@seekrit/cli 0.32.0 → 0.34.0

package/dist/index.js

@@ -16,6 +16,12 @@ const ENTITLEMENT_KEYS = Object.keys({
 		description: "Client-side managed keys for application-layer encryption and signing.",
 		default: true
 	},
+	"feature.honey_tokens": {
+		kind: "feature",
+		label: "Honey tokens",
+		description: "Decoy credentials that alert the moment anyone tries to use them.",
+		default: true
+	},
 	"feature.leases": {
 		kind: "feature",
 		label: "Temporary access",
@@ -122,7 +128,7 @@ const PLAN_FAMILIES = {
 		id: "free",
 		name: "Free",
 		description: "Get started with the essentials.",
-		current: 1,
+		current: 3,
 		hidden: false
 	},
 	team: {
@@ -1119,6 +1125,9 @@ const AUDIT_ACTIONS = [
 	"token.created",
 	"token.revoked",
 	"token.deleted",
+	"honey_token.created",
+	"honey_token.deleted",
+	"honey_token.tripped",
 	"cli_session.approved",
 	"cli_session.denied",
 	"cli_session.revoked",
@@ -1177,7 +1186,8 @@ const NOTIFICATION_TYPES = [
 	"org_welcome",
 	"token_expiring",
 	"lease_expired",
-	"sync_failed"
+	"sync_failed",
+	"honey_token_tripped"
 ];
 /** UI-facing copy + default for each notification type. */
 const NOTIFICATION_TYPE_META = {
@@ -1225,6 +1235,11 @@ const NOTIFICATION_TYPE_META = {
 		label: "Third-party sync failed",
 		description: "A sync to an external destination failed repeatedly and stopped retrying. The destination is now holding stale values.",
 		defaultEnabled: true
+	},
+	honey_token_tripped: {
+		label: "Honey token tripped",
+		description: "Someone tried to use one of your organization's decoy credentials (throttled per token). Nothing legitimate holds one, so every trip is worth reading.",
+		defaultEnabled: true
 	}
 };
 //#endregion
@@ -1332,6 +1347,14 @@ z.object({
 	environmentId: z.string().min(1).nullish(),
 	expiresAt: z.iso.datetime().nullish()
 });
+z.object({
+	name: nameSchema,
+	tokenId: z.string().regex(/^skt_[0-9A-Za-z]+$/),
+	/** SHA-256 hash (base64url) of the full token string. */
+	tokenHash: z.string().min(1),
+	/** Where the decoy was planted, as a reminder for whoever reads the alert. */
+	placement: z.string().max(200).nullish()
+});
 const kmsKeyPurposeSchema = z.enum(["encrypt", "sign"]);
 const kmsKeySpecSchema = z.enum(["aes-256-gcm", "ecdsa-p256"]);
 /** A wrapped key grant supplied by the client (server never sees plaintext material). */
@@ -1490,7 +1513,12 @@ z.object({
 * See `docs/third-party-sync.md`.
 */
 /** Platforms seekrit can push to. Append-only — persisted in `sync_connections.provider`. */
-const SYNC_PROVIDER_KINDS = ["vercel"];
+const SYNC_PROVIDER_KINDS = [
+	"vercel",
+	"cloudflare-workers",
+	"cloudflare-pages",
+	"cloudflare-secrets-store"
+];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
@@ -1505,7 +1533,44 @@ const vercelConnectionConfigSchema = z.object({
 	/** Vercel Team id (`team_…`). Omit for a personal account. */
 	teamId: z.string().trim().min(1).max(128).optional()
 });
-const syncConnectionConfigSchema = z.discriminatedUnion("provider", [vercelConnectionConfigSchema]);
+/**
+* A Cloudflare account id — 32 lowercase hex characters, found in the sidebar
+* of any account's dashboard. Every Cloudflare endpoint seekrit calls is
+* account-scoped, so this is the account half of "which account, which thing".
