@griffin-app/griffin-cli 1.0.29 → 1.0.30

package/README.md

@@ -92,18 +92,18 @@ griffin metrics --env production --period 7d --json
 
 Commands are **top-level** or under a **group**. The default environment is `default` unless overridden with `--env <name>` where supported.
 
-| Area | Commands | Purpose |
-|------|----------|--------|
-| **Project** | `init`, `validate`, `status` | Bootstrap, validate monitors, show status |
-| **Local run** | `test` | Run monitors locally |
-| **Hub sync** | `plan`, `apply`, `destroy` | Preview changes, push to hub, remove from hub |
-| **Hub runs** | `runs`, `run`, `metrics` | List runs, trigger run, view metrics |
-| **Auth** | `auth login`, `auth logout`, `auth connect`, `auth generate-key` | Cloud or self-hosted auth |
-| **Environments** | `env list`, `env add`, `env remove` | Manage environments |
-| **Variables** | `variables list`, `variables add`, `variables remove` | Per-environment variables (in state) |
-| **Secrets** | `secrets list`, `secrets set`, `secrets get`, `secrets delete` | Per-environment secrets (stored on hub) |
-| **Integrations** | `integrations list`, `integrations show`, `integrations connect`, `integrations update`, `integrations remove` | Slack, email, webhooks, etc. |
-| **Notifications** | `notifications list`, `notifications test` | Notification rules and test sends |
+| Area              | Commands                                                                                                       | Purpose                                       |
+| ----------------- | -------------------------------------------------------------------------------------------------------------- | --------------------------------------------- |
+| **Project**       | `init`, `validate`, `status`                                                                                   | Bootstrap, validate monitors, show status     |
+| **Local run**     | `test`                                                                                                         | Run monitors locally                          |
+| **Hub sync**      | `plan`, `apply`, `destroy`                                                                                     | Preview changes, push to hub, remove from hub |
+| **Hub runs**      | `runs`, `run`, `metrics`                                                                                       | List runs, trigger run, view metrics          |
+| **Auth**          | `auth login`, `auth logout`, `auth connect`, `auth generate-key`                                               | Cloud or self-hosted auth                     |
+| **Environments**  | `env list`, `env add`, `env remove`                                                                            | Manage environments                           |
+| **Variables**     | `variables list`, `variables add`, `variables remove`                                                          | Per-environment variables (in state)          |
+| **Secrets**       | `secrets list`, `secrets set`, `secrets get`, `secrets delete`                                                 | Per-environment secrets (stored on hub)       |
+| **Integrations**  | `integrations list`, `integrations show`, `integrations connect`, `integrations update`, `integrations remove` | Slack, email, webhooks, etc.                  |
+| **Notifications** | `notifications list`, `notifications test`                                                                     | Notification rules and test sends             |
 
 ### Top-level commands
 

package/dist/cli.js

@@ -20,7 +20,7 @@ import { executeIntegrationsConnect } from "./commands/hub/integrations.js";
 import { executeNotificationsList, executeNotificationsTest, } from "./commands/hub/notifications.js";
 import { executeSecretsList, executeSecretsSet, executeSecretsGet, executeSecretsDelete, } from "./commands/hub/secrets.js";
 import { executeIntegrationsList, executeIntegrationsShow, executeIntegrationsUpdate, executeIntegrationsRemove, } from "./commands/hub/integrations.js";
-import packageInfo from '../package.json' with { type: 'json' };
+import packageInfo from "../package.json" with { type: "json" };
 const program = new Command();
 program
     .name("griffin")
@@ -60,7 +60,11 @@ program
     .option("--env <name>", "Environment name", "default")
     .option("--json", "Output in JSON format")
     .action(async (options) => {
-    await executePlan({ ...options, env: options.env, json: program.opts().json ?? options.json });
+    await executePlan({
+        ...options,
+        env: options.env,
+        json: program.opts().json ?? options.json,
+    });
 });
 program
     .command("apply")
@@ -70,7 +74,11 @@ program
     .option("--dry-run", "Show what would be done without making changes")
     .option("--prune", "Delete monitors on hub that don't exist locally")
     .action(async (options) => {
-    await executeApply({ ...options, env: options.env, json: program.opts().json });
+    await executeApply({
+        ...options,
+        env: options.env,
+        json: program.opts().json,
+    });
 });
 program
     .command("runs")
@@ -94,7 +102,11 @@ program
     .option("--wait", "Wait for run to complete")
     .option("--force", "Run even if local monitor differs from hub")
     .action(async (options) => {
-    await executeRun({ ...options, env: options.env, json: program.opts().json });
+    await executeRun({
+        ...options,
+        env: options.env,
+        json: program.opts().json,
+    });
 });
 program
     .command("metrics")
@@ -285,7 +297,10 @@ integrations
     .description("Show integration details")
     .option("--json", "Output as JSON")
     .action(async (id, options) => {
-    await executeIntegrationsShow({ id, json: program.opts().json ?? options.json });
+    await executeIntegrationsShow({
+        id,
+        json: program.opts().json ?? options.json,
+    });
 });
 integrations
     .command("connect [type] [provider]")
@@ -323,7 +338,11 @@ integrations
     .description("Remove an integration")
     .option("--force", "Skip confirmation")
     .action(async (id, options) => {
-    await executeIntegrationsRemove({ id, force: options.force, json: program.opts().json });
+    await executeIntegrationsRemove({
+        id,
+        force: options.force,
+        json: program.opts().json,
+    });
 });
 // Notifications command group
 const notifications = program

