@seekrit/cli 0.37.0 → 0.39.0

package/dist/index.js

@@ -1521,7 +1521,11 @@ const SYNC_PROVIDER_KINDS = [
 	"railway",
 	"aws-secrets-manager",
 	"aws-parameter-store",
-	"render"
+	"render",
+	"fly",
+	"northflank",
+	"digitalocean",
+	"heroku"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1658,6 +1662,55 @@ const awsParameterStoreConnectionConfigSchema = z.object({
 * workspace it belongs to.
 */
 const renderConnectionConfigSchema = z.object({ provider: z.literal("render") });
+/**
+* Fly.io account scope — empty, as Render's is.
+*
+* Neither half of "which account, which thing" needs stating: Fly app names are
+* globally unique, so the destination names its app and that is the whole
+* address. Nor is there a token kind to declare the way Railway's `tokenKind`
+* is — Fly's two token shapes do take different auth schemes, but
+* `flyAuthorization` in the connector reads which one from the token itself.
+*/
+const flyConnectionConfigSchema = z.object({ provider: z.literal("fly") });
+/**
+* A Northflank id — projects and secret groups are both slugs derived from the
+* name they were created with (`default-project`, `example-secret-group`), and
+* both appear in the resource's URL. Validated against Northflank's own pattern
+* so the common slip — pasting the *display name*, spaces and all — fails here
+* rather than as a bare 404 inside an alarm with nobody watching.
+*/
+const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/, "must be a Northflank ID — the slug in the resource's URL, not its display name");
+/**
+* Northflank account scope — deliberately empty.
+*
+* A Northflank API token is issued by exactly one team (or org-owned team) and
+* carries that scope itself; `GET /v1/auth` reports which. There is no team id
+* to disambiguate the way Vercel needs one, and no account id the way
+* Cloudflare does: the token plus the destination's project is the whole
+* address. The kind exists so the discriminated union stays uniform.
+*/
+const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
+/**
+* DigitalOcean account scope — deliberately empty, as Render's and Fly's are.
+*
+* A DigitalOcean personal access token belongs to one account (or one team, if
+* it was issued inside one) and carries that scope itself, and every endpoint
+* this connector calls addresses its app by id. There is no team id to
+* disambiguate the way Vercel needs one: the token plus the destination's app
+* id is the whole address.
+*/
+const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digitalocean") });
+/**
+* Heroku account scope — empty, as Fly's and Render's are.
+*
+* A Heroku API token carries its user's access to every app and team they can
+* reach, and app names are globally unique, so the destination's app is the
+* whole address. There is no team id to state: unlike Vercel, where a personal
+* token 403s a team-owned project without `teamId`, Heroku resolves
+* `/apps/{app_id_or_name}` against everything the token can see, team-owned or
+* not.
+*/
+const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1666,7 +1719,11 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	railwayConnectionConfigSchema,
 	awsSecretsManagerConnectionConfigSchema,
 	awsParameterStoreConnectionConfigSchema,
-	renderConnectionConfigSchema
+	renderConnectionConfigSchema,
+	flyConnectionConfigSchema,
+	northflankConnectionConfigSchema,
+	digitalOceanConnectionConfigSchema,
+	herokuConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1867,6 +1924,160 @@ const renderEnvGroupDestinationSchema = z.object({
 	envGroupId: renderEnvGroupIdSchema
 });
 const renderDestinationSchema = z.discriminatedUnion("kind", [renderServiceDestinationSchema, renderEnvGroupDestinationSchema]);
+/**
+* The Fly app whose secret set a binding owns.
+*
+* A Fly app has **one** secret set, shared by every Machine in every region —
+* there is no per-target split to state, the way Vercel and Pages have one.
+* Fly's convention is that staging and production are separate *apps*
+* (`storefront`, `storefront-staging`), so pointing at an environment means
+* naming that app, exactly as a Wrangler environment means naming its own
+* Worker.
+*
+* Values land **staged**: Fly injects secrets when a Machine boots, so already
+* running Machines keep what they started with until the app is deployed or its
+* Machines are updated (`fly secrets deploy -a <app>`), while Machines created
+* after the push get them straight away. The connector deliberately restarts
+* nothing — see the note in `apps/api/src/lib/sync/connectors/fly.ts`.
