@vaultic-dev/cli 0.1.0 → 0.1.2

package/README.md

@@ -0,0 +1,63 @@
+# @vaultic-dev/cli
+
+Command-line client for [Vaultic](https://github.com/vaultic-dev/vaultic) — encrypted,
+versioned secrets management with environment inheritance, rotation, and audit logging. This
+package installs the `vaultic` binary; it talks to a Vaultic server over the REST API and never
+handles crypto itself beyond decrypting values already fetched over the wire.
+
+## Install
+
+```bash
+npm install -g @vaultic-dev/cli
+vaultic --help
+```
+
+Requires Node.js >= 20. You'll also need a Vaultic server to talk to — either your own
+self-hosted instance, or one your team runs (see the
+[main repo README](https://github.com/vaultic-dev/vaultic#readme) for self-hosting instructions).
+
+## Quick start
+
+```bash
+vaultic login                      # opens a browser to approve the login (--no-browser for the
+                                    # email/password prompt, --token to paste one)
+vaultic init                       # interactive: pick/create workspace -> project -> default env
+                                    # writes .vaultic.yaml in the current directory
+
+vaultic secrets set FOO bar        # stored encrypted server-side, versioned
+vaultic secrets list               # masked by default
+vaultic secrets list --reveal      # explicit reveal, audited separately from list/read
+
+vaultic run -- printenv FOO        # injects secrets as env vars into the subprocess -> "bar"
+vaultic export                     # writes .env (dotenv format) with a checksum header
+vaultic status                     # compares local .env vs the server
+vaultic sync                       # pulls latest values, regenerates .env, runs post_sync hook
+```
+
+By default, `vaultic --server <url>` (or the `VAULTIC_API_URL` env var) points at your server;
+otherwise it defaults to `http://localhost:4000`.
+
+## Command reference
+
+| Group | Commands |
+|---|---|
+| Auth | `login`, `logout`, `whoami` |
+| Project setup | `init` (writes `.vaultic.yaml`) |
+| Secrets | `secrets list/get/set/delete/history/rollback/rename/rotate`, `secrets override set/clear`, `rotation-providers` |
+| Local file sync | `run`, `export`, `import`, `status`, `sync` |
+| Environments | `env list/create/duplicate/diff/promote/lock/unlock/proposals/approve/reject` |
+| Workspace | `workspace invite/invites/revoke-invite/members/set-role/remove-member/accept-invite` |
+| Access grants | `access grant/list/revoke` |
+| Service tokens | `tokens create/list/revoke` |
+| Sharing | `share <key>` — one-time/limited-view unauthenticated link |
+| Webhooks | `webhooks create/list/delete/deliveries` |
+| Third-party push | `push github`, `push vercel` |
+| Git integration | `git-integration setup/show/remove` — ephemeral preview environments |
+
+Run `vaultic <command> --help` for a command's full options.
+
+## Links
+
+- [Full documentation, deployment guide, and security model](https://github.com/vaultic-dev/vaultic#readme)
+- [Changelog](https://github.com/vaultic-dev/vaultic/blob/main/CHANGELOG.md)
+- [Issues](https://github.com/vaultic-dev/vaultic/issues)

package/dist/index.js

@@ -100,6 +100,11 @@ import { z } from "zod";
 var SECRET_KEY_REGEX = /^[A-Z][A-Z0-9_]*$/;
 var SlugSchema = z.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "must be lowercase alphanumeric with dashes");
 var SecretKeySchema = z.string().min(1).max(256).regex(SECRET_KEY_REGEX, "keys must be UPPER_SNAKE_CASE (e.g. DATABASE_URL)");
+function normalizeTag(tag) {
+  return tag.trim().toLowerCase();
+}
+var TagSchema = z.string().trim().min(1, "tag cannot be empty").max(64, "tag must be 64 characters or fewer").transform(normalizeTag);
+var SecretTagsSchema = z.array(TagSchema).max(50, "a secret can have at most 50 tags").transform((tags) => Array.from(new Set(tags)));
 var RoleSchema = z.enum(["owner", "admin", "developer", "read-only"]);
 var TokenAccessSchema = z.enum(["read", "write"]);
 var SecretTypeHintSchema = z.enum([
@@ -227,7 +232,14 @@ var SecretSummarySchema = z.object({
   /** when this secret's value was last changed — `rotatedAt` if it's ever gone through
    *  `rotate`, otherwise the most recent version's createdAt. Used to compute rotation-due
    *  state (see `isRotationDue`) client-side, in the CLI, and by the scheduled lifecycle job. */
