@mp-lb/arcnet 0.1.0 → 0.2.1

package/dist/secrets/writeSecretsWorkflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeSecretsWorkflow.js","sourceRoot":"","sources":["../../src/secrets/writeSecretsWorkflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAqB,EACrB,IAAY,EACZ,UAAkB,EAClB,EAAE;IACF,MAAM,IAAI,GAAG,cAAc,CACzB,IAAI,EACJ,gDAAgD,CACjD,CAAC;IAEF,MAAM,MAAM,GACV,6EAA6E,CAAC;IAEhF,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,IAAI,UAAU,KAAK,sBAAsB;QACvC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO;SACX,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM;QACb,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;SACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,oBAAoB,GAAG,KAAK,CAAC,CAAC,CACrD,CAAC;IAEF,aAAa,CACX,IAAI,EACJ,MAAM;QACJ,SAAS,CAAC;YACR,IAAI,EAAE,yBAAyB;YAC/B,EAAE,EAAE;gBACF,iBAAiB,EAAE,EAAE;gBACrB,IAAI,EAAE;oBACJ,QAAQ,EAAE,CAAC,MAAM,CAAC;oBAClB,KAAK,EAAE;wBACL,YAAY;wBACZ,gDAAgD;wBAChD,cAAc;wBACd,gBAAgB;qBACjB;iBACF;aACF;YACD,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YACjC,IAAI,EAAE;gBACJ,QAAQ,EAAE;oBACR,EAAE,EAAE,yBAAyB,MAAM,CAAC,UAAU,sCAAsC;oBACpF,SAAS,EAAE,eAAe;oBAC1B,iBAAiB,EAAE,EAAE;oBACrB,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,qBAAqB;4BAC3B,IAAI,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;yBACvC;wBACD,EAAE,IAAI,EAAE,sBAAsB,EAAE;wBAChC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE;wBAC/D,EAAE,GAAG,EAAE,iDAAiD,EAAE;wBAC1D;4BACE,IAAI,EAAE,2CAA2C;4BACjD,GAAG,EAAE,4BAA4B;4BACjC,GAAG;yBACJ;qBACF;iBACF;aACF;SACF,CAAC,CACL,CAAC;IAEF,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC,CAAC"}

package/docs/public/commands.md

@@ -12,6 +12,83 @@ Generated from the CLI command tree.
 | `--jsonl` | Render structured completion events |
 | `--noninteractive` | Run without prompts (all commands are noninteractive) |
 
+## `arcnet env`
+
+Load ordered encrypted Forum sources and select environment values.
+
+### `arcnet env check`
+
+Validate decryption and mappings; report key names only.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
+### `arcnet env export`
+
+Write selected plaintext JSON to stdout for an explicit pipeline.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
+### `arcnet env run <command...>`
+
+Run a command with selected keys only; withhold child output.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
+## `arcnet secrets`
+
+Attach Forum files, provision GitHub keys and refresh encrypted snapshots.
+
+### `arcnet secrets add`
+
+Attach an existing Forum file and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--existing-key` | Reuse an existing GitHub secret without creating a recipient |
+
+### `arcnet secrets init`
+
+Create a Forum secrets file, prompt for your password and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--input <file>` | Initial plaintext JSON file; defaults to an empty object |
+
+### `arcnet secrets sync`
+
+Refresh encrypted snapshots from Forum and regenerate validation CI; no decryption.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+
 ## `arcnet version`
 
 Show the installed package version.
@@ -37,10 +114,18 @@ Validate project configuration offline.
 
 Plan deployment (Terraform contacts providers; static Vercel stays offline).
 
+| Option | Description |
+| --- | --- |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
 ## `arcnet deploy`
 
 Deploy the approved project.
 
+| Option | Description |
+| --- | --- |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
 ## `arcnet preview`
 
 Deploy static Vercel sites to preview.

package/docs/public/llms-full.txt

@@ -2,13 +2,11 @@
 
 ArcNet's TypeScript CLI for installing deployment configuration and deploying projects. The package owns shared runners, validation, workflow templates and the Vercel Terraform module; projects keep configuration and application-specific Dockerfiles.
 
