varcrypt 0.1.2 → 0.1.3

package/index.mjs

@@ -6,7 +6,27 @@ import * as readline from "readline/promises";
 
 const CONFIG_DIR = join(homedir(), ".varcrypt");
 const CONFIG_FILE = join(CONFIG_DIR, "config.json");
-const DEFAULT_HOST = "http://localhost:3000";
+
+// Official VarCrypt service. --host overrides this for self-hosted deployments.
+const DEFAULT_HOST = "https://varcrypt.vercel.app";
+// Only path this CLI ever contacts on the target host.
+const SECRETS_PATH = "/api/secrets";
+
+function resolveHost(override) {
+  const raw = override ?? DEFAULT_HOST;
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    console.error(`Invalid host: ${raw}`);
+    process.exit(1);
+  }
+  if (parsed.protocol !== "https:" && parsed.hostname !== "localhost") {
+    console.error("Host must use HTTPS");
+    process.exit(1);
+  }
+  return parsed.origin; // strips any stray path/query from the host value
+}
 
 function loadConfig() {
   try {
@@ -45,8 +65,10 @@ async function pull(project, env, opts) {
     process.exit(1);
   }
 
-  const host = opts.host ?? config.host ?? DEFAULT_HOST;
-  const url = `${host}/api/secrets?project=${encodeURIComponent(project)}&env=${encodeURIComponent(env)}`;
+  const origin = resolveHost(opts.host ?? config.host);
+  const url = new URL(SECRETS_PATH, origin);
+  url.searchParams.set("project", project);
+  url.searchParams.set("env", env);
 
   const res = await fetch(url, {
     headers: { Authorization: `Bearer ${config.token}` },
@@ -79,7 +101,7 @@ Commands:
   login                          Save your API token
   pull <project> <env>           Print secrets as KEY=value
     --output export              Print as export KEY="value" instead
-    --host <url>                 Override API host (default: http://localhost:3000)
+    --host <url>                 Override API host (default: https://varcrypt.vercel.app)
 `);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "varcrypt",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "CLI for VarCrypt — pull encrypted secrets from the cloud",
   "type": "module",
   "bin": {