@formigio/fazemos-cli 0.10.51 → 0.10.53

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/api.d.ts +24 -0
  2. package/dist/api.js +63 -8
  3. package/dist/api.js.map +1 -1
  4. package/dist/commands/secrets.d.ts +34 -0
  5. package/dist/commands/secrets.js +330 -0
  6. package/dist/commands/secrets.js.map +1 -0
  7. package/dist/index.js +11 -1
  8. package/dist/index.js.map +1 -1
  9. package/package.json +1 -1
package/dist/api.d.ts CHANGED
@@ -71,6 +71,30 @@ export declare function resolveOrgIdMaybeSlug(value: string): Promise<string>;
71
71
  * archive) and needs subsequent lookups to see the new data.
72
72
  */
73
73
  export declare function refreshAuthMeCache(): Promise<AuthMeResponse | null>;
74
+ /**
75
+ * F49 CHG-2 — Cross-org API key resolver.
76
+ *
77
+ * In agent execution contexts (Fargate tasks), the launcher injects env vars:
78
+ * FAZEMOS_API_KEY — primary org fzm_ key (always present for agents)
79
+ * FAZEMOS_ORG_ID — primary org UUID
80
+ * FAZEMOS_API_KEY__{ORG_SLUG_UPPER_SNAKE} — cross-org key(s), one per target org
81
+ *
82
+ * Resolution order (BD-2 enforcement — no disk write, env-var-only):
83
+ * 1. If FAZEMOS_API_KEY is present → agent context (API key auth)
84
+ * a. If active org UUID differs from FAZEMOS_ORG_ID → cross-org call
85
+ * - Resolve active org slug from authMeCache
86
+ * - Look up FAZEMOS_API_KEY__{SLUG.toUpperCase().replace(/-/g,'_')}
87
+ * - If found → return cross-org key
88
+ * - If absent → fall through to FAZEMOS_API_KEY (server returns natural 404)
89
+ * b. Otherwise (primary org or no org context) → return FAZEMOS_API_KEY
90
+ * 2. No FAZEMOS_API_KEY → human Cognito-token context → return null (caller uses getToken)
91
+ *
92
+ * Slug normalization is EXACTLY `.toUpperCase().replace(/-/g, '_')` per BD-4
93
+ * (no other transformation). Example: "never-behind" → "NEVER_BEHIND".
94
+ *
95
+ * NEVER writes anything to disk — reads process.env only (BD-2 hard property).
96
+ */
97
+ export declare function resolveBearerToken(activeOrgId: string | null): string | null;
74
98
  /**
75
99
  * Core API helper. Always authenticates, always sends X-Org-Id when one is
76
100
  * active, and sends X-Fazemos-Project-Id when a project is active (or one
package/dist/api.js CHANGED
@@ -1,4 +1,4 @@
1
- import { getEnv, getToken, getActiveOrgId, getActiveProjectId, findProjectBySlug, findOrgBySlug, setAuthMeCache, clearAuthMeCache, } from './config.js';
1
+ import { getEnv, getToken, getActiveOrgId, getActiveProjectId, findProjectBySlug, findOrgBySlug, findOrgById, setAuthMeCache, clearAuthMeCache, } from './config.js';
2
2
  import { refreshSession } from './auth.js';
3
3
  /**
4
4
  * Error thrown when an API request returns a non-2xx response. Carries the
@@ -100,6 +100,54 @@ export async function refreshAuthMeCache() {
100
100
  }
101
101
  return null;
102
102
  }
103
+ /**
104
+ * F49 CHG-2 — Cross-org API key resolver.
105
+ *
106
+ * In agent execution contexts (Fargate tasks), the launcher injects env vars:
107
+ * FAZEMOS_API_KEY — primary org fzm_ key (always present for agents)
108
+ * FAZEMOS_ORG_ID — primary org UUID
109
+ * FAZEMOS_API_KEY__{ORG_SLUG_UPPER_SNAKE} — cross-org key(s), one per target org
110
+ *
111
+ * Resolution order (BD-2 enforcement — no disk write, env-var-only):
112
+ * 1. If FAZEMOS_API_KEY is present → agent context (API key auth)
113
+ * a. If active org UUID differs from FAZEMOS_ORG_ID → cross-org call
114
+ * - Resolve active org slug from authMeCache
115
+ * - Look up FAZEMOS_API_KEY__{SLUG.toUpperCase().replace(/-/g,'_')}
116
+ * - If found → return cross-org key
117
+ * - If absent → fall through to FAZEMOS_API_KEY (server returns natural 404)
118
+ * b. Otherwise (primary org or no org context) → return FAZEMOS_API_KEY
119
+ * 2. No FAZEMOS_API_KEY → human Cognito-token context → return null (caller uses getToken)
120
+ *
121
+ * Slug normalization is EXACTLY `.toUpperCase().replace(/-/g, '_')` per BD-4
122
+ * (no other transformation). Example: "never-behind" → "NEVER_BEHIND".
