kavrix 0.2.6 → 0.2.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/README.md +25 -11
  2. package/dist/bin.js +2092 -133
  3. package/dist/chunks/{chunk-O5SD3CYP.js → chunk-6DRI32NY.js} +1 -1
  4. package/dist/chunks/{chunk-S5YN7S73.js → chunk-IEMCXQSI.js} +1112 -24
  5. package/dist/chunks/{chunk-PMIKDBMJ.js → chunk-YBEYXNQM.js} +2122 -23
  6. package/dist/chunks/{chunk-ZNVQXSGS.js → chunk-ZMOWONMK.js} +11 -9
  7. package/dist/index.d.ts +1 -1
  8. package/dist/index.js +1 -1
  9. package/dist/kavrix.cdx.json +20 -20
  10. package/package.json +1 -1
package/README.md CHANGED
@@ -38,29 +38,43 @@ kavrix db profile use work
38
38
  kavrix db init --profile work
39
39
  kavrix db vault create --profile work
40
40
 
41
- # 3. Copy the returned opaque vault ID into the flat commands.
42
- kavrix put github/token --profile work --vault <vault-id>
43
- kavrix get github/token --reveal --profile work --vault <vault-id>
41
+ # 3. Authenticate and select the returned opaque vault ID for this profile.
42
+ kavrix db vault use <vault-id> --profile work
43
+
44
+ # 4. Vault-scoped commands now use that profile default.
45
+ kavrix put github/token --profile work
46
+ kavrix get github/token --reveal --profile work
44
47
 
45
48
  # Or create an explicit project/service/item hierarchy.
46
- kavrix context create platform --environment production --profile work --vault <vault-id>
47
- kavrix service create github --context platform --profile work --vault <vault-id>
48
- kavrix item create deploy --context platform --service github --profile work --vault <vault-id>
49
+ kavrix context create platform --environment production --profile work
50
+ kavrix service create github --context platform --profile work
51
+ kavrix item create deploy --context platform --service github --profile work
49
52
  kavrix field set token --type api-key --context platform --service github \
50
- --item deploy --profile work --vault <vault-id>
53
+ --item deploy --profile work
51
54
  ```
52
55
 
53
56
  Sensitive input is prompted for or read from stdin; it is never accepted as a
54
57
  normal argument. Use `kavrix <command> --help` for the exact protected-input
55
58
  options in your installed version.
56
59
 
60
+ Interactive protected prompts show each non-secret requirement before entry
61
+ and keep `[i]`, `[OK]`, and `[X]` meaningful without color. Invalid local input
62
+ retries only that field, while a confirmation mismatch retries both passphrase
63
+ entries. ANSI color is TTY-only and respects `NO_COLOR` and `TERM=dumb`;
64
+ protected stdin remains silent and ANSI-free.
65
+
66
+ Each datastore profile keeps its own opaque default vault ID in the protected
67
+ non-secret registry. An explicit `--vault <id>` overrides it for one invocation.
68
+ Without either selection, Kavrix fails before requesting secret input. Profiles
69
+ never store MongoDB credentials, passphrases, private labels, keys, or values.
70
+
57
71
  ## Command overview
58
72
 
59
73
  | Group | Purpose |
60
74
  | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
61
75
  | `db profile ...` | Manage non-secret datastore routes. |
62
76
  | `db init`, `db status` | Initialize or authenticate a multi-vault database. |
63
- | `db vault ...` | Create, list, inspect, or rename encrypted vaults. |
77
+ | `db vault ...` | Create, list, inspect, rename, or select encrypted vaults. |
64
78
  | `db key create` | Create an exact-snapshot key for full local-file sharing. |
65
79
  | `db recovery ...` | Manage database-root recovery kits. |
66
80
  | `migrate database` | Copy one legacy version 2 vault into a database. |
@@ -117,7 +131,7 @@ authorization sidecar.
117
131
  | Flag | What it does |
118
132
  | ----------------------------------- | -------------------------------------------------------------------------- |
119
133
  | `--profile`, `--profile-config-dir` | Select a datastore profile without storing secrets. |
120
- | `--vault <id>` | Select one opaque vault explicitly. |
134
+ | `--vault <id>` | Override the selected profile's default vault for one command. |
121
135
  | `--passphrase-stdin` | Read the key passphrase from stdin. |
122
136
  | `--database-url-stdin` | Read the MongoDB URI from stdin. |
123
137
  | `--value-stdin` | Read a credential value from stdin. |
@@ -150,8 +164,8 @@ must explicitly enable validated TLS.
150
164
  permanently unrecoverable by design; there is no reset or escrow.
151
165
  - User identities, public enrollment, per-vault grants and roles, revocation
152
166
  with rotation, and ownership transfer are not yet implemented. Structured
153
- payloads model notes, attachment ownership, and history, but 0.2.6 does not
154
- add attachment transfer or history-restore commands.
167
+ payloads model notes, attachment ownership, and history, but the current CLI
168
+ does not add attachment transfer or history-restore commands.
155
169
  - Windows command scripts (`.bat`, `.cmd`, `.com`) are refused for execution;
156
170
  invoke real executables.
157
171