+*/
+const flyDestinationSchema = z.object({
+	provider: z.literal("fly"),
+	/** Fly app name, as `fly apps list` prints it. */
+	appName: z.string().trim().min(1).max(63).regex(/^[a-z0-9][a-z0-9-]*$/, "must be a Fly app name (lowercase letters, numbers, and dashes)")
+});
+/**
+* Where inside Northflank a binding writes: one **secret group** in one
+* project.
+*
+* A secret group is Northflank's unit of injection — services and jobs in the
+* project inherit its variables, subject to the group's own restrictions and
+* priority. Those settings belong to the operator, not to seekrit: a binding
+* names an existing group and only ever writes its `variables` map, so
+* restrictions, priority, secret type, and any secret *files* stay as they were
+* configured.
+*
+* There is no environment field. Northflank has no per-group environment axis —
+* separate environments are separate projects (or separate groups restricted to
+* a stage), so the binding's seekrit environment maps to a group, one to one.
+*/
+const northflankDestinationSchema = z.object({
+	provider: z.literal("northflank"),
+	/** Project id — the slug in the project URL (`default-project`). */
+	projectId: northflankIdSchema,
+	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
+	secretGroupId: northflankIdSchema
+});
+/**
+* When App Platform makes a variable visible. DigitalOcean's enum also has
+* `UNSET`, which is not offered: it means "no scope stated", and a secrets
+* manager that writes a value should say when that value applies.
+*
+* The default here is `RUN_TIME` rather than DigitalOcean's own
+* `RUN_AND_BUILD_TIME`, and the difference is deliberate. A build-time variable
+* is visible to every build command, every buildpack, and anything they print;
+* a secret only the running process needs has no business being there. Binding
+* a value a build genuinely needs — a private registry token, a sourcemap
+* upload key — is a decision worth making explicitly.
+*/
+const DIGITALOCEAN_ENV_SCOPES = [
+	"RUN_TIME",
+	"BUILD_TIME",
+	"RUN_AND_BUILD_TIME"
+];
+/**
+* A DigitalOcean app id — the UUID in the app's dashboard URL
+* (`cloud.digitalocean.com/apps/<id>`), and what `doctl apps list` prints.
+*
+* DigitalOcean's own spec types this as a bare string, but every app id it
+* issues is a UUID, and the slip worth catching is the one the API cannot tell
+* from a typo: pasting the app's *name* (`storefront`), which `GET /v2/apps/{id}`
+* answers with a flat 404 hours later inside an alarm, with nobody watching.
+*/
+const digitalOceanAppIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a DigitalOcean app ID (the UUID in the app's URL), not its name");
+/**
+* A component name, matching App Platform's own pattern for one. Names are
+* unique within an app, which is what makes a name — rather than an index into
+* `services` — the stable way to address a component's variables.
+*/
+const digitalOceanComponentNameSchema = z.string().trim().regex(/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/, "must be an App Platform component name (lowercase letters, numbers, and dashes)");
+/**
+* Where inside a DigitalOcean app a binding writes.
+*
+* ## A push is a deployment
+*
+* App Platform has no per-variable endpoint. Environment variables live in the
+* app spec, and the only way to change one is to submit a new spec — which
+* starts a **new deployment** of the app. That is not a side effect this
+* connector chose and there is no flag to suppress it; it is what "set an
+* environment variable" means on this platform, in the control panel and in
+* `doctl` alike.
+*
+* The deployment reuses each component's current source (seekrit never sends
+* `update_all_source_versions`), so it redeploys the code already running
+* rather than pulling a newer commit or image. It is still a real deployment:
+* a build, a health check, and a rollout. Bind an environment here knowing that
+* changing a secret in it will roll the app.
+*
+* ## Values are written encrypted
+*
+* Everything seekrit writes goes in as `type: SECRET`, so App Platform encrypts
+* it at rest and hands it back as an opaque `EV[1:…]` blob rather than as
+* plaintext. That is also why this connector cannot tell whether a value it is
+* about to write is already there — see
+* `apps/api/src/lib/sync/connectors/digitalocean.ts`.