+*
+* Validated by shape because the alternative is a bare 400 from Cloudflare
+* hours later inside an alarm, with nobody watching. It does not catch pasting
+* a *zone* id, which has the same shape — only the API can tell those apart.
+*/
+const cloudflareAccountIdSchema = z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Cloudflare account ID (lowercase hex)");
+/**
+* Cloudflare account scope, shared by all three Cloudflare providers. The API
+* token is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's is.
+*
+* The three providers are deliberately separate kinds rather than one
+* `cloudflare` with a mode field: they target different APIs, take different
+* destinations, and fail in different ways. Splitting them keeps the
+* exhaustiveness guard in `connectorFor` meaningful.
+*/
+const cloudflareWorkersConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflarePagesConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflareSecretsStoreConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	accountId: cloudflareAccountIdSchema
+});
+const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
+	vercelConnectionConfigSchema,
+	cloudflareWorkersConnectionConfigSchema,
+	cloudflarePagesConnectionConfigSchema,
+	cloudflareSecretsStoreConnectionConfigSchema
+]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
 	"production",
@@ -1524,7 +1589,51 @@ const vercelDestinationSchema = z.object({
 	*/
 	gitBranch: z.string().trim().min(1).max(255).optional()
 });
-const syncDestinationSchema = z.discriminatedUnion("provider", [vercelDestinationSchema]);
+/**
+* The Worker whose secrets a binding owns. Wrangler *environments* are not a
+* separate field because they are not a separate concept at the API: deploying
+* `my-api` with `--env staging` creates a Worker literally named
+* `my-api-staging`, so pointing at an environment means naming that script.
+*/
+const cloudflareWorkersDestinationSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	/** Worker script name, as shown in the dashboard (`my-api`). */
+	scriptName: z.string().trim().min(1).max(63).regex(/^[A-Za-z0-9_][A-Za-z0-9_-]*$/, "must be a Worker script name")
+});
+/** The two deployment configs a Pages project keeps env vars under. */
+const CLOUDFLARE_PAGES_ENVIRONMENTS = ["production", "preview"];
+const cloudflarePagesDestinationSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	/** Pages project name (`my-site`) — Pages has no separate project id. */
+	projectName: z.string().trim().min(1).max(58).regex(/^[A-Za-z0-9][A-Za-z0-9-]*$/, "must be a Pages project name"),
+	/** Which deployment configs receive these values. At least one. */
+	environments: z.array(z.enum(CLOUDFLARE_PAGES_ENVIRONMENTS)).min(1)
+});
+/**
+* Scopes a Secrets Store secret may be used by. Cloudflare requires at least
+* one at creation and they cannot be inferred, so a binding states them.
+*/
+const CLOUDFLARE_SECRETS_STORE_SCOPES = [
+	"workers",
+	"ai_gateway",
+	"dex",
+	"access",
+	"containers",
+	"websearch"
+];
+const cloudflareSecretsStoreDestinationSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	/** Store id (32 hex). An account has exactly one store today. */
+	storeId: z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Secrets Store ID (lowercase hex)"),
+	/** Scopes applied to secrets this binding creates. At least one. */
+	scopes: z.array(z.enum(CLOUDFLARE_SECRETS_STORE_SCOPES)).min(1)
+});
+const syncDestinationSchema = z.discriminatedUnion("provider", [
+	vercelDestinationSchema,
+	cloudflareWorkersDestinationSchema,
+	cloudflarePagesDestinationSchema,
+	cloudflareSecretsStoreDestinationSchema
+]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
 * explicit `rename` (wins outright), then `prefix`/`suffix`, then `case`.
@@ -2684,6 +2793,14 @@ async function createServiceToken() {
 		publicKeyJwk
 	};
 }
+async function createHoneyToken() {
+	const { token, tokenId, tokenHash } = await createServiceToken();
+	return {
+		token,
+		tokenId,
+		tokenHash
+	};
+}
 async function parseServiceToken(token) {
 	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
 	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
@@ -2720,7 +2837,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.32.0";
+var version = "0.34.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -3032,6 +3149,16 @@ var SeekritClient = class {
 	deleteToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}/permanent`);
 	}
+	listHoneyTokens(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/honey-tokens`);
+	}
+	createHoneyToken(orgId, input) {
+		return this.request("POST", `/v1/orgs/${orgId}/honey-tokens`, input);
+	}
+	/** Delete a decoy outright — there is no access to revoke first. */
+	deleteHoneyToken(orgId, honeyTokenId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/honey-tokens/${honeyTokenId}`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -5233,6 +5360,52 @@ function registerGroupCommands(program) {
 	});
 }
 //#endregion
+//#region src/honey.ts
+/**
+* Honey tokens — decoy credentials that unlock nothing and alert when used.
+*
+* Minted client-side like real tokens (the API only ever sees a hash), printed
+* once, and then planted wherever a thief would rummage. The CLI is the natural
+* home for this: `seekrit honey-token create` piped straight into the file,
+* commit, config, or CI variable you want watched.
+*/
+function registerHoneyTokenCommands(program) {
+	const honey = program.command("honey-token").description("plant decoy credentials that alert when anyone tries to use them");
+	honey.command("create").description("mint a decoy credential; prints it once").requiredOption("--name <name>", "display name, e.g. legacy-ci-bait").option("--org <slug>").option("--placement <note>", "where you're planting it (echoed in the alert email)").action(async (options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		const created = await createHoneyToken();
+		await ctx.client.createHoneyToken(orgRef.id, {
+			name: options.name,
+			tokenId: created.tokenId,
+			tokenHash: created.tokenHash,
+			placement: options.placement ?? null
+		});
+		console.error("decoy created — save it now, it is not stored. Plant it somewhere a thief would look, NOT anywhere your own tooling reads: a deploy script that tries it by mistake trips the alarm just as loudly. It grants nothing.");
+		console.log(created.token);
+	});
+	honey.command("list").alias("ls").description("list decoy credentials and whether any have been tripped").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		const { honeyTokens } = await ctx.client.listHoneyTokens(orgRef.id);
+		emit(options, { honeyTokens }, () => printTable(honeyTokens, [
+			col("name", (t) => t.name),
+			col("status", (t) => t.tripCount > 0 ? `TRIPPED ${t.tripCount}×` : "untouched"),
+			col("planted in", (t) => t.placement ?? "—"),
+			col("last tripped", (t) => t.lastTrippedAt ?? "never"),
+			col("last source", (t) => t.lastTripIp ?? "—"),
+			col("id", (t) => t.id)
+		], "no decoys planted — create one with `seekrit honey-token create`"));
+	});
+	honey.command("delete <honeyTokenId>").alias("rm").description("delete a decoy (stops it alerting)").option("--org <slug>").option("--yes", "skip the confirmation prompt").action(async (honeyTokenId, options) => {
+		const ctx = buildContext();
+		const orgRef = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Delete ${honeyTokenId}? Wherever you planted it goes back to being unwatched — pull the bait too.`);
+		await ctx.client.deleteHoneyToken(orgRef.id, honeyTokenId);
+		console.error(`${honeyTokenId} deleted`);
+	});
+}
+//#endregion
 //#region src/logsink.ts
 /** Collect repeated `--header Name: value` flags into a map. */
 function collectHeader(value, acc = {}) {
@@ -6469,6 +6642,16 @@ function collect(value, acc) {
 }
 //#endregion
 //#region src/sync.ts
+/** Split a `--flag a,b` list into trimmed, non-empty members. */
+function list(raw, fallback) {
+	return (raw ?? fallback).split(",").map((item) => item.trim()).filter(Boolean);
+}
+/** Reject list members outside a known set, naming both the strays and the choices. */
+function assertMembers(values, allowed, flag) {
+	const unknown = values.filter((v) => !allowed.includes(v));
+	if (unknown.length > 0) fail(`unknown ${flag} ${unknown.join(", ")} — one of: ${allowed.join(", ")}`);
+	return values;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6480,6 +6663,14 @@ function buildConfig(provider, options) {
 			provider: "vercel",
 			...options.teamId ? { teamId: options.teamId } : {}
 		};
+		case "cloudflare-workers":
+		case "cloudflare-pages":
+		case "cloudflare-secrets-store":
+			if (!options.accountId) fail(`--account-id is required for ${provider} — 32 hex characters, in the sidebar of any Cloudflare dashboard page`);
+			return {
+				provider,
+				accountId: options.accountId
+			};
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6497,14 +6688,48 @@ function buildDestination(provider, options) {
 				...options.gitBranch ? { gitBranch: options.gitBranch } : {}
 			};
 		}
+		case "cloudflare-workers":
+			if (!options.script) fail("--script is required for cloudflare-workers (the Worker's name, e.g. my-api)");
+			return {
+				provider: "cloudflare-workers",
+				scriptName: options.script
+			};
+		case "cloudflare-pages": {
+			if (!options.project) fail("--project is required for cloudflare-pages (the project name)");
+			const environments = assertMembers(list(options.target, "production"), CLOUDFLARE_PAGES_ENVIRONMENTS, "--target");
+			return {
+				provider: "cloudflare-pages",
+				projectName: options.project,
+				environments
+			};
+		}
+		case "cloudflare-secrets-store": {
+			if (!options.storeId) fail("--store-id is required for cloudflare-secrets-store (32 hex characters)");
+			const scopes = assertMembers(list(options.scopes, "workers"), CLOUDFLARE_SECRETS_STORE_SCOPES, "--scopes");
+			return {
+				provider: "cloudflare-secrets-store",
+				storeId: options.storeId,
+				scopes
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
 function describeDestination(destination) {
 	switch (destination.provider) {
 		case "vercel": return `${destination.projectId} (${destination.targets.join(", ")}${destination.gitBranch ? ` @${destination.gitBranch}` : ""})`;
+		case "cloudflare-workers": return destination.scriptName;
+		case "cloudflare-pages": return `${destination.projectName} (${destination.environments.join(", ")})`;
+		case "cloudflare-secrets-store": return `store ${destination.storeId} (${destination.scopes.join(", ")})`;
 	}
 }
+/**
+* Destination flags, shared by `verify` and `enable` so the two can never drift
+* into accepting different ways of naming the same destination.
+*/
+function destinationOptions(command) {
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers");
+}
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
 	const { connections } = await ctx.client.listSyncConnections(orgId);
@@ -6514,7 +6739,7 @@ async function resolveConnection(ctx, orgId, ref) {
 	return matches[0];
 }
 function registerSyncCommands(program) {
-	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, …)");
+	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, Cloudflare, …)");
 	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6527,7 +6752,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6543,7 +6768,7 @@ function registerSyncCommands(program) {
 		});
 		console.error(`connected ${created.connection.name} (${created.connection.id})`);
 	});
-	sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--json", "print the raw API response").action(async (connection, options) => {
+	destinationOptions(sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--json", "print the raw API response").action(async (connection, options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6577,7 +6802,7 @@ function registerSyncCommands(program) {
 			col("id", (b) => b.id)
 		], "nothing is syncing — enable it with `seekrit sync enable`"));
 	});
-	sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
+	destinationOptions(sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		if (options.onDelete !== "delete" && options.onDelete !== "retain") fail("--on-delete must be delete or retain");
 		if (options.mode !== "auto" && options.mode !== "manual") fail("--mode must be auto or manual");
@@ -7307,6 +7532,7 @@ program.command("export").description("print decrypted secrets (dotenv, json, or
 	console.log(formatSecrets(values, options.format));
 });
 registerAccessCommands(program);
+registerHoneyTokenCommands(program);
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
 token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",