@seekrit/cli 0.37.0 → 0.38.0

package/dist/index.js

@@ -1521,7 +1521,9 @@ const SYNC_PROVIDER_KINDS = [
 	"railway",
 	"aws-secrets-manager",
 	"aws-parameter-store",
-	"render"
+	"render",
+	"fly",
+	"northflank"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1658,6 +1660,34 @@ const awsParameterStoreConnectionConfigSchema = z.object({
 * workspace it belongs to.
 */
 const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
+/**
+* Fly.io account scope — empty, as Render's is.
+*
+* Neither half of "which account, which thing" needs stating: Fly app names are
+* globally unique, so the destination names its app and that is the whole
+* address. Nor is there a token kind to declare the way Railway's `tokenKind`
+* is — Fly's two token shapes do take different auth schemes, but
+* `flyAuthorization` in the connector reads which one from the token itself.
+*/
+const flyConnectionConfigSchema = z.object({ provider: z.literal("fly") });
+/**
+* A Northflank id — projects and secret groups are both slugs derived from the
+* name they were created with (`default-project`, `example-secret-group`), and
+* both appear in the resource's URL. Validated against Northflank's own pattern
+* so the common slip — pasting the *display name*, spaces and all — fails here
+* rather than as a bare 404 inside an alarm with nobody watching.
+*/
+const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/, "must be a Northflank ID — the slug in the resource's URL, not its display name");
+/**
+* Northflank account scope — deliberately empty.
+*
+* A Northflank API token is issued by exactly one team (or org-owned team) and
+* carries that scope itself; `GET /v1/auth` reports which. There is no team id
+* to disambiguate the way Vercel needs one, and no account id the way
+* Cloudflare does: the token plus the destination's project is the whole
+* address. The kind exists so the discriminated union stays uniform.
+*/
+const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1666,7 +1696,9 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	railwayConnectionConfigSchema,
 	awsSecretsManagerConnectionConfigSchema,
 	awsParameterStoreConnectionConfigSchema,
-	renderConnectionConfigSchema
+	renderConnectionConfigSchema,
+	flyConnectionConfigSchema,
+	northflankConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1867,6 +1899,49 @@ const renderEnvGroupDestinationSchema = z.object({
 	envGroupId: renderEnvGroupIdSchema
 });
 const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
+/**
+* The Fly app whose secret set a binding owns.
+*
+* A Fly app has **one** secret set, shared by every Machine in every region —
+* there is no per-target split to state, the way Vercel and Pages have one.
+* Fly's convention is that staging and production are separate *apps*
+* (`storefront`, `storefront-staging`), so pointing at an environment means
+* naming that app, exactly as a Wrangler environment means naming its own
+* Worker.
+*
+* Values land **staged**: Fly injects secrets when a Machine boots, so already
+* running Machines keep what they started with until the app is deployed or its
+* Machines are updated (`fly secrets deploy -a <app>`), while Machines created
+* after the push get them straight away. The connector deliberately restarts
+* nothing — see the note in `apps/api/src/lib/sync/connectors/fly.ts`.
+*/
+const flyDestinationSchema = z.object({
+	provider: z.literal("fly"),
+	/** Fly app name, as `fly apps list` prints it. */
+	appName: z.string().trim().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*$/, "must be a Fly app name (lowercase letters, numbers, and dashes)")
+});
+/**
+* Where inside Northflank a binding writes: one **secret group** in one
+* project.
+*
+* A secret group is Northflank's unit of injection — services and jobs in the
+* project inherit its variables, subject to the group's own restrictions and
+* priority. Those settings belong to the operator, not to seekrit: a binding
+* names an existing group and only ever writes its `variables` map, so
+* restrictions, priority, secret type, and any secret *files* stay as they were
+* configured.
+*
+* There is no environment field. Northflank has no per-group environment axis —
+* separate environments are separate projects (or separate groups restricted to
+* a stage), so the binding's seekrit environment maps to a group, one to one.
+*/
+const northflankDestinationSchema = z.object({
+	provider: z.literal("northflank"),
+	/** Project id — the slug in the project URL (`default-project`). */
+	projectId: northflankIdSchema,
+	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
+	secretGroupId: northflankIdSchema
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -1875,7 +1950,9 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	railwayDestinationSchema,
 	awsSecretsManagerDestinationSchema,
 	awsParameterStoreDestinationSchema,
-	renderDestinationSchema
+	renderDestinationSchema,
+	flyDestinationSchema,
+	northflankDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3080,7 +3157,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.37.0";
+var version = "0.38.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6908,6 +6985,28 @@ function assertMember(value, allowed, flag, fallback) {
 	if (!allowed.includes(value)) fail(`unknown ${flag} "${value}" — one of: ${allowed.join(", ")}`);
 	return value;
 }
+/**
+* Fly app names are DNS labels, and the two habitual slips are pasting the
+* hostname (`storefront.fly.dev`) or a name with capitals in it. Both are a 404
+* from Fly much later, so they are caught here with a message that says which.
+*/
+function assertFlyApp(value) {
+	if (!value) fail("--fly-app is required for fly (the app name, e.g. storefront-production)");
+	const appName = value.trim();
+	if (/\.(fly\.dev|internal)$/.test(appName)) fail(`--fly-app takes the app name, not its hostname — try "${appName.split(".")[0]}"`);
+	if (!/^[a-z0-9][a-z0-9-]*$/.test(appName) || appName.length > 63) fail(`--fly-app "${appName}" is not a Fly app name (lowercase letters, numbers, and dashes)`);
+	return appName;
+}
+/**
+* Northflank ids are slugs from the resource's URL, so the slip to catch is the
+* *display name* — "App Secrets" where "app-secrets" belongs.
+*/
+function assertNorthflankId(value, flag) {
+	if (!value) fail(`${flag} is required for northflank (the slug from its URL)`);
+	const id = value.trim();
+	if (!/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/.test(id)) fail(`${flag} should be a Northflank ID like "app-secrets", not "${id}"`);
+	return id;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6945,6 +7044,8 @@ function buildConfig(provider, options) {
 				accessKeyId: options.accessKeyId
 			};
 		case "render": return { provider: "render" };
+		case "fly": return { provider: "fly" };
+		case "northflank": return { provider: "northflank" };
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -7034,6 +7135,15 @@ function buildDestination(provider, options) {
 			};
 			return fail("--service (srv-…, or crn-… for a cron job) or --env-group (evg-…) is required for render");
 		}
+		case "fly": return {
+			provider: "fly",
+			appName: assertFlyApp(options.flyApp)
+		};
+		case "northflank": return {
+			provider: "northflank",
+			projectId: assertNorthflankId(options.project, "--project"),
+			secretGroupId: assertNorthflankId(options.secretGroup, "--secret-group")
+		};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -7047,14 +7157,19 @@ function describeDestination(destination) {
 		case "aws-secrets-manager": return destination.layout === "json-bundle" ? `${destination.secretName} (json bundle)` : `${destination.pathPrefix ?? ""}* (secret per name)`;
 		case "aws-parameter-store": return `${destination.path}* (${destination.type})`;
 		case "render": return destination.kind === "service" ? destination.serviceId : `env group ${destination.envGroupId}`;
+		case "fly": return destination.appName;
+		case "northflank": return `${destination.projectId} / ${destination.secretGroupId}`;
 	}
 }
 /**
 * Destination flags, shared by `verify` and `enable` so the two can never drift
 * into accepting different ways of naming the same destination.
+*
+* Fly's is `--fly-app`, not `--app`: `--app` already names the seekrit
+* application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -28,8 +28,8 @@
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",