@seekrit/cli 0.33.0 → 0.35.0

package/dist/index.js

@@ -1513,7 +1513,13 @@ z.object({
 * See `docs/third-party-sync.md`.
 */
 /** Platforms seekrit can push to. Append-only — persisted in `sync_connections.provider`. */
-const SYNC_PROVIDER_KINDS = ["vercel"];
+const SYNC_PROVIDER_KINDS = [
+	"vercel",
+	"cloudflare-workers",
+	"cloudflare-pages",
+	"cloudflare-secrets-store",
+	"railway"
+];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
 * Vercel account scope. The API token itself is never here — it is wrapped to
@@ -1528,7 +1534,79 @@ const vercelConnectionConfigSchema = z.object({
 	/** Vercel Team id (`team_…`). Omit for a personal account. */
 	teamId: z.string().trim().min(1).max(128).optional()
 });
-const syncConnectionConfigSchema = z.discriminatedUnion("provider", [vercelConnectionConfigSchema]);
+/**
+* A Cloudflare account id — 32 lowercase hex characters, found in the sidebar
+* of any account's dashboard. Every Cloudflare endpoint seekrit calls is
+* account-scoped, so this is the account half of "which account, which thing".
+*
+* Validated by shape because the alternative is a bare 400 from Cloudflare
+* hours later inside an alarm, with nobody watching. It does not catch pasting
+* a *zone* id, which has the same shape — only the API can tell those apart.
+*/
+const cloudflareAccountIdSchema = z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Cloudflare account ID (lowercase hex)");
+/**
+* Cloudflare account scope, shared by all three Cloudflare providers. The API
+* token is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's is.
+*
+* The three providers are deliberately separate kinds rather than one
+* `cloudflare` with a mode field: they target different APIs, take different
+* destinations, and fail in different ways. Splitting them keeps the
+* exhaustiveness guard in `connectorFor` meaningful.
+*/
+const cloudflareWorkersConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflarePagesConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	accountId: cloudflareAccountIdSchema
+});
+const cloudflareSecretsStoreConnectionConfigSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	accountId: cloudflareAccountIdSchema
+});
+/**
+* A Railway id — every project, environment, and service is a UUID. Validated
+* by shape for the same reason Cloudflare's account id is: the alternative is a
+* bare GraphQL "Problem processing request" hours later inside an alarm, with
+* nobody watching.
+*/
+const railwayIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a Railway UUID");
+/**
+* Which kind of Railway API token the connection holds. This is connection
+* scope rather than a destination detail because it decides the *header* the
+* request carries, and getting it wrong fails every call identically:
+*
+*  - `account` — a personal or workspace token, sent as `Authorization: Bearer`.
+*    Reaches every project the token's owner can see.
+*  - `project` — a project token, sent as `Project-Access-Token`. Scoped to one
+*    project and environment by Railway itself, which makes it the
+*    least-privilege choice when a connection serves a single destination.
+*
+* Railway rejects a project token sent as a bearer, so this cannot be sniffed
+* at request time — the operator states it once, when they paste the token.
+*/
+const RAILWAY_TOKEN_KINDS = ["account", "project"];
+/**
+* Railway account scope. The token is never here — it is wrapped to the
+* connection's public key and stored as ciphertext, exactly as Vercel's is.
+*
+* There is no workspace/team id to carry: Railway ids are globally unique and
+* a destination names its project outright, so the token plus the destination
+* is the whole address.
+*/
+const railwayConnectionConfigSchema = z.object({
+	provider: z.literal("railway"),
+	tokenKind: z.enum(RAILWAY_TOKEN_KINDS).default("account")
+});
+const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
+	vercelConnectionConfigSchema,
+	cloudflareWorkersConnectionConfigSchema,
+	cloudflarePagesConnectionConfigSchema,
+	cloudflareSecretsStoreConnectionConfigSchema,
+	railwayConnectionConfigSchema
+]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
 	"production",
@@ -1547,7 +1625,84 @@ const vercelDestinationSchema = z.object({
 	*/
 	gitBranch: z.string().trim().min(1).max(255).optional()
 });
-const syncDestinationSchema = z.discriminatedUnion("provider", [vercelDestinationSchema]);
+/**
+* The Worker whose secrets a binding owns. Wrangler *environments* are not a
+* separate field because they are not a separate concept at the API: deploying
+* `my-api` with `--env staging` creates a Worker literally named
+* `my-api-staging`, so pointing at an environment means naming that script.
+*/
+const cloudflareWorkersDestinationSchema = z.object({
+	provider: z.literal("cloudflare-workers"),
+	/** Worker script name, as shown in the dashboard (`my-api`). */
+	scriptName: z.string().trim().min(1).max(63).regex(/^[A-Za-z0-9_][A-Za-z0-9_-]*$/, "must be a Worker script name")
+});
+/** The two deployment configs a Pages project keeps env vars under. */
+const CLOUDFLARE_PAGES_ENVIRONMENTS = ["production", "preview"];
+const cloudflarePagesDestinationSchema = z.object({
+	provider: z.literal("cloudflare-pages"),
+	/** Pages project name (`my-site`) — Pages has no separate project id. */
+	projectName: z.string().trim().min(1).max(58).regex(/^[A-Za-z0-9][A-Za-z0-9-]*$/, "must be a Pages project name"),
+	/** Which deployment configs receive these values. At least one. */
+	environments: z.array(z.enum(CLOUDFLARE_PAGES_ENVIRONMENTS)).min(1)
+});
+/**
+* Scopes a Secrets Store secret may be used by. Cloudflare requires at least
+* one at creation and they cannot be inferred, so a binding states them.
+*/
+const CLOUDFLARE_SECRETS_STORE_SCOPES = [
+	"workers",
+	"ai_gateway",
+	"dex",
+	"access",
+	"containers",
+	"websearch"
+];
+const cloudflareSecretsStoreDestinationSchema = z.object({
+	provider: z.literal("cloudflare-secrets-store"),
+	/** Store id (32 hex). An account has exactly one store today. */
+	storeId: z.string().trim().regex(/^[0-9a-f]{32}$/, "must be a 32-character Secrets Store ID (lowercase hex)"),
+	/** Scopes applied to secrets this binding creates. At least one. */
+	scopes: z.array(z.enum(CLOUDFLARE_SECRETS_STORE_SCOPES)).min(1)
+});
+/**
+* Where inside Railway a binding writes.
+*
+* Railway variables are addressed by (project, environment, service) — the
+* environment here is *Railway's* (`production`, `pr-42`), not the seekrit
+* environment the binding reads from; a binding is precisely the mapping
+* between the two.
+*
+* Omitting `serviceId` targets the project's **shared** variables for that
+* environment, which services opt into with `${{shared.NAME}}`. That is a
+* genuinely different destination from any one service's variables, so it is an
+* absent field rather than a sentinel.
+*/
+const railwayDestinationSchema = z.object({
+	provider: z.literal("railway"),
+	/** Railway project id (a UUID, from the project's Settings page or URL). */
+	projectId: railwayIdSchema,
+	/** Railway environment id (a UUID) — the deployment environment to write. */
+	environmentId: railwayIdSchema,
+	/** Service to write. Omit to write the environment's shared variables. */
+	serviceId: railwayIdSchema.optional(),
+	/**
+	* Suppress the redeploy Railway triggers when a variable changes.
+	*
+	* Left off (the default), a sync that changes a value redeploys the service,
+	* which is what makes the new value actually reach the running process —
+	* Railway applies variables at deploy time. Turn it on when deploys are
+	* gated behind a release process and a secrets push must not start one; the
+	* values then sit staged until the next deploy.
+	*/
+	skipDeploys: z.boolean().optional()
+});
+const syncDestinationSchema = z.discriminatedUnion("provider", [
+	vercelDestinationSchema,
+	cloudflareWorkersDestinationSchema,
+	cloudflarePagesDestinationSchema,
+	cloudflareSecretsStoreDestinationSchema,
+	railwayDestinationSchema
+]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
 * explicit `rename` (wins outright), then `prefix`/`suffix`, then `case`.
@@ -2751,7 +2906,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.33.0";
+var version = "0.35.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6556,6 +6711,23 @@ function collect(value, acc) {
 }
 //#endregion
 //#region src/sync.ts
+/** Split a `--flag a,b` list into trimmed, non-empty members. */
+function list(raw, fallback) {
+	return (raw ?? fallback).split(",").map((item) => item.trim()).filter(Boolean);
+}
+/** Reject list members outside a known set, naming both the strays and the choices. */
+function assertMembers(values, allowed, flag) {
+	const unknown = values.filter((v) => !allowed.includes(v));
+	if (unknown.length > 0) fail(`unknown ${flag} ${unknown.join(", ")} — one of: ${allowed.join(", ")}`);
+	return values;
+}
+/** Every Railway id is a UUID; a name or a URL slug in the slot is the common slip. */
+function assertRailwayId(value, flag) {
+	if (!value) fail(`${flag} is required for railway (a UUID)`);
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} should be a Railway UUID, not "${id}"`);
+	return id;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6567,6 +6739,22 @@ function buildConfig(provider, options) {
 			provider: "vercel",
 			...options.teamId ? { teamId: options.teamId } : {}
 		};
+		case "cloudflare-workers":
+		case "cloudflare-pages":
+		case "cloudflare-secrets-store":
+			if (!options.accountId) fail(`--account-id is required for ${provider} — 32 hex characters, in the sidebar of any Cloudflare dashboard page`);
+			return {
+				provider,
+				accountId: options.accountId
+			};
+		case "railway": {
+			const tokenKind = options.tokenKind ?? "account";
+			if (!RAILWAY_TOKEN_KINDS.includes(tokenKind)) fail(`unknown --token-kind "${tokenKind}" — one of: ${RAILWAY_TOKEN_KINDS.join(", ")}`);
+			return {
+				provider: "railway",
+				tokenKind
+			};
+		}
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6584,14 +6772,61 @@ function buildDestination(provider, options) {
 				...options.gitBranch ? { gitBranch: options.gitBranch } : {}
 			};
 		}
+		case "cloudflare-workers":
