@earthlink/dotvault 0.13.0 → 0.14.0

package/dist/index.js

@@ -246,7 +246,7 @@ async function loadProjectConfig(cwd = process.cwd()) {
   const cfg = await loadProjectConfigIfPresent(cwd);
   if (cfg === null) {
     throw new ValidationError(
-      `No project-config.json found at ${path}. Run \`env-sync init\` here, or run env-sync from a directory that has one.`
+      `No project-config.json found at ${path}. Run \`dotvault init\` here, or run dotvault from a directory that has one.`
     );
   }
   return cfg;
@@ -287,7 +287,7 @@ function parseProjectConfig(raw, source = "<inline>") {
   const apiUrl = proxyRaw?.apiUrl;
   if (typeof apiUrl !== "string" || apiUrl.length === 0) {
     throw new ValidationError(
-      `${source}: 'setup.bootstrap.proxy.apiUrl' is required for env-sync CLI`
+      `${source}: 'setup.bootstrap.proxy.apiUrl' is required for dotvault CLI`
     );
   }
   const envSyncRaw = parsed.setup?.envSync;
@@ -349,6 +349,9 @@ function parseProjectConfig(raw, source = "<inline>") {
 function resolveEnv(flag, appEnvVar, defaultEnv) {
   return flag ?? appEnvVar ?? defaultEnv;
 }
+function envVarOverride(env = process.env) {
+  return env.DOTVAULT_ENV ?? env.APP_ENV;
+}
 
 // src/http.ts
 function createHttpClient(apiUrl, fetchImpl = fetch) {
@@ -380,7 +383,7 @@ function createHttpClient(apiUrl, fetchImpl = fetch) {
         method: "GET",
         headers: jsonHeaders(token)
       });
-      return handleResponse(res);
+      return handleResponse(res, { project: query.project, env: query.env });
     },
     async envPullAll(token, query) {
       const url = new URL(`${base}/env/pull`);
@@ -390,7 +393,7 @@ function createHttpClient(apiUrl, fetchImpl = fetch) {
         method: "GET",
         headers: jsonHeaders(token)
       });
-      return handleResponse(res);
+      return handleResponse(res, { project: query.project, env: query.env });
     },
     async envList(token, query) {
       const url = new URL(`${base}/env/list`);
@@ -399,7 +402,7 @@ function createHttpClient(apiUrl, fetchImpl = fetch) {
         method: "GET",
         headers: jsonHeaders(token)
       });
-      return handleResponse(res);
+      return handleResponse(res, { project: query.project });
     },
     async envKeysPut(token, query, body) {
       const url = writeUrl(base, "/env/keys", query);
@@ -429,7 +432,7 @@ function createHttpClient(apiUrl, fetchImpl = fetch) {
         method: "GET",
         headers: jsonHeaders(token)
       });
-      return handleResponse(res);
+      return handleResponse(res, { project: query.project, env: query.env });
     },
     async envRollback(token, query, body) {
       const url = writeUrl(base, "/env/rollback", query);
@@ -459,7 +462,7 @@ function createHttpClient(apiUrl, fetchImpl = fetch) {
         method: "GET",
         headers: jsonHeaders(token)
       });
-      return handleResponse(res);
+      return handleResponse(res, { project: query.project, env: query.env });
     },
     async envGlobalKeys(token, query, opts) {
       const url = new URL(`${base}/env/global-keys`);
@@ -580,7 +583,7 @@ async function callFetch(fetchImpl, url, init) {
     );
   }
 }
-async function handleResponse(res) {
+async function handleResponse(res, ctx) {
   if (res.ok) {
     return await res.json();
   }
@@ -604,21 +607,90 @@ async function handleResponse(res) {
     throw new AuthRequiredError(message);
   }
   if (res.status === 403) {
-    throw new PermissionDeniedError("unknown", "unknown");
+    throw new PermissionDeniedError(
+      ctx?.project ?? "(unknown project)",
+      ctx?.env ?? "(unknown env)"
+    );
   }
   if (res.status === 404) {
-    throw new ProjectNotFoundError("unknown", "unknown");
+    throw new ProjectNotFoundError(
+      ctx?.project ?? "(unknown project)",
+      ctx?.env ?? "(unknown env)"
+    );
   }
   throw new EnvSyncError(code, message, 99);
 }
 
