@seekrit/cli 0.38.0 → 0.39.0

package/dist/index.js

@@ -1523,7 +1523,9 @@ const SYNC_PROVIDER_KINDS = [
 	"aws-parameter-store",
 	"render",
 	"fly",
-	"northflank"
+	"northflank",
+	"digitalocean",
+	"heroku"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1688,6 +1690,27 @@ const northflankIdSchema = z.string().trim().min(3).max(100).regex(/^[a-zA-Z0-9]
 * address. The kind exists so the discriminated union stays uniform.
 */
 const northflankConnectionConfigSchema = z.object({ provider: z.literal("northflank") });
+/**
+* DigitalOcean account scope — deliberately empty, as Render's and Fly's are.
+*
+* A DigitalOcean personal access token belongs to one account (or one team, if
+* it was issued inside one) and carries that scope itself, and every endpoint
+* this connector calls addresses its app by id. There is no team id to
+* disambiguate the way Vercel needs one: the token plus the destination's app
+* id is the whole address.
+*/
+const digitalOceanConnectionConfigSchema = z.object({ provider: z.literal("digitalocean") });
+/**
+* Heroku account scope — empty, as Fly's and Render's are.
+*
+* A Heroku API token carries its user's access to every app and team they can
+* reach, and app names are globally unique, so the destination's app is the
+* whole address. There is no team id to state: unlike Vercel, where a personal
+* token 403s a team-owned project without `teamId`, Heroku resolves
+* `/apps/{app_id_or_name}` against everything the token can see, team-owned or
+* not.
+*/
+const herokuConnectionConfigSchema = z.object({ provider: z.literal("heroku") });
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1698,7 +1721,9 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	awsParameterStoreConnectionConfigSchema,
 	renderConnectionConfigSchema,
 	flyConnectionConfigSchema,
-	northflankConnectionConfigSchema
+	northflankConnectionConfigSchema,
+	digitalOceanConnectionConfigSchema,
+	herokuConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -1942,6 +1967,117 @@ const northflankDestinationSchema = z.object({
 	/** Secret group id — the slug in the group's URL (`example-secret-group`). */
 	secretGroupId: northflankIdSchema
 });
+/**
+* When App Platform makes a variable visible. DigitalOcean's enum also has
+* `UNSET`, which is not offered: it means "no scope stated", and a secrets
+* manager that writes a value should say when that value applies.
+*
+* The default here is `RUN_TIME` rather than DigitalOcean's own
+* `RUN_AND_BUILD_TIME`, and the difference is deliberate. A build-time variable
+* is visible to every build command, every buildpack, and anything they print;
+* a secret only the running process needs has no business being there. Binding
+* a value a build genuinely needs — a private registry token, a sourcemap
+* upload key — is a decision worth making explicitly.
+*/
+const DIGITALOCEAN_ENV_SCOPES = [
+	"RUN_TIME",
+	"BUILD_TIME",
+	"RUN_AND_BUILD_TIME"
+];
+/**
+* A DigitalOcean app id — the UUID in the app's dashboard URL
+* (`cloud.digitalocean.com/apps/<id>`), and what `doctl apps list` prints.
+*
+* DigitalOcean's own spec types this as a bare string, but every app id it
+* issues is a UUID, and the slip worth catching is the one the API cannot tell
+* from a typo: pasting the app's *name* (`storefront`), which `GET /v2/apps/{id}`
+* answers with a flat 404 hours later inside an alarm, with nobody watching.
+*/
+const digitalOceanAppIdSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a DigitalOcean app ID (the UUID in the app's URL), not its name");
+/**
+* A component name, matching App Platform's own pattern for one. Names are
+* unique within an app, which is what makes a name — rather than an index into
+* `services` — the stable way to address a component's variables.
+*/
+const digitalOceanComponentNameSchema = z.string().trim().regex(/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/, "must be an App Platform component name (lowercase letters, numbers, and dashes)");
+/**
+* Where inside a DigitalOcean app a binding writes.
