@kitsy/cnos-docs 1.11.1 → 1.11.2

package/docs/cli/secret.mdx

@@ -9,10 +9,13 @@ description: Set, get, list, and delete secrets through configured vaults.
 cnos secret set app.token super-secret --vault default
 cnos secret set app.token --vault default
 printf "super-secret" | cnos secret set app.token --vault default --stdin
+cnos secret set app.token --vault prod-gcp
 cnos secret get app.token --vault default --reveal
 cnos secret list
 cnos secret list --reveal
 cnos secret delete app.token
 ```
 
-If you omit `[value]`, CNOS prompts for a masked value interactively so the secret does not have to appear in shell history. In non-interactive environments, pass the value explicitly or use `--stdin`.
+For local vaults, omitting `[value]` prompts for a masked value interactively so the secret does not have to appear in shell history. In non-interactive environments, pass the value explicitly or use `--stdin`.
+
+For non-local vaults such as `environment`, `gcp-secret-manager`, `aws-secrets-manager`, `hashicorp-vault`, and `azure-key-vault`, `cnos secret set` writes repo-safe reference metadata only. If `[value]` is omitted, CNOS uses the logical path as the external ref and does not prompt for secret material. Create or update the actual secret in the backing vault separately.

package/docs/cli/vault.mdx

@@ -18,3 +18,5 @@ For local vaults, `cnos vault create <name>` initializes the encrypted keystore
 `cnos vault auth <name>` re-authenticates an existing vault and fails on wrong credentials. Successful auth writes a derived session key under `~/.cnos/secrets/sessions`, so later CNOS commands can reuse it across shells until you run `cnos vault logout <name>` or `cnos vault logout --all`. With `--store-keychain`, CNOS also stores the derived key in the OS keychain.
 
 After local vault auth, `cnos secret set <path> --vault <name>` can prompt for a masked secret value interactively when you omit `[value]`.
+
+`cnos vault list` can also run outside a CNOS project. In that mode it lists local vault stores from the configured CNOS secret home instead of requiring `.cnosrc.yml`. Project-scoped vault definitions are included when the command runs inside a CNOS workspace.

package/docs/guides/secrets.mdx

@@ -15,7 +15,7 @@ cnos secret set app.token --vault default
 
 `cnos vault create default` initializes the local encrypted vault immediately. If CNOS cannot resolve a passphrase from env or keychain, it prompts interactively. `cnos vault auth default` is only for re-authenticating an existing vault and rejects wrong passphrases.
 
-When `[value]` is omitted, `cnos secret set` prompts for a masked secret value so it does not have to appear in shell history. For non-interactive pipelines, use `--stdin` instead:
+For local vaults, when `[value]` is omitted, `cnos secret set` prompts for a masked secret value so it does not have to appear in shell history. For non-interactive pipelines, use `--stdin` instead:
 
 ```bash
 printf "super-secret" | cnos secret set app.token --vault default --stdin
@@ -26,10 +26,13 @@ Environment-backed vault:
 ```bash
 cnos vault create firebase-prod --provider environment --no-passphrase
 cnos secret set app.token APP_TOKEN --vault github-ci
+cnos secret set app.token --vault firebase-prod
 ```
 
 `environment` is the generic provider for platforms that inject secrets into environment variables before your process starts. `github-secrets` remains a compatibility alias for the same behavior.
 
+For non-local vaults such as `environment`, `gcp-secret-manager`, `aws-secrets-manager`, `hashicorp-vault`, and `azure-key-vault`, `cnos secret set` writes reference metadata only. CNOS does not prompt for or store secret material in the repo. If `[value]` is omitted, CNOS uses the logical secret path as the external ref; create or update the actual secret in the backing vault separately.
+
 This is the CNOS bridge for common cloud and CI runtimes:
 
 - GitHub Actions secrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos-docs",
-  "version": "1.11.1",
+  "version": "1.11.2",
   "description": "Source-of-truth CNOS documentation content for Astro Starlight and other static docs consumers.",
   "type": "module",
   "exports": {