@athsra/cli 1.1.5 → 1.1.7

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@athsra/cli",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "athsra CLI — E2EE secret manager on Cloudflare edge. Doppler-style dev UX + zero-knowledge encryption + soft-delete + version history. MIT.",
   "type": "module",
   "main": "./src/index.ts",
   "bin": {
-    "athsra": "./src/index.ts"
+    "athsra": "src/index.ts"
   },
   "license": "MIT",
   "repository": {

package/src/commands/rotate-master.ts

@@ -88,15 +88,33 @@ export async function rotateMasterCmd(_args: string[]): Promise<number> {
     }
   }
 
-  // 1. 모든 projects decrypt (옛 master pw, v1+v2 dispatcher)
+  // 1. 모든 project × 모든 활성 config decrypt (옛 master pw, v1+v2 dispatcher). 비-default 환경
+  //    (dev/staging/prod)까지 포함해야 한다 — 누락하면 회전 후 옛 pw 소실로 그 환경 시크릿이 영구
+  //    복호 불가(데이터 손실). dashboard lib/rotate-master 와 동일 정합.
   const projects = await client.listProjects();
-  console.log(`\n• Decrypting ${projects.length} projects with old master pw...`);
-  const plaintexts: Record<string, Record<string, string>> = {};
+  const targets: { project: string; config: string }[] = [];
   for (const p of projects) {
-    const plain = await readPlain(ctx, p);
+    try {
+      const res = await client.listConfigs(p);
+      const active = res.configs.filter((c) => c.active && !c.deleted).map((c) => c.config);
+      if (active.length === 0) targets.push({ project: p, config: 'default' });
+      else for (const config of active) targets.push({ project: p, config });
+    } catch {
+      // listConfigs 실패 — 최소 default 는 시도(누락보다 안전).
+      targets.push({ project: p, config: 'default' });
+    }
+  }
+  const cfgLabel = (t: { project: string; config: string }) =>
+    t.config === 'default' ? t.project : `${t.project}:${t.config}`;
+  console.log(
+    `\n• Decrypting ${targets.length} envelope(s) across ${projects.length} project(s) with old master pw...`,
+  );
+  const decrypted: { project: string; config: string; plain: Record<string, string> }[] = [];
+  for (const t of targets) {
+    const plain = await readPlain(ctx, t.project, t.config);
     if (!plain) continue;
-    plaintexts[p] = plain;
-    console.log(`  ✓ ${p} (${Object.keys(plain).length} keys)`);
+    decrypted.push({ project: t.project, config: t.config, plain });
+    console.log(`  ✓ ${cfgLabel(t)} (${Object.keys(plain).length} keys)`);
   }
 
   // 2. identity 키쌍 재포장 재료 계산 (있으면) — old pw 로 unwrap → new pw 로 wrap. proof 회전
@@ -135,18 +153,18 @@ export async function rotateMasterCmd(_args: string[]): Promise<number> {
 
   // 4. re-encrypt + PUT (v2 envelope, 자동 마이그레이션)
   console.log(
-    `\n• Re-encrypting ${Object.keys(plaintexts).length} projects with new master pw ` +
+    `\n• Re-encrypting ${decrypted.length} envelope(s) with new master pw ` +
       '(v2, Argon2id m=256MB enterprise)...',
   );
-  for (const [p, plain] of Object.entries(plaintexts)) {
+  for (const { project, config, plain } of decrypted) {
     // rotate-master = enterprise KDF 마이그레이션 지점 (m=256MB). 이후 routine set 은
-    // writePlain 의 보존 로직으로 256MB 유지 (silent downgrade 없음).
-    await writePlain(newCtx, p, plain, { kdfParams: ENTERPRISE_KDF });
-    console.log(`  ✓ ${p}`);
+    // writePlain 의 보존 로직으로 256MB 유지 (silent downgrade 없음). config 전파 필수.
+    await writePlain(newCtx, project, plain, { kdfParams: ENTERPRISE_KDF, config });
+    console.log(`  ✓ ${cfgLabel({ project, config })}`);
   }
 
   console.log(
-    `\n✓ master password rotated. ${Object.keys(plaintexts).length} projects re-encrypted ` +
+    `\n✓ master password rotated. ${decrypted.length} envelope(s) re-encrypted ` +
       'as v2 (Argon2id m=256MB).',
   );
   console.log(

package/src/index.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env bun
+import pkg from '../package.json';
 import { projectCmd, roleCmd, usersCmd } from './commands/admin.ts';
 import { adoptCmd } from './commands/adopt.ts';
 import { auditCmd } from './commands/audit.ts';
@@ -29,7 +30,8 @@ import { setCmd } from './commands/set.ts';
 import { unsetCmd } from './commands/unset.ts';
 import { versionsCmd } from './commands/versions.ts';
 
-const VERSION = '1.1.3';
+// package.json 단일 출처 — 하드코딩 desync 방지(1.1.3 이후 bump 누락으로 --version 이 stale 했던 버그 근본 수정).
+const VERSION = pkg.version;
 
 const commands: Record<string, (args: string[]) => Promise<number>> = {
   login: loginCmd,