env-secrets 0.5.1 → 0.5.2

package/README.md

@@ -246,6 +246,12 @@ env-secrets aws secret upsert --file .env --name app/dev --output json
 # {"NAME":"secret1"}
 ```
 
+`env-secrets aws secret create` also always stores `SecretString` as a JSON object:
+
+- object JSON input is preserved semantically as an object (formatting and key order may change)
+- dotenv-style input is converted into key/value pairs
+- scalar input is wrapped as `{"value":"..."}`.
+
 12. **Append/remove keys on an existing JSON secret:**
 
 ```bash

package/__e2e__/aws-secret-lifecycle.test.ts

@@ -5,7 +5,8 @@ import * as path from 'path';
 import {
   cliWithEnv,
   cliWithEnvAndStdin,
-  cleanupTempFile
+  cleanupTempFile,
+  execAwslocalCommand
 } from './utils/test-utils';
 import { registerAwsE2eContext } from './utils/aws-e2e-context';
 
@@ -38,6 +39,14 @@ describe('AWS Secret Subcommand Lifecycle Args', () => {
     expect(getResult.stdout).toContain(secretName);
     expect(getResult.stdout).not.toContain('initial-value');
 
+    const createdSecret = await execAwslocalCommand(
+      `awslocal secretsmanager get-secret-value --secret-id "${secretName}" --region us-east-1 --query SecretString --output text`,
+      getLocalStackEnv()
+    );
+    expect(JSON.parse(createdSecret.stdout.trim())).toEqual({
+      value: 'initial-value'
+    });
+
     const deleteResult = await cliWithEnv(
       [
         'aws',
@@ -84,6 +93,39 @@ describe('AWS Secret Subcommand Lifecycle Args', () => {
     expect(deleteResult.code).toBe(0);
   });
 
+  test('should create a json secret object from stdin', async () => {
+    const secretName = `managed-secret-create-stdin-${Date.now()}`;
+
+    const createResult = await cliWithEnvAndStdin(
+      ['aws', 'secret', 'create', '-n', secretName, '--value-stdin'],
+      getLocalStackEnv(),
+      'stdin-create-value'
+    );
+    expect(createResult.code).toBe(0);
+
+    const createdSecret = await execAwslocalCommand(
+      `awslocal secretsmanager get-secret-value --secret-id "${secretName}" --region us-east-1 --query SecretString --output text`,
+      getLocalStackEnv()
+    );
+    expect(JSON.parse(createdSecret.stdout.trim())).toEqual({
+      value: 'stdin-create-value'
+    });
+
+    const deleteResult = await cliWithEnv(
+      [
+        'aws',
+        'secret',
+        'delete',
+        '-n',
+        secretName,
+        '--force-delete-without-recovery',
+        '--yes'
+      ],
+      getLocalStackEnv()
+    );
+    expect(deleteResult.code).toBe(0);
+  });
+
   test('should create from a single-line env file and retrieve via aws -s', async () => {
     const secretName = `managed-secret-create-single-file-${Date.now()}`;
     const tempFile = path.join(
@@ -119,6 +161,14 @@ describe('AWS Secret Subcommand Lifecycle Args', () => {
     >;
     expect(envVars.GITHUB_PAT).toBe('github_pat_single_line');
 
+    const createdSecret = await execAwslocalCommand(
+      `awslocal secretsmanager get-secret-value --secret-id "${secretName}" --region us-east-1 --query SecretString --output text`,
+      getLocalStackEnv()
+    );
+    expect(JSON.parse(createdSecret.stdout.trim())).toEqual({
+      GITHUB_PAT: 'github_pat_single_line'
+    });
+
     const deleteResult = await cliWithEnv(
       [
         'aws',
@@ -176,6 +226,15 @@ describe('AWS Secret Subcommand Lifecycle Args', () => {
     expect(envVars.GITHUB_PAT).toBe('github_pat_multi_line');
     expect(envVars.API_URL).toBe('https://example.com');
 