package/dist/commands/hub/destroy.js

@@ -35,7 +35,11 @@ export const executeDestroy = createCommandHandler("destroy", async (options, ou
     const remoteMonitors = response.data?.data;
     fetchSpinner.succeed(`Found ${remoteMonitors.length} remote monitor(s)`);
     if (remoteMonitors.length === 0) {
-        output.setData({ destroyed: [], total: 0, dryRun: options.dryRun ?? false });
+        output.setData({
+            destroyed: [],
+            total: 0,
+            dryRun: options.dryRun ?? false,
+        });
         output.success("No monitors to destroy.");
         return;
     }
@@ -67,7 +71,10 @@ export const executeDestroy = createCommandHandler("destroy", async (options, ou
     if (options.dryRun) {
         output.setData({
             dryRun: true,
-            wouldDestroy: monitorsToDestroy.map((m) => ({ id: m.id, name: m.name })),
+            wouldDestroy: monitorsToDestroy.map((m) => ({
+                id: m.id,
+                name: m.name,
+            })),
             total: monitorsToDestroy.length,
         });
         output.info("[DRY RUN] No changes will be made");

package/dist/commands/hub/integrations.js

@@ -56,7 +56,10 @@ export const executeIntegrationsShow = createCommandHandler("integrations show",
     }
     const raw = response.data?.data;
     if (!raw) {
-        output.setData({ error: "NOT_FOUND", message: "Integration not found." });
+        output.setData({
+            error: "NOT_FOUND",
+            message: "Integration not found.",
+        });
         output.error("Integration not found.");
         output.exit(1);
     }
@@ -120,7 +123,10 @@ export const executeIntegrationsUpdate = createCommandHandler("integrations upda
     }
     const raw = response.data?.data;
     if (!raw) {
-        output.setData({ error: "NOT_FOUND", message: "Integration not found." });
+        output.setData({
+            error: "NOT_FOUND",
+            message: "Integration not found.",
+        });
         output.error("Integration not found.");
         output.exit(1);
     }
@@ -141,7 +147,10 @@ export const executeIntegrationsRemove = createCommandHandler("integrations remo
     }
     const raw = response.data?.data;
     if (!raw) {
-        output.setData({ error: "NOT_FOUND", message: "Integration not found." });
+        output.setData({
+            error: "NOT_FOUND",
+            message: "Integration not found.",
+        });
         output.error("Integration not found.");
         output.exit(1);
     }
@@ -342,7 +351,9 @@ export const executeIntegrationsConnect = createCommandHandler("integrations con
             }
         }
         else {
-            const categories = [...new Set(providers.map((p) => p.category))].sort();
+            const categories = [
+                ...new Set(providers.map((p) => p.category)),
+            ].sort();
             output.info("Available categories: " + categories.join(", "));
         }
         output.exit(1);