123
+ *
124
+ * NEVER writes anything to disk — reads process.env only (BD-2 hard property).
125
+ */
126
+ export function resolveBearerToken(activeOrgId) {
127
+ const primaryApiKey = process.env.FAZEMOS_API_KEY;
128
+ if (!primaryApiKey) {
129
+ // Cognito-token path — caller falls back to getToken() / refreshSession()
130
+ return null;
131
+ }
132
+ const primaryOrgId = process.env.FAZEMOS_ORG_ID;
133
+ if (activeOrgId && primaryOrgId && activeOrgId !== primaryOrgId) {
134
+ // Active org differs from the primary key's org — look for a cross-org key.
135
+ // Slug normalization: EXACT rule per manifest BD-4 and Dex checklist:
136
+ // .toUpperCase().replace(/-/g, '_')
137
+ const activeOrg = findOrgById(activeOrgId);
138
+ if (activeOrg?.slug) {
139
+ const upperSnake = activeOrg.slug.toUpperCase().replace(/-/g, '_');
140
+ const crossOrgKey = process.env[`FAZEMOS_API_KEY__${upperSnake}`];
141
+ if (crossOrgKey) {
142
+ return crossOrgKey;
143
+ }
144
+ // Cross-org key absent (EC3 — env var not yet injected, or SSM mint lagged):
145
+ // fall through to primary key; server returns natural 404. No client-side error.
146
+ }
147
+ }
148
+ // Primary org call, or cross-org slug unresolvable → use primary API key
149
+ return primaryApiKey;
150
+ }
103
151
  /**
104
152
  * Core API helper. Always authenticates, always sends X-Org-Id when one is
105
153
  * active, and sends X-Fazemos-Project-Id when a project is active (or one
@@ -118,20 +166,27 @@ export async function refreshAuthMeCache() {
118
166
  */
119
167
  export async function api(method, path, body, opts = {}) {
120
168
  const env = getEnv();
121
- let token = getToken();
122
169
  const orgId = getActiveOrgId();
123
- // Auto-refresh if token is expired
124
- if (!token) {
125
- token = await refreshSession();
170
+ // F49 CHG-2: resolve bearer token — API key (agent context) or Cognito JWT (human context)
171
+ const apiKey = resolveBearerToken(orgId);
172
+ let token = null;
173
+ if (!apiKey) {
174
+ // Cognito auth path — human users / local dev
175
+ token = getToken();
176
+ // Auto-refresh if token is expired
126
177
  if (!token) {
127
- throw new Error('Session expired. Run: fazemos auth login');
178
+ token = await refreshSession();
179
+ if (!token) {
180
+ throw new Error('Session expired. Run: fazemos auth login');
181
+ }
128
182
  }
129
183
  }
130
184
  const headers = {
131
185
  'Content-Type': 'application/json',
132
186
  };
133
- if (token) {
134
- headers['Authorization'] = `Bearer ${token}`;
187
+ const bearer = apiKey ?? token;
188
+ if (bearer) {
189
+ headers['Authorization'] = `Bearer ${bearer}`;
135
190
  }
136
191
  if (orgId) {
137
192
  headers['X-Org-Id'] = orgId;
package/dist/api.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAW;IACf,YAAY,OAAe,EAAE,MAAc,EAAE,IAAa,EAAE,IAAc;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AA4BD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAqB;IAChE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,mEAAmE;YACnE,kEAAkE;YAClE,oCAAoC;YACpC,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,oBAAoB,YAAY,EAAE,EAClC,GAAG,EACH,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,IAAI,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,kBAAkB,EAAE,CAAC;QAC3B,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,yEAAyE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAmB,CAAC;QAClG,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjD,cAAc,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gEAAgE;QAChE,iBAAiB;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,mCAAmC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,sBAAsB,CAAC,GAAG,SAAS,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oCAAoC;IACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,MAAM;QACN,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAA0C;YAC7C,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,EAAE,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEpD,+DAA+D;QAC/D,8DAA8D;QAC9D,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,QAAQ,CAChB,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,gBAAgB,EAAE,CAAC;AACrB,CAAC"}
1
