onesecret 0.0.0 → 0.1.0

package/bin/help.txt

@@ -4,34 +4,32 @@ Usage
 Commands
   init                      Write config/default.enc.yml for a new age key it prints once,
                             or for SOPS_AGE_KEY when exported
-  set NAME=value...         Encrypt one or more secrets into a layer
+  set NAME                  Encrypt a secret into a layer, typed in $EDITOR
+                            (or read from stdin when piped)
   unset NAME...             Remove secrets from a layer
   edit [file]               Open an encrypted file decrypted in $EDITOR, encrypt it on save
                             (a plain .yml or .json file opens as it is)
   rekey                     Encrypt a layer again with a new data key, for its recipients or a .sops.yaml rule
   ls                        List secret names (no key needed)
   get NAME                  Print one value, from a plain or an encrypted layer
+                            (with no trailing newline when piped)
   dotenv                    Print every decrypted secret as NAME=value
+                            (--json prints them as one JSON object)
   exec -- <command>         Run a command with the config and secrets in its environment
                             (--env also sets its NODE_ENV)
-  kubernetes --name <name>  Apply the secrets as a Kubernetes Secret, print its checksum
-  fly --app <app>           Import the secrets into a Fly app, print their checksum
 
 Options
   --env, -e        Layer to read on top of "default" (defaults to NODE_ENV, then "development").
                    Write commands (set, unset, edit, rekey) write this layer, "default" when omitted.
-                   kubernetes and fly require it, and the layer file must exist ("default" deploys the base alone).
+                   Passed to dotenv or ls, the layer file must exist.
   --dir            Directory holding the config files (defaults to "config")
   --cwd            Project root, where package.json and the config directory are (defaults to the current directory)
-  --namespace, -n  Kubernetes namespace
-  --context        kubectl context
-  --no-stage       fly: apply the secrets now instead of on the next deploy
+  --json           dotenv: print a JSON object instead of NAME=value lines
 
 Examples
   $ onesecret init
-  $ onesecret set DATABASE_URL=postgres://localhost/app
-  $ onesecret set --env production DATABASE_URL=postgres://db.internal/app
+  $ onesecret set DATABASE_URL
+  $ printf %s "$TOKEN" | onesecret set --env production API_TOKEN
   $ onesecret edit config/production.enc.yml
   $ onesecret exec -- node server.js
-  $ onesecret kubernetes --env production --name api-env --namespace api
-  $ onesecret fly --env production --app my-app
+  $ onesecret dotenv --env production --json

package/bin/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 'use strict'
 
-const { run } = require('../src/cli')
+const { render, run } = require('../src/cli')
 
 run(process.argv.slice(2))
-  .then(({ stdout, exitCode = 0 }) => {
-    if (stdout) console.log(stdout)
-    process.exitCode = exitCode
+  .then(result => {
+    process.stdout.write(render(result, process.stdout.isTTY))
+    process.exitCode = result.exitCode ?? 0
   })
   .catch(error => {
     console.error(error.code ? error.message : error)