-**Release status:** implementation and checks are complete; the first npm publication is blocked by registry authentication. The commands below target the pending `0.1.0` release.
-
 From an existing project with Zap, GitHub, and pinned pnpm:
 
 ```sh
-pnpm dlx @mp-lb/arcnet@0.1.0 setup hello-world --dry-run
-pnpm dlx @mp-lb/arcnet@0.1.0 setup hello-world
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world --dry-run
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world
 pnpm install
 pnpm exec arcnet check
 ```
@@ -19,6 +17,41 @@ Setup pins this package in the existing root manifest. Commit the resulting lock
 
 Zap Arc remains the pinned Terraform engine dependency. Environment bootstrap, health checks and teardown are not implemented by this package yet. The static Vercel adapter retains its existing static-only and explicit-project-reference limitations.
 
+## Layered secrets
+
+`arcnet secrets add` attaches an existing Forum encrypted JSON file. `arcnet secrets init` creates one. Both register a file-specific decryption key in the selected GitHub repository, save an encrypted snapshot, and generate a validation workflow. Setup prompts for your Forum encryption password locally; it never prints the password or recipient key. Use `--existing-key` when the GitHub secret already exists. The local `fm` and `gh` CLIs must be authenticated; the selected Forum parent directory must exist.
+
+Use `/projects/<project-slug>/secrets.json.enc` for project files in the company Forum store.
+
+The project keeps only `.arcnet/secrets.json`, encrypted snapshots under `.arcnet/secrets/`, and workflow references. Sources merge left to right, with later values winning. Each source names its own key environment variable. JSON must be an object; unused structured values are allowed, while selected environment values must be nonempty strings. Consumer mappings select and rename fields; an array of source names accepts aliases only when their values agree.
+
+```json
+{
+  "version": 1,
+  "repository": "example/hello-world",
+  "sources": [
+    { "name": "standard", "store": "example/company", "path": "/admin/standard.json.enc", "keyEnv": "STANDARD_SECRETS_KEY" },
+    { "name": "project", "store": "example/company", "path": "/projects/hello-world/secrets.json.enc", "keyEnv": "PROJECT_SECRETS_KEY" }
+  ],
+  "consumers": {
+    "publish": { "NODE_AUTH_TOKEN": ["NPM_TOKEN", "NODE_AUTH_TOKEN"] },
+    "deploy": { "VERCEL_TOKEN": "VERCEL_API_TOKEN" }
+  }
+}
+```
+
+`secrets sync` fetches ciphertext and adds snapshot identity, revision and checksum to this configuration. Commit config and ciphertext together. CI uses the reviewed snapshots and needs only each file's decryption key, not a Forum login. Sync after editing or rotating a source; obsolete snapshots can be removed after checking that no configuration references them. Setup/sync also wire source-key references into workflow steps that call ArcNet's env or deployment commands.
+
+For live loading, omit a snapshot or select `--live`: the installed `fm` CLI fetches each source using its local login or the source's optional `tokenEnv` access credential. A decryption recipient is **not** a Forum read token. Live CI therefore needs an installed, authenticated `fm` as well as the independent decryption keys. Generated CI intentionally uses snapshots.
+
+`arcnet env check` reports source names and selected key names, never values. `arcnet env export` explicitly emits selected plaintext JSON. `arcnet env run` gives a subprocess only the selected values and a small execution environment; it removes file keys, isolates temporary HOME/cache paths, and withholds subprocess output. Keep npm publishing mappings scoped to publishing credentials. The command reference documents the exact options.
+
+For the first local Terraform plan and deploy, GitHub's file keys cannot be read back. Run `arcnet plan --password` or `arcnet deploy --password` in your terminal: ArcNet prompts once for your Forum encryption password and decrypts the reviewed snapshots locally. `arcnet env check --password` validates them the same way. CI still uses the independent file keys and rejects password mode.
+
+When `.arcnet/secrets.json` exists, deployment commands automatically load it. The `deploy` consumer selects operator credentials; Terraform application values are selected using the existing service env lists in `zap.yaml`. No duplicated application map is required. Offline project checks remain offline. Secrets commands in GitHub Actions require the configured repository's main branch.
+
+Provisioning modifies Forum and GitHub separately. A failed GitHub upload leaves an unused Forum recipient; rerun `secrets add` to create/upload another and remove the unused recipient later. If upload succeeded but snapshot/config writing failed, attach the file with `--existing-key`. Existing sources are not silently rotated on reruns. Provision while nobody else is editing that file: the current fm write interface does not offer atomic revision-conditional writes, though ArcNet checks identity/revision before updating and refuses occupied init paths. GitHub secret names are repository-scoped; environment-level overrides take precedence in jobs that use an environment.
+
 # ArcNet command reference
 
 Generated from the CLI command tree.
@@ -33,6 +66,83 @@ Generated from the CLI command tree.
 | `--jsonl` | Render structured completion events |
 | `--noninteractive` | Run without prompts (all commands are noninteractive) |
 
