@vectros-ai/cli 0.13.0 → 0.14.0

package/AUTHORING.md

@@ -78,7 +78,11 @@ A name must be 2–50 chars: a lowercase letter, then lowercase letters / digits
 ```
 
 `bootstrap` shows the same plan and asks for confirmation before minting
-(`--yes` skips the prompt for CI/agents; `--print` previews without minting).
+(`--yes` skips the prompt for CI/agents). ⚠️ **`--no-merge` is NOT a dry run** — it still
+mints/reconciles for real; it only changes where the resulting credential goes, printing the MCP
+config snippet to stdout instead of merging it into your client's config file. To preview without
+touching your account, stop at `blueprint plan` (offline) — `bootstrap`, with or without `--no-merge`,
+always applies.
 
 **Provisioning a production context — `--no-seed`.** A blueprint's `seed`
 records are illustrative sample data: handy for a getting-started or demo
@@ -120,7 +124,10 @@ contextId: mcp          # 3-31 chars, lowercase-start. The app-context the key b
 schemas:
   - typeName: thing   # immutable after first apply
     displayName: Thing
-    indexMode: HYBRID    # HYBRID (default) | SEMANTIC | TEXT
+    indexMode: HYBRID    # HYBRID | SEMANTIC | TEXT | NONE (store-only).
+                         # Omitting it does NOT mean HYBRID: a record schema with no
+                         # indexMode resolves to NONE, and a document schema with none
+                         # is rejected. Declare the mode you want.
     fields:
       - fieldId: title
         fieldType: string       # string | number | boolean | date | enum | array | object | reference

package/CHANGELOG.md

@@ -3,6 +3,69 @@
 All notable changes to `@vectros-ai/cli` are documented here.
 This project adheres to [Semantic Versioning](https://semver.org).
 
+## 0.14.0
+
+### Security
+
+- **`bootstrap` no longer stores your minted `ssk_*` in plaintext.** The key
+  goes to this machine's OS credential store (or an encrypted file where none
+  is available); your MCP client config references it by alias only
+  (`VECTROS_KEYRING_ALIAS`), never the raw secret. **Breaking:** a config
+  merged by an older CLI keeps working, but a fresh `bootstrap` run now
+  produces the alias-only shape — if you scripted against the printed
+  snippet's `VECTROS_API_KEY` field, it's `VECTROS_KEYRING_ALIAS` now.
+
+- **`--print` is renamed `--no-merge`, with no back-compat alias.** It was
+  never a dry run — it always applies for real and only changes where the
+  result goes. It still applies; it just skips writing your client's config
+  file. For a true preview, use `blueprint plan`.
+
+### Added
+
+- **`key issue --to-keyring` and `key rotate --to-keyring` store the minted secret
+  instead of printing it.** Until now the mint verbs could only *emit* a key, so on
+  a desktop the only place to put it was the MCP client's config file, in plaintext.
+  `--to-keyring` writes it to this machine's OS credential store where one is in use,
+  and to the encrypted file under `~/.vectros/secrets` otherwise — telling you which
+  of the two took it either way, because only one of them is login-gated. The key is
+  never printed to a terminal, a pipe or a transcript. Anything that resolves a
+  credential through `vectros keyring show --format raw` — the MCP server included
+  — then reads it with no `VECTROS_API_KEY` set anywhere.
+
+  `--alias <name>` names the entry (default: the context id) and `--no-activate`
+  stores it without making it the active identity. Emitting stays the **default**:
+  it is the right behaviour for a headless server, where a secrets manager
+  distributes the key and nothing should persist it locally. The two destinations
+  are mutually exclusive — `--to-keyring` with `--format raw|env|json` is rejected
+  before anything is minted, rather than storing the key and printing it anyway.
+
+  `rotate --to-keyring` proves the store will accept a write *before* it revokes
+  the old key, so a machine that cannot hold a secret fails with your existing
+  credential intact.
+
+### Fixed
+
+- **`bootstrap --plan` no longer claims `HYBRID` for a schema that declares no
+  `indexMode`.** The plan rendered an absent mode as `HYBRID`, but nothing
+  substitutes that default — the value is forwarded untouched, and the platform
+  then resolves an absent mode to `NONE` (store-only, never searchable) on a record
+  schema, and rejects a document schema that declares none. So the plan promised a
+  searchable type and the apply produced a store-only one, or previewed a request
+  the API would refuse. The plan now names the real outcome in both cases.
+
+### Changed
+
+- **A blueprint may now declare `indexMode: NONE`** (store-only: kept and looked up, never
+  searchable). The mode has always been accepted by the platform, and `bootstrap`/`validate`/`plan`
+  rejected it earlier than that — structural validation runs against this CLI's own bundled copy of
+  the blueprint format, which predated the value. That copy now carries it, so a blueprint declaring
+  `NONE` validates and applies. This governs blueprints loaded **from a file** as much as bundled
+  ones: both funnel through the same structural parse.
+
+- **`blueprint init` scaffold and `AUTHORING.md`** document the full `indexMode` set including
+  `NONE`, and warn that omitting the field does not mean `HYBRID` — a record schema with no mode of
+  its own resolves to `NONE`, and a document schema with none is rejected.
+
 ## 0.13.0
 
 ### Added

package/README.md

@@ -115,7 +115,9 @@ The app-context is intentionally **not** deleted (it's idempotent and reused).
 A machine can hold several Vectros identities (one per context or principal).
 The keyring stores them as named entries plus one **active** pointer, so you can
 switch between them without re-issuing keys. `vectros join <context>` adds an
-entry and activates it; `vectros switch <alias>` flips the active one.
+entry and activates it; `vectros key issue`/`key rotate` add one when passed
+`--to-keyring` (which stores the new secret instead of printing it); `vectros switch
+<alias>` flips the active one.
 
 ```bash
 vectros keyring list                 # the entries; * marks the active one