 // src/keychain.ts
+import { promises as fs } from "fs";
+import { homedir } from "os";
+import { join } from "path";
 var SERVICE = "eln-env-sync";
+function fallbackDir() {
+  const base = process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config");
+  return join(base, "dotvault");
+}
+function fallbackPath() {
+  return join(fallbackDir(), "credentials.json");
+}
+async function readStore() {
+  try {
+    return JSON.parse(await fs.readFile(fallbackPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function writeStore(store) {
+  await fs.mkdir(fallbackDir(), { recursive: true, mode: 448 });
+  await fs.writeFile(fallbackPath(), JSON.stringify(store), { mode: 384 });
+}
+var fileKeychain = {
+  async setPassword(service, account, password) {
+    const store = await readStore();
+    (store[service] ??= {})[account] = password;
+    await writeStore(store);
+  },
+  async getPassword(service, account) {
+    const store = await readStore();
+    return store[service]?.[account] ?? null;
+  },
+  async deletePassword(service, account) {
+    const store = await readStore();
+    if (store[service]?.[account] === void 0) return false;
+    delete store[service][account];
+    await writeStore(store);
+    return true;
+  },
+  async findCredentials(service) {
+    const store = await readStore();
+    return Object.entries(store[service] ?? {}).map(([account, password]) => ({
+      account,
+      password
+    }));
+  }
+};
 var keytarInstance;
+var warnedFallback = false;
+function warnFallbackOnce() {
+  if (warnedFallback) return;
+  warnedFallback = true;
+  process.stderr.write(
+    `dotvault: OS keychain unavailable (keytar could not load). Falling back to file-based token storage at ${fallbackPath()} (mode 0600).
+On Linux, install libsecret (e.g. \`apt-get install libsecret-1-0\`) for the system keychain, or use a service token (DOTVAULT_TOKEN) for headless/CI mode.
+`
+  );
+}
 async function getKeytar() {
   if (keytarInstance === void 0) {
-    const mod = await import("keytar");
-    keytarInstance = mod.default ?? mod;
+    try {
+      const mod = await import("keytar");
+      const k = mod.default ?? mod;
+      await k.findCredentials(SERVICE);
+      keytarInstance = k;
+    } catch {
+      warnFallbackOnce();
+      keytarInstance = fileKeychain;
+    }
   }
   return keytarInstance;
 }
@@ -868,7 +940,7 @@ import { resolve as resolve3, basename as basename2 } from "path";
 