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "onesecret",
   "description": "Keep just one secret to decrypt the rest: SOPS + age secrets for Node.js, with no binaries to install.",
-  "homepage": "https://github.com/kikobeats/onesecret",
-  "version": "0.0.0",
+  "homepage": "https://onesecret.js.org/",
+  "version": "0.1.0",
   "main": "src/index.js",
   "exports": {
     ".": "./src/index.js"
@@ -15,6 +15,12 @@
     "name": "Jose Francisco 'Kiko' Verdú Gambín",
     "url": "https://kikobeats.com"
   },
+  "contributors": [
+    {
+      "name": "Jose Francisco 'Kiko' Verdú Gambín",
+      "email": "kikohumanbeatbox@gmail.com"
+    }
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/kikobeats/onesecret.git"
@@ -41,12 +47,25 @@
     "@commitlint/cli": "latest",
     "@commitlint/config-conventional": "latest",
     "ava": "latest",
+    "browser-sync": "latest",
     "c8": "latest",
+    "ci-publish": "latest",
+    "concurrently": "latest",
+    "conventional-changelog": "latest",
+    "conventional-changelog-conventionalcommits": "latest",
+    "cssnano": "latest",
+    "cssnano-preset-advanced": "latest",
     "dotenv": "~18.0.8",
     "finepack": "latest",
     "git-authors-cli": "latest",
     "github-generate-release": "latest",
+    "gulp": "latest",
+    "gulp-concat": "latest",
+    "gulp-postcss": "latest",
+    "gulp-uglify": "latest",
     "nano-staged": "latest",
+    "postcss": "latest",
+    "postcss-focus": "latest",
     "simple-git-hooks": "latest",
     "standard": "latest",
     "standard-markdown": "latest",
@@ -94,16 +113,28 @@
     "commit-msg": "npx commitlint --edit",
     "pre-commit": "npx nano-staged"
   },
+  "standard": {
+    "ignore": [
+      "docs/cover/shaders.js"
+    ]
+  },
   "scripts": {
+    "build": "gulp build",
     "clean": "rm -rf node_modules",
-    "contributors": "(npx git-authors-cli && npx finepack && git add package.json && git commit -m 'build: contributors' --no-verify) || true",
+    "contributors": "(git-authors-cli && finepack && git add package.json && git commit -m 'build: contributors' --no-verify) || true",
     "coverage": "c8 report --reporter=text-lcov > coverage/lcov.info",
+    "dev": "concurrently \"gulp\" \"pnpm run dev:server\"",
+    "dev:server": "browser-sync start --server --files \"index.html, README.md, static/**/*.(css|js)\"",
     "lint": "standard-markdown README.md && standard",
-    "postrelease": "pnpm release:tags && pnpm release:github && pnpm publish",
+    "postrelease": "pnpm release:tags && pnpm release:github && (ci-publish || pnpm publish --access=public)",
     "pretest": "pnpm lint",
-    "release": "standard-version -a",
+    "release": "pnpm release:version && pnpm release:changelog && pnpm release:commit && pnpm release:tag",
+    "release:changelog": "conventional-changelog -p conventionalcommits -i CHANGELOG.md",
+    "release:commit": "git add package.json CHANGELOG.md && git commit -m \"chore(release): $(node -p \"require('./package.json').version\")\"",
     "release:github": "github-generate-release",
-    "release:tags": "git push --follow-tags origin HEAD:master",
+    "release:tag": "git tag -a v$(node -p \"require('./package.json').version\") -m \"v$(node -p \"require('./package.json').version\")\"",
+    "release:tags": "git push origin HEAD:master --follow-tags",
+    "release:version": "standard-version --skip.changelog --skip.commit --skip.tag",
     "test": "c8 ava"
   }
 }

package/src/accessors.js

@@ -0,0 +1,70 @@
+'use strict'
+
+const { OnesecretError } = require('./error')
+
+const ACCESSORS = ['get', 'has', 'require', 'required']
+
+const isWalkable = value => value !== null && typeof value === 'object'
+
+const isValue = (object, key) =>
+  isWalkable(object) && Object.prototype.propertyIsEnumerable.call(object, key)
+
+const segmentsOf = path => {
+  if (Array.isArray(path)) return path.map(String)
+  if (typeof path === 'number') return [String(path)]
+  if (typeof path === 'string') return path.split('.')
+  throw new OnesecretError(
+    'a config path is a string such as "database.url", or an array of keys',
+    'EUSAGE'
+  )
+}
+
+const lookup = (values, path) => {
+  if (typeof path === 'string' && isValue(values, path)) return values[path]
+  let current = values
+  for (const key of segmentsOf(path)) {
+    if (!isValue(current, key)) return undefined
+    current = current[key]
+  }
+  return current
+}
+
+const assertNoReservedNames = values => {
+  const reserved = ACCESSORS.filter(name => Object.hasOwn(values, name))
+  if (reserved.length > 0) {
+    throw new OnesecretError(
+      `${reserved
+        .map(name => `"${name}"`)
+        .join(', ')} cannot be a config name, config() uses it to read values`,
+      'EFORMAT'
+    )
+  }
+}
+
+const withAccessors = (values, env) => {
+  assertNoReservedNames(values)
+  const get = (path, fallback) => {
+    const value = lookup(values, path)
+    return value === undefined ? fallback : value
+  }
+  const has = path => lookup(values, path) !== undefined
+  const require = path => {
+    if (!has(path)) {
+      throw new OnesecretError(
+        `"${path}" is required but not set in the "${env}" config`,
+        'EMISSING'
+      )
+    }
+    return get(path)
+  }
+  const required = new Proxy(values, {
+    get: (target, path) =>
+      typeof path === 'string' ? require(path) : undefined
+  })
+  for (const [name, value] of Object.entries({ get, has, require, required })) {
+    Object.defineProperty(values, name, { value, enumerable: false })
+  }
+  return values
+}
+
+module.exports = { ACCESSORS, withAccessors }