+ {"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,QAAQ,EACR,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,EACd,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAU;IACd,IAAI,CAAW;IACf,YAAY,OAAe,EAAE,MAAc,EAAE,IAAa,EAAE,IAAc;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AA4BD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,YAAqB;IAChE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,mEAAmE;YACnE,kEAAkE;YAClE,oCAAoC;YACpC,MAAM,kBAAkB,EAAE,CAAC;YAC3B,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,QAAQ,CAChB,oBAAoB,YAAY,EAAE,EAClC,GAAG,EACH,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAa;IACvD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtC,IAAI,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,kBAAkB,EAAE,CAAC;QAC3B,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,yEAAyE,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,EAAE,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAmB,CAAC;QAClG,IAAI,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjD,cAAc,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gEAAgE;QAChE,iBAAiB;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA0B;IAC3D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAClD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAChD,IAAI,WAAW,IAAI,YAAY,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;QAChE,4EAA4E;QAC5E,sEAAsE;QACtE,sCAAsC;QACtC,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,SAAS,EAAE,IAAI,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,UAAU,EAAE,CAAC,CAAC;YAClE,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC;YACrB,CAAC;YACD,6EAA6E;YAC7E,iFAAiF;QACnF,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAE/B,2FAA2F;IAC3F,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAEzC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,8CAA8C;QAC9C,KAAK,GAAG,QAAQ,EAAE,CAAC;QACnB,mCAAmC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,sBAAsB,CAAC,GAAG,SAAS,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,oCAAoC;IACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IACtD,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,MAAM;QACN,OAAO;KACR,CAAC;IAEF,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GACP,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAA0C;YAC7C,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,EAAE,KAAK,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEpD,+DAA+D;QAC/D,8DAA8D;QAC9D,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,QAAQ,CAChB,8BAA8B,EAC9B,QAAQ,CAAC,MAAM,EACf,IAAI,EACJ,IAAI,CACL,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,gBAAgB,EAAE,CAAC;AACrB,CAAC"}
package/dist/commands/secrets.d.ts ADDED
@@ -0,0 +1,34 @@
1
+ /**
2
+ * F48 — Project Secrets Vault CLI commands.
3
+ *
4
+ * Exports `registerSecretsCommands(program)` which wires the following
5
+ * subcommands under `fazemos secrets`:
6
+ *
7
+ * fazemos secrets set <NAME> [VALUE]
8
+ * → POST /api/projects/:projectId/secrets {name, value, scope}
9
+ * Owner/admin only. Value is written to AWS Secrets Manager and NEVER
10
+ * stored in Aurora or echoed in any response (R1/R4).
11
+ *
12
+ * fazemos secrets list
13
+ * → GET /api/projects/:projectId/secrets
14
+ * All project members. Returns metadata only — never a value field.
15
+ *
16
+ * fazemos secrets get <NAME>
17
+ * → GET /api/projects/:projectId/secrets/:name (owner-only)
18
+ * Returns SM path + SM ARN for operator use. Value is NEVER returned
19
+ * by this endpoint (SF-4 deliberate divergence from feature-spec AC2).
20
+ * Break-glass value inspection is out-of-band via AWS CLI against SM ARN.
21
+ *
22
+ * fazemos secrets delete <NAME>
23
+ * → DELETE /api/projects/:projectId/secrets/:name (owner/admin)
24
+ * Schedules SM deletion with a 7-day recovery window; soft-deletes Aurora
25
+ * row. Prompts for confirmation unless --yes / -y is passed.
26
+ *
27
+ * Auth: all commands require a valid Cognito session + active project context.
28
+ * Project ID is threaded in the URL path (not the X-Fazemos-Project-Id header)
29
+ * so noProjectHeader: true is passed to api() on every call here.
30
+ *
31
+ * Spec: F48-execution-profiles-manifest.yaml §cli / §api (T4)
32
+ */
33
+ import type { Command } from 'commander';
34
+ export declare function registerSecretsCommands(program: Command): void;
package/dist/commands/secrets.js ADDED
@@ -0,0 +1,330 @@
1
+ /**
2
+ * F48 — Project Secrets Vault CLI commands.