-  lastRotatedAt: z.string().nullable().optional()
+  lastRotatedAt: z.string().nullable().optional(),
+  /** freeform, normalized (lowercase + trim) tags assigned to this secret (spec: "Tags on
+   *  secrets + tag-based search"). Visible to anyone who can see the secret at all — not
+   *  sensitive, same as key names. */
+  tags: z.array(z.string()).optional(),
+  /** number of entries in this secret's comment thread (see SecretComment) — surfaced on the
+   *  row so the comment/mention feature is discoverable without opening the panel first. */
+  commentCount: z.number().int().optional()
 });
 var SecretRevealedSchema = SecretSummarySchema.extend({
   value: z.string()
@@ -259,6 +271,20 @@ var RotateSecretRequestSchema = z.object({
    *  `secrets get KEY --previous`. Omit for no time limit. */
   graceWindow: z.string().optional()
 });
+var ExecuteRotationRequestSchema = z.object({
+  /** rotation provider id, e.g. "postgres" — must be one the server implements */
+  provider: z.string(),
+  /** the secret's current (pre-rotation) resolved value, e.g. a connection string */
+  currentValue: z.string(),
+  /** provider-specific flags, e.g. { role, adminConnString, newPassword } for postgres */
+  options: z.record(z.string().optional()).optional()
+});
+var ExecuteRotationResponseSchema = z.object({
+  /** the new value to store as the secret's next version */
+  newValue: z.string(),
+  /** one-line human-readable description of what was rotated, printed by the CLI */
+  summary: z.string()
+});
 function parseDurationMs(spec) {
   const match = /^(\d+)(s|m|h|d)$/.exec(spec.trim());
   if (!match)
@@ -315,6 +341,38 @@ var AuditLogEntrySchema = z.object({
   ip: z.string().nullable(),
   createdAt: z.string()
 });
+var NotificationSchema = z.object({
+  id: z.string(),
+  type: z.string(),
+  refId: z.string().nullable(),
+  refType: z.string().nullable(),
+  data: z.record(z.string(), z.unknown()).nullable(),
+  read: z.boolean(),
+  readAt: z.string().nullable(),
+  createdAt: z.string()
+});
+var NotificationListResponseSchema = z.object({
+  notifications: z.array(NotificationSchema),
+  unreadCount: z.number()
+});
+var SecretCommentSchema = z.object({
+  id: z.string(),
+  secretId: z.string(),
+  authorId: z.string().nullable(),
+  authorName: z.string().nullable(),
+  authorEmail: z.string().nullable(),
+  body: z.string(),
+  createdAt: z.string(),
+  /** null until the comment has been edited at least once */
+  editedAt: z.string().nullable()
+});
+var SecretCommentBodySchema = z.string().trim().min(1, "comment cannot be empty").max(4e3, "comment must be 4000 characters or fewer");
+var CreateSecretCommentRequestSchema = z.object({
+  body: SecretCommentBodySchema
+});
+var UpdateSecretCommentRequestSchema = z.object({
+  body: SecretCommentBodySchema
+});
 var RegisterRequestSchema = z.object({
   email: z.string().email(),
   password: z.string().min(8),
@@ -377,11 +435,17 @@ var SetSecretRequestSchema = z.object({
   expiresAt: z.string().datetime().nullable().optional(),
   /** omit to leave unchanged, null to clear, a positive integer (days) to set (see
    *  "Rotation reminders" in the spec) */
-  rotationReminderIntervalDays: z.number().int().positive().nullable().optional()
+  rotationReminderIntervalDays: z.number().int().positive().nullable().optional(),
+  /** omit to leave tags unchanged, an array (possibly empty, to clear all tags) to replace
+   *  the full tag set — normalized/deduped by SecretTagsSchema (see "Tags on secrets"). */
+  tags: SecretTagsSchema.optional()
 });
 var UpdateSecretMetadataRequestSchema = z.object({
   expiresAt: z.string().datetime().nullable().optional(),
-  rotationReminderIntervalDays: z.number().int().positive().nullable().optional()
+  rotationReminderIntervalDays: z.number().int().positive().nullable().optional(),
+  /** omit to leave tags unchanged, an array (possibly empty, to clear all tags) to replace
+   *  the full tag set. */
+  tags: SecretTagsSchema.optional()
 });
 var RenameSecretRequestSchema = z.object({
   newKey: SecretKeySchema
@@ -558,6 +622,20 @@ var SecretsHealthSchema = z.object({
   expiredReminders: z.array(ExpiredReminderSchema),
   inactiveConfigs: z.array(InactiveConfigSchema)
 });
+var DuplicateValueMemberSchema = SecretsHealthLocationSchema.extend({
