@ductape/cli 0.3.32 → 0.3.33

package/dist/commands/resources.js

@@ -8,6 +8,16 @@ import { printJson } from '../lib/output.js';
 import { DuctapeOperationError } from '../lib/operation-error.js';
 import { readCanonicalTopicFile, topicBodyForTransport, validateEventTopicsProject, } from '../lib/event-topics.js';
 const CRUD_VERBS = ['create', 'list', 'get', 'update', 'delete', 'connect'];
+// Modules whose SDK exposes a real fetchAll(product) that decrypts/resolves secret-backed env
+// fields per-env, the same way their single-resource `fetch` does. `resources <module> list` must
+// route through the SDK for these instead of the raw-product-document shortcut below, which plucks
+// the component array straight off the unmodified product document — any secret-backed field
+// (connection_url/username/password) is still in its raw encrypted-at-rest form there, never
+// resolved to a $Secret{} reference. Confirmed by reading source: graphs.service.ts fetchAll() ->
+// products.service.ts fetchGraphs() decrypts each env; databases.service.ts fetchAllDatabases() ->
+// fetchDatabases() decrypts connection_url; vector-database.service.ts fetchAll() has the same
+// per-env resolution. Other modules are left on the shortcut below, unverified.
+const MODULES_WITH_DECRYPTING_FETCH_ALL = new Set(['graph', 'databases', 'vector']);
 export function resolveResourceProductTag(override, linkedProductTag) {
     return override?.trim() || linkedProductTag;
 }
@@ -296,7 +306,7 @@ export async function runResourceCrud(typeName, verb, opts, extraArgs) {
     // body) destructures product's string as `options` and fails with "No database connection
     // established", not a useful error about the definition update. The definition updater is a
     // separate method, databases.updateDatabase(product, database, data).
-    const proxyMethod = (module === 'models' || module === 'feature') && method === 'list'
+    const proxyMethod = (module === 'models' || module === 'feature' || MODULES_WITH_DECRYPTING_FETCH_ALL.has(module)) && method === 'list'
         ? 'fetchAll'
         : module === 'databases' && method === 'update'
             ? 'updateDatabase'
@@ -336,7 +346,7 @@ export async function runResourceCrud(typeName, verb, opts, extraArgs) {
         body: payload,
     });
     const proxy = getSdkProxy(session);
-    if (crud === 'list') {
+    if (crud === 'list' && !MODULES_WITH_DECRYPTING_FETCH_ALL.has(module)) {
         const product = await proxy.execute('product', 'fetch', [productTag]);
         const catalogue = listComponentsFromProduct(module, product);
         if (catalogue !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/cli",
-  "version": "0.3.32",
+  "version": "0.3.33",
   "description": "Ductape CLI — local platform, login, link projects, and manage resources via the proxy (Workbench-compatible)",
   "type": "module",
   "main": "dist/index.js",