@seekrit/cli 0.35.0 → 0.37.0

package/dist/index.js

@@ -669,7 +669,7 @@ const redisSha256VerifierSchema = z.string().regex(/^[0-9a-f]{64}$/, "must be a
 */
 const awsRoleArnSchema = z.string().regex(/^arn:aws(?:-us-gov|-cn)?:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/, "must be an IAM role ARN (arn:aws:iam::<account>:role/<name>)");
 /** An AWS region id, e.g. `us-east-1`, `eu-west-2`, `us-gov-west-1`. */
-const awsRegionSchema = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
+const awsRegionSchema$1 = z.string().regex(/^[a-z]{2}(?:-[a-z]+)+-\d$/, "must be an AWS region id (e.g. us-east-1)");
 /**
 * An STS external id — the shared string a role's trust policy can require so a
 * confused-deputy can't assume it. AWS allows a broad charset; we keep to the
@@ -811,7 +811,7 @@ const awsTargetConfigSchema = z.object({
 	provider: z.literal("aws"),
 	executor: z.literal("in_do"),
 	roleArn: awsRoleArnSchema,
-	region: awsRegionSchema,
+	region: awsRegionSchema$1,
 	externalId: awsExternalIdSchema.optional(),
 	sessionPolicy: z.string().min(1).max(4e3).optional(),
 	maxTtlSeconds: z.number().int().min(900).max(AWS_MAX_TTL_SECONDS).optional()
@@ -1518,7 +1518,10 @@ const SYNC_PROVIDER_KINDS = [
 	"cloudflare-workers",
 	"cloudflare-pages",
 	"cloudflare-secrets-store",
-	"railway"
+	"railway",
+	"aws-secrets-manager",
+	"aws-parameter-store",
+	"render"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1600,12 +1603,70 @@ const railwayConnectionConfigSchema = z.object({
 	provider: z.literal("railway"),
 	tokenKind: z.enum(RAILWAY_TOKEN_KINDS).default("account")
 });
+/**
+* An AWS region id (`us-east-1`, `eu-central-1`, `us-gov-west-1`).
+*
+* Validated by shape rather than against a list, because AWS adds regions
+* faster than we ship. The endpoint host is built from this string, so a typo
+* would otherwise surface as a DNS failure inside an alarm with nobody
+* watching — which is a much worse place to learn about it than this form.
+*/
+const awsRegionSchema = z.string().trim().regex(/^[a-z]{2}(-[a-z]+)+-\d$/, "must be an AWS region ID, e.g. us-east-1");
+/**
+* The IAM access key id seekrit signs with.
+*
+* This lives in `config` — the *non-secret* half — on purpose: an access key id
+* is an identifier, not a credential. It appears in CloudTrail, in the IAM
+* console, and in the `Authorization` header of every signed request; only the
+* **secret access key** is secret, and that is what gets wrapped to the
+* connection's public key. Keeping the id here also lets the dashboard say
+* which key a connection is using, which is the first thing you want to know
+* when a connection starts failing after a key rotation.
+*
+* Long-lived IAM user keys only. `ASIA…` session credentials from STS expire
+* within hours, and a sync connection has to keep working unattended.
+*/
+const awsAccessKeyIdSchema = z.string().trim().regex(/^[A-Z0-9]{16,128}$/, "must be an AWS access key ID, e.g. AKIAIOSFODNN7EXAMPLE");
+/**
+* AWS account scope, shared by both AWS providers: which region to call and
+* which key to sign with. There is no account id — every endpoint seekrit calls
+* is reached through the regional host and authorizes off the signature, so the
+* account is whichever one the key belongs to.
+*
+* Two providers rather than one `aws` with a mode field, for the same reason
+* the three Cloudflare kinds are separate: different APIs, different
+* destinations, different IAM actions.
+*/
+const awsSecretsManagerConnectionConfigSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
+const awsParameterStoreConnectionConfigSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	region: awsRegionSchema,
+	accessKeyId: awsAccessKeyIdSchema
+});
+/**
+* Render account scope — deliberately empty.
+*
+* Like Railway's, and unlike Vercel (which 403s team-owned resources without
+* `teamId`) or Cloudflare (whose every endpoint is account-scoped): a Render
+* API key is issued to a user, and every endpoint seekrit calls addresses its
+* resource by id — `srv-…`, `crn-…`, `evg-…`. There is nothing to scope, so
+* nothing is stored. The connection's `name` is what tells an operator which Render
+* workspace it belongs to.
+*/
+const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
 	cloudflarePagesConnectionConfigSchema,
 	cloudflareSecretsStoreConnectionConfigSchema,
-	railwayConnectionConfigSchema
+	railwayConnectionConfigSchema,
+	awsSecretsManagerConnectionConfigSchema,
+	awsParameterStoreConnectionConfigSchema,
+	renderConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1696,12 +1757,125 @@ const railwayDestinationSchema = z.object({
 	*/
 	skipDeploys: z.boolean().optional()
 });
+/**
+* A customer-managed KMS key to encrypt with, as a key id, ARN, or alias
+* (`alias/seekrit`). Omitted means the AWS-managed default for that service
+* (`aws/secretsmanager`, `aws/ssm`), which is what most accounts want.