+*/
+const digitalOceanAppDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("app"),
+	/** App id — the UUID in `cloud.digitalocean.com/apps/<id>`. */
+	appId: digitalOceanAppIdSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+/**
+* One component's own environment variables. Narrower than the app-level list:
+* only this service, worker, job, static site, or function sees them, and a key
+* here wins over the same key at app level.
+*/
+const digitalOceanComponentDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("component"),
+	appId: digitalOceanAppIdSchema,
+	/** Component name, as it appears in the app spec — not its type. */
+	componentName: digitalOceanComponentNameSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+const digitalOceanDestinationSchema = z.discriminatedUnion("kind", [digitalOceanAppDestinationSchema, digitalOceanComponentDestinationSchema]);
+/**
+* A Heroku app, named the way `/apps/{app_id_or_name}` names one: either the
+* app name or its UUID id. Both are accepted because both work, and the id is
+* the durable one — renaming an app in the dashboard breaks a binding that
+* holds its name, and does not break one that holds its id.
+*
+* The name pattern is Heroku's own (`^[a-z][a-z0-9-]{1,28}[a-z0-9]$`): 3–30
+* characters, starting with a letter and ending alphanumeric. Checking it here
+* turns the habitual slip — pasting `example.herokuapp.com`, or a name with
+* capitals — into a message at the form rather than a bare 404 from an alarm
+* with nobody watching.
+*/
+const herokuAppSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value), "must be a Heroku app name (lowercase letters, numbers, and dashes) or its UUID");
+/**
+* The Heroku app whose config vars a binding owns.
+*
+* A Heroku app has **one** set of config vars, shared by every dyno and every
+* process type — there is no per-target split to state the way Vercel and Pages
+* have one. Heroku's convention is that staging and production are separate
+* *apps* (`storefront`, `storefront-staging`), so pointing at an environment
+* means naming that app, exactly as it does on Fly.
+*
+* Unlike Fly, values take effect **immediately**: setting config vars cuts a new
+* release and restarts the app's dynos, which is why a run sends exactly one
+* request — see the note in `apps/api/src/lib/sync/connectors/heroku.ts`.
+*/
+const herokuDestinationSchema = z.object({
+	provider: z.literal("heroku"),
+	/** App name as `heroku apps` prints it, or the app's UUID. */
+	app: herokuAppSchema
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -1875,7 +2086,11 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	railwayDestinationSchema,
 	awsSecretsManagerDestinationSchema,
 	awsParameterStoreDestinationSchema,
-	renderDestinationSchema
+	renderDestinationSchema,
+	flyDestinationSchema,
+	northflankDestinationSchema,
+	digitalOceanDestinationSchema,
+	herokuDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3080,7 +3295,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.37.0";
+var version = "0.39.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6908,6 +7123,51 @@ function assertMember(value, allowed, flag, fallback) {
 	if (!allowed.includes(value)) fail(`unknown ${flag} "${value}" — one of: ${allowed.join(", ")}`);
 	return value;
 }
+/**
+* Fly app names are DNS labels, and the two habitual slips are pasting the
+* hostname (`storefront.fly.dev`) or a name with capitals in it. Both are a 404
+* from Fly much later, so they are caught here with a message that says which.
+*/
+function assertFlyApp(value) {
+	if (!value) fail("--fly-app is required for fly (the app name, e.g. storefront-production)");
+	const appName = value.trim();
+	if (/\.(fly\.dev|internal)$/.test(appName)) fail(`--fly-app takes the app name, not its hostname — try "${appName.split(".")[0]}"`);
+	if (!/^[a-z0-9][a-z0-9-]*$/.test(appName) || appName.length > 63) fail(`--fly-app "${appName}" is not a Fly app name (lowercase letters, numbers, and dashes)`);
+	return appName;
+}
+/**
+* Heroku takes an app name or the app's UUID, so both are accepted here. The
+* habitual slips are the hostname (`storefront.herokuapp.com`) and capitals;
+* both are a 404 from Heroku much later, so they are caught here with a message
+* that says which.
