@seekrit/cli 0.34.0 → 0.35.0

package/dist/index.js

@@ -1517,7 +1517,8 @@ const SYNC_PROVIDER_KINDS = [
 	"vercel",
 	"cloudflare-workers",
 	"cloudflare-pages",
-	"cloudflare-secrets-store"
+	"cloudflare-secrets-store",
+	"railway"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1565,11 +1566,46 @@ const cloudflareSecretsStoreConnectionConfigSchema = z.object({
 	provider: z.literal("cloudflare-secrets-store"),
 	accountId: cloudflareAccountIdSchema
 });
+/**
+* A Railway id — every project, environment, and service is a UUID. Validated
+* by shape for the same reason Cloudflare's account id is: the alternative is a
+* bare GraphQL "Problem processing request" hours later inside an alarm, with
+* nobody watching.
+*/
+const railwayIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a Railway UUID");
+/**
+* Which kind of Railway API token the connection holds. This is connection
+* scope rather than a destination detail because it decides the *header* the
+* request carries, and getting it wrong fails every call identically:
+*
+*  - `account` — a personal or workspace token, sent as `Authorization: Bearer`.
+*    Reaches every project the token's owner can see.
+*  - `project` — a project token, sent as `Project-Access-Token`. Scoped to one
+*    project and environment by Railway itself, which makes it the
+*    least-privilege choice when a connection serves a single destination.
+*
+* Railway rejects a project token sent as a bearer, so this cannot be sniffed
+* at request time — the operator states it once, when they paste the token.
+*/
+const RAILWAY_TOKEN_KINDS = ["account", "project"];
+/**
+* Railway account scope. The token is never here — it is wrapped to the
+* connection's public key and stored as ciphertext, exactly as Vercel's is.
+*
+* There is no workspace/team id to carry: Railway ids are globally unique and
+* a destination names its project outright, so the token plus the destination
+* is the whole address.
+*/
+const railwayConnectionConfigSchema = z.object({
+	provider: z.literal("railway"),
+	tokenKind: z.enum(RAILWAY_TOKEN_KINDS).default("account")
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
 	cloudflarePagesConnectionConfigSchema,
-	cloudflareSecretsStoreConnectionConfigSchema
+	cloudflareSecretsStoreConnectionConfigSchema,
+	railwayConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1628,11 +1664,44 @@ const cloudflareSecretsStoreDestinationSchema = z.object({
 	/** Scopes applied to secrets this binding creates. At least one. */
 	scopes: z.array(z.enum(CLOUDFLARE_SECRETS_STORE_SCOPES)).min(1)
 });
+/**
+* Where inside Railway a binding writes.
+*
+* Railway variables are addressed by (project, environment, service) — the
+* environment here is *Railway's* (`production`, `pr-42`), not the seekrit
+* environment the binding reads from; a binding is precisely the mapping
+* between the two.
+*
+* Omitting `serviceId` targets the project's **shared** variables for that
+* environment, which services opt into with `${{shared.NAME}}`. That is a
+* genuinely different destination from any one service's variables, so it is an
+* absent field rather than a sentinel.
+*/
+const railwayDestinationSchema = z.object({
+	provider: z.literal("railway"),
+	/** Railway project id (a UUID, from the project's Settings page or URL). */
+	projectId: railwayIdSchema,
+	/** Railway environment id (a UUID) — the deployment environment to write. */
+	environmentId: railwayIdSchema,
+	/** Service to write. Omit to write the environment's shared variables. */
+	serviceId: railwayIdSchema.optional(),
+	/**
+	* Suppress the redeploy Railway triggers when a variable changes.
+	*
+	* Left off (the default), a sync that changes a value redeploys the service,
+	* which is what makes the new value actually reach the running process —
+	* Railway applies variables at deploy time. Turn it on when deploys are
+	* gated behind a release process and a secrets push must not start one; the
+	* values then sit staged until the next deploy.
+	*/
+	skipDeploys: z.boolean().optional()
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
 	cloudflarePagesDestinationSchema,
-	cloudflareSecretsStoreDestinationSchema
+	cloudflareSecretsStoreDestinationSchema,
+	railwayDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -2837,7 +2906,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.34.0";
+var version = "0.35.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6652,6 +6721,13 @@ function assertMembers(values, allowed, flag) {
 	if (unknown.length > 0) fail(`unknown ${flag} ${unknown.join(", ")} — one of: ${allowed.join(", ")}`);
 	return values;
 }
+/** Every Railway id is a UUID; a name or a URL slug in the slot is the common slip. */
+function assertRailwayId(value, flag) {
+	if (!value) fail(`${flag} is required for railway (a UUID)`);
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} should be a Railway UUID, not "${id}"`);
+	return id;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6671,6 +6747,14 @@ function buildConfig(provider, options) {
 				provider,
 				accountId: options.accountId
 			};
+		case "railway": {
+			const tokenKind = options.tokenKind ?? "account";
+			if (!RAILWAY_TOKEN_KINDS.includes(tokenKind)) fail(`unknown --token-kind "${tokenKind}" — one of: ${RAILWAY_TOKEN_KINDS.join(", ")}`);
+			return {
+				provider: "railway",
+				tokenKind
+			};
+		}
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6712,6 +6796,18 @@ function buildDestination(provider, options) {
 				scopes
 			};
 		}
+		case "railway": {
+			const projectId = assertRailwayId(options.railwayProject, "--railway-project");
+			const environmentId = assertRailwayId(options.railwayEnvironment, "--railway-environment");
+			const serviceId = options.service ? assertRailwayId(options.service, "--service") : void 0;
+			return {
+				provider: "railway",
+				projectId,
+				environmentId,
+				...serviceId ? { serviceId } : {},
+				...options.skipDeploys ? { skipDeploys: true } : {}
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -6721,6 +6817,7 @@ function describeDestination(destination) {
 		case "cloudflare-workers": return destination.scriptName;
 		case "cloudflare-pages": return `${destination.projectName} (${destination.environments.join(", ")})`;
 		case "cloudflare-secrets-store": return `store ${destination.storeId} (${destination.scopes.join(", ")})`;
+		case "railway": return `${destination.projectId} / ${destination.environmentId} (${destination.serviceId ? `service ${destination.serviceId}` : "shared"})`;
 	}
 }
 /**
@@ -6728,7 +6825,7 @@ function describeDestination(destination) {
 * into accepting different ways of naming the same destination.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables)").option("--skip-deploys", "railway: stage values without triggering a redeploy");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -6752,7 +6849,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -28,8 +28,8 @@
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/api-client": "0.0.1"
+    "@seekrit/api-client": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",