+*
+* Deliberately loose: a KMS key can be named five different ways, half of them
+* cross-account ARNs, and rejecting a valid one here would be worse than
+* letting KMS give its own (very clear) error.
+*/
+const awsKmsKeyIdSchema = z.string().trim().min(1).max(2048);
+/**
+* How a binding lays its secrets out in Secrets Manager.
+*
+* - `secret-per-name` — one AWS secret per seekrit secret. The direct
+*   translation, and what you want if consumers read secrets individually.
+* - `json-bundle` — every value as one JSON object in a single AWS secret. The
+*   shape ECS task definitions and Lambda read with `secret-arn:json-key::`,
+*   and the reason it exists is billing: Secrets Manager charges per secret per
+*   month, so fifty names cost fifty times as much stored separately.
+*/
+const AWS_SECRETS_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
+/**
+* Where in Secrets Manager a binding writes.
+*
+* `pathPrefix` exists rather than reusing {@link NameTransform}'s `prefix`
+* because the two answer different questions: a name transform produces a
+* *variable name* (`[A-Za-z0-9_]`, no slashes), while this produces a
+* *namespace* — `prod/storefront/` — and slashes are the whole point of it.
+*/
+const awsSecretsManagerDestinationSchema = z.object({
+	provider: z.literal("aws-secrets-manager"),
+	layout: z.enum(AWS_SECRETS_MANAGER_LAYOUTS).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret's name, e.g.
+	* `prod/storefront/`. Optional, but strongly advised in an account that
+	* holds anything else — without it a binding writes at the root of a
+	* namespace it does not own.
+	*/
+	pathPrefix: z.string().trim().max(400).regex(/^[A-Za-z0-9/_+=.@-]*$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod/storefront/env`. */
+	secretName: z.string().trim().min(1).max(512).regex(/^[A-Za-z0-9/_+=.@-]+$/, "may contain letters, digits, and / _ + = . @ -").optional(),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretName !== void 0, {
+	message: "a json-bundle destination needs the name of the secret to write",
+	path: ["secretName"]
+});
+/** Parameter Store's two value types. `SecureString` is KMS-encrypted; `String` is not. */
+const AWS_PARAMETER_TYPES = ["SecureString", "String"];
+/** Parameter Store's storage tiers. Standard is free and caps values at 4KB. */
+const AWS_PARAMETER_TIERS = [
+	"Standard",
+	"Advanced",
+	"Intelligent-Tiering"
+];
+/**
+* The Parameter Store hierarchy a binding owns, e.g. `/prod/storefront/`.
+*
+* A path rather than a free-form prefix because that is what the API is built
+* around: `GetParametersByPath` is how an application reads a whole
+* environment in one call, and it only works on `/`-delimited names. Leading
+* and trailing slashes are required so the binding's names concatenate
+* unambiguously — `/prod/storefront/` + `DB_URL`.
+*/
+const awsParameterStoreDestinationSchema = z.object({
+	provider: z.literal("aws-parameter-store"),
+	/** Must start and end with `/`. `aws`/`ssm` are reserved by AWS as the first segment. */
+	path: z.string().trim().max(1011).regex(/^\/([A-Za-z0-9_.-]+\/)*$/, "must be a parameter path like /prod/storefront/"),
+	type: z.enum(AWS_PARAMETER_TYPES).default("SecureString"),
+	/**
+	* Standard caps a value at 4KB and costs nothing; Advanced raises that to 8KB
+	* and is billed per parameter per month. `Intelligent-Tiering` lets AWS pick,
+	* upgrading only the parameters that need it.
+	*/
+	tier: z.enum(AWS_PARAMETER_TIERS).default("Standard"),
+	kmsKeyId: awsKmsKeyIdSchema.optional()
+});
+/**
+* Render resource ids are `<prefix>-<slug>`, and the two prefixes below are the
+* documented ones: `srv-` for every service type, `crn-` for cron jobs, `evg-`
+* for an environment group.
+*
+* The patterns reject the *other* kind's prefix rather than requiring their own.
+* The mistake worth catching is pasting an env-group id into the service field
+* (or the reverse) — which is otherwise a 404 hours later inside an alarm, with
+* nobody watching. Requiring the positive prefix would also reject a valid id
+* the day Render introduces a new resource prefix, which is not our call to
+* make.
+*/
+const renderServiceIdSchema = z.string().trim().regex(/^(?!evg-)[A-Za-z0-9_-]{1,64}$/, "must be a Render service ID (`srv-…` or `crn-…`), not an environment group");
+const renderEnvGroupIdSchema = z.string().trim().regex(/^(?!srv-|crn-)[A-Za-z0-9_-]{1,64}$/, "must be a Render environment group ID (`evg-…`), not a service");
+/** Environment variables set directly on one service. */
+const renderServiceDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("service"),
+	/** Service id (`srv-…`, or `crn-…` for a cron job), from its dashboard URL. */
+	serviceId: renderServiceIdSchema
+});
+/**
+* Environment variables in a shared environment group. Every service linked to
+* the group sees them, which is the point — and the reason a group binding is
+* worth thinking about twice: its blast radius is the link list, not one
+* service.