+*
+* ## A push is a deployment
+*
+* App Platform has no per-variable endpoint. Environment variables live in the
+* app spec, and the only way to change one is to submit a new spec — which
+* starts a **new deployment** of the app. That is not a side effect this
+* connector chose and there is no flag to suppress it; it is what "set an
+* environment variable" means on this platform, in the control panel and in
+* `doctl` alike.
+*
+* The deployment reuses each component's current source (seekrit never sends
+* `update_all_source_versions`), so it redeploys the code already running
+* rather than pulling a newer commit or image. It is still a real deployment:
+* a build, a health check, and a rollout. Bind an environment here knowing that
+* changing a secret in it will roll the app.
+*
+* ## Values are written encrypted
+*
+* Everything seekrit writes goes in as `type: SECRET`, so App Platform encrypts
+* it at rest and hands it back as an opaque `EV[1:…]` blob rather than as
+* plaintext. That is also why this connector cannot tell whether a value it is
+* about to write is already there — see
+* `apps/api/src/lib/sync/connectors/digitalocean.ts`.
+*/
+const digitalOceanAppDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("app"),
+	/** App id — the UUID in `cloud.digitalocean.com/apps/<id>`. */
+	appId: digitalOceanAppIdSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+/**
+* One component's own environment variables. Narrower than the app-level list:
+* only this service, worker, job, static site, or function sees them, and a key
+* here wins over the same key at app level.
+*/
+const digitalOceanComponentDestinationSchema = z.object({
+	provider: z.literal("digitalocean"),
+	kind: z.literal("component"),
+	appId: digitalOceanAppIdSchema,
+	/** Component name, as it appears in the app spec — not its type. */
+	componentName: digitalOceanComponentNameSchema,
+	scope: z.enum(DIGITALOCEAN_ENV_SCOPES).default("RUN_TIME")
+});
+const digitalOceanDestinationSchema = z.discriminatedUnion("kind", [digitalOceanAppDestinationSchema, digitalOceanComponentDestinationSchema]);
+/**
+* A Heroku app, named the way `/apps/{app_id_or_name}` names one: either the
+* app name or its UUID id. Both are accepted because both work, and the id is
+* the durable one — renaming an app in the dashboard breaks a binding that
+* holds its name, and does not break one that holds its id.
+*
+* The name pattern is Heroku's own (`^[a-z][a-z0-9-]{1,28}[a-z0-9]$`): 3–30
+* characters, starting with a letter and ending alphanumeric. Checking it here
+* turns the habitual slip — pasting `example.herokuapp.com`, or a name with
+* capitals — into a message at the form rather than a bare 404 from an alarm
+* with nobody watching.
+*/
+const herokuAppSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(value) || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value), "must be a Heroku app name (lowercase letters, numbers, and dashes) or its UUID");
+/**
+* The Heroku app whose config vars a binding owns.
+*
+* A Heroku app has **one** set of config vars, shared by every dyno and every
+* process type — there is no per-target split to state the way Vercel and Pages
+* have one. Heroku's convention is that staging and production are separate
+* *apps* (`storefront`, `storefront-staging`), so pointing at an environment
+* means naming that app, exactly as it does on Fly.
+*
+* Unlike Fly, values take effect **immediately**: setting config vars cuts a new
+* release and restarts the app's dynos, which is why a run sends exactly one
+* request — see the note in `apps/api/src/lib/sync/connectors/heroku.ts`.
+*/
+const herokuDestinationSchema = z.object({
+	provider: z.literal("heroku"),
+	/** App name as `heroku apps` prints it, or the app's UUID. */
+	app: herokuAppSchema
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -1952,7 +2088,9 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	awsParameterStoreDestinationSchema,
 	renderDestinationSchema,
 	flyDestinationSchema,
-	northflankDestinationSchema
+	northflankDestinationSchema,
+	digitalOceanDestinationSchema,
+	herokuDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3157,7 +3295,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.38.0";
+var version = "0.39.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6998,6 +7136,19 @@ function assertFlyApp(value) {
 	return appName;
 }
 /**
+* Heroku takes an app name or the app's UUID, so both are accepted here. The
+* habitual slips are the hostname (`storefront.herokuapp.com`) and capitals;
+* both are a 404 from Heroku much later, so they are caught here with a message
+* that says which.
