@seekrit/cli 0.36.0 → 0.37.0

package/dist/index.js

@@ -1520,7 +1520,8 @@ const SYNC_PROVIDER_KINDS = [
 	"cloudflare-secrets-store",
 	"railway",
 	"aws-secrets-manager",
-	"aws-parameter-store"
+	"aws-parameter-store",
+	"render"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1646,6 +1647,17 @@ const awsParameterStoreConnectionConfigSchema = z.object({
 	region: awsRegionSchema,
 	accessKeyId: awsAccessKeyIdSchema
 });
+/**
+* Render account scope — deliberately empty.
+*
+* Like Railway's, and unlike Vercel (which 403s team-owned resources without
+* `teamId`) or Cloudflare (whose every endpoint is account-scoped): a Render
+* API key is issued to a user, and every endpoint seekrit calls addresses its
+* resource by id — `srv-…`, `crn-…`, `evg-…`. There is nothing to scope, so
+* nothing is stored. The connection's `name` is what tells an operator which Render
+* workspace it belongs to.
+*/
+const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1653,7 +1665,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	cloudflareSecretsStoreConnectionConfigSchema,
 	railwayConnectionConfigSchema,
 	awsSecretsManagerConnectionConfigSchema,
-	awsParameterStoreConnectionConfigSchema
+	awsParameterStoreConnectionConfigSchema,
+	renderConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1820,6 +1833,40 @@ const awsParameterStoreDestinationSchema = z.object({
 	tier: z.enum(AWS_PARAMETER_TIERS).default("Standard"),
 	kmsKeyId: awsKmsKeyIdSchema.optional()
 });
+/**
+* Render resource ids are `<prefix>-<slug>`, and the two prefixes below are the
+* documented ones: `srv-` for every service type, `crn-` for cron jobs, `evg-`
+* for an environment group.
+*
+* The patterns reject the *other* kind's prefix rather than requiring their own.
+* The mistake worth catching is pasting an env-group id into the service field
+* (or the reverse) — which is otherwise a 404 hours later inside an alarm, with
+* nobody watching. Requiring the positive prefix would also reject a valid id
+* the day Render introduces a new resource prefix, which is not our call to
+* make.
+*/
+const renderServiceIdSchema = z.string().trim().regex(/^(?!evg-)[A-Za-z0-9_-]{1,64}$/, "must be a Render service ID (`srv-…` or `crn-…`), not an environment group");
+const renderEnvGroupIdSchema = z.string().trim().regex(/^(?!srv-|crn-)[A-Za-z0-9_-]{1,64}$/, "must be a Render environment group ID (`evg-…`), not a service");
+/** Environment variables set directly on one service. */
+const renderServiceDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("service"),
+	/** Service id (`srv-…`, or `crn-…` for a cron job), from its dashboard URL. */
+	serviceId: renderServiceIdSchema
+});
+/**
+* Environment variables in a shared environment group. Every service linked to
+* the group sees them, which is the point — and the reason a group binding is
+* worth thinking about twice: its blast radius is the link list, not one
+* service.
+*/
+const renderEnvGroupDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("env-group"),
+	/** Environment group id (`evg-…`), from its dashboard URL. */
+	envGroupId: renderEnvGroupIdSchema
+});
+const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -1827,7 +1874,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	cloudflareSecretsStoreDestinationSchema,
 	railwayDestinationSchema,
 	awsSecretsManagerDestinationSchema,
-	awsParameterStoreDestinationSchema
+	awsParameterStoreDestinationSchema,
+	renderDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3032,7 +3080,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.36.0";
+var version = "0.37.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6896,6 +6944,7 @@ function buildConfig(provider, options) {
 				region: options.region,
 				accessKeyId: options.accessKeyId
 			};
+		case "render": return { provider: "render" };
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6969,6 +7018,22 @@ function buildDestination(provider, options) {
 				tier: assertMember(options.tier, AWS_PARAMETER_TIERS, "--tier", "Standard"),
 				...options.kmsKeyId ? { kmsKeyId: options.kmsKeyId } : {}
 			};
+		case "render": {
+			const serviceId = options.service?.trim();
+			const envGroupId = options.envGroup?.trim();
+			if (serviceId && envGroupId) fail("pass --service or --env-group for render, not both — a binding writes to one");
+			if (serviceId) return {
+				provider: "render",
+				kind: "service",
+				serviceId
+			};
+			if (envGroupId) return {
+				provider: "render",
+				kind: "env-group",
+				envGroupId
+			};
+			return fail("--service (srv-…, or crn-… for a cron job) or --env-group (evg-…) is required for render");
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -6981,6 +7046,7 @@ function describeDestination(destination) {
 		case "railway": return `${destination.projectId} / ${destination.environmentId} (${destination.serviceId ? `service ${destination.serviceId}` : "shared"})`;
 		case "aws-secrets-manager": return destination.layout === "json-bundle" ? `${destination.secretName} (json bundle)` : `${destination.pathPrefix ?? ""}* (secret per name)`;
 		case "aws-parameter-store": return `${destination.path}* (${destination.type})`;
+		case "render": return destination.kind === "service" ? destination.serviceId : `env group ${destination.envGroupId}`;
 	}
 }
 /**
@@ -6988,7 +7054,7 @@ function describeDestination(destination) {
 * into accepting different ways of naming the same destination.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -28,8 +28,8 @@
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/core": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",