@seekrit/cli 0.40.0 → 0.41.0

package/dist/index.js

@@ -1664,7 +1664,10 @@ const SYNC_PROVIDER_KINDS = [
 	"northflank",
 	"digitalocean",
 	"heroku",
-	"netlify"
+	"netlify",
+	"bunnyshell",
+	"github-actions",
+	"gcp-secret-manager"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1869,6 +1872,82 @@ const netlifyConnectionConfigSchema = z.object({
 	/** Netlify team slug (`acme`) or account id — `{account_id}` accepts either. */
 	accountId: z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Netlify team slug or account ID — no slashes or spaces")
 });
+/**
+* Bunnyshell account scope — empty, as Fly's, Heroku's, and Northflank's are.
+*
+* A Bunnyshell access token (from `environments.bunnyshell.com/access-token`)
+* belongs to a *user* and carries their access to every organization they are
+* in, exactly as a Heroku token does. Unlike Netlify's, that does not force an
+* organization onto the connection, because nothing here is addressed *through*
+* one: both variable collections name their parent by an opaque, globally
+* unique id (`environment` or `project`), so the token plus the destination's
+* id is the whole address. The API offers an `organization` filter, but it
+* narrows a listing — it is not part of an address.
+*/
+const bunnyshellConnectionConfigSchema = z.object({ provider: z.literal("bunnyshell") });
+/**
+* GitHub account scope — empty for github.com, which is the whole point.
+*
+* A GitHub token addresses everything by `{owner}/{repo}` or `{org}`, and those
+* are the destination's business, so there is no account half to state the way
+* Cloudflare and Netlify need one. `baseUrl` is the single exception, and it is
+* not an account scope at all: it names a **GitHub Enterprise Server** install,
+* whose API lives on the customer's own host rather than on `api.github.com`.
+*
+* Left unset for github.com and for Enterprise Cloud (which is `api.github.com`
+* with a different plan behind it). Set only for a self-hosted GHES appliance,
+* where the REST API is at `https://<host>/api/v3`.
+*/
+const githubActionsConnectionConfigSchema = z.object({
+	provider: z.literal("github-actions"),
+	/**
+	* GitHub Enterprise Server API root, e.g. `https://github.acme.com/api/v3`.
+	* Omit for github.com. Must be `https:` — this URL carries the token.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the GitHub Enterprise Server API root, e.g. https://github.acme.com/api/v3").optional()
+});
+/**
+* A Google Cloud project, as `projects/{project}` accepts one: either the
+* project **ID** (`acme-prod`, 6–30 characters, what the console shows) or the
+* project **number** (all digits). Both are accepted because both work, and
+* the id is the one an operator can read off their own dashboard.
+*
+* Validated by shape for the reason Cloudflare's account id is: every Secret
+* Manager URL is built from this string, and a typo would otherwise surface as
+* a 403 from Google hours later inside an alarm, with nobody watching.
+*/
+const gcpProjectSchema = z.string().trim().refine((value) => /^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(value) || /^\d{1,20}$/.test(value), "must be a Google Cloud project ID (e.g. acme-prod) or project number");
+/**
+* Google Cloud project scope — which project's Secret Manager to write.
+*
+* The service account is *not* here, unlike AWS's access key id: a GCP
+* credential is a key JSON that names its own `client_email`, so the identity
+* arrives with the credential the way a Vercel token's does. What the
+* credential cannot say is which project to write, because a service account
+* can be granted access to secrets in projects other than its own — so that is
+* this field, exactly as Cloudflare's account id is.
+*
+* One project per connection. Syncing an environment into two projects means
+* two connections, which also keeps their key grants separate.
+*
+* Global secrets only: v1 addresses `secretmanager.googleapis.com`, not the
+* per-location `secretmanager.<location>.rep.googleapis.com` endpoints that
+* regional secrets live behind. Data residency is expressed instead through the
+* destination's user-managed replication.