+## `arcnet env`
+
+Load ordered encrypted Forum sources and select environment values.
+
+### `arcnet env check`
+
+Validate decryption and mappings; report key names only.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
+### `arcnet env export`
+
+Write selected plaintext JSON to stdout for an explicit pipeline.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
+### `arcnet env run <command...>`
+
+Run a command with selected keys only; withhold child output.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+| `--consumer <name>` | Named mapping in the secrets configuration |
+| `--live` | Fetch current ciphertext through the installed fm CLI instead of snapshots |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
+## `arcnet secrets`
+
+Attach Forum files, provision GitHub keys and refresh encrypted snapshots.
+
+### `arcnet secrets add`
+
+Attach an existing Forum file and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--existing-key` | Reuse an existing GitHub secret without creating a recipient |
+
+### `arcnet secrets init`
+
+Create a Forum secrets file, prompt for your password and provision its CI key.
+
+| Option | Description |
+| --- | --- |
+| `--name <name>` | Unique source name; sources merge in installation order |
+| `--store <workspace/store>` | Forum store |
+| `--path <path>` | Encrypted file path in Forum |
+| `--key-env <name>` | GitHub repository secret / environment variable for this file's key |
+| `--repository <owner/repo>` | GitHub repository receiving the key |
+| `--config <file>` | Secrets source configuration |
+| `--input <file>` | Initial plaintext JSON file; defaults to an empty object |
+
+### `arcnet secrets sync`
+
+Refresh encrypted snapshots from Forum and regenerate validation CI; no decryption.
+
+| Option | Description |
+| --- | --- |
+| `--config <file>` | Secrets source configuration |
+
 ## `arcnet version`
 
 Show the installed package version.
@@ -58,10 +168,18 @@ Validate project configuration offline.
 
 Plan deployment (Terraform contacts providers; static Vercel stays offline).
 
+| Option | Description |
+| --- | --- |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
 ## `arcnet deploy`
 
 Deploy the approved project.
 
+| Option | Description |
+| --- | --- |
+| `--password` | Prompt for the Forum encryption password locally instead of using file keys |
+
 ## `arcnet preview`
 
 Deploy static Vercel sites to preview.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mp-lb/arcnet",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "ArcNet project installation and deployment CLI.",
   "license": "MIT",
   "type": "module",
@@ -34,6 +34,7 @@
     "access": "public"
   },
   "dependencies": {
+    "@mp-lb/forum-secrets": "0.2.1",
     "@mp-lb/zapper": "0.21.0",
     "commander": "14.0.3",
     "yaml": "2.8.1",

package/src/createCli.ts

@@ -9,6 +9,8 @@ import { renderResult } from "./renderResult.js";
 import { runTerraform } from "./runTerraform.js";
 import { runVercel } from "./runVercel.js";
 import { setup } from "./setup.js";
+import { createSecretsCommands } from "./secrets/createSecretsCommands.js";
+import { withDeploymentSecrets } from "./secrets/withDeploymentSecrets.js";
 
 export const createCli = () => {
   const cli = new Command("arcnet")
@@ -31,6 +33,8 @@ export const createCli = () => {
     process.stdout.write(renderResult(result, cli.opts()) + "\n");
   };
 
+  createSecretsCommands(cli, output);
+
   cli
     .command("version")
     .description("Show the installed package version.")
@@ -66,6 +70,11 @@ export const createCli = () => {
     create: "Create one explicitly approved Vercel project.",
   })) {
     const command = cli.command(name).description(description);
+    if (name === "plan" || name === "deploy")
+      command.option(
+        "--password",
+        "Prompt for the Forum encryption password locally instead of using file keys",
+      );
     if (name === "create") command.argument("<site>", "Configured site name");
     command.action(async (site: unknown) => {
       const root = realpathSync(cli.opts().root);
@@ -77,21 +86,33 @@ export const createCli = () => {
         ).mode;
 
       const machine = Boolean(cli.opts().json || cli.opts().jsonl);
-      if (mode === "vercel")
-        output(
-          await runVercel(
+
+      const execute = async () => {
+        if (mode === "vercel")
+          return runVercel(
             name,
             root,
             typeof site === "string" ? site : undefined,
             machine,
-          ),
-        );
-      else if (name === "check" || name === "plan" || name === "deploy")
-        output(runTerraform(name, root, machine));
-      else
+          );
+        if (name === "check" || name === "plan" || name === "deploy")
+          return runTerraform(name, root, machine);
         throw new Error(
           `${name} is only supported for static Vercel references.`,
         );
+      };
+
+      output(
+        await (name === "check" || (name === "plan" && mode === "vercel")
+          ? execute()
+          : withDeploymentSecrets(
+              root,
+              mode,
+              execute,
+              Boolean(command.opts().password),
+              Boolean(cli.opts().noninteractive),
+            )),
+      );
     });
   }
 

