@fentaris/cli 0.2.3 → 0.3.1

package/dist/app/main.js

@@ -23,12 +23,12 @@ export async function main(argv, runtime) {
     }
 }
 async function route(command, runtime) {
-    if (command.name === "help" || command.options.help === true) {
-        printHelp(runtime);
+    if (command.name === "version" || (command.name === "help" && (command.options.version === true || command.options.v === true))) {
+        runtime.out.log(cliVersion);
         return;
     }
-    if (command.name === "version") {
-        runtime.out.log(cliVersion);
+    if (command.name === "help" || command.options.help === true || command.options.h === true) {
+        printHelp(runtime);
         return;
     }
     if (command.name === "auth") {

package/dist/app/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/app/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,OAAgB;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAAmB,EAAE,OAAgB;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC7D,SAAS,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,uBAAuB,CAAC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../../src/app/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,OAAgB;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,OAAmB,EAAE,OAAgB;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QAChI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3F,SAAS,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,IAAI,uBAAuB,CAAC,CAAC;AAC3E,CAAC"}

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI9D,wBAAsB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAepF"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI9D,wBAAsB,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBpF"}

package/dist/commands/doctor.js

@@ -6,6 +6,7 @@ export async function runDoctor(command, runtime) {
         fix: command.options.fix === true,
         runtime: command.options.runtime === true,
         timeoutMs: numberOption(command.options, "timeout", 10_000),
+        strict: command.options.strict === true,
     });
     if (command.options.json === true) {
         runtime.out.log(JSON.stringify({ results }, null, 2));

package/dist/commands/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAmB,EAAE,OAAgB;IACnE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE;QAC9C,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;QACzC,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;KAC5D,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3B,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAEtF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAmB,EAAE,OAAgB;IACnE,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE;QAC9C,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI;QACzC,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;QAC3D,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI;KACxC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3B,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC"}

package/dist/commands/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAG9D,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBrF"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI9D,wBAAsB,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BrF"}

