@seekrit/cli 0.41.0 → 0.42.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +87 -3
- package/package.json +3 -3
package/dist/index.js
CHANGED
|
@@ -8,6 +8,43 @@ import { dirname, join, parse } from "node:path";
|
|
|
8
8
|
import { createInterface } from "node:readline";
|
|
9
9
|
import { Writable } from "node:stream";
|
|
10
10
|
import { createHash } from "node:crypto";
|
|
11
|
+
//#region ../../packages/core/src/agent-policy.ts
|
|
12
|
+
/** A bare hostname: no scheme, no port, no path, no wildcard. */
|
|
13
|
+
const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
|
|
14
|
+
const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
|
|
15
|
+
/**
|
|
16
|
+
* A path pattern. Must be absolute, because it is matched against a request
|
|
17
|
+
* path — a relative pattern is a mistake that would silently match nothing.
|
|
18
|
+
*/
|
|
19
|
+
const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
|
|
20
|
+
const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
|
|
21
|
+
z.object({
|
|
22
|
+
host: policyHostSchema,
|
|
23
|
+
methods: z.array(policyMethodSchema).max(16).default([]),
|
|
24
|
+
paths: z.array(policyPathSchema).max(64).default([]),
|
|
25
|
+
allow: z.array(policySecretNameSchema).max(64).default([]),
|
|
26
|
+
label: z.string().trim().max(120).optional()
|
|
27
|
+
});
|
|
28
|
+
z.object({
|
|
29
|
+
/** `ap1.<body>.<signature>` — opaque to the server. */
|
|
30
|
+
bundle: z.string().min(16).max(256 * 1024) });
|
|
31
|
+
z.object({
|
|
32
|
+
name: z.string().trim().min(1).max(120),
|
|
33
|
+
slug: z.string().trim().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "slug is lowercase letters, digits, and dashes"),
|
|
34
|
+
/** The environment whose secrets this agent's policy may name. Optional. */
|
|
35
|
+
environmentId: z.string().trim().min(1).max(64).optional()
|
|
36
|
+
});
|
|
37
|
+
z.object({
|
|
38
|
+
name: z.string().trim().min(1).max(120).optional(),
|
|
39
|
+
enabled: z.boolean().optional(),
|
|
40
|
+
environmentId: z.string().trim().min(1).max(64).nullish()
|
|
41
|
+
});
|
|
42
|
+
z.object({
|
|
43
|
+
host: policyHostSchema,
|
|
44
|
+
method: policyMethodSchema,
|
|
45
|
+
path: z.string().trim().min(1).max(2048),
|
|
46
|
+
secret: policySecretNameSchema.optional()
|
|
47
|
+
});
|
|
11
48
|
/** All catalog keys as a runtime array (for iteration / zod enums). */
|
|
12
49
|
const ENTITLEMENT_KEYS = Object.keys({
|
|
13
50
|
"feature.kms": {
|
|
@@ -1188,7 +1225,12 @@ const AUDIT_ACTIONS = [
|
|
|
1188
1225
|
"sync.binding_updated",
|
|
1189
1226
|
"sync.binding_deleted",
|
|
1190
1227
|
"sync.run_succeeded",
|
|
1191
|
-
"sync.run_failed"
|
|
1228
|
+
"sync.run_failed",
|
|
1229
|
+
"agent.created",
|
|
1230
|
+
"agent.updated",
|
|
1231
|
+
"agent.deleted",
|
|
1232
|
+
"agent.policy_published",
|
|
1233
|
+
"agent.policy_rolled_back"
|
|
1192
1234
|
];
|
|
1193
1235
|
/**
|
|
1194
1236
|
* Transactional notification emails seekrit can send. Each id is one
|
|
@@ -3897,7 +3939,7 @@ function isCliSessionToken(value) {
|
|
|
3897
3939
|
}
|
|
3898
3940
|
//#endregion
|
|
3899
3941
|
//#region package.json
|
|
3900
|
-
var version = "0.
|
|
3942
|
+
var version = "0.42.0";
|
|
3901
3943
|
//#endregion
|
|
3902
3944
|
//#region ../../packages/api-client/src/index.ts
|
|
3903
3945
|
var SeekritApiError = class extends Error {
|
|
@@ -4219,6 +4261,44 @@ var SeekritClient = class {
|
|
|
4219
4261
|
deleteHoneyToken(orgId, honeyTokenId) {
|
|
4220
4262
|
return this.request("DELETE", `/v1/orgs/${orgId}/honey-tokens/${honeyTokenId}`);
|
|
4221
4263
|
}
|
|
4264
|
+
listAgents(orgId) {
|
|
4265
|
+
return this.request("GET", `/v1/orgs/${orgId}/agents`);
|
|
4266
|
+
}
|
|
4267
|
+
createAgent(orgId, input) {
|
|
4268
|
+
return this.request("POST", `/v1/orgs/${orgId}/agents`, input);
|
|
4269
|
+
}
|
|
4270
|
+
getAgent(orgId, agentId) {
|
|
4271
|
+
return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}`);
|
|
4272
|
+
}
|
|
4273
|
+
updateAgent(orgId, agentId, input) {
|
|
4274
|
+
return this.request("PATCH", `/v1/orgs/${orgId}/agents/${agentId}`, input);
|
|
4275
|
+
}
|
|
4276
|
+
deleteAgent(orgId, agentId) {
|
|
4277
|
+
return this.request("DELETE", `/v1/orgs/${orgId}/agents/${agentId}`);
|
|
4278
|
+
}
|
|
4279
|
+
/** Published versions, newest first. Append-only; nothing here is rewritten. */
|
|
4280
|
+
listAgentPolicies(orgId, agentId) {
|
|
4281
|
+
return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/policies`);
|
|
4282
|
+
}
|
|
4283
|
+
/**
|
|
4284
|
+
* Publish a bundle signed in the browser.
|
|
4285
|
+
*
|
|
4286
|
+
* The signing happens client-side (`signAgentPolicy` in `@seekrit/core`) with
|
|
4287
|
+
* the publishing admin's own key, so the API receives an opaque envelope it
|
|
4288
|
+
* cannot forge. A version mismatch answers `409`: the version is inside the
|
|
4289
|
+
* signature, so a concurrent publish has to be re-signed, not patched.
|
|
4290
|
+
*/
|
|
4291
|
+
publishAgentPolicy(orgId, agentId, bundle) {
|
|
4292
|
+
return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies`, { bundle });
|
|
4293
|
+
}
|
|
4294
|
+
/** Republish an earlier version's bundle as the newest version. */
|
|
4295
|
+
rollbackAgentPolicy(orgId, agentId, version) {
|
|
4296
|
+
return this.request("POST", `/v1/orgs/${orgId}/agents/${agentId}/policies/${version}/rollback`);
|
|
4297
|
+
}
|
|
4298
|
+
/** The caller's own signing thumbprint, for the trust-anchor snippet. */
|
|
4299
|
+
getMyPolicySigner(orgId) {
|
|
4300
|
+
return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
|
|
4301
|
+
}
|
|
4222
4302
|
/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
|
|
4223
4303
|
listKmsKeys(orgId) {
|
|
4224
4304
|
return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
|
|
@@ -8733,7 +8813,11 @@ program.command("login").description("sign in through the browser (or pass a cre
|
|
|
8733
8813
|
} : {},
|
|
8734
8814
|
...options.clientId ? { clientId: options.clientId } : {},
|
|
8735
8815
|
...options.clientSecret ? { clientSecret: options.clientSecret } : {},
|
|
8736
|
-
...options.devUser ? {
|
|
8816
|
+
...options.devUser ? {
|
|
8817
|
+
devUser: options.devUser,
|
|
8818
|
+
sessionToken: void 0,
|
|
8819
|
+
token: void 0
|
|
8820
|
+
} : {},
|
|
8737
8821
|
...options.apiUrl ? { apiUrl: options.apiUrl } : {}
|
|
8738
8822
|
});
|
|
8739
8823
|
console.error("credentials saved");
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@seekrit/cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.42.0",
|
|
4
4
|
"description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"publishConfig": {
|
|
@@ -28,8 +28,8 @@
|
|
|
28
28
|
"tsdown": "^0.22.3",
|
|
29
29
|
"vitest": "^4.1.9",
|
|
30
30
|
"@seekrit/api-client": "0.0.1",
|
|
31
|
-
"@seekrit/
|
|
32
|
-
"@seekrit/
|
|
31
|
+
"@seekrit/crypto": "0.0.1",
|
|
32
|
+
"@seekrit/core": "0.0.1"
|
|
33
33
|
},
|
|
34
34
|
"scripts": {
|
|
35
35
|
"build": "tsdown",
|