package/src/secrets/assertNewSource.ts

@@ -0,0 +1,40 @@
+import { posix } from "node:path";
+import type { SecretSource } from "./config.js";
+import { secretCommand } from "./secretCommand.js";
+
+// fm's write API can overwrite without --force, so its default is not create-only.
+export const assertNewSource = (source: SecretSource, root: string) => {
+  const listing = secretCommand(
+    "fm",
+    [
+      "file",
+      "ls",
+      posix.dirname(source.path),
+      "--store",
+      source.store,
+      "--json",
+    ],
+    root,
+  );
+
+  let names: string[];
+
+  try {
+    names = listing
+      .trim()
+      .split("\n")
+      .filter(Boolean)
+      .map((line) => {
+        const entry = JSON.parse(line) as { message?: unknown };
+        if (typeof entry.message !== "string") throw new Error();
+        return entry.message;
+      });
+  } catch {
+    throw new Error("Cannot verify that the new Forum path is unused.");
+  }
+
+  if (names.includes(posix.basename(source.path)))
+    throw new Error(
+      "Forum file already exists; use secrets add to attach it without replacing its contents.",
+    );
+};

package/src/secrets/config.ts

@@ -0,0 +1,91 @@
+import { readFileSync } from "node:fs";
+import { z } from "zod";
+import { safeTargetPath } from "../safeTargetPath.js";
+
+export const envName = z.string().regex(/^[A-Z_][A-Z0-9_]*$/);
+export const sourceSchema = z
+  .object({
+    name: z.string().regex(/^[a-z][a-z0-9-]*$/),
+    store: z.string().regex(/^[\w-]+\/[\w-]+$/),
+    path: z
+      .string()
+      .startsWith("/")
+      .endsWith(".enc")
+      .refine(
+        (path) =>
+          !/[\r\n\0]/.test(path) &&
+          path
+            .split("/")
+            .slice(1)
+            .every((part) => part && part !== "." && part !== ".."),
+      ),
+    keyEnv: envName,
+    tokenEnv: envName.optional(),
+    snapshot: z
+      .object({
+        file: z.string(),
+        fileId: z.string().min(1),
+        revision: z.number().int().nonnegative(),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+      })
+      .strict()
+      .optional(),
+  })
+  .strict();
+export const secretsConfigSchema = z
+  .object({
+    version: z.literal(1),
+    repository: z.string().regex(/^[\w.-]+\/[\w.-]+$/),
+    sources: z.array(sourceSchema).min(1),
+    consumers: z
+      .record(
+        z.string(),
+        z.record(
+          z.string().min(1),
+          z.union([envName, z.array(envName).min(1)]),
+        ),
+      )
+      .default({}),
+  })
+  .strict()
+  .superRefine((config, ctx) => {
+    if (
+      new Set(config.sources.map((s) => s.name)).size !== config.sources.length
+    )
+      ctx.addIssue({ code: "custom", message: "Source names must be unique." });
+    if (
+      new Set(config.sources.map((s) => s.keyEnv)).size !==
+      config.sources.length
+    )
+      ctx.addIssue({
+        code: "custom",
+        message: "Each source needs its own key environment name.",
+      });
+    for (const mapping of Object.values(config.consumers))
+      for (const name of Object.keys(mapping))
+        if (
+          !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+          name !== "pnpm_config_//registry.npmjs.org/:_authToken"
+        )
+          ctx.addIssue({
+            code: "custom",
+            message: "Invalid output environment name.",
+          });
+  });
+export type SecretsConfig = z.infer<typeof secretsConfigSchema>;
+export type SecretSource = z.infer<typeof sourceSchema>;
+
+export const readSecretsConfig = (
+  root: string,
+  file = ".arcnet/secrets.json",
+): SecretsConfig => {
+  try {
+    return secretsConfigSchema.parse(
+      JSON.parse(readFileSync(safeTargetPath(root, file), "utf8")),
+    );
+  } catch {
+    throw new Error(
+      "Missing or invalid secrets configuration (values omitted).",
+    );
+  }
+};