+*/
+const gcpSecretManagerConnectionConfigSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	/** Project ID (`acme-prod`) or project number. */
+	projectId: gcpProjectSchema
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -1882,7 +1961,10 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	northflankConnectionConfigSchema,
 	digitalOceanConnectionConfigSchema,
 	herokuConnectionConfigSchema,
-	netlifyConnectionConfigSchema
+	netlifyConnectionConfigSchema,
+	bunnyshellConnectionConfigSchema,
+	githubActionsConnectionConfigSchema,
+	gcpSecretManagerConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -2307,6 +2389,292 @@ const netlifyDestinationSchema = z.object({
 	message: "a branch context needs the branch name it applies to",
 	path: ["branch"]
 });
+/**
+* A Bunnyshell resource id, as the platform hands it out.
+*
+* Deliberately loose. Bunnyshell documents no format for these — they are
+* opaque strings from `bns environments list` or the dashboard URL — so
+* asserting a shape here would be inventing a rule the platform never stated,
+* and the failure mode would be seekrit refusing an id that works.
+*
+* Being loose is affordable here in a way it is not on Netlify, where an
+* unresolved `site_id` silently widens a write to the whole team. Both
+* Bunnyshell variable collections name their parent in the **request body** of
+* a create, as a required relation: an id the platform cannot resolve is a 422
+* naming the field, not a write that lands somewhere broader. The listing side
+* is fenced separately — the connector re-checks every variable's own parent
+* before it touches it, so a filter that failed to bite cannot turn into an
+* edit of a neighbouring environment's variables.
+*/
+const bunnyshellIdSchema = z.string().trim().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "must be a Bunnyshell ID — no slashes or spaces");
+/**
+* Variables on one Bunnyshell **environment** — the set every component in it
+* inherits, and the closest match to a seekrit environment.
+*
+* This is the destination for an environment that already exists and stays
+* around: a primary environment, or a long-lived ephemeral one.
+*/
+const bunnyshellEnvironmentDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("environment"),
+	/** Environment ID, as `bns environments list` prints it. */
+	environmentId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Variables on a Bunnyshell **project** — inherited by every environment
+* created in it from then on.
+*
+* Worth thinking about twice, for the reason a Render environment group is:
+* the blast radius is the project, not one environment. It earns its place
+* anyway, because it is the only destination that reaches an environment which
+* *does not exist yet*. Bunnyshell's whole shape is ephemeral environments spun
+* up per branch or per pull request; pushing to the environment cannot seed one
+* that a webhook will create tomorrow, and pushing to the project can.
+*
+* An environment inherits the project's value at creation and may then be
+* overridden at its own scope — so a project binding does not fight an
+* environment binding pointed at the same name, it loses to it.
+*/
+const bunnyshellProjectDestinationSchema = z.object({
+	provider: z.literal("bunnyshell"),
+	kind: z.literal("project"),
+	/** Project ID, as `bns projects list` prints it. */
+	projectId: bunnyshellIdSchema,
+	/** Mark what seekrit creates as a Bunnyshell secret (default true). */
+	secret: z.boolean().optional()
+});
+/**
+* Where in Bunnyshell a binding writes.
+*
+* Split on `kind` rather than into two providers — the way Render's service and
+* environment group are, and unlike Cloudflare's three — because the two are the
+* same API twice over: `/v1/environment_variables` and `/v1/project_variables`
+* take the same fields, fail the same ways, and differ only in which parent they
+* name. One connector serves both, so one provider does too.
+*
+* `secret` is Bunnyshell's `isSecret`, and means less than Netlify's flag of the
+* same name: Bunnyshell encrypts every variable with an organization key whether
+* or not the flag is set, so this only decides whether the value is obscured in
+* the dashboard and stored encrypted in an exported definition. It is on by
+* default all the same — a value pushed from a secrets manager should not be
+* sitting in plain view of everyone with project access. It applies only to
+* variables seekrit **creates**: an update never sends the flag, so a variable
+* an operator deliberately un-secreted stays that way.
+*/
+const bunnyshellDestinationSchema = z.discriminatedUnion("kind", [bunnyshellEnvironmentDestinationSchema, bunnyshellProjectDestinationSchema]);
+/**
+* Which repositories in an organization can read an org-level secret.
+*
+* GitHub's own enum, unchanged. There is deliberately **no default**: `all` hands
+* the value to every repository in the organization — including ones added
+* tomorrow, and including forks' workflows to the extent the org allows them —
+* and that is not a blast radius a secrets manager should pick on an operator's
+* behalf. Naming it is the point.
+*/
+const GITHUB_ACTIONS_VISIBILITIES = [
+	"all",
+	"private",
+	"selected"
+];
+/**
+* A GitHub account or organization login, matching GitHub's own rule:
+* alphanumeric with single internal hyphens, 39 characters at most.
+*
+* Checked here so the habitual slip — pasting a URL, or `owner/repo` into the
+* owner field — fails at the form rather than as a 404 from an alarm with nobody
+* watching.
+*/
+const githubOwnerSchema = z.string().trim().min(1).max(39).regex(/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/, "must be a GitHub user or organization login — not a URL or an owner/repo pair");
+/**
+* A repository name. GitHub's rules are looser than an owner's: letters,
+* numbers, hyphens, underscores, and periods, up to 100 characters. `.` and `..`
+* are refused outright — they would traverse the API path rather than name a
+* repository.
+*/
+const githubRepoSchema = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._-]+$/, "must be a repository name alone (`api`), not `owner/repo` or a URL").refine((value) => value !== "." && value !== "..", "is not a repository name");
+/**
+* A deployment environment name.
+*
+* Deliberately permissive: GitHub allows spaces and most punctuation here, and
+* the dashboard shows names like `prod (eu-west)`. Only the two things that would
+* break the request are refused — an empty name, and the path separators that
+* would let a name escape its URL segment. Everything else is GitHub's to reject.
+*/
+const githubEnvironmentSchema = z.string().trim().min(1).max(255).refine((value) => !value.includes("/") && !value.includes("\\"), "cannot contain a slash — that is a path separator, not part of an environment name");
+/**
+* One repository's Actions secrets.
+*
+* Every workflow in the repository can read these, including one added by a pull
+* request from a collaborator with write access. That is GitHub's model, not a
+* choice this connector makes — but it is the reason `environment` exists below,
+* and the reason to prefer it for anything that touches production.
+*/
+const githubActionsRepoDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("repo"),
+	/** Repository owner — a user or organization login. */
+	owner: githubOwnerSchema,
+	/** Repository name, without the owner. */
+	repo: githubRepoSchema
+});
+/**
+* One deployment environment's Actions secrets — the narrowest scope GitHub has.
+*
+* A job reads these only by declaring `environment: <name>`, which also subjects
+* it to that environment's protection rules: required reviewers, wait timers, and
+* the branch policy. That combination is the closest GitHub gets to "this secret
+* is for production, and reaching it requires approval", and it is the scope to
+* reach for by default.
+*
+* The environment must already exist. This connector will not create one: an
+* environment is a deployment gate, and silently creating an unprotected one
+* because a name was misspelled would quietly remove the protection the operator
+* was relying on.
+*/
+const githubActionsEnvironmentDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("environment"),
+	owner: githubOwnerSchema,
+	repo: githubRepoSchema,
+	/** Environment name, exactly as the repository's Settings → Environments shows it. */
+	environment: githubEnvironmentSchema
+});
+/**
+* An organization's Actions secrets.
+*
+* The widest scope in the product, and the only destination on any provider that
+* can hand a value to repositories nobody named. Read {@link
+* GITHUB_ACTIONS_VISIBILITIES} before using it.
+*
+* `selectedRepositoryIds` takes numeric repository **ids**, not names, because
+* that is what GitHub's API takes. An id is visible at
+* `GET /repos/{owner}/{repo}` as `id`, and in the dashboard nowhere at all —
+* which is friction worth accepting rather than resolving names to ids here: name
+* resolution would mean this connector picking which repository an ambiguous
+* name meant, and getting that wrong widens a secret's reach silently.
+*/
+const githubActionsOrgDestinationSchema = z.object({
+	provider: z.literal("github-actions"),
+	kind: z.literal("org"),
+	/** Organization login. */
+	org: githubOwnerSchema,
+	/** Which repositories may read these secrets. Stated, never defaulted. */
+	visibility: z.enum(GITHUB_ACTIONS_VISIBILITIES),
+	/** Numeric repository ids, required when `visibility` is `selected`. */
+	selectedRepositoryIds: z.array(z.number().int().positive()).max(500).optional()
+}).refine((dest) => dest.visibility !== "selected" || dest.selectedRepositoryIds !== void 0 && dest.selectedRepositoryIds.length > 0, {
+	message: "selected visibility needs at least one repository id",
+	path: ["selectedRepositoryIds"]
+}).refine((dest) => dest.visibility === "selected" || dest.selectedRepositoryIds === void 0, {
+	message: "repository ids only apply to selected visibility — remove them, or select it",
+	path: ["selectedRepositoryIds"]
+});
+const githubActionsDestinationSchema = z.discriminatedUnion("kind", [
+	githubActionsRepoDestinationSchema,
+	githubActionsEnvironmentDestinationSchema,
+	githubActionsOrgDestinationSchema
+]);
+/**
+* How a binding lays its secrets out in Secret Manager. The same two shapes the
+* AWS Secrets Manager destination offers, and for the same reasons:
+*
+* - `secret-per-name` — one GCP secret per seekrit secret. The direct
+*   translation, and what Cloud Run's `--set-secrets` and GKE's Secret Manager
+*   CSI driver mount one at a time.
+* - `json-bundle` — every value as one JSON object in a single secret. Costs one
+*   active version instead of fifty, which is the whole billing unit here.
+*/
+const GCP_SECRET_MANAGER_LAYOUTS = ["secret-per-name", "json-bundle"];
+/**
+* Where Google keeps the copies of a secret. Chosen at creation and
+* **immutable** afterwards — changing it means deleting the secret and letting
+* the next run recreate it.
+*
+* - `automatic` — Google picks the locations. One billable replica, and what
+*   you want unless a policy says otherwise.
+* - `user-managed` — the binding names the regions. This is how data residency
+*   is expressed for global secrets, and each region is billed as its own
+*   active version.
+*/
+const GCP_REPLICATION_POLICIES = ["automatic", "user-managed"];
+/**
+* A Secret Manager secret ID. Google's own rule, quoted from the API reference:
+* "a string with a maximum length of 255 characters and can contain uppercase
+* and lowercase letters, numerals, and the hyphen (`-`) and underscore (`_`)
+* characters."
+*
+* Notably **no slashes and no dots**, which is what makes this a different
+* field from AWS's `pathPrefix` rather than the same idea renamed: a Secret
+* Manager namespace is spelled `prod-storefront-DB_URL`, not
+* `prod/storefront/DB_URL`.
+*/
+const gcpSecretIdSchema = z.string().trim().min(1).max(255).regex(/^[A-Za-z0-9_-]+$/, "may contain letters, digits, hyphens, and underscores");
+/**
+* A GCP region for a user-managed replica (`us-east1`, `europe-west4`,
+* `northamerica-northeast1`). Validated by shape rather than against a list,
+* because Google adds regions faster than we ship — a name Secret Manager does
+* not know is refused by Google with a clear message at creation.
+*/
+const gcpLocationSchema = z.string().trim().regex(/^[a-z]+-[a-z]+\d+$/, "must be a GCP region ID, e.g. us-east1");
+/**
+* A Cloud KMS key, as its full resource name — the only form the API accepts:
+* `projects/p/locations/l/keyRings/r/cryptoKeys/k`.
+*
+* Stricter than AWS's `kmsKeyId` (which tolerates five spellings) because
+* Google tolerates exactly one, and because a key in the wrong *location* is
+* rejected at creation: an automatic-replication secret needs a `global` key,
+* and a user-managed replica needs one in its own region.
+*/
+const gcpKmsKeyNameSchema = z.string().trim().max(1024).regex(/^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+$/, "must be a full Cloud KMS key name (projects/…/locations/…/keyRings/…/cryptoKeys/…)");
+/**
+* Where inside a project's Secret Manager a binding writes.
+*
+* ## Every push would otherwise cost a version
+*
+* Secret Manager has no "set the value" call — only `addVersion`, which appends.
+* A run pushes the whole environment (never a diff), so changing one secret in
+* an environment of fifty would leave fifty new versions behind, forty-nine of
+* them identical to their predecessors, each one billed for as long as it stays
+* active.
+*
+* So this connector writes a version only when the value actually changed,
+* decided from a keyed digest it keeps in the secret's own **annotations** — see
+* `apps/api/src/lib/sync/connectors/gcp-secret-manager.ts` for why it is keyed
+* and what that costs. `pruneVersions` is the other half of the bill: with it
+* on, the version a push supersedes is destroyed as soon as the new one lands,
+* so a secret keeps exactly one active version.
+*/
+const gcpSecretManagerDestinationSchema = z.object({
+	provider: z.literal("gcp-secret-manager"),
+	layout: z.enum(GCP_SECRET_MANAGER_LAYOUTS).default("secret-per-name"),
+	/**
+	* `secret-per-name` only: prepended to every secret ID, e.g.
+	* `prod-storefront-`. Optional, but strongly advised in a project that holds
+	* anything else — without it a binding writes at the root of a namespace it
+	* does not own, and Secret Manager has no folders to hide behind.
+	*/
+	idPrefix: z.string().trim().max(200).regex(/^[A-Za-z0-9_-]*$/, "may contain letters, digits, hyphens, and underscores").optional(),
+	/** `json-bundle` only: the one secret that holds every value, e.g. `prod-storefront-env`. */
+	secretId: gcpSecretIdSchema.optional(),
+	replication: z.enum(GCP_REPLICATION_POLICIES).default("automatic"),
+	/** `user-managed` only: the regions to replicate to. At least one. */
+	locations: z.array(gcpLocationSchema).min(1).max(16).optional(),
+	/** Customer-managed encryption key. Omitted means Google-managed keys. */
+	kmsKeyName: gcpKmsKeyNameSchema.optional(),
+	/** Destroy the version each push supersedes, keeping one active version. */
+	pruneVersions: z.boolean().optional()
+}).refine((d) => d.layout !== "json-bundle" || d.secretId !== void 0, {
+	message: "a json-bundle destination needs the ID of the secret to write",
+	path: ["secretId"]
+}).refine((d) => d.replication !== "user-managed" || (d.locations?.length ?? 0) > 0, {
+	message: "user-managed replication needs at least one location",
+	path: ["locations"]
+}).refine((d) => d.kmsKeyName === void 0 || d.replication === "automatic" || (d.locations?.length ?? 0) === 1, {
+	message: "a customer-managed key covers one location — use automatic replication, or a single location",
+	path: ["kmsKeyName"]
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2320,7 +2688,10 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	northflankDestinationSchema,
 	digitalOceanDestinationSchema,
 	herokuDestinationSchema,
-	netlifyDestinationSchema
+	netlifyDestinationSchema,
+	bunnyshellDestinationSchema,
+	githubActionsDestinationSchema,
+	gcpSecretManagerDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3526,7 +3897,7 @@ function isCliSessionToken(value) {
 }
 //#endregion
 //#region package.json
-var version = "0.40.0";
+var version = "0.41.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -7643,6 +8014,61 @@ function assertNetlifySite(value) {
 	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(site)) fail(`--netlify-site "${site}" is not a site API ID — Netlify shows it under Project configuration → General → Project information, and it is a UUID, not the site name or its .netlify.app address`);
 	return site;
 }
+/**
+* A Bunnyshell environment or project ID, as the platform hands it out.
+*
+* Checked only for shape, not format: Bunnyshell documents none for these, so
+* asserting one would be inventing a rule and refusing IDs that work. Both
+* variable collections name their parent in the **body** of a create, as a
+* required relation, so an ID Bunnyshell cannot resolve is a 422 naming the
+* field — not a write that lands somewhere wider. That is why this is loose
+* where {@link assertNetlifySite} is strict.
+*/
+function assertBunnyshellId(value, flag) {
+	if (!value) fail(`${flag} is required for bunnyshell (the ID from \`bns\` or the dashboard URL)`);
+	const id = value.trim();
+	if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(id)) fail(`${flag} "${id}" is not a Bunnyshell ID — no slashes or spaces`);
+	return id;
+}
+/**
+* Split `--gh-repo owner/name` into the two halves GitHub's paths need.
+*
+* Taken as one flag rather than two because `owner/name` is how GitHub writes a
+* repository everywhere — in its URLs, in `gh repo view`, in every workflow file —
+* and asking for it in two pieces invites the mistake of pasting the pair into
+* one of them.
+*/
+function assertGithubRepo(value) {
+	if (!value) fail("--gh-repo is required for github-actions (owner/name)");
+	const parts = value.trim().split("/");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) fail(`--gh-repo "${value}" should be owner/name, e.g. acme/storefront`);
+	const [owner, repo] = parts;
+	if (!/^[A-Za-z0-9](?:-?[A-Za-z0-9])*$/.test(owner) || owner.length > 39) fail(`--gh-repo owner "${owner}" is not a GitHub login`);
+	if (!/^[A-Za-z0-9._-]+$/.test(repo) || repo === "." || repo === "..") fail(`--gh-repo name "${repo}" is not a repository name`);
+	return {
+		owner,
+		repo
+	};
+}
+/** Parse `--gh-repo-ids 1,2,3` — GitHub's org endpoint takes numeric ids, not names. */
+function assertRepoIds(raw) {
+	const parts = list(raw, "");
+	if (parts.length === 0) fail("--gh-repo-ids is required with `--gh-visibility selected` — numeric repository IDs, which `gh api repos/<owner>/<name> --jq .id` prints");
+	return parts.map((part) => {
+		const id = Number(part);
+		if (!Number.isInteger(id) || id <= 0) fail(`--gh-repo-ids "${part}" is not a repository ID — GitHub takes numeric IDs, not names`);
+		return id;
+	});
+}
+/**
+* What `sync connect` calls the secret it reads from stdin. Only the wording
+* differs — every provider's credential is wrapped the same way.
+*/
+function credentialNoun(provider) {
+	if (provider.startsWith("aws-")) return "secret access key";
+	if (provider === "gcp-secret-manager") return "service-account key JSON";
+	return "API token";
+}
 /** Account-scope config for a connection (never the credential itself). */
 function buildConfig(provider, options) {
 	switch (provider) {
@@ -7686,6 +8112,17 @@ function buildConfig(provider, options) {
 				provider: "netlify",
 				accountId: options.accountId
 			};
+		case "bunnyshell": return { provider: "bunnyshell" };
+		case "github-actions": return {
+			provider: "github-actions",
+			...options.baseUrl ? { baseUrl: options.baseUrl } : {}
+		};
+		case "gcp-secret-manager":
+			if (!options.projectId) fail("--project-id is required for gcp-secret-manager — the project ID (or number) whose Secret Manager to write");
+			return {
+				provider: "gcp-secret-manager",
+				projectId: options.projectId
+			};
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -7819,6 +8256,71 @@ function buildDestination(provider, options) {
 				secret: options.netlifySecret !== false
 			};
 		}
+		case "bunnyshell": {
+			const environmentId = options.bunnyshellEnvironment?.trim();
+			const projectId = options.project?.trim();
+			if (environmentId && projectId) fail("pass --bunnyshell-environment or --project for bunnyshell, not both — a binding writes to one");
+			const secret = options.bunnyshellSecret !== false;
+			if (projectId) return {
+				provider: "bunnyshell",
+				kind: "project",
+				projectId: assertBunnyshellId(projectId, "--project"),
+				secret
+			};
+			return {
+				provider: "bunnyshell",
+				kind: "environment",
+				environmentId: assertBunnyshellId(environmentId, "--bunnyshell-environment"),
+				secret
+			};
+		}
+		case "github-actions": {
+			if (options.ghOrg) {
+				if (options.ghRepo || options.ghEnvironment) fail("--gh-org writes organization secrets — drop --gh-repo and --gh-environment");
+				const visibility = assertMember(options.ghVisibility, GITHUB_ACTIONS_VISIBILITIES, "--gh-visibility", "private");
+				if (visibility !== "selected" && options.ghRepoIds) fail(`--gh-repo-ids only applies to \`--gh-visibility selected\`, not ${visibility}`);
+				return {
+					provider: "github-actions",
+					kind: "org",
+					org: options.ghOrg.trim(),
+					visibility,
+					...visibility === "selected" ? { selectedRepositoryIds: assertRepoIds(options.ghRepoIds) } : {}
+				};
+			}
+			const { owner, repo } = assertGithubRepo(options.ghRepo);
+			const environment = options.ghEnvironment?.trim();
+			if (!environment) return {
+				provider: "github-actions",
+				kind: "repo",
+				owner,
+				repo
+			};
+			return {
+				provider: "github-actions",
+				kind: "environment",
+				owner,
+				repo,
+				environment
+			};
+		}
+		case "gcp-secret-manager": {
+			const layout = assertMember(options.layout, GCP_SECRET_MANAGER_LAYOUTS, "--layout", "secret-per-name");
+			if (layout === "json-bundle" && !options.secretName) fail("--secret-name is required for --layout json-bundle (the one secret to write)");
+			const replication = assertMember(options.gcpReplication, GCP_REPLICATION_POLICIES, "--gcp-replication", "automatic");
+			const locations = options.gcpLocations ? list(options.gcpLocations, "") : [];
+			if (replication === "user-managed" && locations.length === 0) fail("--gcp-locations is required with --gcp-replication user-managed, e.g. us-east1");
+			if (options.gcpKmsKey && replication === "user-managed" && locations.length > 1) fail("--gcp-kms-key covers one location — use automatic replication, or a single --gcp-locations entry");
+			return {
+				provider: "gcp-secret-manager",
+				layout,
+				replication,
+				...options.gcpPrefix ? { idPrefix: options.gcpPrefix } : {},
+				...layout === "json-bundle" && options.secretName ? { secretId: options.secretName } : {},
+				...replication === "user-managed" ? { locations } : {},
+				...options.gcpKmsKey ? { kmsKeyName: options.gcpKmsKey } : {},
+				...options.gcpPruneVersions ? { pruneVersions: true } : {}
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -7837,6 +8339,13 @@ function describeDestination(destination) {
 		case "digitalocean": return `${destination.appId}${destination.kind === "component" ? ` / ${destination.componentName}` : ""} (${destination.scope})`;
 		case "heroku": return destination.app;
 		case "netlify": return `${destination.siteId} (${destination.contexts.map((context) => context === "branch" ? `branch @${destination.branch}` : context).join(", ")})`;
+		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
+		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
+		case "github-actions": switch (destination.kind) {
+			case "repo": return `${destination.owner}/${destination.repo}`;
+			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
+			case "org": return `org ${destination.org} (${destination.visibility}${destination.selectedRepositoryIds ? `: ${destination.selectedRepositoryIds.length} repos` : ""})`;
+		}
 	}
 }
 /**
@@ -7847,7 +8356,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -7871,11 +8380,11 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com)").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
-		const noun = provider.startsWith("aws-") ? "secret access key" : "API token";
+		const noun = credentialNoun(provider);
 		const credential = (process.stdin.isTTY ? await promptHidden(`${provider} ${noun}: `) : await readStdin()).trim();
 		if (!credential) fail(`no ${noun} given`);
 		const id = randomId("syc");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -27,9 +27,9 @@
     "@types/node": "^26.1.0",
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
+    "@seekrit/api-client": "0.0.1",
     "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/api-client": "0.0.1"
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",