@seekrit/cli 0.36.0 → 0.38.0

package/dist/index.js

@@ -1520,7 +1520,10 @@ const SYNC_PROVIDER_KINDS = [
 	"cloudflare-secrets-store",
 	"railway",
 	"aws-secrets-manager",
-	"aws-parameter-store"
+	"aws-parameter-store",
+	"render",
+	"fly",
+	"northflank"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1646,6 +1649,45 @@ const awsParameterStoreConnectionConfigSchema = z.object({
 	region: awsRegionSchema,
 	accessKeyId: awsAccessKeyIdSchema
 });
+/**
+* Render account scope — deliberately empty.
+*
+* Like Railway's, and unlike Vercel (which 403s team-owned resources without
+* `teamId`) or Cloudflare (whose every endpoint is account-scoped): a Render
+* API key is issued to a user, and every endpoint seekrit calls addresses its
+* resource by id — `srv-…`, `crn-…`, `evg-…`. There is nothing to scope, so
+* nothing is stored. The connection's `name` is what tells an operator which Render
+* workspace it belongs to.
+*/
+const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
+/**
+* Fly.io account scope — empty, as Render's is.
+*
+* Neither half of "which account, which thing" needs stating: Fly app names are
+* globally unique, so the destination names its app and that is the whole
+* address. Nor is there a token kind to declare the way Railway's `tokenKind`
+* is — Fly's two token shapes do take different auth schemes, but
+* `flyAuthorization` in the connector reads which one from the token itself.
+*/
+const flyConnectionConfigSchema = z.object({ provider: z.literal("fly") });
+/**
+* A Northflank id — projects and secret groups are both slugs derived from the
+* name they were created with (`default-project`, `example-secret-group`), and
+* both appear in the resource's URL. Validated against Northflank's own pattern
+* so the common slip — pasting the *display name*, spaces and all — fails here
+* rather than as a bare 404 inside an alarm with nobody watching.
+*/
+const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/, "must be a Northflank ID — the slug in the resource's URL, not its display name");
+/**
+* Northflank account scope — deliberately empty.
+*
+* A Northflank API token is issued by exactly one team (or org-owned team) and
+* carries that scope itself; `GET /v1/auth` reports which. There is no team id
+* to disambiguate the way Vercel needs one, and no account id the way
+* Cloudflare does: the token plus the destination's project is the whole
+* address. The kind exists so the discriminated union stays uniform.
+*/
+const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1653,7 +1695,10 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	cloudflareSecretsStoreConnectionConfigSchema,
 	railwayConnectionConfigSchema,
 	awsSecretsManagerConnectionConfigSchema,
-	awsParameterStoreConnectionConfigSchema
+	awsParameterStoreConnectionConfigSchema,
+	renderConnectionConfigSchema,
+	flyConnectionConfigSchema,
+	northflankConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1820,6 +1865,83 @@ const awsParameterStoreDestinationSchema = z.object({
 	tier: z.enum(AWS_PARAMETER_TIERS).default("Standard"),
 	kmsKeyId: awsKmsKeyIdSchema.optional()
 });
+/**
+* Render resource ids are `<prefix>-<slug>`, and the two prefixes below are the
+* documented ones: `srv-` for every service type, `crn-` for cron jobs, `evg-`
+* for an environment group.
+*
+* The patterns reject the *other* kind's prefix rather than requiring their own.
+* The mistake worth catching is pasting an env-group id into the service field
+* (or the reverse) — which is otherwise a 404 hours later inside an alarm, with
+* nobody watching. Requiring the positive prefix would also reject a valid id
+* the day Render introduces a new resource prefix, which is not our call to
+* make.
+*/
+const renderServiceIdSchema = z.string().trim().regex(/^(?!evg-)[A-Za-z0-9_-]{1,64}$/, "must be a Render service ID (`srv-…` or `crn-…`), not an environment group");
+const renderEnvGroupIdSchema = z.string().trim().regex(/^(?!srv-|crn-)[A-Za-z0-9_-]{1,64}$/, "must be a Render environment group ID (`evg-…`), not a service");
+/** Environment variables set directly on one service. */
+const renderServiceDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("service"),
+	/** Service id (`srv-…`, or `crn-…` for a cron job), from its dashboard URL. */
+	serviceId: renderServiceIdSchema
+});
+/**
+* Environment variables in a shared environment group. Every service linked to
+* the group sees them, which is the point — and the reason a group binding is
+* worth thinking about twice: its blast radius is the link list, not one
+* service.
+*/
+const renderEnvGroupDestinationSchema = z.object({
+	provider: z.literal("render"),
+	kind: z.literal("env-group"),
+	/** Environment group id (`evg-…`), from its dashboard URL. */
+	envGroupId: renderEnvGroupIdSchema
+});
+const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
+/**
+* The Fly app whose secret set a binding owns.
+*
+* A Fly app has **one** secret set, shared by every Machine in every region —
+* there is no per-target split to state, the way Vercel and Pages have one.
+* Fly's convention is that staging and production are separate *apps*
+* (`storefront`, `storefront-staging`), so pointing at an environment means
+* naming that app, exactly as a Wrangler environment means naming its own
+* Worker.
+*
+* Values land **staged**: Fly injects secrets when a Machine boots, so already
+* running Machines keep what they started with until the app is deployed or its
+* Machines are updated (`fly secrets deploy -a <app>`), while Machines created
+* after the push get them straight away. The connector deliberately restarts
+* nothing — see the note in `apps/api/src/lib/sync/connectors/fly.ts`.
