@seekrit/cli 0.34.0 → 0.36.0

package/dist/index.js

@@ -669,7 +669,7 @@ const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a
 */
 const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
 /** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
-const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+const awsRegionSchema$1 = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
 /**
 * An STS external id — the shared string a role's trust policy can require so a
 * confused-deputy can't assume it. AWS allows a broad charset; we keep to the
@@ -811,7 +811,7 @@ const awsTargetConfigSchema = z.object({
 	provider: z.literal("aws"),
 	executor: z.literal("in_do"),
 	roleArn: awsRoleArnSchema,
-	region: awsRegionSchema,
+	region: awsRegionSchema$1,
 	externalId: awsExternalIdSchema.optional(),
 	sessionPolicy: z.string().min(1).max(4e3).optional(),
 	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
@@ -1517,7 +1517,10 @@ const SYNC_PROVIDER_KINDS = [
 	"vercel",
 	"cloudflare-workers",
 	"cloudflare-pages",
-	"cloudflare-secrets-store"
+	"cloudflare-secrets-store",
+	"railway",
+	"aws-secrets-manager",
+	"aws-parameter-store"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1565,11 +1568,92 @@ const cloudflareSecretsStoreConnectionConfigSchema = z.object({
 	provider: z.literal("cloudflare-secrets-store"),
 	accountId: cloudflareAccountIdSchema
 });
+/**
+* A Railway id — every project, environment, and service is a UUID. Validated
+* by shape for the same reason Cloudflare's account id is: the alternative is a
+* bare GraphQL "Problem processing request" hours later inside an alarm, with
+* nobody watching.
+*/
+const railwayIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a Railway UUID");
+/**
+* Which kind of Railway API token the connection holds. This is connection
+* scope rather than a destination detail because it decides the *header* the
+* request carries, and getting it wrong fails every call identically:
+*
+*  - `account` — a personal or workspace token, sent as `Authorization: Bearer`.
+*    Reaches every project the token's owner can see.
+*  - `project` — a project token, sent as `Project-Access-Token`. Scoped to one
+*    project and environment by Railway itself, which makes it the
+*    least-privilege choice when a connection serves a single destination.
+*
+* Railway rejects a project token sent as a bearer, so this cannot be sniffed
+* at request time — the operator states it once, when they paste the token.
+*/
+const RAILWAY_TOKEN_KINDS = ["account", "project"];
+/**
+* Railway account scope. The token is never here — it is wrapped to the
+* connection's public key and stored as ciphertext, exactly as Vercel's is.
+*
+* There is no workspace/team id to carry: Railway ids are globally unique and
+* a destination names its project outright, so the token plus the destination
+* is the whole address.
+*/
+const railwayConnectionConfigSchema = z.object({
+	provider: z.literal("railway"),
+	tokenKind: z.enum(RAILWAY_TOKEN_KINDS).default("account")
+});
+/**
+* An AWS region id (`us-east-1`, `eu-central-1`, `us-gov-west-1`).
+*
+* Validated by shape rather than against a list, because AWS adds regions
+* faster than we ship. The endpoint host is built from this string, so a typo
+* would otherwise surface as a DNS failure inside an alarm with nobody
+* watching — which is a much worse place to learn about it than this form.
+*/
+const awsRegionSchema = z.string().trim().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "must be an AWS region ID, e.g. us-east-1");
+/**
+* The IAM access key id seekrit signs with.
+*
+* This lives in `config` — the *non-secret* half — on purpose: an access key id
+* is an identifier, not a credential. It appears in CloudTrail, in the IAM
+* console, and in the `Authorization` header of every signed request; only the
+* **secret access key** is secret, and that is what gets wrapped to the
+* connection's public key. Keeping the id here also lets the dashboard say
+* which key a connection is using, which is the first thing you want to know
+* when a connection starts failing after a key rotation.
+*
+* Long-lived IAM user keys only. `ASIA…` session credentials from STS expire
+* within hours, and a sync connection has to keep working unattended.
