
+            throw new errors_js_1.CliError(`A secret needs a value: slskit env set ${key}=<value> --secret`);
+        }
+        def = { secret: true };
+        (0, dotenv_js_1.ensureDotenvIgnored)(cwd);
+        const file = (0, dotenv_js_1.setDotenvValue)(cwd, environment, key, value);
+        where = file;
+    }
+    else {
+        if (value === undefined) {
+            throw new errors_js_1.CliError(`A value is required: slskit env set ${key}=<value>`);
+        }
+        def = { value };
+        where = "slskit.json";
+    }
+    const variables = { ...config.variables, [key]: def };
+    const knownBefore = Object.keys(config.variables ?? {});
+    (0, environments_js_1.writeManifest)(cwd, {
+        ...manifest,
+        environments: {
+            default: manifest.environments.default,
+            list: {
+                ...manifest.environments.list,
+                [environment]: { ...config, variables },
+            },
+        },
+    });
+    logger_js_1.logger.info(`\nSet ${key} for environment "${environment}".`);
+    logger_js_1.logger.info(`  stored in: ${where}`);
+    // A brand-new variable name means every template needs a matching parameter.
+    if (!knownBefore.includes(key)) {
+        const written = (0, templates_js_1.regenerateTemplates)(cwd, (0, environments_js_1.readManifest)(cwd, "slskit env set"));
+        if (written.length > 0) {
+            logger_js_1.logger.info(`  regenerated ${written.length} template(s) for the new parameter`);
+        }
+    }
+}
+async function envUnsetAction(key, options) {
+    const cwd = process.cwd();
+    const manifest = (0, environments_js_1.readManifest)(cwd, "slskit env unset");
+    const environment = (0, environments_js_1.resolveEnvironmentName)(manifest, options.env);
+    const config = (0, environments_js_1.requireEnvironment)(manifest, environment);
+    const name = parseKey(key);
+    if (!config.variables?.[name]) {
+        throw new errors_js_1.CliError(`Variable "${name}" is not set for environment "${environment}".`);
+    }
+    const variables = { ...config.variables };
+    delete variables[name];
+    (0, environments_js_1.writeManifest)(cwd, {
+        ...manifest,
+        environments: {
+            default: manifest.environments.default,
+            list: {
+                ...manifest.environments.list,
+                [environment]: { ...config, variables },
+            },
+        },
+    });
+    (0, dotenv_js_1.unsetDotenvValue)(cwd, environment, name);
+    const written = (0, templates_js_1.regenerateTemplates)(cwd, (0, environments_js_1.readManifest)(cwd, "slskit env unset"));
+    logger_js_1.logger.info(`\nRemoved ${name} from environment "${environment}".`);
+    if (written.length > 0) {
+        logger_js_1.logger.info(`  regenerated ${written.length} template(s)`);
+    }
+}
+async function envVarsAction(options) {
+    const cwd = process.cwd();
+    const manifest = (0, environments_js_1.readManifest)(cwd, "slskit env vars");
+    const environment = (0, environments_js_1.resolveEnvironmentName)(manifest, options.env);
+    const config = (0, environments_js_1.requireEnvironment)(manifest, environment);
+    const secrets = (0, dotenv_js_1.readDotenv)(cwd, environment);
+    logger_js_1.logger.info(`\nVariables for environment "${environment}":\n`);
+    // Always shown first: it is generated, not stored, and every name derives from it.
+    logger_js_1.logger.info(`  ${environments_js_1.APP_ENVIRONMENT_KEY}=${environment}   (generated)`);
+    // Declared and undeclared together: a key typed straight into the .env file
+    // reaches the functions exactly like one added with "slskit env set".
+    const keys = (0, keys_js_1.environmentEnvKeys)(cwd, manifest, environment);
+    for (const key of keys) {
+        const def = config.variables?.[key];
+        if (!def) {
+            const held = secrets[key] ?? "";
+            const shown = options.showSecrets || held === "" ? held : "********";
+            logger_js_1.logger.info(`  ${key}=${shown}   (${(0, dotenv_js_1.dotenvFileName)(environment)})`);
+            continue;
+        }
+        const source = (0, environments_js_1.envVarSource)(def);
+        if (source === "ssm") {
+            logger_js_1.logger.info(`  ${key}=<ssm:${def.ssm}>   (resolved by AWS at deploy)`);
+            continue;
+        }
+        if (source === "secret") {
+            const held = secrets[key];
+            const shown = options.showSecrets
+                ? held ?? "(missing)"
+                : held
+                    ? "********"
+                    : "(missing)";
+            logger_js_1.logger.info(`  ${key}=${shown}   (secret, ${(0, dotenv_js_1.dotenvFileName)(environment)})`);
+            continue;
+        }
+        logger_js_1.logger.info(`  ${key}=${def.value ?? ""}   (slskit.json)`);
+    }
+    const hidden = keys.some((key) => config.variables?.[key]?.secret || config.variables?.[key] === undefined);
+    if (keys.length === 0) {
+        logger_js_1.logger.info(`\n  No variables set yet. Add one with "slskit env set KEY=value", or put it straight into ${(0, dotenv_js_1.dotenvFileName)(environment)}.`);
+    }
+    else if (!options.showSecrets && hidden) {
+        logger_js_1.logger.info("\nRe-run with --show-secrets to reveal hidden values.");
+    }
+}
+// Called by init and configure so a new environment always has its dotenv file.
+function seedDotenv(cwd, environment) {
+    (0, dotenv_js_1.ensureDotenvIgnored)(cwd);
+    const existing = (0, dotenv_js_1.readDotenv)(cwd, environment);
+    return (0, dotenv_js_1.writeDotenv)(cwd, environment, existing);
+}

