@kitsy/cnos-cli 1.8.1 → 1.8.3

package/dist/index.js

@@ -802,7 +802,10 @@ async function defineValue(namespace, configPath, rawValue, options = {}) {
   };
 }
 async function setSecret(configPath, rawValue, options = {}) {
-  const runtime = await createRuntimeService(options);
+  const runtime = await createRuntimeService({
+    ...options,
+    secretResolution: "lazy"
+  });
   const workspaceRoot = getSelectedWorkspaceRoot(options, runtime);
   const profile = options.profile ?? runtime.graph.profile;
   const filePath = resolveConfigDocumentPath(workspaceRoot, "secret", configPath, profile);
@@ -812,7 +815,7 @@ async function setSecret(configPath, rawValue, options = {}) {
   if (!vaultDefinition) {
     throw new Error(`Unknown vault "${vault}". Create it first with cnos vault create ${vault}.`);
   }
-  const mode = options.mode ?? (vaultDefinition.provider === "local" ? "local" : vaultDefinition.provider === "github-secrets" ? "ref" : "remote");
+  const mode = options.mode ?? (vaultDefinition.provider === "local" ? "local" : vaultDefinition.provider === "github-secrets" || vaultDefinition.provider === "environment" ? "ref" : "remote");
   let reference;
   if (mode === "local") {
     const auth = await resolveVaultAuth(vault, vaultDefinition, options.processEnv ?? process.env);
@@ -843,7 +846,10 @@ async function setSecret(configPath, rawValue, options = {}) {
 }
 async function deleteSecret(configPath, options = {}) {
   await assertWritableConfigRoot(`delete secret.${configPath}`, options);
-  const runtime = await createRuntimeService(options);
+  const runtime = await createRuntimeService({
+    ...options,
+    secretResolution: "lazy"
+  });
   const workspaceRoot = getSelectedWorkspaceRoot(options, runtime);
   const profile = options.profile ?? runtime.graph.profile;
   const filePath = resolveConfigDocumentPath(workspaceRoot, "secret", configPath, profile);
@@ -1806,7 +1812,7 @@ var COMMANDS = [
       "cnos vault create local-dev",
       "cnos vault auth local-dev",
       "cnos secret set app.token super-secret --vault local-dev",
-      "cnos vault create github-ci --provider github-secrets --no-passphrase",
+      "cnos vault create github-ci --provider environment --no-passphrase",
       "cnos secret set app.token APP_TOKEN --vault github-ci"
     ]
   },
@@ -1814,21 +1820,21 @@ var COMMANDS = [
     id: "vault",
     summary: "Manage manifest-defined secret vaults.",
     usage: "cnos vault [create <name> | list | remove <name>] [options] [global-options]",
-    description: "Creates, lists, and removes vault definitions in .cnos/cnos.yml. Local vaults use encrypted material under ~/.cnos/secrets, while github-secrets vaults resolve from process.env in CI.",
+    description: "Creates, lists, and removes vault definitions in .cnos/cnos.yml. Local vaults use encrypted material under ~/.cnos/secrets, while environment-backed vaults resolve from process.env in CI and cloud runtimes. github-secrets remains a compatibility alias.",
     options: [
       {
-        flag: "--provider <local|github-secrets>",
+        flag: "--provider <local|environment|github-secrets>",
         description: "Vault provider. Defaults to local."
       },
       {
         flag: "--no-passphrase",
-        description: "Allowed for passwordless providers such as github-secrets."
+        description: "Allowed for passwordless providers such as environment-backed vaults."