package/dist/commands/hub/metrics.js

@@ -1,7 +1,7 @@
 import { resolveEnvironment } from "../../core/state.js";
 import { createSdkFromState } from "../../core/sdk.js";
 import { handleSDKErrorWithOutput } from "../../utils/sdk-error.js";
-import { createCommandHandler, } from "../../utils/command-wrapper.js";
+import { createCommandHandler } from "../../utils/command-wrapper.js";
 const METRICS_PERIODS = ["1h", "6h", "24h", "7d", "30d"];
 /**
  * Show metrics summary from the hub

package/dist/commands/hub/run.js

@@ -119,7 +119,8 @@ export const executeRun = createCommandHandler("run", async (options, output) =>
                 handleSDKErrorWithOutput(err, output, "Failed to fetch run status");
             }
             const currentRun = runStatusResponse.data?.data;
-            if (currentRun.status === "completed" || currentRun.status === "failed") {
+            if (currentRun.status === "completed" ||
+                currentRun.status === "failed") {
                 if (currentRun.success) {
                     waitSpinner.succeed(`Run ${currentRun.status}`);
                 }

package/dist/commands/hub/secrets.js

@@ -29,10 +29,10 @@ export const executeSecretsList = createCommandHandler("secrets list", async (op
     output.info(`Secrets (environment: ${env})`);
     output.blank();
     const table = output.table({
-        head: ["Name", "Created", "Updated"],
+        head: ["Name"],
     });
     for (const s of secrets) {
-        table.push([s.name, s.createdAt ?? "-", s.updatedAt ?? "-"]);
+        table.push([s.name]);
     }
     output.log(table.toString());
 });
@@ -80,8 +80,6 @@ export const executeSecretsSet = createCommandHandler("secrets set", async (opti
     const result = response.data;
     output.setData({
         name: result.data?.name ?? options.name,
-        createdAt: result.data?.createdAt,
-        updatedAt: result.data?.updatedAt,
     });
     output.success(`Secret "${result.data?.name ?? options.name}" saved.`);
 });
@@ -104,8 +102,6 @@ export const executeSecretsGet = createCommandHandler("secrets get", async (opti
     const secret = response.data?.data;
     output.setData(secret);
     output.info(`Secret: ${secret.name}`);
-    output.dim(`Created: ${secret.createdAt ?? "-"}`);
-    output.dim(`Updated: ${secret.updatedAt ?? "-"}`);
 });
 /**
  * Delete a secret (with confirmation unless --force; in JSON mode --force is required to avoid prompt).

package/dist/core/secrets.d.ts

@@ -1,37 +1,24 @@
 /**
- * Secrets configuration for CLI local runs.
- * Reads configuration from environment variables to construct a secret provider.
+ * Secrets configuration for CLI runs.
+ *
+ * Two providers:
+ * - `env`: reads secrets from environment variables (local dev, no hub needed)
+ * - `hub`: resolves secrets via POST /secrets/resolve on the hub API
  */
-import { type SecretProvider, type SecretProviderConfig } from "@griffin-app/griffin-executor";
+import { type SecretProvider } from "@griffin-app/griffin-executor";
+import type { GriffinHubSdk } from "@griffin-app/griffin-hub-sdk";
 /**
- * Read secrets provider configuration from environment variables.
- *
- * Supported configurations:
- *
- * 1. Environment provider (default if no config):
- *    GRIFFIN_SECRETS_PROVIDER=env
- *    GRIFFIN_SECRETS_ENV_PREFIX=APP_
- *
- * 2. AWS Secrets Manager:
- *    GRIFFIN_SECRETS_PROVIDER=aws
- *    GRIFFIN_SECRETS_AWS_REGION=us-east-1
- *    GRIFFIN_SECRETS_AWS_PREFIX=myapp/
- *    GRIFFIN_SECRETS_AWS_ROLE_ARN=arn:aws:iam::123:role/griffin
- *    GRIFFIN_SECRETS_AWS_EXTERNAL_ID=xyz
- *    GRIFFIN_SECRETS_AWS_ACCESS_KEY_ID=...
- *    GRIFFIN_SECRETS_AWS_SECRET_ACCESS_KEY=...
- *
- * 3. HashiCorp Vault:
- *    GRIFFIN_SECRETS_PROVIDER=vault
- *    GRIFFIN_SECRETS_VAULT_ADDRESS=https://vault.example.com
- *    GRIFFIN_SECRETS_VAULT_TOKEN=...
- *    GRIFFIN_SECRETS_VAULT_NAMESPACE=myapp
- *    GRIFFIN_SECRETS_VAULT_KV_VERSION=2
- *    GRIFFIN_SECRETS_VAULT_PREFIX=myapp/
+ * Create an env-based secret provider for fully-local CLI runs (no hub).
  */
-export declare function getSecretsConfigFromEnv(): SecretProviderConfig;
+export declare function createEnvSecretsProvider(): SecretProvider;
 /**
- * Create a secret provider for CLI local runs.
- * Reads configuration from environment variables.
+ * SecretProvider that resolves secrets via the hub's POST /secrets/resolve endpoint.
+ * The hub is the sole gateway for AWS Secrets Manager — no credentials leave the hub.
  */
-export declare function createSecretsProviderForCLI(): Promise<SecretProvider>;
+export declare class HubSecretProvider implements SecretProvider {
+    readonly name = "hub";
+    private readonly sdk;
+    private readonly environment;
+    constructor(sdk: GriffinHubSdk, environment: string);
+    resolve(ref: string): Promise<string>;
+}