package/dist/commands/env/dotenv.d.ts

@@ -0,0 +1,6 @@
+export declare function dotenvFileName(environment: string): string;
+export declare function readDotenv(cwd: string, environment: string): Record<string, string>;
+export declare function writeDotenv(cwd: string, environment: string, values: Record<string, string>): string;
+export declare function setDotenvValue(cwd: string, environment: string, key: string, value: string): string;
+export declare function unsetDotenvValue(cwd: string, environment: string, key: string): void;
+export declare function ensureDotenvIgnored(cwd: string): boolean;

package/dist/commands/env/dotenv.js

@@ -0,0 +1,99 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dotenvFileName = dotenvFileName;
+exports.readDotenv = readDotenv;
+exports.writeDotenv = writeDotenv;
+exports.setDotenvValue = setDotenvValue;
+exports.unsetDotenvValue = unsetDotenvValue;
+exports.ensureDotenvIgnored = ensureDotenvIgnored;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const environments_js_1 = require("../../core/environments.js");
+// Secret values live beside the project in .env.<environment>, which the generated
+// .gitignore excludes. Nothing in this file is ever written into slskit.json.
+function dotenvFileName(environment) {
+    return `.env.${environment}`;
+}
+function parseLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+        return undefined;
+    }
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) {
+        return undefined;
+    }
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+        value = value.slice(1, -1).replace(/\\(["\\])/g, "$1");
+    }
+    else if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
+        value = value.slice(1, -1);
+    }
+    return [key, value];
+}
+function readDotenv(cwd, environment) {
+    const file = node_path_1.default.join(cwd, dotenvFileName(environment));
+    if (!node_fs_1.default.existsSync(file)) {
+        return {};
+    }
+    const values = {};
+    for (const line of node_fs_1.default.readFileSync(file, "utf8").split("\n")) {
+        const entry = parseLine(line);
+        if (entry) {
+            values[entry[0]] = entry[1];
+        }
+    }
+    return values;
+}
+// Values are quoted when they contain anything that would not survive a raw round trip.
+function formatLine(key, value) {
+    if (/^[A-Za-z0-9_./:-]*$/.test(value)) {
+        return `${key}=${value}`;
+    }
+    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    return `${key}="${escaped}"`;
+}
+// APP_ENVIRONMENT is always written first and always equals the environment name,
+// so the file is self-describing and can never disagree with the manifest.
+function writeDotenv(cwd, environment, values) {
+    const file = dotenvFileName(environment);
+    const rest = Object.keys(values)
+        .filter((key) => key !== environments_js_1.APP_ENVIRONMENT_KEY)
+        .sort()
+        .map((key) => formatLine(key, values[key]));
+    const body = [formatLine(environments_js_1.APP_ENVIRONMENT_KEY, environment), ...rest].join("\n");
+    const header = `# Values for the "${environment}" environment. Never commit this file.\n`;
+    node_fs_1.default.writeFileSync(node_path_1.default.join(cwd, file), `${header}${body}\n`);
+    return file;
+}
+function setDotenvValue(cwd, environment, key, value) {
+    const values = readDotenv(cwd, environment);
+    values[key] = value;
+    return writeDotenv(cwd, environment, values);
+}
+function unsetDotenvValue(cwd, environment, key) {
+    const values = readDotenv(cwd, environment);
+    if (!(key in values)) {
+        return;
+    }
+    delete values[key];
+    writeDotenv(cwd, environment, values);
+}
+// A leaked credential is the expensive failure here, so the ignore rule is repaired
+// on every write rather than trusted to whatever the project was scaffolded with.
+function ensureDotenvIgnored(cwd) {
+    const file = node_path_1.default.join(cwd, ".gitignore");
+    const existing = node_fs_1.default.existsSync(file) ? node_fs_1.default.readFileSync(file, "utf8") : "";
+    const lines = existing.split("\n").map((line) => line.trim());
+    if (lines.includes(".env.*")) {
+        return false;
+    }
+    const separator = existing.endsWith("\n") || existing === "" ? "" : "\n";
+    node_fs_1.default.writeFileSync(file, `${existing}${separator}.env\n.env.*\n`);
+    return true;
+}

package/dist/commands/env/index.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare function registerEnvCommand(program: Command): void;

package/dist/commands/env/index.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerEnvCommand = registerEnvCommand;
+const run_js_1 = require("../../core/run.js");
+function registerEnvCommand(program) {
+    const env = program
+        .command("env")
+        .description("Manage deployment environments (dev, staging, production, ...) and their variables");
+    env
+        .command("list")
+        .alias("ls")
+        .description("Show every environment and its deploy target")
+        .action(() => (0, run_js_1.runCommand)(async () => {
+        const { envListAction } = await import("./action.js");
+        await envListAction();
+    }));
+    env
+        .command("add")
+        .description("Add an environment and configure its AWS deploy target")
+        .argument("<name>", "Environment name (example: staging)")
+        .option("--profile <name>", "AWS named profile to resolve credentials from")
+        .option("--region <region>", "AWS region to deploy into (example: us-east-1)")
+        .option("--stack-name <name>", "CloudFormation stack name for this environment")
+        .option("--skip-verify", "Save without checking that the credentials work", false)
+        .action((name, options) => (0, run_js_1.runCommand)(async () => {
+        const { envAddAction } = await import("./action.js");
+        await envAddAction(name, options);
+    }));
+    env
+        .command("use")
+        .description("Set the environment that commands default to")
+        .argument("<name>", "Environment name")
+        .action((name) => (0, run_js_1.runCommand)(async () => {
+        const { envUseAction } = await import("./action.js");
+        await envUseAction(name);
+    }));
+    env
+        .command("remove")
+        .alias("rm")
+        .description("Remove an environment from this project")
+        .argument("<name>", "Environment name")
+        .option("-y, --yes", "Skip the confirmation prompt", false)
+        .action((name, options) => (0, run_js_1.runCommand)(async () => {
+        const { envRemoveAction } = await import("./action.js");
+        await envRemoveAction(name, options);
+    }));
+    env
+        .command("set")
+        .description("Add or update a variable (KEY=value)")
+        .argument("<assignment>", "KEY=value")
+        .option("-e, --env <name>", "Environment to change (default: the default environment)")
+        .option("--secret", "Store the value in .env.<environment> instead of slskit.json", false)
+        .option("--ssm <path>", "Read the value from an SSM Parameter Store path at deploy time")
+        .action((assignment, options) => (0, run_js_1.runCommand)(async () => {
+        const { envSetAction } = await import("./action.js");
+        await envSetAction(assignment, options);
+    }));
+    env
+        .command("unset")
+        .description("Remove a variable from an environment")
+        .argument("<key>", "Variable name")
+        .option("-e, --env <name>", "Environment to change (default: the default environment)")
+        .action((key, options) => (0, run_js_1.runCommand)(async () => {
+        const { envUnsetAction } = await import("./action.js");
+        await envUnsetAction(key, options);
+    }));
+    env
+        .command("vars")
+        .description("Show every variable configured for an environment")
+        .option("-e, --env <name>", "Environment to show (default: the default environment)")
+        .option("--show-secrets", "Reveal secret values instead of masking them", false)
+        .action((options) => (0, run_js_1.runCommand)(async () => {
+        const { envVarsAction } = await import("./action.js");
+        await envVarsAction(options);
+    }));
+}

package/dist/commands/env/keys.d.ts

@@ -0,0 +1,8 @@
+import type { EnvironmentsConfig } from "../../core/environments.js";
+type ManifestView = {
+    environments?: EnvironmentsConfig;
+};
+export declare function isVariableName(key: string): boolean;
+export declare function projectEnvKeys(cwd: string, manifest: ManifestView): string[];
+export declare function environmentEnvKeys(cwd: string, manifest: ManifestView, environment: string): string[];
+export {};

package/dist/commands/env/keys.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isVariableName = isVariableName;
+exports.projectEnvKeys = projectEnvKeys;
+exports.environmentEnvKeys = environmentEnvKeys;
+const environments_js_1 = require("../../core/environments.js");
+const dotenv_js_1 = require("./dotenv.js");
+// Anything that is not a legal shell/Lambda variable name is skipped rather than
+// turned into a CloudFormation parameter, so a stray line in a hand-edited .env
+// file can never produce an unbuildable template.
+const VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isVariableName(key) {
+    return VARIABLE_NAME.test(key) && key !== environments_js_1.APP_ENVIRONMENT_KEY;
+}
+// Every variable name in play across the whole project, whether it was declared
+// with "slskit env set" or simply typed into a .env.<environment> file by hand.
+// Templates are shared by every environment, so they declare a parameter for the
+// union: a variable only one stage sets still has to exist in the template that
+// every other stage deploys from.
+function projectEnvKeys(cwd, manifest) {
+    const keys = new Set((0, environments_js_1.allEnvKeys)(manifest).filter(isVariableName));
+    for (const environment of Object.keys(manifest.environments?.list ?? {})) {
+        for (const key of Object.keys((0, dotenv_js_1.readDotenv)(cwd, environment))) {
+            if (isVariableName(key)) {
+                keys.add(key);
+            }
+        }
+    }
+    return [...keys].sort();
+}
+// The keys one environment actually supplies a value for, declared or not.
+function environmentEnvKeys(cwd, manifest, environment) {
+    const config = manifest.environments?.list?.[environment];
+    const keys = new Set(Object.keys(config?.variables ?? {}).filter(isVariableName));
+    for (const key of Object.keys((0, dotenv_js_1.readDotenv)(cwd, environment))) {
+        if (isVariableName(key)) {
+            keys.add(key);
+        }
+    }
+    return [...keys].sort();
+}

package/dist/commands/env/parameters.d.ts

@@ -0,0 +1,7 @@
+import type { ProjectManifest } from "../../core/environments.js";
+export interface ParameterOverride {
+    name: string;
+    value: string;
+}
+export declare function parameterOverrides(cwd: string, manifest: ProjectManifest, environment: string): ParameterOverride[];
+export declare function toCliArguments(overrides: ParameterOverride[]): string[];

package/dist/commands/env/parameters.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parameterOverrides = parameterOverrides;
+exports.toCliArguments = toCliArguments;
+const errors_js_1 = require("../../core/errors.js");
+const environments_js_1 = require("../../core/environments.js");
+const helpers_js_1 = require("../init/templates/helpers.js");
+const dotenv_js_1 = require("./dotenv.js");
+const keys_js_1 = require("./keys.js");
+// Turns one environment into the --parameter-overrides list that both "slskit run"
+// and a deploy hand to the AWS SAM CLI. AppEnvironment always comes first: it is
+// what every stage-scoped resource name is built from.
+function parameterOverrides(cwd, manifest, environment) {
+    const config = (0, environments_js_1.requireEnvironment)(manifest, environment);
+    const overrides = [
+        { name: environments_js_1.APP_ENVIRONMENT_PARAM, value: environment },
+    ];
+    const fileValues = (0, dotenv_js_1.readDotenv)(cwd, environment);
+    const declared = config.variables ?? {};
+    // The whole project's key set, not just this environment's: templates are shared,
+    // so every parameter they declare has to be resolvable from here.
+    for (const key of (0, keys_js_1.projectEnvKeys)(cwd, manifest)) {
+        const def = declared[key];
+        const name = (0, helpers_js_1.envParameterName)(key);
+        if (!def) {
+            // Undeclared: it exists only because someone put it in a .env file. Stages
+            // that leave it out fall through to the parameter's empty default.
+            const value = fileValues[key];
+            if (value !== undefined && value !== "") {
+                overrides.push({ name, value });
+            }
+            continue;
+        }
+        const source = (0, environments_js_1.envVarSource)(def);
+        if (source === "ssm") {
+            // A CloudFormation dynamic reference: AWS resolves it at deploy time, so the
+            // secret never passes through this process.
+            overrides.push({ name, value: `{{resolve:ssm:${def.ssm}}}` });
+            continue;
+        }
+        if (source === "secret") {
+            const value = fileValues[key];
+            if (value === undefined) {
+                throw new errors_js_1.CliError(`Variable "${key}" is marked secret for environment "${environment}" but is missing from ${(0, dotenv_js_1.dotenvFileName)(environment)}.\nSet it with: slskit env set ${key}=<value> --secret --env ${environment}`);
+            }
+            overrides.push({ name, value });
+            continue;
+        }
+        overrides.push({ name, value: def.value ?? "" });
+    }
+    return overrides;
+}
+// The shorthand "Key=Value" form the AWS SAM CLI also accepts splits on whitespace,
+// so a value with a space in it is silently truncated -- "hello world" arrives as
+// "hello". The explicit ParameterKey/ParameterValue form with the value quoted is the
+// only one that survives spaces, commas and equals signs alike. Backslashes are
+// deliberately left alone: escaping them doubles them.
+function quoteValue(value) {
+    return `"${value.replace(/"/g, '\\"')}"`;
+}
+function toCliArguments(overrides) {
+    return overrides.map(({ name, value }) => `ParameterKey=${name},ParameterValue=${quoteValue(value)}`);
+}