3
+ *
4
+ * Exports `registerSecretsCommands(program)` which wires the following
5
+ * subcommands under `fazemos secrets`:
6
+ *
7
+ * fazemos secrets set <NAME> [VALUE]
8
+ * → POST /api/projects/:projectId/secrets {name, value, scope}
9
+ * Owner/admin only. Value is written to AWS Secrets Manager and NEVER
10
+ * stored in Aurora or echoed in any response (R1/R4).
11
+ *
12
+ * fazemos secrets list
13
+ * → GET /api/projects/:projectId/secrets
14
+ * All project members. Returns metadata only — never a value field.
15
+ *
16
+ * fazemos secrets get <NAME>
17
+ * → GET /api/projects/:projectId/secrets/:name (owner-only)
18
+ * Returns SM path + SM ARN for operator use. Value is NEVER returned
19
+ * by this endpoint (SF-4 deliberate divergence from feature-spec AC2).
20
+ * Break-glass value inspection is out-of-band via AWS CLI against SM ARN.
21
+ *
22
+ * fazemos secrets delete <NAME>
23
+ * → DELETE /api/projects/:projectId/secrets/:name (owner/admin)
24
+ * Schedules SM deletion with a 7-day recovery window; soft-deletes Aurora
25
+ * row. Prompts for confirmation unless --yes / -y is passed.
26
+ *
27
+ * Auth: all commands require a valid Cognito session + active project context.
28
+ * Project ID is threaded in the URL path (not the X-Fazemos-Project-Id header)
29
+ * so noProjectHeader: true is passed to api() on every call here.
30
+ *
31
+ * Spec: F48-execution-profiles-manifest.yaml §cli / §api (T4)
32
+ */
33
+ import chalk from 'chalk';
34
+ import { readFileSync } from 'fs';
35
+ import { createInterface } from 'readline';
36
+ import { api, ApiError, resolveProjectIdBySlug } from '../api.js';
37
+ // ── Project resolution ────────────────────────────────────────────────────────
38
+ /**
39
+ * Resolve the active project ID for a secrets command.
40
+ *
41
+ * Applies the standard F15 resolution chain:
42
+ * --project <slug> override → resolveProjectIdBySlug (cache + refresh)
43
+ * active project from config → getActiveProjectId()
44
+ *
45
+ * Exits 1 with the uniform "requirement missing: project" block (KD9) if
46
+ * neither a slug override nor an active project can be found.
47
+ */
48
+ async function requireProjectForSecrets(slugOverride) {
49
+ let projectId;
50
+ try {
51
+ projectId = await resolveProjectIdBySlug(slugOverride);
52
+ }
53
+ catch (err) {
54
+ // resolveProjectIdBySlug throws ApiError(UNKNOWN_PROJECT) on slug miss
55
+ console.error(chalk.red(err?.message ?? String(err)));
56
+ process.exit(1);
57
+ }
58
+ if (!projectId) {
59
+ console.error(chalk.red('Error: requirement missing: project'));
60
+ console.error('');
61
+ console.error(chalk.gray('Set one with: fazemos projects switch <slug>'));
62
+ console.error(chalk.gray('Or pass: --project <slug>'));
63
+ process.exit(1);
64
+ }
65
+ return projectId;
66
+ }
67
+ // ── Interactive value prompt ──────────────────────────────────────────────────
68
+ /**
69
+ * Prompt for a secret value on a TTY, masking typed characters with *.
70
+ * Falls back to reading from piped stdin when process.stdin is not a TTY.
71
+ *
72
+ * Manifests the "echoed as ***" behaviour specified in the cli.commands.set
73
+ * behaviour block — typed input is not echoed in plaintext so the value does
74
+ * not appear in terminal scrollback.
75
+ */
76
+ function promptSecretValue(name) {
77
+ return new Promise((resolve, reject) => {
78
+ if (!process.stdin.isTTY) {
79
+ // Piped stdin: accumulate all data, then trim trailing newline.
80
+ let data = '';
81
+ process.stdin.setEncoding('utf8');
82
+ process.stdin.on('data', (chunk) => { data += chunk; });
83
+ process.stdin.on('end', () => resolve(data.trimEnd()));
84
+ process.stdin.on('error', reject);
85
+ return;
86
+ }
87
+ // Interactive TTY: mask every typed character with *.
88
+ const rl = createInterface({
89
+ input: process.stdin,
90
+ output: process.stdout,
91
+ terminal: true,
92
+ });
93
+ // Override the readline output writer so typed chars appear as *.
