@vaultic-dev/cli 0.1.1 → 0.1.2

package/dist/index.js

@@ -236,7 +236,10 @@ var SecretSummarySchema = z.object({
   /** freeform, normalized (lowercase + trim) tags assigned to this secret (spec: "Tags on
    *  secrets + tag-based search"). Visible to anyone who can see the secret at all — not
    *  sensitive, same as key names. */
-  tags: z.array(z.string()).optional()
+  tags: z.array(z.string()).optional(),
+  /** number of entries in this secret's comment thread (see SecretComment) — surfaced on the
+   *  row so the comment/mention feature is discoverable without opening the panel first. */
+  commentCount: z.number().int().optional()
 });
 var SecretRevealedSchema = SecretSummarySchema.extend({
   value: z.string()
@@ -268,6 +271,20 @@ var RotateSecretRequestSchema = z.object({
    *  `secrets get KEY --previous`. Omit for no time limit. */
   graceWindow: z.string().optional()
 });
+var ExecuteRotationRequestSchema = z.object({
+  /** rotation provider id, e.g. "postgres" — must be one the server implements */
+  provider: z.string(),
+  /** the secret's current (pre-rotation) resolved value, e.g. a connection string */
+  currentValue: z.string(),
+  /** provider-specific flags, e.g. { role, adminConnString, newPassword } for postgres */
+  options: z.record(z.string().optional()).optional()
+});
+var ExecuteRotationResponseSchema = z.object({
+  /** the new value to store as the secret's next version */
+  newValue: z.string(),
+  /** one-line human-readable description of what was rotated, printed by the CLI */
+  summary: z.string()
+});
 function parseDurationMs(spec) {
   const match = /^(\d+)(s|m|h|d)$/.exec(spec.trim());
   if (!match)
@@ -1243,89 +1260,23 @@ async function syncCommand(opts) {
 import readline from "readline";
 
 // src/rotation/postgres.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { Client } from "pg";
-var ROLE_NAME_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function generatePassword(bytes = 24) {
-  return randomBytes2(bytes).toString("base64url");
-}
-function sqlLiteral(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
 var postgresRotationPlugin = {
   name: "postgres",
   describe() {
-    return "Rotates a PostgreSQL role's password via `ALTER ROLE ... WITH PASSWORD ...`. Treats the secret's current value as a postgres://user:password@host:port/db connection string. Options: --role <name> (defaults to the connection string's user), --admin-conn-string <url> (connect with different credentials than the value being rotated, e.g. a superuser, when the target role can't alter its own password), --new-password <value> (defaults to a random 32-character password).";
+    return "Rotates a PostgreSQL role's password via `ALTER ROLE ... WITH PASSWORD ...`, executed server-side (the CLI never connects to the database directly). Treats the secret's current value as a postgres://user:password@host:port/db connection string. Options: --role <name> (defaults to the connection string's user), --admin-conn-string <url> (connect with different credentials than the value being rotated, e.g. a superuser, when the target role can't alter its own password), --new-password <value> (defaults to a random 32-character password).";
   },
   async rotate(ctx) {
-    let targetUrl;
-    try {
-      targetUrl = new URL(ctx.currentValue);
-    } catch {
-      throw new Error(
-        `Current value for "${ctx.key}" isn't a valid URL \u2014 expected a postgres://user:password@host:port/db connection string.`
-      );
-    }
-    if (targetUrl.protocol !== "postgres:" && targetUrl.protocol !== "postgresql:") {
-      throw new Error(
-        `Current value for "${ctx.key}" has scheme "${targetUrl.protocol}", expected postgres:// or postgresql://.`
-      );
-    }
-    const role = ctx.options.role ?? decodeURIComponent(targetUrl.username);
-    if (!role) throw new Error(`Could not determine the role to rotate for "${ctx.key}"; pass --role explicitly.`);
-    if (!ROLE_NAME_REGEX.test(role)) {
-      throw new Error(`Refusing to rotate role "${role}": expected [A-Za-z_][A-Za-z0-9_]* (use --role to override).`);
-    }
-    const connectionString = ctx.options.adminConnString ?? ctx.currentValue;
-    const newPassword = ctx.options.newPassword ?? generatePassword();
-    const client = new Client({ connectionString });
-    await client.connect();
-    try {
-      await client.query(`ALTER ROLE "${role}" WITH PASSWORD ${sqlLiteral(newPassword)}`);
-    } finally {
-      await client.end();
-    }
-    const newUrl = new URL(targetUrl.toString());
-    newUrl.password = newPassword;
-    return {
-      newValue: newUrl.toString(),
-      summary: `Rotated PostgreSQL role "${role}"'s password (ALTER ROLE) on ${targetUrl.hostname}:${targetUrl.port || "5432"}/${targetUrl.pathname.replace(/^\//, "")}`
-    };
-  }
-};
-
-// src/rotation/types.ts
-var RotationNotImplementedError = class extends Error {
-};
-
-// src/rotation/stripe.ts
-var stripeRotationPlugin = {
-  name: "stripe",
-  describe() {
-    return "STUB \u2014 not exercised against a live Stripe account in this environment. Documents the interface for restricted-key rotation (create new key with same scopes, store it, revoke the old one after the grace window). See packages/cli/src/rotation/stripe.ts for what a real implementation needs.";
-  },
-  async rotate() {
-    throw new RotationNotImplementedError(
-      "The stripe rotation plugin is a documented stub (no Stripe credentials available in this environment to build/verify a real integration) \u2014 see `packages/cli/src/rotation/stripe.ts`."
-    );
-  }
-};
-
-// src/rotation/aws.ts
-var awsIamRotationPlugin = {
-  name: "aws-iam",
-  describe() {
-    return "STUB \u2014 not exercised against a live AWS account in this environment. Documents the interface for IAM access-key rotation (CreateAccessKey for a new key while the old one stays active, then deactivate/delete the old key after the grace window). See packages/cli/src/rotation/aws.ts for what a real implementation needs.";
-  },
-  async rotate() {
-    throw new RotationNotImplementedError(
-      "The aws-iam rotation plugin is a documented stub (no AWS credentials available in this environment to build/verify a real integration) \u2014 see `packages/cli/src/rotation/aws.ts`."
-    );
+    const response = await ctx.api.post(`${ctx.envBase}/secrets/${ctx.key}/rotate/execute`, {
+      provider: "postgres",
+      currentValue: ctx.currentValue,
+      options: ctx.options
+    });
+    return { newValue: response.newValue, summary: response.summary };
   }
 };
 
 // src/rotation/index.ts
-var PLUGINS = [postgresRotationPlugin, stripeRotationPlugin, awsIamRotationPlugin];
+var PLUGINS = [postgresRotationPlugin];
 function getRotationPlugin(name) {
   const plugin = PLUGINS.find((p) => p.name === name);
   if (!plugin) {
@@ -1443,7 +1394,9 @@ async function secretsRotateCommand(key, value, opts) {
     const result = await plugin.rotate({
       key,
       currentValue: current.value,
-      options: { role: opts.role, adminConnString: opts.adminConnString, newPassword: opts.newPassword }
+      options: { role: opts.role, adminConnString: opts.adminConnString, newPassword: opts.newPassword },
+      api,
+      envBase: envBase(cfg, env2)
     });
     console.log(result.summary);
     resolvedValue = result.newValue;
@@ -2121,7 +2074,7 @@ secrets.command("delete").argument("<key>").option("-e, --env <environment>").ac
 secrets.command("history").argument("<key>").option("-e, --env <environment>").option("--reveal").action(wrap(secretsHistoryCommand));
 secrets.command("rollback").argument("<key>").requiredOption("--version <version>").option("-e, --env <environment>").action(wrap(secretsRollbackCommand));
 secrets.command("rename").argument("<oldKey>").argument("<newKey>").option("-e, --env <environment>").action(wrap(secretsRenameCommand));
-secrets.command("rotate").description("Set a new value, keeping the old one fetchable via 'secrets get KEY --previous'").argument("<key>").argument("[value]", "new value, or '-' to read from stdin (omit entirely when using --provider)").option("-e, --env <environment>").option("--from-file <path>", "read the new value from a file").option("--grace <duration>", 'how long the previous value stays fetchable, e.g. "1h", "30m" (omit for no limit)').option("--provider <name>", "have a rotation plugin compute the new value (postgres | stripe | aws-iam)").option("--role <role>", "[postgres] role to rotate (defaults to the connection string's user)").option("--admin-conn-string <url>", "[postgres] connect with different credentials than the value being rotated").option("--new-password <password>", "[postgres] use this password instead of a random one").action(wrap(secretsRotateCommand));
+secrets.command("rotate").description("Set a new value, keeping the old one fetchable via 'secrets get KEY --previous'").argument("<key>").argument("[value]", "new value, or '-' to read from stdin (omit entirely when using --provider)").option("-e, --env <environment>").option("--from-file <path>", "read the new value from a file").option("--grace <duration>", 'how long the previous value stays fetchable, e.g. "1h", "30m" (omit for no limit)').option("--provider <name>", "have a rotation plugin compute the new value (postgres)").option("--role <role>", "[postgres] role to rotate (defaults to the connection string's user)").option("--admin-conn-string <url>", "[postgres] connect with different credentials than the value being rotated").option("--new-password <password>", "[postgres] use this password instead of a random one").action(wrap(secretsRotateCommand));
 program.command("rotation-providers").description("List available `secrets rotate --provider` plugins").action(wrap(rotationProvidersCommand));
 var override = secrets.command("override").description("Manage your personal, server-side value overrides");
 override.command("set").argument("<key>").argument("[value]", "value, or '-' to read from stdin").option("-e, --env <environment>").option("--from-file <path>", "read the value from a file").action(wrap(secretsOverrideSetCommand));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultic-dev/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "bin": {
     "vaultic": "./dist/index.js"
@@ -11,6 +11,15 @@
   "engines": {
     "node": ">=20"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vaultic-dev/vaultic.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://github.com/vaultic-dev/vaultic#readme",
+  "bugs": {
+    "url": "https://github.com/vaultic-dev/vaultic/issues"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -26,7 +35,6 @@
     "commander": "^12.1.0",
     "js-yaml": "^4.1.0",
     "libsodium-wrappers": "^0.8.4",
-    "pg": "^8.13.1",
     "prompts": "^2.4.2",
     "zod": "^3.23.8"
   },
@@ -34,7 +42,6 @@
     "@types/js-yaml": "^4.0.9",
     "@types/libsodium-wrappers": "^0.8.2",
     "@types/node": "^22.7.5",
-    "@types/pg": "^8.11.10",
     "@types/prompts": "^2.4.9",
     "tsup": "^8.3.0",
     "tsx": "^4.19.1",