package/src/cli.js

@@ -3,13 +3,13 @@
 const { spawn, spawnSync } = require('node:child_process')
 const fs = require('node:fs')
 const os = require('node:os')
+const tty = require('node:tty')
 const path = require('node:path')
 const mri = require('mri')
 const secrets = require('./secrets')
 const write = require('./write')
-const deploy = require('./deploy')
 const store = require('./store')
-const { isEnvScalar, toDotenv } = require('./format')
+const { isEnvScalar, toDotenv, toEnv } = require('./format')
 const yaml = require('./yaml')
 const { withoutAgeKey } = require('./keys')
 const { OnesecretError } = require('./error')
@@ -31,6 +31,15 @@ const readOptions = flags => ({
 
 const writeOptions = flags => ({ dir: flags.dir, cwd: flags.cwd })
 
+const readLayersFor = (command, flags) => {
+  const layered = secrets.readLayers(readOptions(flags))
+  if (!flags.env) return layered
+  return secrets.requireEnvLayer(
+    layered,
+    `${command} found no "${layered.env}" layer in ${layered.dir}, check the --env name`
+  )
+}
+
 const writeLayerOf = flags => flags.env || 'default'
 
 const relative = file => path.relative(process.cwd(), file) || file
@@ -191,8 +200,7 @@ const editInWorkspace = (target, copy) => {
   }
 }
 
-const edit = (flags, args) => {
-  const target = editTargetOf(flags, args)
+const withWorkspace = use => {
   const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'onesecret-'))
   const removeWorkspace = () =>
     fs.rmSync(workspace, { recursive: true, force: true })
@@ -202,18 +210,73 @@ const edit = (flags, args) => {
   }
   for (const signal of EDIT_SIGNALS) process.on(signal, onSignal)
   try {
-    return editInWorkspace(target, path.join(workspace, target.workspaceName))
+    return use(workspace)
   } finally {
     removeWorkspace()
     for (const signal of EDIT_SIGNALS) process.off(signal, onSignal)
   }
 }
 