+    const createdSecret = await execAwslocalCommand(
+      `awslocal secretsmanager get-secret-value --secret-id "${secretName}" --region us-east-1 --query SecretString --output text`,
+      getLocalStackEnv()
+    );
+    expect(JSON.parse(createdSecret.stdout.trim())).toEqual({
+      GITHUB_PAT: 'github_pat_multi_line',
+      API_URL: 'https://example.com'
+    });
+
     const deleteResult = await cliWithEnv(
       [
         'aws',

package/dist/index.js

@@ -43,6 +43,40 @@ const parseSecretJsonObject = (secretName, value) => {
     }
     return parsed;
 };
+const parseEnvToObject = (value) => {
+    try {
+        const parsed = (0, helpers_1.parseEnvSecrets)(value);
+        if (parsed.entries.length === 0) {
+            return undefined;
+        }
+        return Object.fromEntries(parsed.entries.map((entry) => [entry.key, entry.value]));
+    }
+    catch (_a) {
+        return undefined;
+    }
+};
+const toSecretJsonObject = (value) => {
+    try {
+        const parsed = JSON.parse(value);
+        if (parsed && !Array.isArray(parsed) && typeof parsed === 'object') {
+            return parsed;
+        }
+        if (typeof parsed === 'string') {
+            const envPayload = parseEnvToObject(parsed);
+            if (envPayload) {
+                return envPayload;
+            }
+        }
+        return { value: parsed };
+    }
+    catch (_a) {
+        const envPayload = parseEnvToObject(value);
+        if (envPayload) {
+            return envPayload;
+        }
+    }
+    return { value };
+};
 // main program
 program
     .name('env-secrets')
@@ -125,9 +159,10 @@ secretCommand
         if (!value) {
             throw new Error('Secret value is required. Provide --value, --value-stdin, or --file.');
         }
+        const payload = toSecretJsonObject(value);
         const result = yield (0, secretsmanager_admin_1.createSecret)({
             name: options.name,
-            value,
+            value: JSON.stringify(payload),
             description: options.description,
             kmsKeyId: options.kmsKeyId,
             tags: options.tag,

package/docs/AWS.md

@@ -200,6 +200,12 @@ source secrets.env
      --output json
    ```
 
+   `create` always writes a JSON object:
+
+   - object JSON input is preserved semantically as an object (formatting and key order may change) (`{"API_KEY":"abc123"}`)
+   - dotenv-style input is converted (`KEY=value` -> `{"KEY":"value"}`)
+   - non-object/scalar input is wrapped (`super-secret-value` -> `{"value":"super-secret-value"}`)
+
 2. **Create from stdin (recommended for sensitive values):**
 
    ```bash
@@ -262,6 +268,7 @@ source secrets.env
 
 - `delete` requires `--yes`.
 - `create`/`update` accept `--value`, `--value-stdin`, or `--file` (use only one).
+- `create` always stores `SecretString` as a JSON object.
 - `append` and `remove` require the secret value to be a JSON object.
 - `upsert/import --file --name` parses `export KEY=value` and `KEY=value`, stores them as one JSON secret object, ignores blank lines/comments, and reports `created`, `updated`, `skipped`, and `failed`.
 - Use `--value-stdin` to avoid shell history leakage for sensitive values.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "env-secrets",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "get secrets from a secrets vault and inject them into the running environment",
   "main": "index.js",
   "author": "Mark C Allen (@markcallen)",

package/src/index.ts

@@ -18,6 +18,7 @@ import {
 } from './vaults/secretsmanager-admin';
 import {
   asOutputFormat,
+  parseEnvSecrets,
   parseEnvSecretsFile,
   printData,
   parseRecoveryDays,
@@ -58,6 +59,48 @@ const parseSecretJsonObject = (
   return parsed as Record<string, unknown>;
 };
 
+const parseEnvToObject = (
+  value: string
+): Record<string, unknown> | undefined => {
+  try {
+    const parsed = parseEnvSecrets(value);
+    if (parsed.entries.length === 0) {
+      return undefined;
+    }
+
+    return Object.fromEntries(
+      parsed.entries.map((entry) => [entry.key, entry.value])
+    );
+  } catch {
+    return undefined;
+  }
+};
+
+const toSecretJsonObject = (value: string): Record<string, unknown> => {
+  try {
+    const parsed = JSON.parse(value) as unknown;
+    if (parsed && !Array.isArray(parsed) && typeof parsed === 'object') {
+      return parsed as Record<string, unknown>;
+    }
+
+    if (typeof parsed === 'string') {
+      const envPayload = parseEnvToObject(parsed);
+      if (envPayload) {
+        return envPayload;
+      }
+    }
+
+    return { value: parsed };
+  } catch {
+    const envPayload = parseEnvToObject(value);
+    if (envPayload) {
+      return envPayload;
+    }
+  }
+
+  return { value };
+};
+
 // main program
 program
   .name('env-secrets')
@@ -166,9 +209,10 @@ secretCommand
         );
       }
 
+      const payload = toSecretJsonObject(value);
       const result = await createSecret({
         name: options.name,
-        value,
+        value: JSON.stringify(payload),
         description: options.description,
         kmsKeyId: options.kmsKeyId,
         tags: options.tag,