+  key: z.string()
+});
+var DuplicateValueGroupSchema = z.object({
+  count: z.number().int(),
+  members: z.array(DuplicateValueMemberSchema)
+});
+var DuplicateValuesResponseSchema = z.object({
+  groups: z.array(DuplicateValueGroupSchema),
+  /** true if at least one visible secret's current version hasn't been HMAC-indexed yet
+   *  (null valueHmac) — e.g. a version written before this feature existed. Lets the UI show
+   *  a "results may be incomplete" notice instead of silently under-reporting duplicates. */
+  incomplete: z.boolean()
+});
 
 // src/lib/project-config.ts
 var CONFIG_FILE = ".vaultic.yaml";
@@ -724,6 +802,88 @@ function exitCancelled() {
 
 // src/commands/auth.ts
 import prompts2 from "prompts";
+
+// src/lib/browser-login.ts
+import { createServer } from "http";
+import { randomBytes } from "crypto";
+import { spawn } from "child_process";
+function openInBrowser(url) {
+  try {
+    const platform = process.platform;
+    const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", '""', url]] : ["xdg-open", [url]];
+    spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+  } catch {
+  }
+}
+var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+async function browserLogin(opts) {
+  const { serverUrl, timeoutMs = DEFAULT_TIMEOUT_MS, onUrl } = opts;
+  const providers = await fetch(`${serverUrl}/auth/providers`).then((res) => res.ok ? res.json() : null).catch(() => null);
+  const webAppUrl = providers?.webAppUrl;
+  if (!webAppUrl) {
+    throw new Error(
+      "This server doesn't support browser login (no webAppUrl from /auth/providers) -- use --email/--password or --token instead."
+    );
+  }
+  const state = randomBytes(24).toString("hex");
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const timeout = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      server.close();
+      reject(new Error("Timed out waiting for browser login approval."));
+    }, timeoutMs);
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const returnedState = url.searchParams.get("state");
+      const code = url.searchParams.get("code");
+      const finish = (err, result) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timeout);
+        server.close();
+        if (err) reject(err);
+        else resolve(result);
+      };
+      if (returnedState !== state || !code) {
+        res.writeHead(400, { "content-type": "text/html" }).end("<h1>Invalid login attempt.</h1>You can close this tab.");
+        finish(new Error("Received an invalid or mismatched login callback."));
+        return;
+      }
+      fetch(`${serverUrl}/auth/cli/exchange`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code })
+      }).then(async (exchangeRes) => {
+        const data = await exchangeRes.json();
+        if (!exchangeRes.ok) throw new Error(data?.error ?? "Login failed");
+        res.writeHead(200, { "content-type": "text/html" }).end("<h1>Logged in!</h1>You can close this tab and return to your terminal.");
+        finish(null, data);
+      }).catch((err) => {
+        res.writeHead(500, { "content-type": "text/html" }).end("<h1>Login failed.</h1>You can close this tab.");
+        finish(err instanceof Error ? err : new Error(String(err)));
+      });
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      const loginUrl = `${webAppUrl}/cli-login?state=${state}&port=${port}`;
+      if (onUrl) {
+        onUrl(loginUrl);
+      } else {
+        console.log(`Opening ${loginUrl} in your browser\u2026`);
+        console.log("Waiting for you to approve the login (Ctrl+C to cancel)\u2026");
+        openInBrowser(loginUrl);
+      }
+    });
+  });
+}
+
+// src/commands/auth.ts
 async function loginCommand(opts) {
   const serverUrl = opts.server ?? process.env.VAULTIC_API_URL ?? DEFAULT_SERVER_URL;
   if (opts.token) {
@@ -731,6 +891,12 @@ async function loginCommand(opts) {
     console.log(`Saved credentials for ${serverUrl}`);
     return;
   }
+  if (!opts.email && !opts.password && opts.browser !== false) {
+    const res = await browserLogin({ serverUrl });
+    saveCredentials({ serverUrl, token: res.token, email: res.user.email });
+    console.log(`Logged in as ${res.user.email}`);
+    return;
+  }
   const email = opts.email ?? (await prompts2({ type: "text", name: "email", message: "Email" })).email;