package/dist/commands/secrets.js

@@ -1,21 +1,153 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { authKeyFromRuntime, secretScope, storeCredential } from "../domain/auth/local-store.js";
+import { manifestFromSecretRefs, manifestsEqual, parseManifest, serializeManifest } from "@fentaris/core";
+import { secretScope } from "../domain/auth/local-store.js";
+import { manifestPath, openLocalSecretsBackend, scopeFromOptions } from "../domain/secrets/backend.js";
+import { buildListRows, getSecretsDoctorIssues, loadRequiredReferences } from "../domain/secrets/doctor.js";
+import { scanEntrypointForSecrets } from "../domain/secrets/manifest-scan.js";
 import { discoverProject } from "../domain/project/project.js";
+import { exists } from "../shared/utils.js";
 import { section, style } from "../ui/format.js";
 export async function runSecrets(command, runtime) {
     const [action, reference] = command.args;
-    if (action !== "set" || !reference) {
-        throw new Error("Usage: fentaris secrets set <reference> [--user <id> | --group <id>]");
+    if (!action) {
+        throw new Error("Usage: fentaris secrets <set|list|unset|manifest|doctor> ...");
+    }
+    if (action === "set") {
+        await runSecretsSet(command, reference, runtime);
+        return;
+    }
+    if (action === "list") {
+        await runSecretsList(command, runtime);
+        return;
+    }
+    if (action === "unset") {
+        await runSecretsUnset(command, reference, runtime);
+        return;
     }
-    if (typeof command.options.user === "string" && typeof command.options.group === "string") {
-        throw new Error("Use either --user or --group, not both.");
+    if (action === "manifest") {
+        await runSecretsManifest(command, runtime);
+        return;
+    }
+    if (action === "doctor") {
+        await runSecretsDoctor(command, runtime);
+        return;
+    }
+    throw new Error(`Unknown secrets command "${action}". Run fentaris help.`);
+}
+async function runSecretsSet(command, reference, runtime) {
+    if (!reference) {
+        throw new Error("Usage: fentaris secrets set <reference> [--user <id> | --group <id>]");
     }
     const project = await discoverProject(runtime.cwd);
-    const key = await authKeyFromRuntime(runtime, command.options);
+    const backend = await openLocalSecretsBackend(project, runtime, command.options);
+    if (!(await backend.credentialsExist())) {
+        await backend.initEmpty();
+    }
     const value = typeof command.options.value === "string" ? command.options.value : await runtime.prompt.text(`Secret value for ${reference}`, { secret: true });
-    await storeCredential(path.join(project.root, project.config.authDir), key, reference, value, command.options);
+    await backend.set(reference, value, scopeFromOptions(command.options));
     section(runtime, "Secrets");
     runtime.out.log(`  ${style.pass(`Stored ${reference} as ${secretScope(command.options)} credential.`)}`);
     runtime.out.log("Value: <redacted>");
 }
+async function runSecretsUnset(command, reference, runtime) {
+    if (!reference) {
+        throw new Error("Usage: fentaris secrets unset <reference> [--user <id> | --group <id>]");
+    }
+    const project = await discoverProject(runtime.cwd);
+    const backend = await openLocalSecretsBackend(project, runtime, command.options);
+    await backend.unset(reference, scopeFromOptions(command.options));
+    section(runtime, "Secrets");
+    runtime.out.log(`  ${style.pass(`Removed ${reference} from ${secretScope(command.options)} credentials.`)}`);
+}
+async function runSecretsList(command, runtime) {
+    const project = await discoverProject(runtime.cwd);
+    const backend = await openLocalSecretsBackend(project, runtime, command.options);
+    const stored = await backend.listRefs();
+    const required = await loadRequiredReferences(project);
+    const rows = buildListRows(required, stored);
+    if (command.options.json === true) {
+        runtime.out.log(JSON.stringify({ provider: "local", secrets: rows }, null, 2));
+        return;
+    }
+    section(runtime, "Secrets (local)");
+    if (rows.length === 0) {
+        runtime.out.log(`  ${style.hint("No secrets stored yet. Run fentaris secrets set <reference>.")}`);
+        return;
+    }
+    runtime.out.log(`  ${style.label("REF".padEnd(24))}${style.label("SCOPE".padEnd(18))}${style.label("STATUS")}`);
+    for (const row of rows) {
+        const status = row.status === "missing" ? style.fail("missing") : row.status === "set" ? style.pass("set") : style.pass(row.status);
+        runtime.out.log(`  ${row.ref.padEnd(24)}${row.scope.padEnd(18)}${status}`);
+    }
+}
+async function runSecretsManifest(command, runtime) {
+    const project = await discoverProject(runtime.cwd);
+    const entrypoint = path.join(project.root, project.config.entrypoint);
+    if (!(await exists(entrypoint))) {
+        throw new Error(`Entrypoint not found: ${project.config.entrypoint}`);
+    }
+    const scanned = await scanEntrypointForSecrets(entrypoint);
+    const manifest = manifestFromSecretRefs(scanned.references.map((entry) => ({
+        ref: entry.ref,
+        scope: decodeManifestScope(entry.scope),
+        kind: "credential",
+        count: 1,
+    })), scanned.envVars);
+    const target = manifestPath(project);
+    if (command.options.check === true) {
+        if (!(await exists(target))) {
+            throw new Error("secrets.manifest.json is missing. Run fentaris secrets manifest.");
+        }
+        const current = parseManifest(JSON.parse(await readFile(target, "utf8")));
+        if (!manifestsEqual(current, manifest)) {
+            throw new Error("secrets.manifest.json is out of date. Run fentaris secrets manifest.");
+        }
+        section(runtime, "Secrets manifest");
+        runtime.out.log(`  ${style.pass("secrets.manifest.json matches entrypoint.")}`);
+        return;
+    }
+    await mkdir(path.dirname(target), { recursive: true });
+    await writeFile(target, serializeManifest(manifest));
+    section(runtime, "Secrets manifest");
+    runtime.out.log(`  ${style.pass(`Wrote ${path.relative(project.root, target)}`)}`);
+    runtime.out.log(`  ${style.hint(`${manifest.references.length} credential reference(s)${manifest.envVars?.length ? `, ${manifest.envVars.length} env var(s)` : ""}.`)}`);
+}
+async function runSecretsDoctor(command, runtime) {
+    const project = await discoverProject(runtime.cwd);
+    const issues = await getSecretsDoctorIssues(project, runtime, { strict: command.options.strict === true });
+    if (command.options.json === true) {
+        runtime.out.log(JSON.stringify({ issues }, null, 2));
+    }
+    else {
+        section(runtime, "Secrets doctor");
+        if (issues.length === 0) {
+            runtime.out.log(`  ${style.pass("All secrets checks passed.")}`);
+        }
+        else {
+            for (const issue of issues) {
+                const marker = issue.status === "pass" ? style.pass : issue.status === "warn" ? style.warn : style.fail;
+                runtime.out.log(`  ${marker(`${issue.ref} (${issue.scope})`)} ${style.hint(issue.detail)}`);
+                if (issue.hint) {
+                    runtime.out.log(`    ${style.hint(`→ ${issue.hint}`)}`);
+                }
+            }
+        }
+    }
+    if (issues.some((issue) => issue.status === "fail") || (command.options.strict === true && issues.some((issue) => issue.status === "warn"))) {
+        throw new Error("Secrets doctor reported issues.");
+    }
+}
+function decodeManifestScope(scope) {
+    if (scope === "default") {
+        return { kind: "default" };
+    }
+    if (scope.startsWith("user:")) {
+        return { kind: "user", id: scope.slice("user:".length) };
+    }
+    if (scope.startsWith("group:")) {
+        return { kind: "group", id: scope.slice("group:".length) };
+    }
+    return { kind: "default" };
+}
 //# sourceMappingURL=secrets.js.map