+*/
+function assertHerokuApp(value) {
+	if (!value) fail("--heroku-app is required for heroku (the app name, e.g. storefront-production)");
+	const app = value.trim();
+	if (/\.(herokuapp\.com|herokudns\.com)$/.test(app)) fail(`--heroku-app takes the app name, not its hostname — try "${app.split(".")[0]}"`);
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(app) && !/^[a-z][a-z0-9-]{1,28}[a-z0-9]$/.test(app)) fail(`--heroku-app "${app}" is not a Heroku app name — 3 to 30 characters, starting with a lowercase letter, made of lowercase letters, numbers, and dashes (or the app's UUID)`);
+	return app;
+}
+/**
 * Northflank ids are slugs from the resource's URL, so the slip to catch is the
 * *display name* — "App Secrets" where "app-secrets" belongs.
 */
@@ -7007,6 +7158,16 @@ function assertNorthflankId(value, flag) {
 	if (!/^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$/.test(id)) fail(`${flag} should be a Northflank ID like "app-secrets", not "${id}"`);
 	return id;
 }
+/**
+* DigitalOcean app ids are UUIDs, and the slip to catch is the app *name* —
+* what the dashboard headline shows, and what the API answers with a bare 404.
+*/
+function assertDigitalOceanApp(value) {
+	if (!value) fail("--do-app is required for digitalocean (the UUID in the app's URL)");
+	const appId = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(appId)) fail(`--do-app should be the app's UUID, from its URL — not "${appId}"`);
+	return appId;
+}
 function assertProvider(value) {
 	if (!SYNC_PROVIDER_KINDS.includes(value)) fail(`unknown provider "${value}" — one of: ${SYNC_PROVIDER_KINDS.join(", ")}`);
 	return value;
@@ -7046,6 +7207,8 @@ function buildConfig(provider, options) {
 		case "render": return { provider: "render" };
 		case "fly": return { provider: "fly" };
 		case "northflank": return { provider: "northflank" };
+		case "digitalocean": return { provider: "digitalocean" };
+		case "heroku": return { provider: "heroku" };
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -7144,6 +7307,29 @@ function buildDestination(provider, options) {
 			projectId: assertNorthflankId(options.project, "--project"),
 			secretGroupId: assertNorthflankId(options.secretGroup, "--secret-group")
 		};
+		case "digitalocean": {
+			const appId = assertDigitalOceanApp(options.doApp);
+			const scope = assertMember(options.envScope, DIGITALOCEAN_ENV_SCOPES, "--env-scope", "RUN_TIME");
+			const componentName = options.component?.trim();
+			if (!componentName) return {
+				provider: "digitalocean",
+				kind: "app",
+				appId,
+				scope
+			};
+			if (!/^[a-z][a-z0-9-]{0,30}[a-z0-9]$/.test(componentName)) fail(`--component "${componentName}" is not an App Platform component name (lowercase letters, numbers, and dashes)`);
+			return {
+				provider: "digitalocean",
+				kind: "component",
+				appId,
+				componentName,
+				scope
+			};
+		}
+		case "heroku": return {
+			provider: "heroku",
+			app: assertHerokuApp(options.herokuApp)
+		};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -7159,6 +7345,8 @@ function describeDestination(destination) {
 		case "render": return destination.kind === "service" ? destination.serviceId : `env group ${destination.envGroupId}`;
 		case "fly": return destination.appName;
 		case "northflank": return `${destination.projectId} / ${destination.secretGroupId}`;
+		case "digitalocean": return `${destination.appId}${destination.kind === "component" ? ` / ${destination.componentName}` : ""} (${destination.scope})`;
+		case "heroku": return destination.app;
 	}
 }
 /**
@@ -7169,7 +7357,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
-    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/api-client": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",