   const password = opts.password ?? (await prompts2({ type: "password", name: "password", message: "Password" })).password;
   if (!email || !password) {
@@ -766,7 +932,7 @@ async function whoamiCommand() {
     console.log("Not logged in.");
     return;
   }
-  if (creds.token.startsWith("vlt_")) {
+  if (creds.token.startsWith("sht_")) {
     console.log(`Authenticated with a service token against ${creds.serverUrl}`);
     return;
   }
@@ -776,7 +942,7 @@ async function whoamiCommand() {
 }
 
 // src/commands/run.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 
 // src/lib/context.ts
 function envBase(cfg, env2) {
@@ -802,7 +968,7 @@ async function runCommand(commandParts, opts) {
   const fetchSecrets = () => api.get(`${envBase(cfg, env2)}/export`);
   if (!opts.watch) {
     const secrets2 = await fetchSecrets();
-    const child2 = spawn(cmd, args, { stdio: "inherit", env: { ...process.env, ...secrets2 } });
+    const child2 = spawn2(cmd, args, { stdio: "inherit", env: { ...process.env, ...secrets2 } });
     child2.on("exit", (code, signal) => {
       if (signal) process.kill(process.pid, signal);
       else process.exit(code ?? 0);
@@ -819,7 +985,7 @@ async function runCommand(commandParts, opts) {
   let stopped = false;
   let restarting = false;
   function spawnChild() {
-    child = spawn(cmd, args, { stdio: "inherit", env: { ...process.env, ...current } });
+    child = spawn2(cmd, args, { stdio: "inherit", env: { ...process.env, ...current } });
     child.on("exit", (code, signal) => {
       if (stopped || restarting) return;
       stopped = true;
@@ -1094,89 +1260,23 @@ async function syncCommand(opts) {
 import readline from "readline";
 
 // src/rotation/postgres.ts
-import { randomBytes } from "crypto";
-import { Client } from "pg";
-var ROLE_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function generatePassword(bytes = 24) {
-  return randomBytes(bytes).toString("base64url");
-}
-function sqlLiteral(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
 var postgresRotationPlugin = {
   name: "postgres",
   describe() {
-    return "Rotates a PostgreSQL role's password via `ALTER ROLE ... WITH PASSWORD ...`. Treats the secret's current value as a postgres://user:password@host:port/db connection string. Options: --role <name> (defaults to the connection string's user), --admin-conn-string <url> (connect with different credentials than the value being rotated, e.g. a superuser, when the target role can't alter its own password), --new-password <value> (defaults to a random 32-character password).";
+    return "Rotates a PostgreSQL role's password via `ALTER ROLE ... WITH PASSWORD ...`, executed server-side (the CLI never connects to the database directly). Treats the secret's current value as a postgres://user:password@host:port/db connection string. Options: --role <name> (defaults to the connection string's user), --admin-conn-string <url> (connect with different credentials than the value being rotated, e.g. a superuser, when the target role can't alter its own password), --new-password <value> (defaults to a random 32-character password).";
   },
   async rotate(ctx) {
-    let targetUrl;
-    try {
-      targetUrl = new URL(ctx.currentValue);
-    } catch {
-      throw new Error(
-        `Current value for "${ctx.key}" isn't a valid URL \u2014 expected a postgres://user:password@host:port/db connection string.`
-      );
-    }
-    if (targetUrl.protocol !== "postgres:" && targetUrl.protocol !== "postgresql:") {
-      throw new Error(
-        `Current value for "${ctx.key}" has scheme "${targetUrl.protocol}", expected postgres:// or postgresql://.`
-      );
-    }
-    const role = ctx.options.role ?? decodeURIComponent(targetUrl.username);
-    if (!role) throw new Error(`Could not determine the role to rotate for "${ctx.key}"; pass --role explicitly.`);
-    if (!ROLE_NAME_REGEX.test(role)) {
-      throw new Error(`Refusing to rotate role "${role}": expected [A-Za-z_][A-Za-z0-9_]* (use --role to override).`);
-    }
-    const connectionString = ctx.options.adminConnString ?? ctx.currentValue;
-    const newPassword = ctx.options.newPassword ?? generatePassword();
-    const client = new Client({ connectionString });
-    await client.connect();