+*/
+const flyDestinationSchema = z.object({
+	provider: z.literal("fly"),
+	/** Fly app name, as `fly apps list` prints it. */
+	appName: z.string().trim().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*$/, "must be a Fly app name (lowercase letters, numbers, and dashes)")
+});
+/**
+* Where inside Northflank a binding writes: one **secret group** in one
+* project.
+*
+* A secret group is Northflank's unit of injection — services and jobs in the
+* project inherit its variables, subject to the group's own restrictions and
+* priority. Those settings belong to the operator, not to seekrit: a binding
+* names an existing group and only ever writes its `variables` map, so
+* restrictions, priority, secret type, and any secret *files* stay as they were
+* configured.
+*
+* There is no environment field. Northflank has no per-group environment axis —
+* separate environments are separate projects (or separate groups restricted to
+* a stage), so the binding's seekrit environment maps to a group, one to one.
+*/
+const northflankDestinationSchema = z.object({
+	provider: z.literal("northflank"),
+	/** Project id — the slug in the project URL (`default-project`). */
+	projectId: northflankIdSchema,
+	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
+	secretGroupId: northflankIdSchema
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -1827,7 +1949,10 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	cloudflareSecretsStoreDestinationSchema,
 	railwayDestinationSchema,
 	awsSecretsManagerDestinationSchema,
-	awsParameterStoreDestinationSchema
+	awsParameterStoreDestinationSchema,
+	renderDestinationSchema,
+	flyDestinationSchema,
+	northflankDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3032,7 +3157,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.36.0";
+var version = "0.38.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6860,6 +6985,28 @@ function assertMember(value, allowed, flag, fallback) {
 	if (!allowed.includes(value)) fail(`unknown ${flag} "${value}" — one of: ${allowed.join(", ")}`);
 	return value;
 }
+/**
+* Fly app names are DNS labels, and the two habitual slips are pasting the
+* hostname (`storefront.fly.dev`) or a name with capitals in it. Both are a 404
+* from Fly much later, so they are caught here with a message that says which.
+*/
+function assertFlyApp(value) {
+	if (!value) fail("--fly-app is required for fly (the app name, e.g. storefront-production)");
+	const appName = value.trim();
+	if (/\.(fly\.dev|internal)$/.test(appName)) fail(`--fly-app takes the app name, not its hostname — try "${appName.split(".")[0]}"`);
+	if (!/^[a-z0-9][a-z0-9-]*$/.test(appName) || appName.length > 63) fail(`--fly-app "${appName}" is not a Fly app name (lowercase letters, numbers, and dashes)`);
+	return appName;
+}
+/**
+* Northflank ids are slugs from the resource's URL, so the slip to catch is the
+* *display name* — "App Secrets" where "app-secrets" belongs.
+*/
+function assertNorthflankId(value, flag) {
+	if (!value) fail(`${flag} is required for northflank (the slug from its URL)`);
+	const id = value.trim();
+	if (!/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/.test(id)) fail(`${flag} should be a Northflank ID like "app-secrets", not "${id}"`);
+	return id;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6896,6 +7043,9 @@ function buildConfig(provider, options) {
 				region: options.region,
 				accessKeyId: options.accessKeyId
 			};
+		case "render": return { provider: "render" };
+		case "fly": return { provider: "fly" };
+		case "northflank": return { provider: "northflank" };
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -6969,6 +7119,31 @@ function buildDestination(provider, options) {
 				tier: assertMember(options.tier, AWS_PARAMETER_TIERS, "--tier", "Standard"),
 				...options.kmsKeyId ? { kmsKeyId: options.kmsKeyId } : {}
 			};
+		case "render": {
+			const serviceId = options.service?.trim();
+			const envGroupId = options.envGroup?.trim();
+			if (serviceId && envGroupId) fail("pass --service or --env-group for render, not both — a binding writes to one");
+			if (serviceId) return {
+				provider: "render",
+				kind: "service",
+				serviceId
+			};
+			if (envGroupId) return {
+				provider: "render",
+				kind: "env-group",
+				envGroupId
+			};
+			return fail("--service (srv-…, or crn-… for a cron job) or --env-group (evg-…) is required for render");
+		}
+		case "fly": return {
+			provider: "fly",
+			appName: assertFlyApp(options.flyApp)
+		};
+		case "northflank": return {
+			provider: "northflank",
+			projectId: assertNorthflankId(options.project, "--project"),
+			secretGroupId: assertNorthflankId(options.secretGroup, "--secret-group")
+		};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -6981,14 +7156,20 @@ function describeDestination(destination) {
 		case "railway": return `${destination.projectId} / ${destination.environmentId} (${destination.serviceId ? `service ${destination.serviceId}` : "shared"})`;
 		case "aws-secrets-manager": return destination.layout === "json-bundle" ? `${destination.secretName} (json bundle)` : `${destination.pathPrefix ?? ""}* (secret per name)`;
 		case "aws-parameter-store": return `${destination.path}* (${destination.type})`;
+		case "render": return destination.kind === "service" ? destination.serviceId : `env group ${destination.envGroupId}`;
+		case "fly": return destination.appName;
+		case "northflank": return `${destination.projectId} / ${destination.secretGroupId}`;
 	}
 }
 /**
 * Destination flags, shared by `verify` and `enable` so the two can never drift
 * into accepting different ways of naming the same destination.
+*
+* Fly's is `--fly-app`, not `--app`: `--app` already names the seekrit
+* application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {