@vaultic-dev/cli 0.1.0 → 0.1.1

package/README.md

@@ -0,0 +1,63 @@
+# @vaultic-dev/cli
+
+Command-line client for [Vaultic](https://github.com/vaultic-dev/vaultic) — encrypted,
+versioned secrets management with environment inheritance, rotation, and audit logging. This
+package installs the `vaultic` binary; it talks to a Vaultic server over the REST API and never
+handles crypto itself beyond decrypting values already fetched over the wire.
+
+## Install
+
+```bash
+npm install -g @vaultic-dev/cli
+vaultic --help
+```
+
+Requires Node.js >= 20. You'll also need a Vaultic server to talk to — either your own
+self-hosted instance, or one your team runs (see the
+[main repo README](https://github.com/vaultic-dev/vaultic#readme) for self-hosting instructions).
+
+## Quick start
+
+```bash
+vaultic login                      # opens a browser to approve the login (--no-browser for the
+                                    # email/password prompt, --token to paste one)
+vaultic init                       # interactive: pick/create workspace -> project -> default env
+                                    # writes .vaultic.yaml in the current directory
+
+vaultic secrets set FOO bar        # stored encrypted server-side, versioned
+vaultic secrets list               # masked by default
+vaultic secrets list --reveal      # explicit reveal, audited separately from list/read
+
+vaultic run -- printenv FOO        # injects secrets as env vars into the subprocess -> "bar"
+vaultic export                     # writes .env (dotenv format) with a checksum header
+vaultic status                     # compares local .env vs the server
+vaultic sync                       # pulls latest values, regenerates .env, runs post_sync hook
+```
+
+By default, `vaultic --server <url>` (or the `VAULTIC_API_URL` env var) points at your server;
+otherwise it defaults to `http://localhost:4000`.
+
+## Command reference
+
+| Group | Commands |
+|---|---|
+| Auth | `login`, `logout`, `whoami` |
+| Project setup | `init` (writes `.vaultic.yaml`) |
+| Secrets | `secrets list/get/set/delete/history/rollback/rename/rotate`, `secrets override set/clear`, `rotation-providers` |
+| Local file sync | `run`, `export`, `import`, `status`, `sync` |
+| Environments | `env list/create/duplicate/diff/promote/lock/unlock/proposals/approve/reject` |
+| Workspace | `workspace invite/invites/revoke-invite/members/set-role/remove-member/accept-invite` |
+| Access grants | `access grant/list/revoke` |
+| Service tokens | `tokens create/list/revoke` |
+| Sharing | `share <key>` — one-time/limited-view unauthenticated link |
+| Webhooks | `webhooks create/list/delete/deliveries` |
+| Third-party push | `push github`, `push vercel` |
+| Git integration | `git-integration setup/show/remove` — ephemeral preview environments |
+
+Run `vaultic <command> --help` for a command's full options.
+
+## Links
+
+- [Full documentation, deployment guide, and security model](https://github.com/vaultic-dev/vaultic#readme)
+- [Changelog](https://github.com/vaultic-dev/vaultic/blob/main/CHANGELOG.md)
+- [Issues](https://github.com/vaultic-dev/vaultic/issues)

package/dist/index.js

@@ -100,6 +100,11 @@ import { z } from "zod";
 var SECRET_KEY_REGEX = /^[A-Z][A-Z0-9_]*$/;
 var SlugSchema = z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric with dashes");
 var SecretKeySchema = z.string().min(1).max(256).regex(SECRET_KEY_REGEX, "keys must be UPPER_SNAKE_CASE (e.g. DATABASE_URL)");
+function normalizeTag(tag) {
+  return tag.trim().toLowerCase();
+}
+var TagSchema = z.string().trim().min(1, "tag cannot be empty").max(64, "tag must be 64 characters or fewer").transform(normalizeTag);
+var SecretTagsSchema = z.array(TagSchema).max(50, "a secret can have at most 50 tags").transform((tags) => Array.from(new Set(tags)));
 var RoleSchema = z.enum(["owner", "admin", "developer", "read-only"]);
 var TokenAccessSchema = z.enum(["read", "write"]);
 var SecretTypeHintSchema = z.enum([
@@ -227,7 +232,11 @@ var SecretSummarySchema = z.object({
   /** when this secret's value was last changed — `rotatedAt` if it's ever gone through
    *  `rotate`, otherwise the most recent version's createdAt. Used to compute rotation-due
    *  state (see `isRotationDue`) client-side, in the CLI, and by the scheduled lifecycle job. */
-  lastRotatedAt: z.string().nullable().optional()
+  lastRotatedAt: z.string().nullable().optional(),
+  /** freeform, normalized (lowercase + trim) tags assigned to this secret (spec: "Tags on
+   *  secrets + tag-based search"). Visible to anyone who can see the secret at all — not
+   *  sensitive, same as key names. */
+  tags: z.array(z.string()).optional()
 });
 var SecretRevealedSchema = SecretSummarySchema.extend({
   value: z.string()
@@ -315,6 +324,38 @@ var AuditLogEntrySchema = z.object({
   ip: z.string().nullable(),
   createdAt: z.string()
 });
+var NotificationSchema = z.object({
+  id: z.string(),
+  type: z.string(),
+  refId: z.string().nullable(),
+  refType: z.string().nullable(),
+  data: z.record(z.string(), z.unknown()).nullable(),
+  read: z.boolean(),
+  readAt: z.string().nullable(),
+  createdAt: z.string()
+});
+var NotificationListResponseSchema = z.object({
+  notifications: z.array(NotificationSchema),
+  unreadCount: z.number()
+});
+var SecretCommentSchema = z.object({
+  id: z.string(),
+  secretId: z.string(),
+  authorId: z.string().nullable(),
+  authorName: z.string().nullable(),
+  authorEmail: z.string().nullable(),
+  body: z.string(),
+  createdAt: z.string(),
+  /** null until the comment has been edited at least once */
+  editedAt: z.string().nullable()
+});
+var SecretCommentBodySchema = z.string().trim().min(1, "comment cannot be empty").max(4e3, "comment must be 4000 characters or fewer");
+var CreateSecretCommentRequestSchema = z.object({
+  body: SecretCommentBodySchema
+});
+var UpdateSecretCommentRequestSchema = z.object({
+  body: SecretCommentBodySchema
+});
 var RegisterRequestSchema = z.object({
   email: z.string().email(),
   password: z.string().min(8),
@@ -377,11 +418,17 @@ var SetSecretRequestSchema = z.object({
   expiresAt: z.string().datetime().nullable().optional(),
   /** omit to leave unchanged, null to clear, a positive integer (days) to set (see
    *  "Rotation reminders" in the spec) */
-  rotationReminderIntervalDays: z.number().int().positive().nullable().optional()
+  rotationReminderIntervalDays: z.number().int().positive().nullable().optional(),
+  /** omit to leave tags unchanged, an array (possibly empty, to clear all tags) to replace
+   *  the full tag set — normalized/deduped by SecretTagsSchema (see "Tags on secrets"). */
+  tags: SecretTagsSchema.optional()
 });
 var UpdateSecretMetadataRequestSchema = z.object({
   expiresAt: z.string().datetime().nullable().optional(),
-  rotationReminderIntervalDays: z.number().int().positive().nullable().optional()
+  rotationReminderIntervalDays: z.number().int().positive().nullable().optional(),
+  /** omit to leave tags unchanged, an array (possibly empty, to clear all tags) to replace
+   *  the full tag set. */
+  tags: SecretTagsSchema.optional()
 });
 var RenameSecretRequestSchema = z.object({
   newKey: SecretKeySchema
@@ -558,6 +605,20 @@ var SecretsHealthSchema = z.object({
   expiredReminders: z.array(ExpiredReminderSchema),
   inactiveConfigs: z.array(InactiveConfigSchema)
 });
+var DuplicateValueMemberSchema = SecretsHealthLocationSchema.extend({
+  key: z.string()
+});
+var DuplicateValueGroupSchema = z.object({
+  count: z.number().int(),
+  members: z.array(DuplicateValueMemberSchema)
+});
+var DuplicateValuesResponseSchema = z.object({
+  groups: z.array(DuplicateValueGroupSchema),
+  /** true if at least one visible secret's current version hasn't been HMAC-indexed yet
+   *  (null valueHmac) — e.g. a version written before this feature existed. Lets the UI show
+   *  a "results may be incomplete" notice instead of silently under-reporting duplicates. */
+  incomplete: z.boolean()
+});
 
 // src/lib/project-config.ts
 var CONFIG_FILE = ".vaultic.yaml";
@@ -724,6 +785,88 @@ function exitCancelled() {
 
 // src/commands/auth.ts
 import prompts2 from "prompts";
+
+// src/lib/browser-login.ts
+import { createServer } from "http";
+import { randomBytes } from "crypto";
+import { spawn } from "child_process";
+function openInBrowser(url) {
+  try {
+    const platform = process.platform;
+    const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", '""', url]] : ["xdg-open", [url]];
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+async function browserLogin(opts) {
+  const { serverUrl, timeoutMs = DEFAULT_TIMEOUT_MS, onUrl } = opts;
+  const providers = await fetch(`${serverUrl}/auth/providers`).then((res) => res.ok ? res.json() : null).catch(() => null);
+  const webAppUrl = providers?.webAppUrl;
+  if (!webAppUrl) {
+    throw new Error(
+      "This server doesn't support browser login (no webAppUrl from /auth/providers) -- use --email/--password or --token instead."
+    );
+  }
+  const state = randomBytes(24).toString("hex");
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const timeout = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      server.close();
+      reject(new Error("Timed out waiting for browser login approval."));
+    }, timeoutMs);
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const returnedState = url.searchParams.get("state");
+      const code = url.searchParams.get("code");
+      const finish = (err, result) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeout);
+        server.close();
+        if (err) reject(err);
+        else resolve(result);
+      };
+      if (returnedState !== state || !code) {
+        res.writeHead(400, { "content-type": "text/html" }).end("<h1>Invalid login attempt.</h1>You can close this tab.");
+        finish(new Error("Received an invalid or mismatched login callback."));
+        return;
+      }
+      fetch(`${serverUrl}/auth/cli/exchange`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code })
+      }).then(async (exchangeRes) => {
+        const data = await exchangeRes.json();
+        if (!exchangeRes.ok) throw new Error(data?.error ?? "Login failed");
+        res.writeHead(200, { "content-type": "text/html" }).end("<h1>Logged in!</h1>You can close this tab and return to your terminal.");
+        finish(null, data);
+      }).catch((err) => {
+        res.writeHead(500, { "content-type": "text/html" }).end("<h1>Login failed.</h1>You can close this tab.");
+        finish(err instanceof Error ? err : new Error(String(err)));
+      });
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      const loginUrl = `${webAppUrl}/cli-login?state=${state}&port=${port}`;
+      if (onUrl) {
+        onUrl(loginUrl);
+      } else {
+        console.log(`Opening ${loginUrl} in your browser\u2026`);
+        console.log("Waiting for you to approve the login (Ctrl+C to cancel)\u2026");
+        openInBrowser(loginUrl);
+      }
+    });
+  });
+}
+
+// src/commands/auth.ts
 async function loginCommand(opts) {
   const serverUrl = opts.server ?? process.env.VAULTIC_API_URL ?? DEFAULT_SERVER_URL;
   if (opts.token) {
@@ -731,6 +874,12 @@ async function loginCommand(opts) {
     console.log(`Saved credentials for ${serverUrl}`);
     return;
   }
+  if (!opts.email && !opts.password && opts.browser !== false) {
+    const res = await browserLogin({ serverUrl });
+    saveCredentials({ serverUrl, token: res.token, email: res.user.email });
+    console.log(`Logged in as ${res.user.email}`);
+    return;
+  }
   const email = opts.email ?? (await prompts2({ type: "text", name: "email", message: "Email" })).email;
   const password = opts.password ?? (await prompts2({ type: "password", name: "password", message: "Password" })).password;
   if (!email || !password) {
@@ -766,7 +915,7 @@ async function whoamiCommand() {
     console.log("Not logged in.");
     return;
   }
-  if (creds.token.startsWith("vlt_")) {
+  if (creds.token.startsWith("sht_")) {
     console.log(`Authenticated with a service token against ${creds.serverUrl}`);
     return;
   }
@@ -776,7 +925,7 @@ async function whoamiCommand() {
 }
 