-    try {
-      await client.query(`ALTER ROLE "${role}" WITH PASSWORD ${sqlLiteral(newPassword)}`);
-    } finally {
-      await client.end();
-    }
-    const newUrl = new URL(targetUrl.toString());
-    newUrl.password = newPassword;
-    return {
-      newValue: newUrl.toString(),
-      summary: `Rotated PostgreSQL role "${role}"'s password (ALTER ROLE) on ${targetUrl.hostname}:${targetUrl.port || "5432"}/${targetUrl.pathname.replace(/^\//, "")}`
-    };
-  }
-};
-
-// src/rotation/types.ts
-var RotationNotImplementedError = class extends Error {
-};
-
-// src/rotation/stripe.ts
-var stripeRotationPlugin = {
-  name: "stripe",
-  describe() {
-    return "STUB \u2014 not exercised against a live Stripe account in this environment. Documents the interface for restricted-key rotation (create new key with same scopes, store it, revoke the old one after the grace window). See packages/cli/src/rotation/stripe.ts for what a real implementation needs.";
-  },
-  async rotate() {
-    throw new RotationNotImplementedError(
-      "The stripe rotation plugin is a documented stub (no Stripe credentials available in this environment to build/verify a real integration) \u2014 see `packages/cli/src/rotation/stripe.ts`."
-    );
-  }
-};
-
-// src/rotation/aws.ts
-var awsIamRotationPlugin = {
-  name: "aws-iam",
-  describe() {
-    return "STUB \u2014 not exercised against a live AWS account in this environment. Documents the interface for IAM access-key rotation (CreateAccessKey for a new key while the old one stays active, then deactivate/delete the old key after the grace window). See packages/cli/src/rotation/aws.ts for what a real implementation needs.";
-  },
-  async rotate() {
-    throw new RotationNotImplementedError(
-      "The aws-iam rotation plugin is a documented stub (no AWS credentials available in this environment to build/verify a real integration) \u2014 see `packages/cli/src/rotation/aws.ts`."
-    );
+    const response = await ctx.api.post(`${ctx.envBase}/secrets/${ctx.key}/rotate/execute`, {
+      provider: "postgres",
+      currentValue: ctx.currentValue,
+      options: ctx.options
+    });
+    return { newValue: response.newValue, summary: response.summary };
   }
 };
 
 // src/rotation/index.ts
-var PLUGINS = [postgresRotationPlugin, stripeRotationPlugin, awsIamRotationPlugin];
+var PLUGINS = [postgresRotationPlugin];
 function getRotationPlugin(name) {
   const plugin = PLUGINS.find((p) => p.name === name);
   if (!plugin) {
@@ -1294,7 +1394,9 @@ async function secretsRotateCommand(key, value, opts) {
     const result = await plugin.rotate({
       key,
       currentValue: current.value,
-      options: { role: opts.role, adminConnString: opts.adminConnString, newPassword: opts.newPassword }
+      options: { role: opts.role, adminConnString: opts.adminConnString, newPassword: opts.newPassword },
+      api,
+      envBase: envBase(cfg, env2)
     });
     console.log(result.summary);
     resolvedValue = result.newValue;
@@ -1956,7 +2058,7 @@ async function gitIntegrationRemoveCommand() {
 var program = new Command();
 program.name("vaultic").description("Vaultic CLI").version("0.1.0");
 program.command("init").description("Initialize this directory as a Vaultic project (writes .vaultic.yaml)").action(wrap(initCommand));
-program.command("login").description("Log in with email/password, or paste a token with --token").option("--token <token>", "paste a session or service token instead of logging in interactively").option("--server <url>", "Vaultic server URL").option("--email <email>", "email (non-interactive)").option("--password <password>", "password (non-interactive)").action(wrap(loginCommand));
+program.command("login").description("Log in via your browser (default), with email/password, or by pasting a token with --token").option("--token <token>", "paste a session or service token instead of logging in interactively").option("--server <url>", "Vaultic server URL").option("--email <email>", "email (non-interactive; skips the browser flow)").option("--password <password>", "password (non-interactive; skips the browser flow)").option("--no-browser", "skip opening a browser; prompt for email/password instead").action(wrap(loginCommand));
 program.command("logout").description("Clear stored credentials").action(wrap(logoutCommand));
