Release v3.114.0

Cratis projects get named environments and secrets in .cratis, inspired by Pulumi stacks: configuration that differs per environment lives next to the model, with secrets encrypted by a passphrase or kept in Azure Key Vault or HashiCorp Vault.

Added

• Environments in .cratis/environments/<name>.yaml with any name, development by default, and a per-user selection that is never committed; select with --environment, CRATIS_ENVIRONMENT or cratis env select (#514)
• cratis env init, select, ls and rm, and cratis config set, get, rm and list with --output json
• cratis config --missing <keys> lists the keys an environment still lacks
• Secrets providers per environment: values encrypted with AES-256-GCM from a passphrase (CRATIS_PASSPHRASE, CRATIS_PASSPHRASE_FILE or a prompt), Azure Key Vault, or HashiCorp Vault (#515)
• cratis config set <key> --secret reads the value from stdin or a hidden prompt, and secrets print as [secret] unless --show-secret is passed
• cratis env change-secrets-provider and cratis env change-passphrase move or re-encrypt every secret
• Cratis.Environments package for reading environments and resolving secrets from other tools
• Documentation: Environments and Secrets

Changed

• cratis init adds .cratis/local/ to .gitignore so the selected environment stays per user