package/dist/commands/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAmB,EAAE,OAAgB;IACpE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACzC,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/J,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/G,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,SAAS,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACvG,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC5G,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAmB,EAAE,OAAgB;IACpE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1B,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,uBAAuB,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAmB,EAAE,SAA6B,EAAE,OAAgB;IAC/F,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/J,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,UAAU,SAAS,OAAO,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAmB,EAAE,SAA6B,EAAE,OAAgB;IACjG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,SAAS,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;AAC/G,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAmB,EAAE,OAAgB;IACjE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE7C,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IAED,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,EAAE,CAAC,CAAC;QACnG,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAmB,EAAE,OAAgB;IACrE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACtE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,sBAAsB,CACrC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjC,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,IAAI,EAAE,YAAqB;QAC3B,KAAK,EAAE,CAAC;KACT,CAAC,CAAC,EACH,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAErC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAY,CAAC,CAAC;QACrF,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,2BAA2B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AAC3K,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAmB,EAAE,OAAgB;IACnE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAE3G,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5F,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBACf,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5I,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,MAAe,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAkB,EAAE,CAAC;AACtC,CAAC"}

package/dist/domain/auth/local-store.d.ts

@@ -1,11 +1,18 @@
-import { type LocalCredentials } from "@fentaris/core";
 import type { CliOptions, Runtime } from "../../shared/types.js";
 export declare function initLocalAuth(options: CliOptions): Promise<void>;
 export declare function storeCredential(dir: string, key: string, reference: string, value: string, options: CliOptions): Promise<void>;
+export declare function unsetCredential(dir: string, key: string, reference: string, options: CliOptions): Promise<void>;
 export declare function addUserApiKey(dir: string, key: string, userId: string, apiKey: string): Promise<void>;
 export declare function inspectAuthFiles(dir: string, key: string): Promise<unknown>;
 export declare function authKeyFromRuntime(runtime: Runtime, options: CliOptions): Promise<string>;
 export declare function secretScope(options: CliOptions): string;
-export declare function readCredentials(dir: string, key: string): Promise<LocalCredentials>;
-export declare function writeCredentials(dir: string, key: string, credentials: LocalCredentials): Promise<void>;
+export declare function readCredentials(dir: string, key: string): Promise<{
+    users: Record<string, {
+        apiKeys: string[];
+        credentials: Record<string, string>;
+    }>;
+    groups: Record<string, Record<string, string>>;
+    defaults: Record<string, string>;
+}>;
+export declare function writeCredentials(dir: string, key: string, credentials: Awaited<ReturnType<typeof readCredentials>>): Promise<void>;
 //# sourceMappingURL=local-store.d.ts.map

package/dist/domain/auth/local-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-store.d.ts","sourceRoot":"","sources":["../../../src/domain/auth/local-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGjE,wBAAsB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtE;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAapI;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS3G;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAkBjF;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ/F;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAQvD;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAEzF;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7G"}
+{"version":3,"file":"local-store.d.ts","sourceRoot":"","sources":["../../../src/domain/auth/local-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGjE,wBAAsB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtE;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBpI;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAcrH;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAU3G;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA0BjF;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ/F;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAQvD;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;;;;GAG7D;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxI"}