 program.command("whoami").description("Show the current logged-in user").action(wrap(whoamiCommand));
 program.command("run").description("Inject secrets as env vars and run a command").option("-e, --env <environment>", "environment to use").option("--watch", "poll for secret changes and restart the subprocess when they change").option("--poll-interval <ms>", "watch poll interval in milliseconds (default 2000)").allowUnknownOption().argument("<command...>", "command to run, after --").action(wrap((commandParts, opts) => runCommand(commandParts, opts)));
@@ -1972,7 +2074,7 @@ secrets.command("delete").argument("<key>").option("-e, --env <environment>").ac
 secrets.command("history").argument("<key>").option("-e, --env <environment>").option("--reveal").action(wrap(secretsHistoryCommand));
 secrets.command("rollback").argument("<key>").requiredOption("--version <version>").option("-e, --env <environment>").action(wrap(secretsRollbackCommand));
 secrets.command("rename").argument("<oldKey>").argument("<newKey>").option("-e, --env <environment>").action(wrap(secretsRenameCommand));
-secrets.command("rotate").description("Set a new value, keeping the old one fetchable via 'secrets get KEY --previous'").argument("<key>").argument("[value]", "new value, or '-' to read from stdin (omit entirely when using --provider)").option("-e, --env <environment>").option("--from-file <path>", "read the new value from a file").option("--grace <duration>", 'how long the previous value stays fetchable, e.g. "1h", "30m" (omit for no limit)').option("--provider <name>", "have a rotation plugin compute the new value (postgres | stripe | aws-iam)").option("--role <role>", "[postgres] role to rotate (defaults to the connection string's user)").option("--admin-conn-string <url>", "[postgres] connect with different credentials than the value being rotated").option("--new-password <password>", "[postgres] use this password instead of a random one").action(wrap(secretsRotateCommand));
+secrets.command("rotate").description("Set a new value, keeping the old one fetchable via 'secrets get KEY --previous'").argument("<key>").argument("[value]", "new value, or '-' to read from stdin (omit entirely when using --provider)").option("-e, --env <environment>").option("--from-file <path>", "read the new value from a file").option("--grace <duration>", 'how long the previous value stays fetchable, e.g. "1h", "30m" (omit for no limit)').option("--provider <name>", "have a rotation plugin compute the new value (postgres)").option("--role <role>", "[postgres] role to rotate (defaults to the connection string's user)").option("--admin-conn-string <url>", "[postgres] connect with different credentials than the value being rotated").option("--new-password <password>", "[postgres] use this password instead of a random one").action(wrap(secretsRotateCommand));
 program.command("rotation-providers").description("List available `secrets rotate --provider` plugins").action(wrap(rotationProvidersCommand));
 var override = secrets.command("override").description("Manage your personal, server-side value overrides");
 override.command("set").argument("<key>").argument("[value]", "value, or '-' to read from stdin").option("-e, --env <environment>").option("--from-file <path>", "read the value from a file").action(wrap(secretsOverrideSetCommand));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultic-dev/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "type": "module",
   "bin": {
     "vaultic": "./dist/index.js"
@@ -11,6 +11,15 @@
   "engines": {
     "node": ">=20"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vaultic-dev/vaultic.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/vaultic-dev/vaultic#readme",
+  "bugs": {
+    "url": "https://github.com/vaultic-dev/vaultic/issues"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -26,7 +35,6 @@
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
     "libsodium-wrappers": "^0.8.4",
-    "pg": "^8.13.1",
     "prompts": "^2.4.2",
     "zod": "^3.23.8"
   },
@@ -34,7 +42,6 @@
     "@types/js-yaml": "^4.0.9",
     "@types/libsodium-wrappers": "^0.8.2",
     "@types/node": "^22.7.5",
-    "@types/pg": "^8.11.10",
     "@types/prompts": "^2.4.9",
     "tsup": "^8.3.0",
     "tsx": "^4.19.1",