94
+ // Only suppress the echoed input — the prompt text and the final newline
95
+ // are still written normally so the UX stays legible.
96
+ rl._writeToOutput = function (s) {
97
+ if (s === '\r\n' || s === '\n' || s === '\r') {
98
+ process.stdout.write('\n');
99
+ }
100
+ else if (s && s !== '\u0003') {
101
+ // Each typed character → one * (mask everything except Ctrl-C)
102
+ process.stdout.write('*');
103
+ }
104
+ };
105
+ // Write the prompt ourselves (before the readline question) so the
106
+ // question('') call does not emit a blank prefix.
107
+ process.stdout.write(`Enter value for ${chalk.cyan(name)}: `);
108
+ rl.question('', (answer) => {
109
+ rl.close();
110
+ resolve(answer);
111
+ });
112
+ });
113
+ }
114
+ // ── Confirmation prompt ───────────────────────────────────────────────────────
115
+ /**
116
+ * Prompt for y/N confirmation. Returns true only if the user types 'y' or 'Y'.
117
+ * Defaults to NO on empty input or any other key (safe default for destructive
118
+ * operations like secret deletion).
119
+ */
120
+ function confirmPrompt(message) {
121
+ return new Promise((resolve) => {
122
+ const rl = createInterface({
123
+ input: process.stdin,
124
+ output: process.stdout,
125
+ });
126
+ rl.question(`${message} [y/N] `, (answer) => {
127
+ rl.close();
128
+ resolve(answer.trim().toLowerCase() === 'y');
129
+ });
130
+ });
131
+ }
132
+ // ── Command registration ──────────────────────────────────────────────────────
133
+ export function registerSecretsCommands(program) {
134
+ const secrets = program
135
+ .command('secrets')
136
+ .description('Project secret management (F48 — secrets vault)');
137
+ // ── secrets set ────────────────────────────────────────────────────────────
138
+ secrets
139
+ .command('set')
140
+ .description('Write a project secret to the vault (owner/admin only). ' +
141
+ 'Value is stored in AWS Secrets Manager — NEVER in Aurora or echoed back.')
142
+ .argument('<name>', 'Secret name — letters, numbers, and underscores only (max 256 chars)')
143
+ .argument('[value]', 'Secret value (omit to prompt interactively or pipe via stdin)')
144
+ .option('--value-from <file>', 'Read secret value from a file (avoids shell history)')
145
+ .option('--scope <scope>', "Secret scope (default: 'project'; only valid value in Phase A)", 'project')
146
+ .option('--project <slug>', 'Override active project for this call')
147
+ .action(async (name, valueArg, opts) => {
148
+ try {
149
+ const projectId = await requireProjectForSecrets(opts.project);
150
+ // Resolve value in priority order:
151
+ // 1. Positional arg (provided inline — user accepts history risk)
152
+ // 2. --value-from <file> (avoids shell history)
153
+ // 3. stdin (piped) or interactive masked prompt
154
+ let value;
155
+ if (valueArg !== undefined) {
156
+ value = valueArg;
157
+ }
158
+ else if (opts.valueFrom) {
159
+ try {
160
+ value = readFileSync(opts.valueFrom, 'utf-8').trimEnd();
161
+ }
162
+ catch (err) {
163
+ console.error(chalk.red(`Error reading --value-from file: ${err.message}`));
164
+ process.exit(1);
165
+ }
166
+ }
167
+ else {
168
+ value = await promptSecretValue(name);
169
+ }
170
+ if (!value) {
171
+ console.error(chalk.red('Error: Secret value cannot be empty'));
172
+ process.exit(1);
173
+ }
174
+ const body = { name, value, scope: opts.scope };
175
+ // Project ID is in the URL path; suppress the X-Fazemos-Project-Id header
176
+ // to avoid a duplicate / mismatched header on path-scoped endpoints.