package/dist/domain/auth/local-store.js

@@ -1,30 +1,51 @@
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { FentarisAuth } from "@fentaris/core";
+import { LocalSecretsBackend } from "@fentaris/core";
 import { redactRecord, required } from "../../shared/utils.js";
 export async function initLocalAuth(options) {
     const dir = required(options, "dir");
     const key = required(options, "key");
-    await mkdir(dir, { recursive: true });
-    await writeCredentials(dir, key, { users: {}, groups: {}, defaults: {} });
+    await LocalSecretsBackend.open({ dir, key });
+    const backend = new LocalSecretsBackend({ dir, key });
+    await backend.initEmpty();
 }
 export async function storeCredential(dir, key, reference, value, options) {
-    const credentials = await readCredentials(dir, key);
+    const backend = await openBackend(dir, key);
+    if (!(await backend.credentialsExist())) {
+        await backend.initEmpty();
+    }
+    if (typeof options.user === "string" && typeof options.group === "string") {
+        throw new Error("Use either --user or --group, not both.");
+    }
     if (typeof options.user === "string") {
-        const user = credentials.users[options.user] ?? { apiKeys: [], credentials: {} };
-        credentials.users[options.user] = { ...user, credentials: { ...user.credentials, [reference]: value } };
+        await backend.set(reference, value, { kind: "user", id: options.user });
+        return;
     }
-    else if (typeof options.group === "string") {
-        credentials.groups[options.group] = { ...(credentials.groups[options.group] ?? {}), [reference]: value };
+    if (typeof options.group === "string") {
+        await backend.set(reference, value, { kind: "group", id: options.group });
+        return;
     }
-    else {
-        credentials.defaults[reference] = value;
+    await backend.set(reference, value, { kind: "default" });
+}
+export async function unsetCredential(dir, key, reference, options) {
+    const backend = await openBackend(dir, key);
+    if (typeof options.user === "string" && typeof options.group === "string") {
+        throw new Error("Use either --user or --group, not both.");
     }
-    await writeCredentials(dir, key, credentials);
+    if (typeof options.user === "string") {
+        await backend.unset(reference, { kind: "user", id: options.user });
+        return;
+    }
+    if (typeof options.group === "string") {
+        await backend.unset(reference, { kind: "group", id: options.group });
+        return;
+    }
+    await backend.unset(reference, { kind: "default" });
 }
 export async function addUserApiKey(dir, key, userId, apiKey) {
     const credentials = await readCredentials(dir, key);
     const user = credentials.users[userId] ?? { apiKeys: [], credentials: {} };
+    const { FentarisAuth } = await import("@fentaris/core");
     const hashed = FentarisAuth.hashApiKey(apiKey);
     credentials.users[userId] = {
         ...user,
@@ -33,6 +54,8 @@ export async function addUserApiKey(dir, key, userId, apiKey) {
     await writeCredentials(dir, key, credentials);
 }
 export async function inspectAuthFiles(dir, key) {
+    const backend = await openBackend(dir, key);
+    const refs = await backend.listRefs();
     const credentials = await readCredentials(dir, key);
     return {
         credentials: {
@@ -46,6 +69,12 @@ export async function inspectAuthFiles(dir, key) {
             groups: Object.fromEntries(Object.entries(credentials.groups).map(([groupId, values]) => [groupId, redactRecord(values)])),
             defaults: redactRecord(credentials.defaults),
         },
+        refs: refs.map((entry) => ({
+            ref: entry.ref,
+            scope: entry.scope,
+            kind: entry.kind,
+            count: entry.count,
+        })),
     };
 }
 export async function authKeyFromRuntime(runtime, options) {
@@ -67,9 +96,16 @@ export function secretScope(options) {
     return "default";
 }
 export async function readCredentials(dir, key) {
+    const { FentarisAuth } = await import("@fentaris/core");
     return FentarisAuth.decryptCredentials(JSON.parse(await readFile(path.join(dir, "credentials.enc.json"), "utf8")), key);
 }
 export async function writeCredentials(dir, key, credentials) {
+    const { FentarisAuth } = await import("@fentaris/core");
+    await mkdir(dir, { recursive: true });
     await writeFile(path.join(dir, "credentials.enc.json"), JSON.stringify(FentarisAuth.encryptCredentials(credentials, key), null, 2));
 }
+async function openBackend(dir, key) {
+    await mkdir(dir, { recursive: true });
+    return LocalSecretsBackend.open({ dir, key });
+}
 //# sourceMappingURL=local-store.js.map

package/dist/domain/auth/local-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-store.js","sourceRoot":"","sources":["../../../src/domain/auth/local-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAyB,MAAM,gBAAgB,CAAC;AAErE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAmB;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW,EAAE,SAAiB,EAAE,KAAa,EAAE,OAAmB;IACnH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEpD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACjF,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1G,CAAC;SAAM,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7C,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;IAC3G,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC1C,CAAC;IAED,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW,EAAE,MAAc,EAAE,MAAc;IAC1F,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;QAC1B,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;KAClF,CAAC;IACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IAC7D,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEpD,OAAO;QACL,WAAW,EAAE;YACX,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;gBAC7D,MAAM;gBACN;oBACE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC;oBAClD,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC;iBACjD;aACF,CAAC,CACH;YACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1H,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC;SAC7C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,OAAmB;IAC5E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9F,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAmB;IAC7C,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,OAAO,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW;IAC5D,OAAO,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAY,EAAE,GAAG,CAAC,CAAC;AACrI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW,EAAE,WAA6B;IAC5F,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtI,CAAC"}
+{"version":3,"file":"local-store.js","sourceRoot":"","sources":["../../../src/domain/auth/local-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAmB;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW,EAAE,SAAiB,EAAE,KAAa,EAAE,OAAmB;IACnH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW,EAAE,SAAiB,EAAE,OAAmB;IACpG,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW,EAAE,MAAc,EAAE,MAAc;IAC1F,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC3E,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;QAC1B,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC;KAClF,CAAC;IACF,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IAC7D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEpD,OAAO;QACL,WAAW,EAAE;YACX,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;gBAC7D,MAAM;gBACN;oBACE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC;oBAClD,WAAW,EAAE,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC;iBACjD;aACF,CAAC,CACH;YACD,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC1H,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC;SAC7C;QACD,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACzB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB,EAAE,OAAmB;IAC5E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QAC9F,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAmB;IAC7C,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,SAAS,OAAO,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,GAAW;IAC5D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,OAAO,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAY,EAAE,GAAG,CAAC,CAAC;AACrI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW,EAAE,WAAwD;IACvH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtI,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IACjD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/domain/health/checks.d.ts

@@ -3,6 +3,7 @@ export type DoctorOptions = {
     fix?: boolean;
     runtime?: boolean;
     timeoutMs?: number;
+    strict?: boolean;
 };
 export declare function getDoctorResults(runtime: Runtime, options?: boolean | DoctorOptions): Promise<HealthResult[]>;
 export declare function getProjectCheckResults(project: ProjectDiscovery, offline: boolean, runtime?: Runtime): Promise<HealthResult[]>;

package/dist/domain/health/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../../src/domain/health/checks.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAiC,gBAAgB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGpH,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAWF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,OAAO,GAAG,aAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA0CvH;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA8BpI;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAE3D;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAE3D"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../../src/domain/health/checks.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAiC,gBAAgB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAIpH,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAWF,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAE,OAAO,GAAG,aAAkB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA0CvH;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA8BpI;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAE3D;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,CAE3D"}

