ww-1.0.0 is not a library.

ww — Scylla‑backed secrets daemon + CLI

ww is a Doppler‑like secret manager built on ScyllaDB. It runs a background daemon that talks to Scylla and exposes project secrets over a local Unix socket. The companion CLI can inject environment variables into commands, download them in multiple formats, or update individual keys.

✨ Features

🔑 Store project secrets in ScyllaDB (map<text,text> column)
📡 Local daemon with Unix socket protocol
🛠 CLI with familiar commands: run, secrets, set-env, client
🌐 Path‑to‑project bindings (~/.config/ww/config.toml)
📄 Export secrets as .env, JSON, or YAML
🔒 Socket permissions default to 0600

🚀 Quick Start

1. Start the daemon

ww serve --node 127.0.0.1:9042 --user cassandra --pass cassandra

2. Bind your repo to a project

cd /path/to/repo
ww client setup my_project

3. Set a secret

ww set-env --name API_KEY --val abc123

4. Run your app with secrets injected

ww node app.js

🔧 CLI Overview

USAGE:
    ww <COMMAND>

COMMANDS:
    serve       Start the daemon server
    run         Run a command with env vars injected
    secrets     Download or read secrets
    set-env     Upsert a single secret
    client      Manage global client config

Examples

Show current project resolution:
```
ww client which
```

Download secrets to .env file:

ww secrets download --format env --output .env

Fetch a single secret:
```
ww secrets get --name API_KEY --plain
```
Run any command, injecting resolved project secrets:
```
ww npm run dev
```

⚙️ Client Config

Location: ~/.config/ww/config.toml

default_project = "demo_project"

[[paths]]
dir = "/abs/path/to/repo"
project = "my_project"

Resolution order:

--project flag (explicit)
WW_PROJECT environment variable
Path binding from config
default_project

📡 Socket Protocol

The daemon speaks a simple line protocol over a Unix socket:

QUERY_PROJECTS:<project>\n → KEY=VALUE\n...
ENSURE_PROJECT:<project>\n → OK\n or ERROR:...
SET_ENV:<project>:<key>=<value>\n → OK\n or ERROR:...

Socket path defaults to /tmp/ww.sock.

🔐 Security Notes

Socket is 0600 (owner read/write only)
Assumes local single‑user trust; no encryption/auth on socket
Use --plain only when piping into secure sinks

🛠 Development

Build

cargo build --release

Test

cargo test

Install locally

cargo install --path .

📜 License

Licensed under MIT.

ww 1.0.0