package/dist/core/secrets.js

@@ -1,96 +1,45 @@
 /**
- * Secrets configuration for CLI local runs.
- * Reads configuration from environment variables to construct a secret provider.
+ * Secrets configuration for CLI runs.
+ *
+ * Two providers:
+ * - `env`: reads secrets from environment variables (local dev, no hub needed)
+ * - `hub`: resolves secrets via POST /secrets/resolve on the hub API
  */
-import { createSecretProvider, } from "@griffin-app/griffin-executor";
+import { EnvSecretProvider, } from "@griffin-app/griffin-executor";
 /**
- * Environment variable prefixes for secrets configuration.
+ * Environment variable name for selecting the local secrets provider.
+ * Only "env" is supported for fully-local runs without a hub.
  */
 const ENV_PREFIX = "GRIFFIN_SECRETS_";
 /**
- * Read secrets provider configuration from environment variables.
- *
- * Supported configurations:
- *
- * 1. Environment provider (default if no config):
- *    GRIFFIN_SECRETS_PROVIDER=env
- *    GRIFFIN_SECRETS_ENV_PREFIX=APP_
- *
- * 2. AWS Secrets Manager:
- *    GRIFFIN_SECRETS_PROVIDER=aws
- *    GRIFFIN_SECRETS_AWS_REGION=us-east-1
- *    GRIFFIN_SECRETS_AWS_PREFIX=myapp/
- *    GRIFFIN_SECRETS_AWS_ROLE_ARN=arn:aws:iam::123:role/griffin
- *    GRIFFIN_SECRETS_AWS_EXTERNAL_ID=xyz
- *    GRIFFIN_SECRETS_AWS_ACCESS_KEY_ID=...
- *    GRIFFIN_SECRETS_AWS_SECRET_ACCESS_KEY=...
- *
- * 3. HashiCorp Vault:
- *    GRIFFIN_SECRETS_PROVIDER=vault
- *    GRIFFIN_SECRETS_VAULT_ADDRESS=https://vault.example.com
- *    GRIFFIN_SECRETS_VAULT_TOKEN=...
- *    GRIFFIN_SECRETS_VAULT_NAMESPACE=myapp
- *    GRIFFIN_SECRETS_VAULT_KV_VERSION=2
- *    GRIFFIN_SECRETS_VAULT_PREFIX=myapp/
+ * Create an env-based secret provider for fully-local CLI runs (no hub).
  */
-export function getSecretsConfigFromEnv() {
-    const provider = process.env[`${ENV_PREFIX}PROVIDER`] || "env";
-    switch (provider) {
-        case "env":
-            return {
-                provider: "env",
-                prefix: process.env[`${ENV_PREFIX}ENV_PREFIX`] || "",
-                env: process.env,
-            };
-        case "aws": {
-            const region = process.env[`${ENV_PREFIX}AWS_REGION`];
-            if (!region) {
-                throw new Error(`${ENV_PREFIX}AWS_REGION is required when GRIFFIN_SECRETS_PROVIDER=aws`);
-            }
-            const accessKeyId = process.env[`${ENV_PREFIX}AWS_ACCESS_KEY_ID`];
-            const secretAccessKey = process.env[`${ENV_PREFIX}AWS_SECRET_ACCESS_KEY`];
-            return {
-                provider: "aws",
-                region,
-                prefix: process.env[`${ENV_PREFIX}AWS_PREFIX`],