+const edit = (flags, args) => {
+  const target = editTargetOf(flags, args)
+  return withWorkspace(workspace =>
+    editInWorkspace(target, path.join(workspace, target.workspaceName))
+  )
+}
+
+const SET_USAGE =
+  'set takes one NAME: the value comes from $EDITOR, or from stdin when piped'
+
+const EDITOR_NEWLINES = ['', '\n', '\r\n']
+const STRICT_UTF8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true })
+
+const assertStorable = value => {
+  if (value.includes('\0')) {
+    throw new OnesecretError(
+      'the value contains a NUL byte, which no environment variable can hold',
+      'EVALUE'
+    )
+  }
+  return value
+}
+
+const valueFromEditor = (name, current = '') =>
+  withWorkspace(workspace => {
+    const file = path.join(workspace, name)
+    fs.writeFileSync(file, current, { mode: 0o600 })
+    const saved = openEditor(file)
+    if (EDITOR_NEWLINES.some(newline => saved === current + newline)) {
+      return current
+    }
+    const value = saved.replace(/\r?\n$/, '')
+    return value === '' ? null : assertStorable(value)
+  })
+
+const valueFromStdin = () => {
+  let value
+  try {
+    value = STRICT_UTF8.decode(fs.readFileSync(0))
+  } catch (error) {
+    if (!(error instanceof TypeError)) throw error
+    throw new OnesecretError('the value on stdin is not valid UTF-8', 'EVALUE')
+  }
+  if (value === '') {
+    throw new OnesecretError(
+      'no value on stdin, pipe the value or run set in a terminal to open $EDITOR',
+      'EUSAGE'
+    )
+  }
+  return assertStorable(value)
+}
+
+const readSetValue = (name, current, { interactive = tty.isatty(0) } = {}) =>
+  interactive ? valueFromEditor(name, current) : valueFromStdin()
+
 const exec = (flags, command) => {
   if (command.length === 0) usage('exec needs a command after --')
   const env = withoutAgeKey(process.env)
   if (flags.env) env.NODE_ENV = flags.env
-  secrets.fill(
+  secrets.writeEnv(
     { ...readOptions(flags), processEnv: env },
     { allowKeyCommand: true }
   )
@@ -254,17 +317,25 @@ const COMMANDS = {
       `private key  ${result.identity}`,
       `secrets      ${relative(result.defaultFile)}`,
       '',
-      'The private key is shown only now and is not saved anywhere. Keep it in your',
-      'password manager and as SOPS_AGE_KEY in CI. To use it in this shell:',
+      'The private key is the only secret to keep: it decrypts all the others.',
+      'It is shown only now and saved nowhere, so store it safely (and as',
+      'SOPS_AGE_KEY in CI). To use it in this shell:',
       '',
       `  export SOPS_AGE_KEY=${result.identity}`
     ].join('\n')
   },
   set: (flags, args) => {
-    if (args.length === 0) usage('set needs at least one NAME=value')
-    return `${relative(
-      write.set(writeOptions(flags), writeLayerOf(flags), args)
-    )} encrypted`
+    if (args.length !== 1 || args[0].includes('=')) usage(SET_USAGE)
+    const [name] = args
+    const { file, status } = write.set(
+      writeOptions(flags),
+      writeLayerOf(flags),
+      name,
+      current => readSetValue(name, current)
+    )
+    if (status === 'cancelled') return `${name} not set, the value was empty`
+    if (status === 'unchanged') return `${name} unchanged in ${relative(file)}`
+    return `${relative(file)} encrypted`
   },
   unset: (flags, args) => {
     if (args.length === 0) usage('unset needs at least one NAME')
@@ -277,7 +348,7 @@ const COMMANDS = {
     `${relative(
       write.rekey(writeOptions(flags), writeLayerOf(flags))
     )} encrypted with a new data key`,
-  ls: flags => secrets.names(readOptions(flags)).join('\n'),
+  ls: flags => secrets.namesOf(readLayersFor('ls', flags)).join('\n'),
   get: (flags, args) => {
     if (args.length !== 1) usage('get needs exactly one NAME')
     const values = secrets.get(readOptions(flags), args[0])
@@ -285,33 +356,19 @@ const COMMANDS = {
       throw new OnesecretError(`"${args[0]}" is not set in any layer`, 'EVALUE')
     }
     const value = values[args[0]]
-    if (value === null) return ''
-    return isEnvScalar(value) ? String(value) : yaml.dump(value).trimEnd()
+    if (value === null) return { stdout: '', exact: true }
+    return {
+      stdout: isEnvScalar(value) ? String(value) : yaml.dump(value).trimEnd(),
+      exact: true
+    }
   },
-  dotenv: flags =>
-    toDotenv(
-      secrets.loadSecrets(secrets.readLayers(readOptions(flags)))
-    ).trimEnd(),
-  exec: (flags, args) => exec(flags, args),
-  kubernetes: flags => {
-    const { checksum, output } = deploy.kubernetes({
-      ...readOptions(flags),
-      name: flags.name,
-      namespace: flags.namespace,
-      context: flags.context
-    })
-    if (output) console.error(output)
-    return checksum
+  dotenv: flags => {
+    const loaded = secrets.loadSecrets(readLayersFor('dotenv', flags))
+    return flags.json
+      ? JSON.stringify(toEnv(loaded))
+      : toDotenv(loaded).trimEnd()
   },
-  fly: flags => {
-    const { checksum, output } = deploy.fly({
-      ...readOptions(flags),
-      app: flags.app,
-      stage: flags.stage
-    })
-    if (output) console.error(output)
-    return checksum
-  }
+  exec: (flags, args) => exec(flags, args)
 }
 
 const parse = argv => {
@@ -322,10 +379,9 @@ const parse = argv => {
     _: [command, ...args],
     ...flags
   } = mri(own, {
-    boolean: ['help', 'version', 'stage'],
-    string: ['dir', 'env', 'cwd', 'name', 'namespace', 'context', 'app'],
-    alias: { h: 'help', v: 'version', e: 'env', n: 'namespace' },
-    default: { stage: true }
+    boolean: ['help', 'version', 'json'],
+    string: ['dir', 'env', 'cwd'],
+    alias: { h: 'help', v: 'version', e: 'env' }
   })
   return {
     command,
@@ -340,8 +396,14 @@ const run = async argv => {
   if (flags.help || !command) return { stdout: HELP.trimEnd() }
   const handler = COMMANDS[command]
   if (!handler) usage(`unknown command "${command}"`)
+  if (flags.json && command !== 'dotenv') usage('--json only works with dotenv')
   const result = await handler(flags, args)
   return typeof result === 'object' ? result : { stdout: result }
 }
 