+			if (!options.script) fail("--script is required for cloudflare-workers (the Worker's name, e.g. my-api)");
+			return {
+				provider: "cloudflare-workers",
+				scriptName: options.script
+			};
+		case "cloudflare-pages": {
+			if (!options.project) fail("--project is required for cloudflare-pages (the project name)");
+			const environments = assertMembers(list(options.target, "production"), CLOUDFLARE_PAGES_ENVIRONMENTS, "--target");
+			return {
+				provider: "cloudflare-pages",
+				projectName: options.project,
+				environments
+			};
+		}
+		case "cloudflare-secrets-store": {
+			if (!options.storeId) fail("--store-id is required for cloudflare-secrets-store (32 hex characters)");
+			const scopes = assertMembers(list(options.scopes, "workers"), CLOUDFLARE_SECRETS_STORE_SCOPES, "--scopes");
+			return {
+				provider: "cloudflare-secrets-store",
+				storeId: options.storeId,
+				scopes
+			};
+		}
+		case "railway": {
+			const projectId = assertRailwayId(options.railwayProject, "--railway-project");
+			const environmentId = assertRailwayId(options.railwayEnvironment, "--railway-environment");
+			const serviceId = options.service ? assertRailwayId(options.service, "--service") : void 0;
+			return {
+				provider: "railway",
+				projectId,
+				environmentId,
+				...serviceId ? { serviceId } : {},
+				...options.skipDeploys ? { skipDeploys: true } : {}
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
 function describeDestination(destination) {
 	switch (destination.provider) {
 		case "vercel": return `${destination.projectId} (${destination.targets.join(", ")}${destination.gitBranch ? ` @${destination.gitBranch}` : ""})`;
+		case "cloudflare-workers": return destination.scriptName;
+		case "cloudflare-pages": return `${destination.projectName} (${destination.environments.join(", ")})`;
+		case "cloudflare-secrets-store": return `store ${destination.storeId} (${destination.scopes.join(", ")})`;
+		case "railway": return `${destination.projectId} / ${destination.environmentId} (${destination.serviceId ? `service ${destination.serviceId}` : "shared"})`;
 	}
 }
+/**
+* Destination flags, shared by `verify` and `enable` so the two can never drift
+* into accepting different ways of naming the same destination.
+*/
+function destinationOptions(command) {
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables)").option("--skip-deploys", "railway: stage values without triggering a redeploy");
+}
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
 	const { connections } = await ctx.client.listSyncConnections(orgId);
@@ -6601,7 +6836,7 @@ async function resolveConnection(ctx, orgId, ref) {
 	return matches[0];
 }
 function registerSyncCommands(program) {
-	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, …)");
+	const sync = program.command("sync").description("push environments to a third-party platform (Vercel, Cloudflare, …)");
 	sync.command("connections").alias("conns").description("list destination accounts seekrit can push to").option("--org <slug>").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6614,7 +6849,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6630,7 +6865,7 @@ function registerSyncCommands(program) {
 		});
 		console.error(`connected ${created.connection.name} (${created.connection.id})`);
 	});
-	sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--json", "print the raw API response").action(async (connection, options) => {
+	destinationOptions(sync.command("verify <connection>").description("check a stored credential against a destination").option("--org <slug>").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--json", "print the raw API response").action(async (connection, options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -6664,7 +6899,7 @@ function registerSyncCommands(program) {
 			col("id", (b) => b.id)
 		], "nothing is syncing — enable it with `seekrit sync enable`"));
 	});
-	sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--project <id>", "vercel: project id or name").option("--target <list>", "vercel: comma-separated targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
+	destinationOptions(sync.command("enable").description("start syncing one environment to a destination (lets seekrit decrypt it)").option("--org <slug>").requiredOption("--connection <name>", "destination account, by name or id").option("--app <slug>", "application slug (defaults to seekrit.json)").requiredOption("--env <slug>", "the environment to push").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel")).option("--prefix <prefix>", "prepend this to every destination key name").option("--include <globs>", "comma-separated name globs to push (default: all)").option("--exclude <globs>", "comma-separated name globs to skip").option("--on-delete <action>", "delete | retain — what happens when a secret is removed", "delete").option("--mode <mode>", "auto (push on write) | manual", "auto").option("--acknowledge-decryption", "confirm that seekrit's servers may decrypt this environment to push it").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		if (options.onDelete !== "delete" && options.onDelete !== "retain") fail("--on-delete must be delete or retain");
 		if (options.mode !== "auto" && options.mode !== "manual") fail("--mode must be auto or manual");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.33.0",
+  "version": "0.35.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
+    "@seekrit/core": "0.0.1",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",