-                roleArn: process.env[`${ENV_PREFIX}AWS_ROLE_ARN`],
-                externalId: process.env[`${ENV_PREFIX}AWS_EXTERNAL_ID`],
-                credentials: accessKeyId && secretAccessKey
-                    ? { accessKeyId, secretAccessKey }
-                    : undefined,
-            };
-        }
-        case "vault": {
-            const address = process.env[`${ENV_PREFIX}VAULT_ADDRESS`];
-            const token = process.env[`${ENV_PREFIX}VAULT_TOKEN`];
-            if (!address) {
-                throw new Error(`${ENV_PREFIX}VAULT_ADDRESS is required when GRIFFIN_SECRETS_PROVIDER=vault`);
-            }
-            if (!token) {
-                throw new Error(`${ENV_PREFIX}VAULT_TOKEN is required when GRIFFIN_SECRETS_PROVIDER=vault`);
-            }
-            const kvVersionStr = process.env[`${ENV_PREFIX}VAULT_KV_VERSION`];
-            const kvVersion = kvVersionStr === "1" || kvVersionStr === "2"
-                ? parseInt(kvVersionStr)
-                : 2;
-            return {
-                provider: "vault",
-                address,
-                token,
-                namespace: process.env[`${ENV_PREFIX}VAULT_NAMESPACE`],
-                kvVersion,
-                prefix: process.env[`${ENV_PREFIX}VAULT_PREFIX`],
-            };
-        }
-        default:
-            throw new Error(`Unknown secrets provider: ${provider}. Supported: env, aws, vault`);
-    }
+export function createEnvSecretsProvider() {
+    return new EnvSecretProvider({
+        prefix: process.env[`${ENV_PREFIX}ENV_PREFIX`] || "",
+        env: process.env,
+    });
 }
 /**
- * Create a secret provider for CLI local runs.
- * Reads configuration from environment variables.
+ * SecretProvider that resolves secrets via the hub's POST /secrets/resolve endpoint.
+ * The hub is the sole gateway for AWS Secrets Manager — no credentials leave the hub.
  */
-export async function createSecretsProviderForCLI() {
-    const config = getSecretsConfigFromEnv();
-    return createSecretProvider(config);
+export class HubSecretProvider {
+    name = "hub";
+    sdk;
+    environment;
+    constructor(sdk, environment) {
+        this.sdk = sdk;
+        this.environment = environment;
+    }
+    async resolve(ref) {
+        const response = await this.sdk.postSecretsResolve({
+            body: { name: ref, environment: this.environment },
+        });
+        const value = response.data?.data?.value;
+        if (value === undefined) {
+            throw new Error(`Secret "${ref}" not found for environment "${this.environment}"`);
+        }
+        return value;
+    }
 }