-module.exports = { run }
+const render = ({ stdout, exact = false }, isTTY) => {
+  if (exact && !isTTY) return stdout
+  return stdout ? `${stdout}\n` : ''
+}
+
+module.exports = { readSetValue, render, run }

package/src/index.js

@@ -1,7 +1,6 @@
 'use strict'
 
-const { config, load, names } = require('./secrets')
-const { fly, kubernetes } = require('./deploy')
+const { config, env } = require('./secrets')
 const { checksum, toDotenv, toEnv } = require('./format')
 const { withoutAgeKey } = require('./keys')
 const { OnesecretError } = require('./error')
@@ -9,10 +8,7 @@ const { OnesecretError } = require('./error')
 module.exports = {
   checksum,
   config,
-  fly,
-  kubernetes,
-  load,
-  names,
+  env,
   toDotenv,
   toEnv,
   withoutAgeKey,

package/src/secrets.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const crypto = require('node:crypto')
 const fs = require('node:fs')
 const path = require('node:path')
 const sops = require('./sops')
@@ -7,6 +8,7 @@ const store = require('./store')
 const { withIdentities } = require('./keys')
 const { isEnvName, isEnvScalar, toEnvValue } = require('./format')
 const { OnesecretError } = require('./error')
+const { withAccessors } = require('./accessors')
 
 const DEFAULT_DIR = 'config'
 const DEFAULT_ENV = 'development'
@@ -65,19 +67,21 @@ const readLayer = (dir, name) => {
     plainFile,
     encryptedFile,
     values: plainFile ? store.readPlain(plainFile) : {},
-    document: encryptedFile ? readEncrypted(encryptedFile) : null
+    ...(encryptedFile ? readEncrypted(encryptedFile) : { document: null })
   }
 }
 
+const sha256 = data => crypto.createHash('sha256').update(data).digest('hex')
+
 const readEncrypted = file => {
-  const document = store.readDocument(file)
-  if (document === null) return null
+  const { text, document } = store.readDocumentText(file)
+  if (document === null) return { document: null }
   try {
     sops.names(document)
   } catch (error) {
     throw new OnesecretError(`${file}: ${error.reason}`, error.code)
   }
-  return document
+  return { document, contentHash: sha256(text) }
 }
 
 const readLayers = input => {
@@ -128,6 +132,39 @@ const decryptDocuments = (documents, keyCommand, keyOptions) => {
 const decryptDocument = (document, keyCommand) =>
   decryptDocuments([document], keyCommand)[0]
 
+const decryptedByFile = new Map()
+
+const fingerprintOf = identities =>
+  sha256(
+    identities
+      .map(identity => Buffer.from(identity).toString('hex'))
+      .sort()
+      .join('\n')
+  )
+
+const decryptOnce = (layers, keyCommand, keyOptions) => {
+  const encrypted = layers.filter(({ document }) => document)
+  if (encrypted.length === 0) return []
+  return withIdentities(
+    keyCommand,
+    identities => {
+      const fingerprint = fingerprintOf(identities)
+      return encrypted.map(({ encryptedFile, contentHash, document }) => {
+        const key = `${fingerprint}:${contentHash}`
+        const cached = decryptedByFile.get(encryptedFile)
+        if (cached?.key !== key) {
+          decryptedByFile.set(encryptedFile, {
+            key,
+            value: sops.decrypt(document, identities)
+          })
+        }
+        return structuredClone(decryptedByFile.get(encryptedFile).value)
+      })
+    },
+    keyOptions
+  )
+}
+
 const UNSAFE_NAME = '__proto__'
 
 const assign = (target, name, value) =>
@@ -177,12 +214,18 @@ const pick = (values, names) => {
   return picked
 }
 