+*/
+const awsAccessKeyIdSchema = z.string().trim().regex(/^[A-Z0-9]{16,128}$/, "must be an AWS access key ID, e.g. AKIAIOSFODNN7EXAMPLE");
+/**
+* AWS account scope, shared by both AWS providers: which region to call and
+* which key to sign with. There is no account id — every endpoint seekrit calls
+* is reached through the regional host and authorizes off the signature, so the
+* account is whichever one the key belongs to.
+*
+* Two providers rather than one `aws` with a mode field, for the same reason
+* the three Cloudflare kinds are separate: different APIs, different
+* destinations, different IAM actions.
+*/
+const awsSecretsManagerConnectionConfigSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
+const awsParameterStoreConnectionConfigSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
 	cloudflarePagesConnectionConfigSchema,
-	cloudflareSecretsStoreConnectionConfigSchema
+	cloudflareSecretsStoreConnectionConfigSchema,
+	railwayConnectionConfigSchema,
+	awsSecretsManagerConnectionConfigSchema,
+	awsParameterStoreConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1628,11 +1712,122 @@ const cloudflareSecretsStoreDestinationSchema = z.object({
 	/** Scopes applied to secrets this binding creates. At least one. */
 	scopes: z.array(z.enum(CLOUDFLARE_SECRETS_STORE_SCOPES)).min(1)
 });
+/**
+* Where inside Railway a binding writes.
+*
+* Railway variables are addressed by (project, environment, service) — the
+* environment here is *Railway's* (`production`, `pr-42`), not the seekrit
+* environment the binding reads from; a binding is precisely the mapping
+* between the two.
+*
+* Omitting `serviceId` targets the project's **shared** variables for that
+* environment, which services opt into with `${{shared.NAME}}`. That is a
+* genuinely different destination from any one service's variables, so it is an
+* absent field rather than a sentinel.
+*/
+const railwayDestinationSchema = z.object({
+	provider: z.literal("railway"),
+	/** Railway project id (a UUID, from the project's Settings page or URL). */
+	projectId: railwayIdSchema,
+	/** Railway environment id (a UUID) — the deployment environment to write. */
+	environmentId: railwayIdSchema,
+	/** Service to write. Omit to write the environment's shared variables. */
+	serviceId: railwayIdSchema.optional(),
+	/**
+	* Suppress the redeploy Railway triggers when a variable changes.
+	*
+	* Left off (the default), a sync that changes a value redeploys the service,
+	* which is what makes the new value actually reach the running process —
+	* Railway applies variables at deploy time. Turn it on when deploys are
+	* gated behind a release process and a secrets push must not start one; the
+	* values then sit staged until the next deploy.
+	*/
+	skipDeploys: z.boolean().optional()
+});
+/**
+* A customer-managed KMS key to encrypt with, as a key id, ARN, or alias
+* (`alias/seekrit`). Omitted means the AWS-managed default for that service
+* (`aws/secretsmanager`, `aws/ssm`), which is what most accounts want.
+*
+* Deliberately loose: a KMS key can be named five different ways, half of them
+* cross-account ARNs, and rejecting a valid one here would be worse than
+* letting KMS give its own (very clear) error.
+*/
+const awsKmsKeyIdSchema = z.string().trim().min(1).max(2048);
+/**
+* How a binding lays its secrets out in Secrets Manager.
+*
+* - `secret-per-name` — one AWS secret per seekrit secret. The direct
+*   translation, and what you want if consumers read secrets individually.
+* - `json-bundle` — every value as one JSON object in a single AWS secret. The
+*   shape ECS task definitions and Lambda read with `secret-arn:json-key::`,
+*   and the reason it exists is billing: Secrets Manager charges per secret per
+*   month, so fifty names cost fifty times as much stored separately.
+*/
+const AWS_SECRETS_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
+/**
+* Where in Secrets Manager a binding writes.
