vpctl 0.9.0

`secret generate --persist [path]` flag: saves generated values to a file (default: `secrets.import.yaml` ) and auto-loads it on subsequent runs so values are reused without regeneration.

`keyType: ca-cert` support in the secret schema: auto-generates a self-signed CA certificate (RSA 4096-bit, 10-year validity period) when no value is provided, so you don't need to manually supply a CA certificate for non-interactive generation.

Alphanumeric-only validation for generated password fields, to prevent special characters, for example, `@` , `!` , from breaking connection strings. This applies to both auto-generated and user-provided values. Set `alphanumeric: false` in the secret schema to opt out for fields that are not used in connection strings.

`deployment.helmChartMode` manifest setting ( `"local"` or `"remote"` , defaults to `"local"` ): choose between local charts from the release package or remote OCI charts. Existing manifests without this field continue using local charts.

`vpctl artifact sync charts` subcommand to sync OCI Helm charts between registries (mirrors remote charts for air-gapped deployments).

Remote chart support across the `release generate` and `release deploy --format helm` paths, including multi-source ArgoCD `Application` generation (OCI chart source + Git values reference).

Image and chart references in rendered output are rewritten to your target registry during generation (air-gapped deployments).

`secret generate` now re-prompts on invalid input in interactive mode instead of aborting the entire session.

`secret generate` export now correctly base64-encodes fields with `encoding: "base64"` (e.g. licenses), so reimporting preserves the original values instead of corrupting them.

`secret generate` interactive input for `encoding: "base64"` fields (licenses) now uses a multi-line reader, so pasted multiline base64 content works correctly.

`secret generate --use-defaults` now writes a `TBD` placeholder for required fields with no default and no auto-generate option, instead of stopping execution. A warning is logged for each such field so you know to replace them before deploying.

Sync recap now lists the specific images and artifacts that failed instead of only showing a count.