package/dist/domain/health/checks.js

@@ -6,6 +6,7 @@ import path from "node:path";
 import { FentarisAuth } from "@fentaris/core";
 import { authDir, supportedPackageManagers } from "../../shared/constants.js";
 import { canAccess, exists, isNodeError, readJson } from "../../shared/utils.js";
+import { secretsDoctorHealthResults } from "../secrets/doctor.js";
 export async function getDoctorResults(runtime, options = {}) {
     const normalized = normalizeDoctorOptions(options);
     const results = [
@@ -21,7 +22,7 @@ export async function getDoctorResults(runtime, options = {}) {
         const validation = await configResults(project.discovery);
         results.push(...validation.results);
         results.push(...await packageResults(project.discovery));
-        results.push(...await authResults(project.discovery, runtime));
+        results.push(...await authResults(project.discovery, runtime, { strict: normalized.strict }));
         results.push(await portResult(project.discovery.config.port));
         if (normalized.runtime) {
             results.push(await runtimeEndpointResult(project.discovery, runtime, normalized.timeoutMs));
@@ -80,12 +81,13 @@ export function hasWarning(results) {
 }
 function normalizeDoctorOptions(options) {
     if (typeof options === "boolean") {
-        return { fix: options, runtime: false, timeoutMs: 10_000 };
+        return { fix: options, runtime: false, timeoutMs: 10_000, strict: false };
     }
     return {
         fix: options.fix === true,
         runtime: options.runtime === true,
         timeoutMs: normalizeTimeout(options.timeoutMs),
+        strict: options.strict === true,
     };
 }
 function environmentResults(runtime) {
@@ -328,7 +330,7 @@ async function packageResults(project) {
     ];
     return results;
 }
-async function authResults(project, runtime) {
+async function authResults(project, runtime, options = {}) {
     const authPath = path.join(project.root, project.config.authDir);
     const credentialsPath = path.join(authPath, "credentials.enc.json");
     const authDirectoryExists = await exists(authPath);
@@ -376,6 +378,17 @@ async function authResults(project, runtime) {
             hint: "Set FENTARIS_AUTH_KEY to verify encrypted credentials locally.",
         });
     }
+    if (runtime) {
+        const extended = await secretsDoctorHealthResults(project, runtime, { strict: options.strict });
+        for (const result of extended) {
+            if (result.label.startsWith("credentials.enc.json")) {
+                continue;
+            }
+            if (!results.some((existing) => existing.label === result.label && existing.detail === result.detail)) {
+                results.push(result);
+            }
+        }
+    }
     return results;
 }
 async function runtimeEndpointResult(project, runtime, timeoutMs) {
@@ -541,7 +554,10 @@ async function lockfileResult(root, packageManager) {
 }
 async function gitignoreAuthResult(root, configuredAuthDir) {
     const gitignorePath = path.join(root, ".gitignore");
-    const gitignoreEntry = `${configuredAuthDir.replace(/\\/g, "/").replace(/\/+$/u, "")}/`;
+    const normalizedAuthDir = configuredAuthDir.replace(/\\/g, "/").replace(/\/+$/u, "");
+    const gitignoreDirectoryEntry = `${normalizedAuthDir}/`;
+    const gitignoreContentsEntry = `${normalizedAuthDir}/*`;
+    const manifestEntry = `!${normalizedAuthDir}/secrets.manifest.json`;
     const present = await exists(gitignorePath);
     if (!present) {
         return {
@@ -549,25 +565,24 @@ async function gitignoreAuthResult(root, configuredAuthDir) {
             label: ".gitignore auth entry",
             status: "warn",
             detail: ".gitignore is missing.",
-            hint: `doctor --fix can create .gitignore with ${gitignoreEntry} ignored.`,
+            hint: `doctor --fix can create .gitignore with ${gitignoreContentsEntry} ignored.`,
             fix: async () => {
-                await writeFile(gitignorePath, `${gitignoreEntry}\n`);
+                await writeFile(gitignorePath, `${gitignoreContentsEntry}\n${manifestEntry}\n`);
             },
         };
     }
     const contents = await readFile(gitignorePath, "utf8");
-    const gitignoreEntryWithoutSlash = gitignoreEntry.slice(0, -1);
     const ignoresAuth = contents
         .split(/\r?\n/)
-        .some((line) => line.trim() === gitignoreEntry || line.trim() === gitignoreEntryWithoutSlash);
+        .some((line) => line.trim() === gitignoreDirectoryEntry || line.trim() === normalizedAuthDir || line.trim() === gitignoreContentsEntry);
     return {
         group: "Auth",
         label: ".gitignore auth entry",
         status: ignoresAuth ? "pass" : "warn",
-        detail: ignoresAuth ? `${gitignoreEntry} is ignored.` : `${gitignoreEntry} is not ignored.`,
-        hint: ignoresAuth ? undefined : `doctor --fix can add ${gitignoreEntry} to .gitignore.`,
+        detail: ignoresAuth ? `${gitignoreContentsEntry} is ignored.` : `${gitignoreContentsEntry} is not ignored.`,
+        hint: ignoresAuth ? undefined : `doctor --fix can add ${gitignoreContentsEntry} to .gitignore.`,
         fix: async () => {
-            await writeFile(gitignorePath, `${contents.trimEnd()}\n${gitignoreEntry}\n`);
+            await writeFile(gitignorePath, `${contents.trimEnd()}\n${gitignoreContentsEntry}\n${manifestEntry}\n`);
         },
     };
 }