+*/
+function assertHerokuApp(value) {
+	if (!value) fail("--heroku-app is required for heroku (the app name, e.g. storefront-production)");
+	const app = value.trim();
+	if (/\.(herokuapp\.com|herokudns\.com)$/.test(app)) fail(`--heroku-app takes the app name, not its hostname — try "${app.split(".")[0]}"`);
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(app) && !/^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(app)) fail(`--heroku-app "${app}" is not a Heroku app name — 3 to 30 characters, starting with a lowercase letter, made of lowercase letters, numbers, and dashes (or the app's UUID)`);
+	return app;
+}
+/**
+* Northflank ids are slugs from the resource's URL, so the slip to catch is the
+* *display name* — "App Secrets" where "app-secrets" belongs.
+*/
+function assertNorthflankId(value, flag) {
+	if (!value) fail(`${flag} is required for northflank (the slug from its URL)`);
+	const id = value.trim();
+	if (!/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/.test(id)) fail(`${flag} should be a Northflank ID like "app-secrets", not "${id}"`);
+	return id;
+}
+/**
+* DigitalOcean app ids are UUIDs, and the slip to catch is the app *name* —
+* what the dashboard headline shows, and what the API answers with a bare 404.
+*/
+function assertDigitalOceanApp(value) {
+	if (!value) fail("--do-app is required for digitalocean (the UUID in the app's URL)");
+	const appId = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(appId)) fail(`--do-app should be the app's UUID, from its URL — not "${appId}"`);
+	return appId;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -6945,6 +7205,10 @@ function buildConfig(provider, options) {
 				accessKeyId: options.accessKeyId
 			};
 		case "render": return { provider: "render" };
+		case "fly": return { provider: "fly" };
+		case "northflank": return { provider: "northflank" };
+		case "digitalocean": return { provider: "digitalocean" };
+		case "heroku": return { provider: "heroku" };
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -7034,6 +7298,38 @@ function buildDestination(provider, options) {
 			};
 			return fail("--service (srv-…, or crn-… for a cron job) or --env-group (evg-…) is required for render");
 		}
+		case "fly": return {
+			provider: "fly",
+			appName: assertFlyApp(options.flyApp)
+		};
+		case "northflank": return {
+			provider: "northflank",
+			projectId: assertNorthflankId(options.project, "--project"),
+			secretGroupId: assertNorthflankId(options.secretGroup, "--secret-group")
+		};
+		case "digitalocean": {
+			const appId = assertDigitalOceanApp(options.doApp);
+			const scope = assertMember(options.envScope, DIGITALOCEAN_ENV_SCOPES, "--env-scope", "RUN_TIME");
+			const componentName = options.component?.trim();
+			if (!componentName) return {
+				provider: "digitalocean",
+				kind: "app",
+				appId,
+				scope
+			};
+			if (!/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/.test(componentName)) fail(`--component "${componentName}" is not an App Platform component name (lowercase letters, numbers, and dashes)`);
+			return {
+				provider: "digitalocean",
+				kind: "component",
+				appId,
+				componentName,
+				scope
+			};
+		}
+		case "heroku": return {
+			provider: "heroku",
+			app: assertHerokuApp(options.herokuApp)
+		};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -7047,14 +7343,21 @@ function describeDestination(destination) {
 		case "aws-secrets-manager": return destination.layout === "json-bundle" ? `${destination.secretName} (json bundle)` : `${destination.pathPrefix ?? ""}* (secret per name)`;
 		case "aws-parameter-store": return `${destination.path}* (${destination.type})`;
 		case "render": return destination.kind === "service" ? destination.serviceId : `env group ${destination.envGroupId}`;
+		case "fly": return destination.appName;
+		case "northflank": return `${destination.projectId} / ${destination.secretGroupId}`;
+		case "digitalocean": return `${destination.appId}${destination.kind === "component" ? ` / ${destination.componentName}` : ""} (${destination.scope})`;
+		case "heroku": return destination.app;
 	}
 }
 /**
 * Destination flags, shared by `verify` and `enable` so the two can never drift
 * into accepting different ways of naming the same destination.
+*
+* Fly's is `--fly-app`, not `--app`: `--app` already names the seekrit
+* application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages: project name").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/api-client": "0.0.1",
+    "@seekrit/core": "0.0.1",
     "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",