 // src/commands/run.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/lib/context.ts
 function envBase(cfg, env2) {
@@ -802,7 +951,7 @@ async function runCommand(commandParts, opts) {
   const fetchSecrets = () => api.get(`${envBase(cfg, env2)}/export`);
   if (!opts.watch) {
     const secrets2 = await fetchSecrets();
-    const child2 = spawn(cmd, args, { stdio: "inherit", env: { ...process.env, ...secrets2 } });
+    const child2 = spawn2(cmd, args, { stdio: "inherit", env: { ...process.env, ...secrets2 } });
     child2.on("exit", (code, signal) => {
       if (signal) process.kill(process.pid, signal);
       else process.exit(code ?? 0);
@@ -819,7 +968,7 @@ async function runCommand(commandParts, opts) {
   let stopped = false;
   let restarting = false;
   function spawnChild() {
-    child = spawn(cmd, args, { stdio: "inherit", env: { ...process.env, ...current } });
+    child = spawn2(cmd, args, { stdio: "inherit", env: { ...process.env, ...current } });
     child.on("exit", (code, signal) => {
       if (stopped || restarting) return;
       stopped = true;
@@ -1094,11 +1243,11 @@ async function syncCommand(opts) {
 import readline from "readline";
 
 // src/rotation/postgres.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 import { Client } from "pg";
 var ROLE_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
 function generatePassword(bytes = 24) {
-  return randomBytes(bytes).toString("base64url");
+  return randomBytes2(bytes).toString("base64url");
 }
 function sqlLiteral(value) {
   return `'${value.replace(/'/g, "''")}'`;
@@ -1956,7 +2105,7 @@ async function gitIntegrationRemoveCommand() {
 var program = new Command();
 program.name("vaultic").description("Vaultic CLI").version("0.1.0");
 program.command("init").description("Initialize this directory as a Vaultic project (writes .vaultic.yaml)").action(wrap(initCommand));
-program.command("login").description("Log in with email/password, or paste a token with --token").option("--token <token>", "paste a session or service token instead of logging in interactively").option("--server <url>", "Vaultic server URL").option("--email <email>", "email (non-interactive)").option("--password <password>", "password (non-interactive)").action(wrap(loginCommand));
+program.command("login").description("Log in via your browser (default), with email/password, or by pasting a token with --token").option("--token <token>", "paste a session or service token instead of logging in interactively").option("--server <url>", "Vaultic server URL").option("--email <email>", "email (non-interactive; skips the browser flow)").option("--password <password>", "password (non-interactive; skips the browser flow)").option("--no-browser", "skip opening a browser; prompt for email/password instead").action(wrap(loginCommand));
 program.command("logout").description("Clear stored credentials").action(wrap(logoutCommand));
 program.command("whoami").description("Show the current logged-in user").action(wrap(whoamiCommand));
 program.command("run").description("Inject secrets as env vars and run a command").option("-e, --env <environment>", "environment to use").option("--watch", "poll for secret changes and restart the subprocess when they change").option("--poll-interval <ms>", "watch poll interval in milliseconds (default 2000)").allowUnknownOption().argument("<command...>", "command to run, after --").action(wrap((commandParts, opts) => runCommand(commandParts, opts)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultic-dev/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "bin": {
     "vaultic": "./dist/index.js"