+*
+* `pathPrefix` exists rather than reusing {@link NameTransform}'s `prefix`
+* because the two answer different questions: a name transform produces a
+* *variable name* (`[A-Za-z0-9_]`, no slashes), while this produces a
+* *namespace* — `prod/storefront/` — and slashes are the whole point of it.
+*/
+const awsSecretsManagerDestinationSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	layout: z.enum(AWS_SECRETS_MANAGER_LAYOUTS).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret's name, e.g.
+	* `prod/storefront/`. Optional, but strongly advised in an account that
+	* holds anything else — without it a binding writes at the root of a
+	* namespace it does not own.
+	*/
+	pathPrefix: z.string().trim().max(400).regex(/^[A-Za-z0-9/_+=.@-]*$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod/storefront/env`. */
+	secretName: z.string().trim().min(1).max(512).regex(/^[A-Za-z0-9/_+=.@-]+$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretName !== void 0, {
+	message: "a json-bundle destination needs the name of the secret to write",
+	path: ["secretName"]
+});
+/** Parameter Store's two value types. `SecureString` is KMS-encrypted; `String` is not. */
+const AWS_PARAMETER_TYPES = ["SecureString", "String"];
+/** Parameter Store's storage tiers. Standard is free and caps values at 4KB. */
+const AWS_PARAMETER_TIERS = [
+	"Standard",
+	"Advanced",
+	"Intelligent-Tiering"
+];
+/**
+* The Parameter Store hierarchy a binding owns, e.g. `/prod/storefront/`.
+*
+* A path rather than a free-form prefix because that is what the API is built
+* around: `GetParametersByPath` is how an application reads a whole
+* environment in one call, and it only works on `/`-delimited names. Leading
+* and trailing slashes are required so the binding's names concatenate
+* unambiguously — `/prod/storefront/` + `DB_URL`.
+*/
+const awsParameterStoreDestinationSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	/** Must start and end with `/`. `aws`/`ssm` are reserved by AWS as the first segment. */
+	path: z.string().trim().max(1011).regex(/^\/([A-Za-z0-9_.-]+\/)*$/, "must be a parameter path like /prod/storefront/"),
+	type: z.enum(AWS_PARAMETER_TYPES).default("SecureString"),
+	/**
+	* Standard caps a value at 4KB and costs nothing; Advanced raises that to 8KB
+	* and is billed per parameter per month. `Intelligent-Tiering` lets AWS pick,
+	* upgrading only the parameters that need it.
+	*/
+	tier: z.enum(AWS_PARAMETER_TIERS).default("Standard"),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
 	cloudflarePagesDestinationSchema,
-	cloudflareSecretsStoreDestinationSchema
+	cloudflareSecretsStoreDestinationSchema,
+	railwayDestinationSchema,
+	awsSecretsManagerDestinationSchema,
+	awsParameterStoreDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -2837,7 +3032,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.34.0";
+var version = "0.36.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6652,6 +6847,19 @@ function assertMembers(values, allowed, flag) {
 	if (unknown.length > 0) fail(`unknown ${flag} ${unknown.join(", ")} — one of: ${allowed.join(", ")}`);
 	return values;
 }
+/** Every Railway id is a UUID; a name or a URL slug in the slot is the common slip. */
+function assertRailwayId(value, flag) {
+	if (!value) fail(`${flag} is required for railway (a UUID)`);
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} should be a Railway UUID, not "${id}"`);
+	return id;
+}
+/** Reject a single value outside a known set, naming the choices. */
+function assertMember(value, allowed, flag, fallback) {
+	if (value === void 0) return fallback;
+	if (!allowed.includes(value)) fail(`unknown ${flag} "${value}" — one of: ${allowed.join(", ")}`);
+	return value;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6671,6 +6879,23 @@ function buildConfig(provider, options) {
 				provider,
 				accountId: options.accountId
 			};
+		case "railway": {
+			const tokenKind = options.tokenKind ?? "account";