 // src/env-writer.ts
 import { chmod, readFile as readFile2, rename, unlink, writeFile } from "fs/promises";
-import { dirname, basename, join } from "path";
+import { dirname, basename, join as join2 } from "path";
 import { randomBytes } from "crypto";
 var MARKER_BEGIN = "# BEGIN: eln-bootstrap-envsync (managed by env-sync)";
 var MARKER_END = "# END: eln-bootstrap-envsync";
@@ -921,7 +993,7 @@ async function prepareRewrite(target, keys) {
   const next = composeFile(outside, block);
   const dir = dirname(target);
   const tmpName = `.${basename(target)}.${randomBytes(6).toString("hex")}.tmp`;
-  const tmp = join(dir, tmpName);
+  const tmp = join2(dir, tmpName);
   return {
     target,
     tmp,
@@ -979,7 +1051,7 @@ ${block}
 async function pullCommand(opts = {}) {
   const cfg = await loadProjectConfig(opts.cwd);
   const project = opts.project ?? cfg.name;
-  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const env = resolveEnv(opts.env, envVarOverride(), cfg.envSync.defaultEnv);
   const cwd = opts.cwd ?? process.cwd();
   const explicitFile = opts.file ?? (opts.target !== void 0 ? basename2(opts.target) : void 0);
   const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
@@ -1070,7 +1142,7 @@ async function buildAuthedFetch2(http) {
 import { spawn as nodeSpawn } from "child_process";
 import { mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir } from "os";
-import { basename as basename3, join as join2, resolve as resolve4 } from "path";
+import { basename as basename3, join as join3, resolve as resolve4 } from "path";
 async function runCommand(opts) {
   if (opts.command === void 0 || opts.command.length === 0) {
     throw new EnvSyncError(
@@ -1081,7 +1153,7 @@ async function runCommand(opts) {
   }
   const cfg = await loadProjectConfig(opts.cwd);
   const project = opts.project ?? cfg.name;
-  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const env = resolveEnv(opts.env, envVarOverride(), cfg.envSync.defaultEnv);
   const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
   const authedFetch = await buildAuthedFetch3(http);
   let merged = {};
@@ -1108,8 +1180,8 @@ async function runCommand(opts) {
     ).catch(() => null);
     for (const f of fileResp?.files ?? []) {
       if (f.pointerEnv !== void 0) {
-        tmpDir ??= mkdtempSync(join2(tmpdir(), "env-sync-files-"));
-        const p = join2(tmpDir, basename3(f.name));
+        tmpDir ??= mkdtempSync(join3(tmpdir(), "env-sync-files-"));
+        const p = join3(tmpDir, basename3(f.name));
         writeFileSync2(p, f.content, { mode: 384 });
         childEnv[f.pointerEnv] = p;
       } else {
@@ -1178,7 +1250,7 @@ import { basename as basename4, resolve as resolve5 } from "path";
 async function resolveAuth(opts) {
   const cfg = await loadProjectConfig(opts.cwd);
   const project = opts.project ?? cfg.name;
-  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const env = resolveEnv(opts.env, envVarOverride(), cfg.envSync.defaultEnv);
   const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
   const serviceToken = resolveServiceToken();
   if (serviceToken !== void 0 && serviceToken.length > 0) {
@@ -1242,7 +1314,7 @@ async function filesCommand(opts) {
 
 // src/scan.ts
 import { readdirSync, readFileSync, statSync } from "fs";
-import { join as join3, relative } from "path";
+import { join as join4, relative } from "path";
 var RULES = [
   { id: "aws-access-key-id", description: "AWS Access Key ID", regex: /AKIA[0-9A-Z]{16}/g },
   {
@@ -1331,7 +1403,7 @@ function scanPaths(paths, root = process.cwd()) {
     if (st.isDirectory()) {
       for (const entry of readdirSync(p)) {
         if (SKIP_DIRS.has(entry)) continue;
-        visit(join3(p, entry));
+        visit(join4(p, entry));
       }
       return;
     }
@@ -1355,7 +1427,7 @@ import { resolve as resolve6 } from "path";
 async function resolveContext(opts) {
   const cfg = await loadProjectConfig(opts.cwd);
   const project = opts.project ?? cfg.name;
-  const env = resolveEnv(opts.env, process.env.APP_ENV, cfg.envSync.defaultEnv);
+  const env = resolveEnv(opts.env, envVarOverride(), cfg.envSync.defaultEnv);
   const fileInput = opts.file ?? cfg.envSync.files[0];
   const file = slugToFileName(fileNameToSlug(fileInput));
   const http = opts.http ?? createHttpClient(cfg.proxy.apiUrl);
@@ -1688,7 +1760,7 @@ function buildProgram() {
     "after",
     `
 Examples:
-  $ dotvault login                    # browser-based auth (Cognito)
+  $ dotvault login                    # email + password auth (Cognito)
   $ dotvault pull                     # write .env / .npmrc etc. to local disk
   $ dotvault run -- npm run dev       # inject secrets into child process (no file written)
   $ dotvault push .npmrc              # add any file to the sync set