-const names = input => secretNamesOf(readLayers(input).layers)
+const namesOf = layered => secretNamesOf(layered.layers)
 
-const loadLayers = ({ layers, keyCommand }) =>
-  mergeLayers(layers, decryptDocuments(documentsOf(layers), keyCommand))
+const requireEnvLayer = (layered, message) => {
+  const envLayer = layered.layers.find(({ name }) => name === layered.env)
+  if (!envLayer.plainFile && !envLayer.encryptedFile) {
+    throw new OnesecretError(message, 'EVALUE')
+  }
+  return layered
+}
 
-const load = input => loadLayers(readLayers(input))
+const loadLayers = ({ layers, keyCommand }) =>
+  mergeLayers(layers, decryptOnce(layers, keyCommand))
 
 const get = (input, name) => {
   const layered = readLayers(input)
@@ -212,9 +255,7 @@ const decryptForConfig = (
   allowKeyCommand = !DEPLOYED_ENVS.includes(env)
 ) => {
   try {
-    return decryptDocuments(documentsOf(layers), keyCommand, {
-      allowKeyCommand
-    })
+    return decryptOnce(layers, keyCommand, { allowKeyCommand })
   } catch (error) {
     if (!KEY_ERRORS.includes(error.code)) throw error
     const verb = missing.length === 1 ? 'is' : 'are'
@@ -278,15 +319,13 @@ const assertScalarSecrets = (secrets, missing) => {
   }
 }
 
-const config = input => fill(input)
-
-const fill = (input, { allowKeyCommand } = {}) => {
+const resolve = (input, { allowKeyCommand } = {}) => {
   const options = optionsOf(input)
   const target = options.processEnv || process.env
   const skip = target[SKIP_VARIABLE] === '1'
   const layered = readLayers(options)
   if (!hasFiles(layered.layers)) {
-    if (skip) return {}
+    if (skip) return { target, env: layered.env, result: {}, missing: {} }
     throw new OnesecretError(
       `no config files for "default" or "${layered.env}" found in ${layered.dir}`,
       'EMISSING'
@@ -301,6 +340,7 @@ const fill = (input, { allowKeyCommand } = {}) => {
       : null
   const merged = mergeLayers(layered.layers, decrypted)
   const result = {}
+  const missingValues = {}
   for (const name of nameOrder(layered.layers)) {
     if (!isUnset(target, name)) {
       assign(
@@ -311,21 +351,37 @@ const fill = (input, { allowKeyCommand } = {}) => {
     } else if (Object.hasOwn(merged, name)) {
       const value = merged[name]
       assign(result, name, value)
-      if (isExportable(name, value)) target[name] = toEnvValue(name, value)
+      if (isExportable(name, value)) {
+        assign(missingValues, name, toEnvValue(name, value))
+      }
     }
   }
-  return result
+  return { target, env: layered.env, result, missing: missingValues }
 }
 
+const config = input => {
+  const { result, env } = resolve(input)
+  return withAccessors(result, env)
+}
+
+const writeEnv = (input, options) => {
+  const { target, missing } = resolve(input, options)
+  for (const [name, value] of Object.entries(missing)) target[name] = value
+}
+
+const env = input => writeEnv(input)
+
 module.exports = {
   assertEnv,
   config,
   decryptDocument,
-  fill,
+  env,
   get,
-  load,
+  loadLayers,
   loadSecrets,
-  names,
+  namesOf,
+  requireEnvLayer,
   readLayers,
+  writeEnv,
   resolveOptions
 }

package/src/store.js

@@ -101,9 +101,12 @@ const parseErrorOf = error => {
   return error.code || error.message
 }
 
-const readDocument = file => {
+const readDocument = file => readDocumentText(file).document
+
+const readDocumentText = file => {
   try {
-    return yaml.parse(fs.readFileSync(file, 'utf8'))
+    const text = fs.readFileSync(file, 'utf8')
+    return { text, document: yaml.parse(text) }
   } catch (error) {
     throw new OnesecretError(
       `cannot read ${file}: ${parseErrorOf(error)}`,
@@ -250,6 +253,7 @@ module.exports = {
   layerFileOrNew,
   layersFor,
   readDocument,
+  readDocumentText,
   readPlain,
   stringify,
   writeDocument,