177
+ const data = await api('POST', `/api/projects/${projectId}/secrets`, body, { noProjectHeader: true });
178
+ console.log(chalk.green(`Secret ${name} written.`));
179
+ console.log(` SM path: ${data.smPath}`);
180
+ }
181
+ catch (err) {
182
+ if (err instanceof ApiError) {
183
+ if (err.code === 'INSUFFICIENT_ROLE') {
184
+ console.error(chalk.red('Error: Only project owners and admins can write secrets'));
185
+ }
186
+ else if (err.code === 'INVALID_NAME') {
187
+ console.error(chalk.red('Error: Secret name must contain only letters, numbers, and underscores (max 256 chars)'));
188
+ }
189
+ else if (err.code === 'INVALID_SCOPE') {
190
+ console.error(chalk.red("Error: --scope must be 'project'"));
191
+ }
192
+ else {
193
+ console.error(chalk.red(err.message));
194
+ }
195
+ }
196
+ else {
197
+ console.error(chalk.red(err?.message ?? String(err)));
198
+ }
199
+ process.exit(1);
200
+ }
201
+ });
202
+ // ── secrets list ──────────────────────────────────────────────────────────
203
+ secrets
204
+ .command('list')
205
+ .description('List project secrets — metadata only, values are never returned')
206
+ .option('--project <slug>', 'Override active project for this call')
207
+ .action(async (opts) => {
208
+ try {
209
+ const projectId = await requireProjectForSecrets(opts.project);
210
+ const data = await api('GET', `/api/projects/${projectId}/secrets`, undefined, { noProjectHeader: true });
211
+ const items = data.secrets ?? [];
212
+ if (items.length === 0) {
213
+ console.log(chalk.yellow('No secrets'));
214
+ return;
215
+ }
216
+ // Compute column widths from data (minimum widths from header labels).
217
+ const nameW = Math.max(4, ...items.map((s) => String(s.name ?? '').length));
218
+ const scopeW = Math.max(5, ...items.map((s) => String(s.scope ?? '').length));
219
+ const pathW = Math.max(7, ...items.map((s) => String(s.smPath ?? '').length));
220
+ const header = [
221
+ 'NAME'.padEnd(nameW),
222
+ 'SCOPE'.padEnd(scopeW),
223
+ 'SM PATH'.padEnd(pathW),
224
+ 'CREATED AT',
225
+ ].join(' ');
226
+ console.log(chalk.gray(header));
227
+ console.log(chalk.gray('─'.repeat(header.length)));
228
+ for (const s of items) {
229
+ // Explicitly exclude any `value` field — the API contract forbids it,
230
+ // but the CLI must never print it even if the response accidentally
231
+ // includes one (R4: no Fazemos path ever returns plaintext values).
232
+ const created = s.createdAt
233
+ ? new Date(s.createdAt).toLocaleString()
234
+ : (s.created_at ?? '');
235
+ console.log([
236
+ String(s.name ?? '').padEnd(nameW),
237
+ String(s.scope ?? '').padEnd(scopeW),
238
+ String(s.smPath ?? '').padEnd(pathW),
239
+ created,
240
+ ].join(' '));
241
+ }
242
+ }
243
+ catch (err) {
244
+ console.error(chalk.red(err?.message ?? String(err)));
245
+ process.exit(1);
246
+ }
247
+ });
248
+ // ── secrets get ───────────────────────────────────────────────────────────
249
+ secrets
250
+ .command('get')
251
+ .description('Get secret metadata (owner-only). ' +
252
+ 'Returns SM path + SM ARN — the value is NEVER returned by this command (SF-4). ' +
253
+ 'Use the AWS CLI against the SM ARN for break-glass value inspection.')
254
+ .argument('<name>', 'Secret name')
255
+ .option('--project <slug>', 'Override active project for this call')
256
+ .action(async (name, opts) => {
257
+ try {
258
+ const projectId = await requireProjectForSecrets(opts.project);
259
+ const data = await api('GET', `/api/projects/${projectId}/secrets/${encodeURIComponent(name)}`, undefined, { noProjectHeader: true });
260
+ // NEVER print a value field — metadata-only (SF-4 / R4).
