@seekrit/cli 0.3.0 → 0.4.0

package/dist/index.js

@@ -315,7 +315,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.3.0";
+var version = "0.4.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -563,12 +563,19 @@ async function readStdin() {
 * Build the client context from configured credentials, or return null when
 * none are set. `seekrit run` uses this to degrade to a plain launcher instead
 * of exiting; every other command goes through `buildContext`, which fails.
+*
+* `dotenvVars` supplies `SEEKRIT_*` values read from a `.env` file. They sit
+* below the live `process.env` but above the saved config, so a project-local
+* `.env` can carry the token / API URL — matching `seekrit-run`'s
+* `flag > env > .env` credential resolution. Empty for every command but
+* `seekrit run`, which loads `.env` before authenticating.
 */
-function tryBuildContext() {
+function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
-	const apiUrl = process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "http://localhost:8787";
-	const token = process.env.SEEKRIT_TOKEN ?? config.token;
-	const devUser = process.env.SEEKRIT_DEV_USER ?? config.devUser;
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
+	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
 	let auth;
 	if (token) auth = {
 		type: "bearer",
@@ -1028,8 +1035,10 @@ async function materialize(ctx, options) {
 */
 async function materializeForRun(options) {
 	const envFiles = options.envFile ?? [".env"];
+	const dotenvVars = {};
+	overlayEnvFiles(dotenvVars, {}, envFiles);
 	try {
-		const ctx = tryBuildContext();
+		const ctx = tryBuildContext(dotenvVars);
 		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
 		return await materialize(ctx, options);
 	} catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {