@seekrit/cli 0.46.0 → 0.47.0

package/dist/index.js

@@ -2481,7 +2481,8 @@ const SYNC_PROVIDER_KINDS = [
 	"bunnyshell",
 	"github-actions",
 	"gcp-secret-manager",
-	"langgraph-platform"
+	"langgraph-platform",
+	"azure-key-vault"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -2822,6 +2823,54 @@ const langgraphPlatformConnectionConfigSchema = z.object({
 	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
 	path: ["baseUrl"]
 });
+/**
+* The Azure clouds a vault can live in.
+*
+* Unlike AWS, where the China partition can be read off the region string
+* (`cn-…`), nothing about a tenant id or a vault name says which cloud it
+* belongs to — and two hosts have to agree with the answer: the Entra authority
+* that issues the token and the DNS suffix the vault answers on. Getting either
+* wrong is a failure inside an alarm with nobody watching, so it is stated.
+*/
+const AZURE_CLOUDS = [
+	"public",
+	"usgov",
+	"china"
+];
+/**
+* A Microsoft Entra directory (tenant) or application (client) id.
+*
+* Both are GUIDs. Entra accepts a verified domain name in place of a tenant id
+* in the token URL, but not a client id, and taking only the GUID for both
+* keeps one rule — a tenant's GUID is on the same admin-center page as the
+* client id it pairs with, so nothing is harder to find.
+*/
+const azureGuidSchema = z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a GUID, as the Entra admin center shows it");
+/**
+* Azure account scope: which directory to authenticate against, as which app.
+*
+* The split follows AWS's, and for the same reason. A service principal's
+* **client secret** is the credential and is wrapped to the connection's key;
+* the tenant and client ids are *identifiers* — they appear in the token
+* request URL, in sign-in logs, and on the app registration blade. Keeping them
+* here lets the dashboard say which principal a connection authenticates as,
+* which is the first thing worth knowing when a connection starts failing after
+* a secret expires.
+*
+* Client secrets are the only credential kind here: a certificate or federated
+* credential would need a private key or a trust relationship the sync engine
+* has nowhere to keep, and Entra caps a client secret at 24 months, which is a
+* rotation the connection's `lastError` will make loud.
+*/
+const azureKeyVaultConnectionConfigSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Entra directory (tenant) ID. */
+	tenantId: azureGuidSchema,
+	/** Application (client) ID of the service principal seekrit signs in as. */
+	clientId: azureGuidSchema,
+	/** Which Azure cloud the tenant and its vaults live in. */
+	cloud: z.enum(AZURE_CLOUDS).default("public")
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -2839,7 +2888,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
 	gcpSecretManagerConnectionConfigSchema,
-	langgraphPlatformConnectionConfigSchema
+	langgraphPlatformConnectionConfigSchema,
+	azureKeyVaultConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -3571,6 +3621,65 @@ const langgraphPlatformDestinationSchema = z.object({
 	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
 	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
 });
+/**
+* A Key Vault's name — the leftmost label of its DNS name, so the vault
+* `acme-prod` answers at `acme-prod.vault.azure.net`.
+*
+* Azure's own rule, stated here because the failure it prevents is confusing:
+* 3–24 characters, alphanumerics and hyphens, starting with a letter, ending
+* with a letter or digit, and no run of two hyphens. A name that breaks it
+* cannot exist, so a typo is a DNS failure rather than a 404 — an error that
+* says nothing about what was wrong.
+*
+* The *base URL* is not taken instead. It would let a connection be pointed at
+* any host, and the whole address seekrit needs is this label plus the cloud
+* already named on the connection.
+*/
+const azureVaultNameSchema = z.string().trim().regex(/^[A-Za-z](?!.*--)[A-Za-z0-9-]{1,22}[A-Za-z0-9]$/, "must be a Key Vault name: 3–24 letters, digits, and single hyphens, starting with a letter");
+/**
+* What to do with a name Key Vault cannot store.
+*
+* Key Vault secret names are `^[0-9a-zA-Z-]+$` — **no underscores** — and
+* `DATABASE_URL` is what a secret is actually called nearly everywhere. So this
+* is not an edge case to fail on: it is the common case, and a connector that
+* rejected it would push nothing at all.
+*
+* - `dash` — `_` becomes `-`, so `DATABASE_URL` is stored as `DATABASE-URL`.
+*   The default, and what every other tool bridging this gap does. The rename
+*   is visible: the dashboard and the run ledger both show it.
+* - `reject` — fail each such name instead, for an operator who would rather
+*   name every secret explicitly with the binding's `rename` than have seekrit
+*   choose. Nothing is renamed silently under either setting; this one just
+*   refuses rather than translating.
+*
+* Translating can make two seekrit names collide (`A_B` and `A-B` both give
+* `A-B`). That is caught per run and fails *both* names rather than letting
+* whichever sorts last win — the same rule, and the same reasoning, as
+* {@link mapSecretNames}.
+*/
+const AZURE_KEY_VAULT_NAME_MODES = ["dash", "reject"];
+/**
+* Which vault a binding writes to, and under what names.
+*
+* There is no layout choice as Secrets Manager has: the reason a `json-bundle`
+* exists there is billing — AWS charges per secret per month — and Key Vault
+* charges per *operation*, so fifty names cost the same stored fifty ways. One
+* secret per name is simply correct here.
+*/
+const azureKeyVaultDestinationSchema = z.object({
+	provider: z.literal("azure-key-vault"),
+	/** Vault name, e.g. `acme-prod` for `acme-prod.vault.azure.net`. */
+	vault: azureVaultNameSchema,
+	/**
+	* Prepended to every secret name, e.g. `storefront-`. Key Vault has no
+	* hierarchy — its names are flat, and `/` is not among the characters it
+	* accepts — so unlike Parameter Store's `path` this is a naming convention
+	* and nothing more. Worth setting in a vault that holds anything else.
+	*/
+	prefix: z.string().trim().max(64).regex(/^[A-Za-z0-9-]*$/, "may contain letters, digits, and hyphens").optional(),
+	/** What to do with a name Key Vault cannot store — see {@link AZURE_KEY_VAULT_NAME_MODES}. */
+	nameMode: z.enum(AZURE_KEY_VAULT_NAME_MODES).default("dash")
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -3588,7 +3697,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
 	gcpSecretManagerDestinationSchema,
-	langgraphPlatformDestinationSchema
+	langgraphPlatformDestinationSchema,
+	azureKeyVaultDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -4876,7 +4986,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "0.46.0";
+var version = "0.47.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -12271,8 +12381,21 @@ function credentialNoun(provider) {
 	if (provider.startsWith("aws-")) return "secret access key";
 	if (provider === "gcp-secret-manager") return "service-account key JSON";
 	if (provider === "langgraph-platform") return "LangSmith API key";
+	if (provider === "azure-key-vault") return "client secret";
 	return "API token";
 }
+/**
+* Entra takes a verified domain name in place of a tenant id, but never in
+* place of a client id — so both are held to the GUID, which keeps one rule
+* and costs nothing: the admin center shows a tenant's GUID on the same page
+* as the application id it pairs with.
+*/
+function assertAzureGuid(value, flag, what) {
+	if (!value) fail(`${flag} is required for azure-key-vault (${what})`);
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} "${id}" is not a GUID — the Entra admin center shows it under ${what}`);
+	return id;
+}
 /** Account-scope config for a connection (never the credential itself). */
 function buildConfig(provider, options) {
 	switch (provider) {
@@ -12338,6 +12461,15 @@ function buildConfig(provider, options) {
 				...options.langgraphTenant ? { tenantId: options.langgraphTenant.trim() } : {}
 			};
 		}
+		case "azure-key-vault": {
+			const cloud = assertMembers(list(options.azureCloud, "public"), AZURE_CLOUDS, "--azure-cloud")[0];
+			return {
+				provider: "azure-key-vault",
+				tenantId: assertAzureGuid(options.azureTenantId, "--azure-tenant-id", "Directory (tenant) ID"),
+				clientId: assertAzureGuid(options.azureClientId, "--azure-client-id", "Application (client) ID"),
+				cloud: cloud ?? "public"
+			};
+		}
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -12540,6 +12672,17 @@ function buildDestination(provider, options) {
 			provider: "langgraph-platform",
 			deploymentId: assertLanggraphDeploymentId(options.langgraphDeployment)
 		};
+		case "azure-key-vault": {
+			if (!options.vault) fail("--vault is required for azure-key-vault — the vault name, e.g. acme-prod");
+			const prefix = options.path?.trim();
+			const nameMode = assertMembers(list(options.nameMode, "dash"), AZURE_KEY_VAULT_NAME_MODES, "--name-mode")[0];
+			return {
+				provider: "azure-key-vault",
+				vault: options.vault.trim(),
+				...prefix ? { prefix } : {},
+				nameMode: nameMode ?? "dash"
+			};
+		}
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -12561,6 +12704,7 @@ function describeDestination(destination) {
 		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
 		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
 		case "langgraph-platform": return `deployment ${destination.deploymentId}`;
+		case "azure-key-vault": return `${destination.vault}${destination.prefix ? ` (${destination.prefix}*)` : ""}`;
 		case "github-actions": switch (destination.kind) {
 			case "repo": return `${destination.owner}/${destination.repo}`;
 			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
@@ -12576,7 +12720,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager, azure-key-vault: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version").option("--vault <name>", "azure-key-vault: vault name, e.g. acme-prod").option("--name-mode <mode>", `azure-key-vault: ${AZURE_KEY_VAULT_NAME_MODES.join(" | ")} — Key Vault stores no underscores, so DATABASE_URL becomes DATABASE-URL unless you reject instead`);
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -12600,7 +12744,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--azure-tenant-id <id>", "azure-key-vault: Entra Directory (tenant) ID, a GUID").option("--azure-client-id <id>", "azure-key-vault: Application (client) ID of the service principal, a GUID (its client secret is read from stdin)").option("--azure-cloud <cloud>", `azure-key-vault: ${AZURE_CLOUDS.join(" | ")}`, "public").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -29,8 +29,8 @@
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/core": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",