@farthershore/cli 0.14.6 → 0.14.8

package/README.md

@@ -315,6 +315,28 @@ Use `consumer list` first to discover `subscriberId`. `block` suspends a user
 and revokes active API keys. `remove` is irreversible and tears down subscriber
 state across billing, edge credentials, and subscriptions.
 
+### `farthershore secret`
+
+Manage private business secrets. These are API-controlled operational values,
+not repo-authored product behavior. Values are encrypted at rest and list/read
+responses return metadata only.
+
+```bash
+farthershore secret list weather-api --format json
+printf '%s' "$CLERK_SECRET_KEY" | farthershore secret set weather-api \
+  CLERK_SECRET_KEY \
+  --from-stdin \
+  --target RUNTIME \
+  --format json
+farthershore secret delete weather-api CLERK_SECRET_KEY --yes --format json
+```
+
+Use `frontend env` for public browser-visible variables such as
+`NEXT_PUBLIC_*`, `VITE_PUBLIC_*`, or analytics keys. Use `secret` for server
+runtime and private build values. `BUILD` secrets are injected only into managed
+frontend builds and require a redeploy after changes; `RUNTIME` secrets are for
+trusted server/backend runtime code and are never emitted into browser config.
+
 ### `farthershore backend`
 
 Create BYO backends and provision runtime tokens for upstream services. Core
@@ -643,6 +665,7 @@ operation registry that generates the CLI command groups. Tool names use the
   `fs_promo_code_update`, `fs_promo_code_archive`,
   `fs_promo_code_reactivate`
 - Consumers: `fs_consumer_list`, `fs_consumer_block`, `fs_consumer_remove`
+- Secrets: `fs_secret_list`, `fs_secret_set`, `fs_secret_delete`
 - Personas: `fs_persona_bootstrap`, `fs_persona_list`, `fs_persona_revoke`
 - Usage and maker tokens: `fs_usage_read`, `fs_maker_token_list`