261
+ console.log(chalk.cyan(`Secret: ${data.name}`));
262
+ console.log(` Scope: ${data.scope}`);
263
+ console.log(` SM path: ${data.smPath}`);
264
+ console.log(` SM ARN: ${data.smArn ?? '(not yet populated)'}`);
265
+ console.log(` Created by: ${data.createdByMemberId ?? '(unknown)'}`);
266
+ console.log(` Created at: ${data.createdAt ? new Date(data.createdAt).toLocaleString() : ''}`);
267
+ console.log(` Updated at: ${data.updatedAt ? new Date(data.updatedAt).toLocaleString() : ''}`);
268
+ console.log('');
269
+ console.log(chalk.gray('Break-glass value inspection: aws secretsmanager get-secret-value --secret-id <SM ARN above>'));
270
+ }
271
+ catch (err) {
272
+ if (err instanceof ApiError) {
273
+ if (err.code === 'INSUFFICIENT_ROLE') {
274
+ console.error(chalk.red('Error: Only project owners can retrieve secret metadata'));
275
+ }
276
+ else if (err.code === 'SECRET_NOT_FOUND') {
277
+ console.error(chalk.red(`Error: Secret '${name}' not found`));
278
+ }
279
+ else {
280
+ console.error(chalk.red(err.message));
281
+ }
282
+ }
283
+ else {
284
+ console.error(chalk.red(err?.message ?? String(err)));
285
+ }
286
+ process.exit(1);
287
+ }
288
+ });
289
+ // ── secrets delete ────────────────────────────────────────────────────────
290
+ secrets
291
+ .command('delete')
292
+ .description('Delete a project secret (owner/admin only). ' +
293
+ 'Schedules 7-day SM recovery window; soft-deletes the Aurora metadata row. ' +
294
+ 'The secret can be re-created at the same name within the window.')
295
+ .argument('<name>', 'Secret name')
296
+ .option('--project <slug>', 'Override active project for this call')
297
+ .option('-y, --yes', 'Skip confirmation prompt')
298
+ .action(async (name, opts) => {
299
+ try {
300
+ const projectId = await requireProjectForSecrets(opts.project);
301
+ if (!opts.yes) {
302
+ const confirmed = await confirmPrompt(`Delete secret ${chalk.cyan(name)}? This schedules SM deletion with a 7-day recovery window.`);
303
+ if (!confirmed) {
304
+ console.log('Aborted.');
305
+ return;
306
+ }
307
+ }
308
+ await api('DELETE', `/api/projects/${projectId}/secrets/${encodeURIComponent(name)}`, undefined, { noProjectHeader: true });
309
+ console.log(chalk.green(`Secret ${name} deleted (7-day SM recovery window).`));
310
+ }
311
+ catch (err) {
312
+ if (err instanceof ApiError) {
313
+ if (err.code === 'INSUFFICIENT_ROLE') {
314
+ console.error(chalk.red('Error: Only project owners and admins can delete secrets'));
315
+ }
316
+ else if (err.code === 'SECRET_NOT_FOUND') {
317
+ console.error(chalk.red(`Error: Secret '${name}' not found`));
318
+ }
319
+ else {
320
+ console.error(chalk.red(err.message));
321
+ }
322
+ }
323
+ else {
324
+ console.error(chalk.red(err?.message ?? String(err)));
325
+ }
326
+ process.exit(1);
327
+ }
328
+ });
329
+ }
330
+ //# sourceMappingURL=secrets.js.map
package/dist/commands/secrets.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAElE,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,KAAK,UAAU,wBAAwB,CAAC,YAAqB;IAC3D,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,uEAAuE;QACvE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzB,gEAAgE;YAChE,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QAED,sDAAsD;QACtD,MAAM,EAAE,GAAG,eAAe,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,kEAAkE;QAClE,yEAAyE;QACzE,sDAAsD;QACrD,EAAU,CAAC,cAAc,GAAG,UAAU,CAAS;YAC9C,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/B,+DAA+D;gBAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,mEAAmE;QACnE,kDAAkD;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YACzB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YAC1C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,iDAAiD,CAAC,CAAC;IAElE,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,0DAA0D;QAC1D,0EAA0E,CAC3E;SACA,QAAQ,CAAC,QAAQ,EAAE,sEAAsE,CAAC;SAC1F,QAAQ,CAAC,SAAS,EAAE,+DAA+D,CAAC;SACpF,MAAM,CAAC,qBAAqB,EAAE,sDAAsD,CAAC;SACrF,MAAM,CAAC,iBAAiB,EAAE,gEAAgE,EAAE,SAAS,CAAC;SACtG,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,QAA4B,EAAE,IAAI,EAAE,EAAE;QACjE,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/D,mCAAmC;YACnC,qEAAqE;YACrE,mDAAmD;YACnD,kDAAkD;YAClD,IAAI,KAAa,CAAC;YAClB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;iBAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1D,CAAC;gBAAC,OAAO,GAAQ,EAAE,CAAC;oBAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAChD,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,MAAM,EACN,iBAAiB,SAAS,UAAU,EACpC,IAAI,EACJ,EAAE,eAAe,EAAE,IAAI,EAAE,CACnB,CAAC;YAET,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;gBACtF,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACvC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CACrB,wFAAwF,CACzF,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;oBACxC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBAC/D,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAE7E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,KAAK,EACL,iBAAiB,SAAS,UAAU,EACpC,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CACnB,CAAC;YAET,MAAM,KAAK,GAAU,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YAED,uEAAuE;YACvE,MAAM,KAAK,GAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG;gBACb,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtB,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;gBACvB,YAAY;aACb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAEnD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS;oBACzB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;oBACxC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;gBACzB,OAAO,CAAC,GAAG,CACT;oBACE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACnC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;oBACpC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACpC,OAAO;iBACR,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAE7E,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,oCAAoC;QACpC,iFAAiF;QACjF,sEAAsE,CACvE;SACA,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;SACjC,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,KAAK,EACL,iBAAiB,SAAS,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAChE,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CACnB,CAAC;YAET,yDAAyD;YACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,IAAI,qBAAqB,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,iBAAiB,IAAI,WAAW,EAAE,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CACpB,8FAA8F,CAC/F,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;gBACtF,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC3C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,IAAI,aAAa,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAE7E,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,8CAA8C;QAC9C,4EAA4E;QAC5E,kEAAkE,CACnE;SACA,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;SACjC,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE/D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,4DAA4D,CAC9F,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,GAAG,CACP,QAAQ,EACR,iBAAiB,SAAS,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAChE,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,IAAI,sCAAsC,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC,CAAC;gBACvF,CAAC;qBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC3C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,IAAI,aAAa,CAAC,CAAC,CAAC;gBAChE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
package/dist/index.js CHANGED
@@ -25,6 +25,7 @@ import { registerAutoStartCommands } from './autostart.js';
25
25
  import { registerFtrCommand } from './ftr.js';
26
26
  import { registerScheduleCommands } from './schedule.js';
27
27
  import { registerApprovalsCommands } from './approvals.js';
28
+ import { registerSecretsCommands } from './commands/secrets.js';
28
29
  import { parseExecutionsJson, resolveWaitOptions, waitForPipelines, buildAwsCommand, validateExecutionEntry, } from './wait-for-pipeline.js';
29
30
  import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, statSync } from 'fs';
30
31
  import { fileURLToPath } from 'url';
@@ -531,7 +532,7 @@ program
531
532
  // ── Directory context (`fazemos use`) ───────────────────────
532
533
  program
533
534
  .command('use')
534
- .description(`Set the default org/project for the current directory (writes ${DIR_CONFIG_FILENAME}). Running the CLI anywhere under that directory scopes calls to this org/project automatically.`)
535
+ .description(`Set the default org/project for the current directory (writes ${DIR_CONFIG_FILENAME}). Running the CLI anywhere under that directory scopes calls to this org/project automatically. Environment (dev/prod) is deliberately session-scoped, not directory-scoped — set FAZEMOS_ENV or pass --env instead.`)
535
536
  .option('-o, --org <slug>', 'Org slug to pin for this directory')
536
537
  .option('-p, --project <slug>', 'Project slug to pin for this directory')
537
538
  .option('--show', 'Show the directory context in effect and which file provides it')
@@ -10189,6 +10190,15 @@ registerScheduleCommands(program);
10189
10190
  // --reason is mandatory for resolve — CLI typed-token equivalent (OBD #1).
10190
10191
  // Auth: requireAuth + org membership (server-side, F37 shipped).
10191
10192
  registerApprovalsCommands(program);
10193
+ // ── F48 — Project Secrets Vault: secrets set / list / get / delete ────────────
10194
+ // Registers `secrets` top-level command with set, list, get, delete sub-commands.
10195
+ // All calls use project ID in the URL path (/api/projects/:projectId/secrets);
10196
+ // noProjectHeader: true on every call (path-scoped, not header-scoped).
10197
+ // set/delete: owner/admin only. get: owner-only (metadata+smArn, never value).
10198
+ // list: all project members (metadata only — values are never returned, R4).
10199
+ // set supports interactive masked input, --value-from <file>, positional arg,
10200
+ // and piped stdin. delete prompts for confirmation unless --yes / -y is passed.
10201
+ registerSecretsCommands(program);
10192
10202
  // Skip auto-parse only when running under Vitest (which sets process.env.VITEST).
10193
10203
  // Tests import `program` and drive it via `program.parseAsync(...)` after mocking
10194
10204
  // `./api.js`. In every other context — direct invocation, npx tsx, OR the bin