+			if (!RAILWAY_TOKEN_KINDS.includes(tokenKind)) fail(`unknown --token-kind "${tokenKind}" — one of: ${RAILWAY_TOKEN_KINDS.join(", ")}`);
+			return {
+				provider: "railway",
+				tokenKind
+			};
+		}
+		case "aws-secrets-manager":
+		case "aws-parameter-store":
+			if (!options.region) fail(`--region is required for ${provider} — an AWS region ID, e.g. us-east-1`);
+			if (!options.accessKeyId) fail(`--access-key-id is required for ${provider} — the IAM access key ID (AKIA…)`);
+			return {
+				provider,
+				region: options.region,
+				accessKeyId: options.accessKeyId
+			};
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6712,6 +6937,38 @@ function buildDestination(provider, options) {
 				scopes
 			};
 		}
+		case "railway": {
+			const projectId = assertRailwayId(options.railwayProject, "--railway-project");
+			const environmentId = assertRailwayId(options.railwayEnvironment, "--railway-environment");
+			const serviceId = options.service ? assertRailwayId(options.service, "--service") : void 0;
+			return {
+				provider: "railway",
+				projectId,
+				environmentId,
+				...serviceId ? { serviceId } : {},
+				...options.skipDeploys ? { skipDeploys: true } : {}
+			};
+		}
+		case "aws-secrets-manager": {
+			const layout = assertMember(options.layout, AWS_SECRETS_MANAGER_LAYOUTS, "--layout", "secret-per-name");
+			if (layout === "json-bundle" && !options.secretName) fail("--secret-name is required for --layout json-bundle (the one secret to write)");
+			return {
+				provider: "aws-secrets-manager",
+				layout,
+				...options.path ? { pathPrefix: options.path } : {},
+				...options.secretName ? { secretName: options.secretName } : {},
+				...options.kmsKeyId ? { kmsKeyId: options.kmsKeyId } : {}
+			};
+		}
+		case "aws-parameter-store":
+			if (!options.path) fail("--path is required for aws-parameter-store, e.g. /prod/storefront/");
+			return {
+				provider: "aws-parameter-store",
+				path: options.path,
+				type: assertMember(options.paramType, AWS_PARAMETER_TYPES, "--param-type", "SecureString"),
+				tier: assertMember(options.tier, AWS_PARAMETER_TIERS, "--tier", "Standard"),
+				...options.kmsKeyId ? { kmsKeyId: options.kmsKeyId } : {}
+			};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -6721,6 +6978,9 @@ function describeDestination(destination) {
 		case "cloudflare-workers": return destination.scriptName;
 		case "cloudflare-pages": return `${destination.projectName} (${destination.environments.join(", ")})`;
 		case "cloudflare-secrets-store": return `store ${destination.storeId} (${destination.scopes.join(", ")})`;
+		case "railway": return `${destination.projectId} / ${destination.environmentId} (${destination.serviceId ? `service ${destination.serviceId}` : "shared"})`;
+		case "aws-secrets-manager": return destination.layout === "json-bundle" ? `${destination.secretName} (json bundle)` : `${destination.pathPrefix ?? ""}* (secret per name)`;
+		case "aws-parameter-store": return `${destination.path}* (${destination.type})`;
 	}
 }
 /**
@@ -6728,7 +6988,7 @@ function describeDestination(destination) {
 * into accepting different ways of naming the same destination.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -6752,12 +7012,13 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
-		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} API token: `) : await readStdin()).trim();
-		if (!credential) fail("no API token given");
+		const noun = provider.startsWith("aws-") ? "secret access key" : "API token";
+		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} ${noun}: `) : await readStdin()).trim();
+		if (!credential) fail(`no ${noun} given`);
 		const id = randomId("syc");
 		const { publicKeyJwk } = await ctx.client.getSyncConnectionKey(ref.id, id);
 		const created = await ctx.client.createSyncConnection(ref.id, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
+    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/api-client": "0.0.1"
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",