package/dist/commands/env/templates.d.ts

@@ -0,0 +1,3 @@
+import type { ProjectManifest } from "../../core/environments.js";
+export declare function regenerateTemplates(cwd: string, manifest: ProjectManifest): string[];
+export declare function syncTemplates(cwd: string, manifest: ProjectManifest): string[];

package/dist/commands/env/templates.js

@@ -0,0 +1,65 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.regenerateTemplates = regenerateTemplates;
+exports.syncTemplates = syncTemplates;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const helpers_js_1 = require("../init/templates/helpers.js");
+const types_js_1 = require("../init/types.js");
+const sam_js_1 = require("../init/templates/sam.js");
+const manifest_js_1 = require("../function/manifest.js");
+const keys_js_1 = require("./keys.js");
+// Templates declare a CloudFormation parameter per variable name, so every template
+// has to be rewritten whenever that set changes in any environment.
+function regenerateTemplates(cwd, manifest) {
+    const functionView = manifest;
+    if (!Array.isArray(functionView.applications)) {
+        return [];
+    }
+    const answers = (0, manifest_js_1.toInitAnswers)(functionView);
+    const apps = (0, manifest_js_1.toServiceDefs)(functionView);
+    const envKeys = (0, keys_js_1.projectEnvKeys)(cwd, manifest);
+    const written = [];
+    for (const app of apps) {
+        const relative = (0, types_js_1.serviceTemplatePath)(app.name);
+        const full = node_path_1.default.join(cwd, relative);
+        // Absent in a project generated before services had their own templates.
+        node_fs_1.default.mkdirSync(node_path_1.default.dirname(full), { recursive: true });
+        node_fs_1.default.writeFileSync(full, (0, sam_js_1.samServiceTemplate)(answers, app, envKeys));
+        written.push(relative);
+    }
+    node_fs_1.default.writeFileSync(node_path_1.default.join(cwd, "template.yaml"), (0, sam_js_1.samRootTemplate)(answers, apps, envKeys));
+    written.push("template.yaml");
+    return written;
+}
+// The stage parameters the root template currently declares. Scoped to the
+// Parameters block so a resource that happens to start with "Env" is never counted.
+function declaredStageParameters(cwd) {
+    const file = node_path_1.default.join(cwd, "template.yaml");
+    if (!node_fs_1.default.existsSync(file)) {
+        return new Set();
+    }
+    const body = node_fs_1.default.readFileSync(file, "utf8");
+    const block = /^Parameters:\n((?: .*\n|\n)*)/m.exec(body);
+    if (!block) {
+        return new Set();
+    }
+    const names = new Set();
+    for (const match of block[1].matchAll(/^ {2}(Env[A-Za-z0-9]*):$/gm)) {
+        names.add(match[1]);
+    }
+    return names;
+}
+// Variables can appear without any slskit command running -- someone edits
+// .env.production by hand -- so "run" and "deploy" reconcile the templates with the
+// current key set before handing anything to SAM. Returns the files it rewrote,
+// empty when they were already in step.
+function syncTemplates(cwd, manifest) {
+    const wanted = new Set((0, keys_js_1.projectEnvKeys)(cwd, manifest).map(helpers_js_1.envParameterName));
+    const declared = declaredStageParameters(cwd);
+    const inStep = wanted.size === declared.size && [...wanted].every((name) => declared.has(name));
+    return inStep ? [] : regenerateTemplates(cwd, manifest);
+}