       }
     ],
     examples: [
       "cnos vault create local-dev",
       "cnos vault auth local-dev",
-      "cnos vault create github-ci --provider github-secrets --no-passphrase",
+      "cnos vault create github-ci --provider environment --no-passphrase",
       "cnos vault list",
       "cnos vault remove local-dev"
     ]
@@ -1836,11 +1842,11 @@ var COMMANDS = [
   {
     id: "vault create",
     summary: "Create a manifest-defined vault.",
-    usage: "cnos vault create <name> [--provider <local|github-secrets>] [--no-passphrase] [global-options]",
+    usage: "cnos vault create <name> [--provider <local|environment|github-secrets>] [--no-passphrase] [global-options]",
     description: "Creates a vault definition in .cnos/cnos.yml and, for local vaults, initializes the encrypted store under ~/.cnos/secrets. CNOS prompts for a passphrase when one is not already available from env or keychain.",
     examples: [
       "cnos vault create local-dev",
-      "cnos vault create github-ci --provider github-secrets --no-passphrase"
+      "cnos vault create firebase-prod --provider environment --no-passphrase"
     ]
   },
   {
@@ -2013,12 +2019,12 @@ var COMMANDS = [
     id: "secret set",
     summary: "Write a secret securely.",
     usage: "cnos secret set <path> <value> [--local|--remote|--ref] [--vault <name>] [--provider <name>] [global-options]",
-    description: "Writes a secret reference into the repo. When a local vault is selected, CNOS stores encrypted secret material outside the repo under ~/.cnos/secrets/vaults/<vault>; when a github-secrets vault is selected, CNOS writes a CI env-backed ref.",
+    description: "Writes a secret reference into the repo. When a local vault is selected, CNOS stores encrypted secret material outside the repo under ~/.cnos/secrets/vaults/<vault>; when an environment-backed vault is selected, CNOS writes an env-backed ref for CI or cloud runtimes.",
     examples: [
       "cnos vault create db",
       "cnos vault auth db",
       "cnos secret set app.token super-secret --vault db",
-      "cnos vault create github-ci --provider github-secrets --no-passphrase",
+      "cnos vault create github-ci --provider environment --no-passphrase",
       "cnos secret set app.token APP_TOKEN --vault github-ci"
     ]
   },
@@ -2914,7 +2920,10 @@ function toStoredEntry(namespace, entry, filter = {}) {
   };
 }
 async function listStoredNamespace(namespace, options) {
-  const runtime = await createRuntimeService(options);
+  const runtime = await createRuntimeService({
+    ...options,
+    ...namespace === "secret" ? { secretResolution: "lazy" } : {}
+  });
   return Array.from(runtime.graph.entries.values()).filter((entry) => entry.namespace === namespace).map((entry) => {
     const stored = toStoredEntry(namespace, entry, options);
     if (!stored) {
@@ -4012,21 +4021,21 @@ async function authenticateVault(name, options = {}) {
   const auth = await resolveVaultAuth2(vault, definition, options.processEnv ?? process.env);
   const storeRoot = resolveSecretStoreRoot2(options.processEnv);
   if (definition.provider === "local") {
-    if (!auth.passphrase) {
-      throw new Error(`Vault "${vault}" requires passphrase-based authentication.`);
-    }
     const metadata = await readVaultMetadata(storeRoot, vault);
     if (!metadata) {
       throw new Error(
         `Vault "${vault}" has not been initialized yet. Run cnos vault create ${vault} first.`
       );
     }
-    const derivedKey = deriveVaultKey(auth.passphrase, Buffer.from(metadata.salt, "base64"), metadata.iterations);
+    const derivedKey = auth.derivedKey ?? (auth.passphrase ? deriveVaultKey(auth.passphrase, Buffer.from(metadata.salt, "base64"), metadata.iterations) : void 0);
+    if (!derivedKey) {
+      throw new Error(`Vault "${vault}" requires passphrase-based authentication.`);
+    }
     await listLocalSecrets(
       storeRoot,
       {
         derivedKey,
-        method: auth.method,
+        method: auth.derivedKey ? auth.method : "passphrase",
         ...definition.auth?.config ? { config: definition.auth.config } : {}
       },
       vault
@@ -4191,7 +4200,10 @@ async function runSecret(argsOrPath, options = {}) {
     return runVault(["create", tail[0] ?? "default"], options);
   }
   if (action === "list") {
-    const runtime2 = await createRuntimeService(options);
+    const runtime2 = await createRuntimeService({
+      ...options,
+      secretResolution: "lazy"
+    });
     const prefix = consumeOption(cliArgs, "--prefix");
     const vault = consumeOption(cliArgs, "--vault");
     const provider = consumeOption(cliArgs, "--provider");
@@ -4254,12 +4266,16 @@ async function runSecret(argsOrPath, options = {}) {
     }
     return result.deleted ? `deleted secret.${secretPath2} from ${displayPath(result.filePath, root)}` : `no secret.${secretPath2} found in ${displayPath(result.filePath, root)}`;
   }
-  const runtime = await createRuntimeService(options);
+  const runtime = await createRuntimeService({
+    ...options,
+    secretResolution: "lazy"
+  });
   const secretPath = tail[0] ?? "app.token";
   const expectedVault = consumeOption(cliArgs, "--vault");
   const reveal = consumeFlag(cliArgs, "--reveal");
   const entry = runtime.graph.entries.get(`secret.${secretPath}`);
   const secretRef = entry?.winner.metadata?.secretRef;
+  await runtime.refreshSecret(`secret.${secretPath}`);
   const value = runtime.secret(secretPath);
   if (value === void 0) {
     throw new Error(`Missing CNOS secret path: ${secretPath}`);
@@ -4318,7 +4334,7 @@ async function runValidate(options = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos-cli",
-  version: "1.8.1",
+  version: "1.8.3",
   description: "CLI entry point and developer tooling for CNOS.",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos-cli",
-  "version": "1.8.1",
+  "version": "1.8.3",
   "description": "CLI entry point and developer tooling for CNOS.",
   "type": "module",
   "main": "./dist/index.js",
@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "smol-toml": "^1.4.2",
-    "@kitsy/cnos": "1.8.1"
+    "@kitsy/cnos": "1.8.3"
   },
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts",