@seekrit/cli 0.33.0 → 0.34.0

package/dist/index.js

@@ -1513,7 +1513,12 @@ z.object({
 * See `docs/third-party-sync.md`.
 */
 /** Platforms seekrit can push to. Append-only — persisted in `sync_connections.provider`. */
-const SYNC_PROVIDER_KINDS = ["vercel"];
+const SYNC_PROVIDER_KINDS = [
+	"vercel",
+	"cloudflare-workers",
+	"cloudflare-pages",
+	"cloudflare-secrets-store"
+];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
@@ -1528,7 +1533,44 @@ const vercelConnectionConfigSchema = z.object({
 	/** Vercel Team id (`team_…`). Omit for a personal account. */
 	teamId: z.string().trim().min(1).max(128).optional()
 });
-const syncConnectionConfigSchema = z.discriminatedUnion("provider", [vercelConnectionConfigSchema]);
+/**
+* A Cloudflare account id — 32 lowercase hex characters, found in the sidebar
+* of any account's dashboard. Every Cloudflare endpoint seekrit calls is
+* account-scoped, so this is the account half of "which account, which thing".
+*
+* Validated by shape because the alternative is a bare 400 from Cloudflare
+* hours later inside an alarm, with nobody watching. It does not catch pasting
+* a *zone* id, which has the same shape — only the API can tell those apart.
+*/
+const cloudflareAccountIdSchema = z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Cloudflare account ID (lowercase hex)");
+/**
+* Cloudflare account scope, shared by all three Cloudflare providers. The API
+* token is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's is.
+*
+* The three providers are deliberately separate kinds rather than one
+* `cloudflare` with a mode field: they target different APIs, take different
+* destinations, and fail in different ways. Splitting them keeps the
+* exhaustiveness guard in `connectorFor` meaningful.
+*/
+const cloudflareWorkersConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflarePagesConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflareSecretsStoreConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	accountId: cloudflareAccountIdSchema
+});
+const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
+	vercelConnectionConfigSchema,
+	cloudflareWorkersConnectionConfigSchema,
+	cloudflarePagesConnectionConfigSchema,
+	cloudflareSecretsStoreConnectionConfigSchema
+]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
 	"production",
@@ -1547,7 +1589,51 @@ const vercelDestinationSchema = z.object({
 	*/
 	gitBranch: z.string().trim().min(1).max(255).optional()
 });
-const syncDestinationSchema = z.discriminatedUnion("provider", [vercelDestinationSchema]);
+/**
+* The Worker whose secrets a binding owns. Wrangler *environments* are not a
+* separate field because they are not a separate concept at the API: deploying
+* `my-api` with `--env staging` creates a Worker literally named
+* `my-api-staging`, so pointing at an environment means naming that script.
+*/
+const cloudflareWorkersDestinationSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	/** Worker script name, as shown in the dashboard (`my-api`). */
+	scriptName: z.string().trim().min(1).max(63).regex(/^[A-Za-z0-9_][A-Za-z0-9_-]*$/, "must be a Worker script name")
+});
+/** The two deployment configs a Pages project keeps env vars under. */
+const CLOUDFLARE_PAGES_ENVIRONMENTS = ["production", "preview"];
+const cloudflarePagesDestinationSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	/** Pages project name (`my-site`) — Pages has no separate project id. */
+	projectName: z.string().trim().min(1).max(58).regex(/^[A-Za-z0-9][A-Za-z0-9-]*$/, "must be a Pages project name"),
+	/** Which deployment configs receive these values. At least one. */
+	environments: z.array(z.enum(CLOUDFLARE_PAGES_ENVIRONMENTS)).min(1)
+});
+/**
+* Scopes a Secrets Store secret may be used by. Cloudflare requires at least
+* one at creation and they cannot be inferred, so a binding states them.
+*/
+const CLOUDFLARE_SECRETS_STORE_SCOPES = [
+	"workers",
+	"ai_gateway",
+	"dex",
+	"access",
+	"containers",
+	"websearch"
+];
+const cloudflareSecretsStoreDestinationSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	/** Store id (32 hex). An account has exactly one store today. */
+	storeId: z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Secrets Store ID (lowercase hex)"),
+	/** Scopes applied to secrets this binding creates. At least one. */
+	scopes: z.array(z.enum(CLOUDFLARE_SECRETS_STORE_SCOPES)).min(1)
+});
+const syncDestinationSchema = z.discriminatedUnion("provider", [
+	vercelDestinationSchema,
+	cloudflareWorkersDestinationSchema,
+	cloudflarePagesDestinationSchema,
+	cloudflareSecretsStoreDestinationSchema
+]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
 * explicit `rename` (wins outright), then `prefix`/`suffix`, then `case`.
@@ -2751,7 +2837,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.33.0";
+var version = "0.34.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6556,6 +6642,16 @@ function collect(value, acc) {
 }
 //#endregion
 //#region src/sync.ts
+/** Split a `--flag a,b` list into trimmed, non-empty members. */
+function list(raw, fallback) {
+	return (raw ?? fallback).split(",").map((item) => item.trim()).filter(Boolean);
+}
+/** Reject list members outside a known set, naming both the strays and the choices. */
+function assertMembers(values, allowed, flag) {
+	const unknown = values.filter((v) => !allowed.includes(v));
+	if (unknown.length > 0) fail(`unknown ${flag} ${unknown.join(", ")} — one of: ${allowed.join(", ")}`);
+	return values;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6567,6 +6663,14 @@ function buildConfig(provider, options) {
 			provider: "vercel",
 			...options.teamId ? { teamId: options.teamId } : {}
 		};
+		case "cloudflare-workers":
+		case "cloudflare-pages":
+		case "cloudflare-secrets-store":
+			if (!options.accountId) fail(`--account-id is required for ${provider} — 32 hex characters, in the sidebar of any Cloudflare dashboard page`);
+			return {
+				provider,
+				accountId: options.accountId
+			};
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6584,14 +6688,48 @@ function buildDestination(provider, options) {
 				...options.gitBranch ? { gitBranch: options.gitBranch } : {}
 			};
 		}
+		case "cloudflare-workers":
+			if (!options.script) fail("--script is required for cloudflare-workers (the Worker's name, e.g. my-api)");
+			return {
+				provider: "cloudflare-workers",
+				scriptName: options.script
+			};
+		case "cloudflare-pages": {
+			if (!options.project) fail("--project is required for cloudflare-pages (the project name)");
+			const environments = assertMembers(list(options.target, "production"), CLOUDFLARE_PAGES_ENVIRONMENTS, "--target");
+			return {
+				provider: "cloudflare-pages",
+				projectName: options.project,
+				environments
+			};
+		}
+		case "cloudflare-secrets-store": {
+			if (!options.storeId) fail("--store-id is required for cloudflare-secrets-store (32 hex characters)");
+			const scopes = assertMembers(list(options.scopes, "workers"), CLOUDFLARE_SECRETS_STORE_SCOPES, "--scopes");
+			return {
+				provider: "cloudflare-secrets-store",
+				storeId: options.storeId,
+				scopes
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
 function describeDestination(destination) {
 	switch (destination.provider) {
 		case "vercel": return `${destination.projectId} (${destination.targets.join(", ")}${destination.gitBranch ? ` @${destination.gitBranch}` : ""})`;
+		case "cloudflare-workers": return destination.scriptName;
+		case "cloudflare-pages": return `${destination.projectName} (${destination.environments.join(", ")})`;
+		case "cloudflare-secrets-store": return `store ${destination.storeId} (${destination.scopes.join(", ")})`;
 	}
 }
+/**
+* Destination flags, shared by `verify` and `enable` so the two can never drift
+* into accepting different ways of naming the same destination.
+*/
+function destinationOptions(command) {
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers");
+}
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
 	const { connections } = await ctx.client.listSyncConnections(orgId);
@@ -6601,7 +6739,7 @@ async function resolveConnection(ctx, orgId, ref) {
 	return matches[0];
 }
 function registerSyncCommands(program) {
-	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, …)");
+	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, Cloudflare, …)");
 	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6614,7 +6752,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6630,7 +6768,7 @@ function registerSyncCommands(program) {
 		});
 		console.error(`connected ${created.connection.name} (${created.connection.id})`);
 	});
-	sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--json", "print the raw API response").action(async (connection, options) => {
+	destinationOptions(sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--json", "print the raw API response").action(async (connection, options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6664,7 +6802,7 @@ function registerSyncCommands(program) {
 			col("id", (b) => b.id)
 		], "nothing is syncing — enable it with `seekrit sync enable`"));
 	});
-	sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
+	destinationOptions(sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		if (options.onDelete !== "delete" && options.onDelete !== "retain") fail("--on-delete must be delete or retain");
 		if (options.mode !== "auto" && options.mode !== "manual") fail("--mode must be auto or manual");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/api-client": "0.0.1",
+    "@seekrit/core": "0.0.1",
     "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",