+*/
+const renderEnvGroupDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("env-group"),
+	/** Environment group id (`evg-…`), from its dashboard URL. */
+	envGroupId: renderEnvGroupIdSchema
+});
+const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
 	cloudflarePagesDestinationSchema,
 	cloudflareSecretsStoreDestinationSchema,
-	railwayDestinationSchema
+	railwayDestinationSchema,
+	awsSecretsManagerDestinationSchema,
+	awsParameterStoreDestinationSchema,
+	renderDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -2906,7 +3080,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.35.0";
+var version = "0.37.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6728,6 +6902,12 @@ function assertRailwayId(value, flag) {
 	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} should be a Railway UUID, not "${id}"`);
 	return id;
 }
+/** Reject a single value outside a known set, naming the choices. */
+function assertMember(value, allowed, flag, fallback) {
+	if (value === void 0) return fallback;
+	if (!allowed.includes(value)) fail(`unknown ${flag} "${value}" — one of: ${allowed.join(", ")}`);
+	return value;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6755,6 +6935,16 @@ function buildConfig(provider, options) {
 				tokenKind
 			};
 		}
+		case "aws-secrets-manager":
+		case "aws-parameter-store":
+			if (!options.region) fail(`--region is required for ${provider} — an AWS region ID, e.g. us-east-1`);
+			if (!options.accessKeyId) fail(`--access-key-id is required for ${provider} — the IAM access key ID (AKIA…)`);
+			return {
+				provider,
+				region: options.region,
+				accessKeyId: options.accessKeyId
+			};
+		case "render": return { provider: "render" };
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6808,6 +6998,42 @@ function buildDestination(provider, options) {
 				...options.skipDeploys ? { skipDeploys: true } : {}
 			};
 		}
+		case "aws-secrets-manager": {
+			const layout = assertMember(options.layout, AWS_SECRETS_MANAGER_LAYOUTS, "--layout", "secret-per-name");
+			if (layout === "json-bundle" && !options.secretName) fail("--secret-name is required for --layout json-bundle (the one secret to write)");
+			return {
+				provider: "aws-secrets-manager",
+				layout,
+				...options.path ? { pathPrefix: options.path } : {},
+				...options.secretName ? { secretName: options.secretName } : {},
+				...options.kmsKeyId ? { kmsKeyId: options.kmsKeyId } : {}
+			};
+		}
+		case "aws-parameter-store":
+			if (!options.path) fail("--path is required for aws-parameter-store, e.g. /prod/storefront/");
+			return {
+				provider: "aws-parameter-store",
+				path: options.path,
+				type: assertMember(options.paramType, AWS_PARAMETER_TYPES, "--param-type", "SecureString"),
+				tier: assertMember(options.tier, AWS_PARAMETER_TIERS, "--tier", "Standard"),
+				...options.kmsKeyId ? { kmsKeyId: options.kmsKeyId } : {}
+			};
+		case "render": {
+			const serviceId = options.service?.trim();
+			const envGroupId = options.envGroup?.trim();
+			if (serviceId && envGroupId) fail("pass --service or --env-group for render, not both — a binding writes to one");
+			if (serviceId) return {
+				provider: "render",
+				kind: "service",
+				serviceId
+			};
+			if (envGroupId) return {
+				provider: "render",
+				kind: "env-group",
+				envGroupId
+			};
+			return fail("--service (srv-…, or crn-… for a cron job) or --env-group (evg-…) is required for render");
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -6818,6 +7044,9 @@ function describeDestination(destination) {
 		case "cloudflare-pages": return `${destination.projectName} (${destination.environments.join(", ")})`;
 		case "cloudflare-secrets-store": return `store ${destination.storeId} (${destination.scopes.join(", ")})`;
 		case "railway": return `${destination.projectId} / ${destination.environmentId} (${destination.serviceId ? `service ${destination.serviceId}` : "shared"})`;
+		case "aws-secrets-manager": return destination.layout === "json-bundle" ? `${destination.secretName} (json bundle)` : `${destination.pathPrefix ?? ""}* (secret per name)`;
+		case "aws-parameter-store": return `${destination.path}* (${destination.type})`;
+		case "render": return destination.kind === "service" ? destination.serviceId : `env group ${destination.envGroupId}`;
 	}
 }
 /**
@@ -6825,7 +7054,7 @@ function describeDestination(destination) {
 * into accepting different ways of naming the same destination.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables)").option("--skip-deploys", "railway: stage values without triggering a redeploy");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -6849,12 +7078,13 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar)").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
-		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} API token: `) : await readStdin()).trim();
-		if (!credential) fail("no API token given");
+		const noun = provider.startsWith("aws-") ? "secret access key" : "API token";
+		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} ${noun}: `) : await readStdin()).trim();
+		if (!credential) fail(`no ${noun} given`);
 		const id = randomId("syc");
 		const { publicKeyJwk } = await ctx.client.getSyncConnectionKey(ref.id, id);
 		const created = await ctx.client.createSyncConnection(ref.id, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/core": "0.0.1",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/core": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",