package/dist/monitor-runner.js

@@ -1,13 +1,14 @@
 import "tsx";
 import { Value } from "typebox/value";
-import { executeMonitorV1, AxiosAdapter, } from "@griffin-app/griffin-executor";
+import { executeMonitorV1, AxiosAdapter, planHasSecrets, } from "@griffin-app/griffin-executor";
 import { MonitorDSLSchema } from "@griffin-app/griffin-core/schema";
 import { randomUUID } from "crypto";
 import { loadVariables } from "./core/variables.js";
 import { getProjectId } from "./core/state.js";
 import { resolveMonitor } from "./resolve.js";
 import { terminal } from "./utils/terminal.js";
-import { createSecretsProviderForCLI } from "./core/secrets.js";
+import { createEnvSecretsProvider, HubSecretProvider } from "./core/secrets.js";
+import { createSdkFromState } from "./core/sdk.js";
 function validateDsl(monitor) {
     const errors = Value.Errors(MonitorDSLSchema, monitor);
     if (errors.length > 0) {
@@ -25,13 +26,25 @@ export async function runTestFile(filePath, envName) {
     const rawMonitor = validateDsl(defaultExport.default);
     terminal.dim(`Project ID: ${projectId}`);
     const resolvedMonitor = resolveMonitor(rawMonitor, projectId, envName, variables);
-    // Create secret provider from environment configuration
-    const secretProvider = await createSecretsProviderForCLI();
+    // Create secret provider: prefer hub (authenticated) for cloud secrets,
+    // fall back to env provider for fully-local runs.
+    let secretProvider;
+    const monitorV1 = { ...resolvedMonitor, id: randomUUID() };
+    if (planHasSecrets(monitorV1)) {
+        try {
+            const sdk = await createSdkFromState();
+            secretProvider = new HubSecretProvider(sdk, envName);
+        }
+        catch {
+            // Hub not available — fall back to env provider
+            secretProvider = createEnvSecretsProvider();
+        }
+    }
+    else {
+        secretProvider = createEnvSecretsProvider();
+    }
     try {
-        const result = await executeMonitorV1({
-            ...resolvedMonitor,
-            id: randomUUID(),
-        }, "default-org", {
+        const result = await executeMonitorV1(monitorV1, "default-org", {
             mode: "local",
             httpClient: new AxiosAdapter(),
             secretProvider,

package/dist/utils/output.js

@@ -178,7 +178,12 @@ export class OutputContext {
             const envelope = {
                 ok: false,
                 command: this.commandName,
-                error: { code, message, ...(details !== undefined && { details }), ...(hint && { hint }) },
+                error: {
+                    code,
+                    message,
+                    ...(details !== undefined && { details }),
+                    ...(hint && { hint }),
+                },
             };
             process.stderr.write(JSON.stringify(envelope) + "\n");
         }

package/dist/utils/sdk-error.js

@@ -47,7 +47,9 @@ function getSDKErrorCodeAndMessage(sdkError, context) {
                 return {
                     code: "CONFLICT",
                     message: `${contextMsg}Conflict`,
-                    details: sdkError.body?.message ? { message: sdkError.body.message } : undefined,
+                    details: sdkError.body?.message
+                        ? { message: sdkError.body.message }
+                        : undefined,
                     hint: "The operation conflicts with the current state.",
                 };
             case 422:
@@ -77,7 +79,9 @@ function getSDKErrorCodeAndMessage(sdkError, context) {
                     details: {
                         status: sdkError.status,
                         statusText: sdkError.statusText,
-                        ...(sdkError.body?.message && { bodyMessage: sdkError.body.message }),
+                        ...(sdkError.body?.message && {
+                            bodyMessage: sdkError.body.message,
+                        }),
                     },
                     hint: "The hub encountered an internal error.",
                 };
@@ -88,7 +92,9 @@ function getSDKErrorCodeAndMessage(sdkError, context) {
                     details: {
                         status: sdkError.status,
                         statusText: sdkError.statusText,
-                        ...(sdkError.body?.message && { bodyMessage: sdkError.body.message }),
+                        ...(sdkError.body?.message && {
+                            bodyMessage: sdkError.body.message,
+                        }),
                         ...(sdkError.message && { message: sdkError.message }),
                     },
                 };
@@ -116,7 +122,8 @@ export function handleSDKError(error, context) {
         }
         else if (typeof details === "object" && "errors" in details) {
             terminal.dim("Validation failed:");
-            for (const err of details.errors) {
+            for (const err of details
+                .errors) {
                 terminal.dim(`  - ${err.message || err}`);
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@griffin-app/griffin-cli",
-  "version": "1.0.29",
+  "version": "1.0.30",
   "description": "CLI tool for running and managing griffin API tests",
   "type": "module",
   "main": "dist/index.js",
@@ -24,8 +24,8 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@griffin-app/griffin-hub-sdk": "1.0.25",
-    "@griffin-app/griffin-executor": "0.1.1",
+    "@griffin-app/griffin-hub-sdk": "1.0.27",
+    "@griffin-app/griffin-executor": "0.1.2",
     "@griffin-app/griffin-core": "0.2.2",
     "better-auth": "^1.4.17",
     "cli-table3": "^0.6.5",