@monster-orange/den 0.2.7 → 0.3.0

package/README.md

@@ -122,11 +122,13 @@ Concerns that vary by org are strategies selected in config, never hard-wired:
 
 | Concern          | Built-in choices                        | Chosen in                                                                                                            |
 | ---------------- | --------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
-| Secrets backend  | `env`, `doppler`, `1password`           | `secrets.provider` in the org config; per engineer in `config/local/user.yml`; per shell `<PREFIX>_SECRETS_PROVIDER` |
+| Secrets backend  | `none`, `env`, `doppler`, `1password`   | `secrets.provider` in the org config; per engineer in `config/local/user.yml`; per shell `<PREFIX>_SECRETS_PROVIDER` |
 | Test-user tokens | `local-jwt`, `cognito`, `auth0`, `none` | `auth.provider` in `config/environments/<env>.json`                                                                  |
 
 A new secrets backend implements `SecretsProvider`
-(`src/shared/secrets/types.ts`); a new identity provider implements a token
+(`src/shared/secrets/types.ts`) and registers as a strategy
+(`src/shared/secrets/strategies.ts`); a distribution needs no store at all
+(`none`, see "Secrets" in `docs/distributions.md`). A new identity provider implements a token
 provider in `src/shared/auth/token-providers/`.
 
 ## CLI

package/bin/den

@@ -16,7 +16,8 @@ if [ -z "${DEN_ROOT:-}" ] && [ -f "$DEN_ENGINE_ROOT/den.yml" ]; then
   export DEN_ROOT
 fi
 export DEN_INVOKE_CWD="$PWD"
-export OP_ACCOUNT="${OP_ACCOUNT:-example.1password.com}"
+# No backend account of its own (SEC-0): the 1password strategy sets
+# OP_ACCOUNT from the distribution's config, or the caller's own is kept.
 
 # tsx: Den's own (a checkout) or hoisted into the distribution's node_modules.
 find_tsx() {