@absolutejs/cli 0.1.0

package/dist/cli.js

@@ -0,0 +1,660 @@
+// @bun
+// src/loadConfig.ts
+import { existsSync, statSync } from "fs";
+import { dirname, join, resolve } from "path";
+var CONFIG_NAMES = [
+  "absolutejs.config.ts",
+  "absolutejs.config.mts",
+  "absolutejs.config.js",
+  "absolutejs.config.mjs"
+];
+var findConfigPath = (startDir) => {
+  let dir = resolve(startDir);
+  for (;; ) {
+    for (const name of CONFIG_NAMES) {
+      const candidate = join(dir, name);
+      try {
+        if (existsSync(candidate) && statSync(candidate).isFile()) {
+          return candidate;
+        }
+      } catch {}
+    }
+    const parent = dirname(dir);
+    if (parent === dir)
+      return;
+    dir = parent;
+  }
+};
+var loadConfig = async (startDir = process.cwd()) => {
+  const path = findConfigPath(startDir);
+  if (path === undefined) {
+    throw new Error(`[absolutejs] no config file found.
+` + `Looked for: ${CONFIG_NAMES.join(", ")} (walked up from ${startDir})
+
+` + `Create an absolutejs.config.ts with:
+
+` + `  import { defineConfig } from '@absolutejs/cli';
+` + `  export default defineConfig({
+` + `    secrets: /* your SecretBroker */,
+` + `    deployments: [],
+` + `  });`);
+  }
+  let mod;
+  try {
+    mod = await import(path);
+  } catch (error) {
+    throw new Error(`[absolutejs] failed to load ${path}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const config = mod.default;
+  if (config === undefined || typeof config !== "object") {
+    throw new Error(`[absolutejs] ${path} must \`export default defineConfig({...})\``);
+  }
+  return { config, path };
+};
+
+// src/utils/output.ts
+var renderTable = (headers, rows) => {
+  if (rows.length === 0) {
+    return `${headers.join("  ")}
+(no rows)
+`;
+  }
+  const widths = headers.map((header, columnIndex) => {
+    const cells = rows.map((row) => row[columnIndex] ?? "");
+    return Math.max(header.length, ...cells.map((cell) => cell.length));
+  });
+  const formatRow = (row) => row.map((cell, columnIndex) => (cell ?? "").padEnd(widths[columnIndex] ?? 0)).join("  ").trimEnd();
+  const lines = [formatRow(headers), formatRow(widths.map((w) => "-".repeat(w)))];
+  for (const row of rows)
+    lines.push(formatRow(row));
+  return `${lines.join(`
+`)}
+`;
+};
+var writeOut = (text) => {
+  process.stdout.write(text.endsWith(`
+`) ? text : `${text}
+`);
+};
+var writeJson = (value) => {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+};
+var writeErr = (text) => {
+  process.stderr.write(text.endsWith(`
+`) ? text : `${text}
+`);
+};
+var formatRelativeTime = (msAgo) => {
+  if (msAgo < 60000)
+    return `${Math.round(msAgo / 1000)}s ago`;
+  if (msAgo < 3600000)
+    return `${Math.round(msAgo / 60000)}m ago`;
+  if (msAgo < 86400000)
+    return `${Math.round(msAgo / 3600000)}h ago`;
+  return `${Math.round(msAgo / 86400000)}d ago`;
+};
+
+// src/commands/secrets.ts
+var requireBroker = (config) => {
+  if (config.secrets === undefined) {
+    throw new Error("config.secrets is not set \u2014 `secrets` verbs need a SecretBroker");
+  }
+  return config.secrets;
+};
+var requireAdapter = (config) => {
+  if (config.secretAdapter === undefined) {
+    throw new Error("config.secretAdapter is not set \u2014 pass the SecretAdapter you used to build the broker");
+  }
+  return config.secretAdapter;
+};
+var runSecrets = async (config, args, mode) => {
+  const { verb, positional, flags } = args;
+  switch (verb) {
+    case "list": {
+      const adapter = requireAdapter(config);
+      const broker = requireBroker(config);
+      if (adapter.list === undefined) {
+        throw new Error("the configured SecretAdapter does not implement `list()`");
+      }
+      const names = await adapter.list();
+      const rows = [];
+      for (const name of names.sort()) {
+        const value = await adapter.fetch(name);
+        const fingerprint = value === null ? "(empty)" : broker.fingerprint(value);
+        rows.push([name, fingerprint]);
+      }
+      if (mode === "json") {
+        writeJson(rows.map(([name, fingerprint]) => ({ fingerprint, name })));
+      } else {
+        writeOut(renderTable(["name", "fingerprint"], rows));
+      }
+      return 0;
+    }
+    case "get": {
+      const broker = requireBroker(config);
+      const name = positional[0];
+      if (name === undefined) {
+        throw new Error("usage: secrets get <name> [--show]");
+      }
+      const resolved = await broker.resolve(name);
+      if (resolved === null) {
+        writeErr(`(no value for ${name})`);
+        return 2;
+      }
+      if (mode === "json") {
+        writeJson({
+          fingerprint: resolved.fingerprint,
+          name,
+          value: flags.show === true ? resolved.value : "(redacted; pass --show)"
+        });
+      } else if (flags.show === true) {
+        writeOut(resolved.value);
+      } else {
+        writeOut(`${name}: fingerprint=${resolved.fingerprint} (pass --show to print plaintext)`);
+      }
+      return 0;
+    }
+    case "set": {
+      const adapter = requireAdapter(config);
+      if (adapter.put === undefined) {
+        throw new Error("the configured SecretAdapter does not implement `put()`");
+      }
+      const pair = positional[0];
+      if (pair === undefined) {
+        throw new Error("usage: secrets set <NAME>=<value>");
+      }
+      const eq = pair.indexOf("=");
+      if (eq <= 0) {
+        throw new Error("usage: secrets set <NAME>=<value> (missing `=`)");
+      }
+      const name = pair.slice(0, eq);
+      const value = pair.slice(eq + 1);
+      await adapter.put(name, value);
+      if (mode === "json") {
+        writeJson({ name, set: true });
+      } else {
+        writeOut(`set ${name}`);
+      }
+      return 0;
+    }
+    case "rotate": {
+      const broker = requireBroker(config);
+      const name = positional[0];
+      if (name === undefined) {
+        throw new Error("usage: secrets rotate <name>");
+      }
+      const rotated = await broker.rotate(name);
+      if (mode === "json") {
+        writeJson({
+          fingerprint: rotated.fingerprint,
+          name,
+          rotated: true
+        });
+      } else {
+        writeOut(`rotated ${name} (new fingerprint: ${rotated.fingerprint})`);
+      }
+      return 0;
+    }
+    default:
+      throw new Error(`unknown secrets verb: "${verb}". try: list | get | set | rotate`);
+  }
+};
+
+// src/commands/env.ts
+var KEY_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+var NEEDS_QUOTING = /[\s"'`$\\#&|;<>(){}*?!]/;
+var validateKey = (key) => {
+  if (!KEY_PATTERN.test(key)) {
+    throw new Error(`invalid env key "${key}" \u2014 must match /^[A-Z_][A-Z0-9_]*$/`);
+  }
+};
+var serializeLine = (key, value) => {
+  validateKey(key);
+  if (value.includes(`
+`) || value.includes("\r")) {
+    throw new Error(`value for "${key}" contains a newline \u2014 env files cannot represent multi-line values`);
+  }
+  if (NEEDS_QUOTING.test(value) || value.startsWith("=") || value === "") {
+    const escaped = value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"");
+    return `${key}="${escaped}"`;
+  }
+  return `${key}=${value}`;
+};
+var serializeEnvFile = (values) => {
+  const lines = [];
+  for (const key of Object.keys(values).sort()) {
+    const value = values[key];
+    if (value === undefined)
+      continue;
+    lines.push(serializeLine(key, value));
+  }
+  return `${lines.join(`
+`)}
+`;
+};
+var unquoteValue = (raw) => {
+  if (raw.length >= 2 && raw.startsWith('"') && raw.endsWith('"')) {
+    return raw.slice(1, -1).replaceAll("\\\"", '"').replaceAll("\\\\", "\\");
+  }
+  if (raw.length >= 2 && raw.startsWith("'") && raw.endsWith("'")) {
+    return raw.slice(1, -1);
+  }
+  return raw;
+};
+var parseEnvFile = (text) => {
+  const result = {};
+  for (const rawLine of text.split(`
+`)) {
+    const line = rawLine.trim();
+    if (line.length === 0 || line.startsWith("#"))
+      continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0)
+      continue;
+    const key = line.slice(0, eq).trim();
+    const value = unquoteValue(line.slice(eq + 1).trim());
+    if (KEY_PATTERN.test(key))
+      result[key] = value;
+  }
+  return result;
+};
+var findDeployment = (config, stage) => {
+  const match = (config.deployments ?? []).find((d) => d.name === stage);
+  if (match === undefined) {
+    const names = (config.deployments ?? []).map((d) => d.name);
+    throw new Error(`unknown deployment "${stage}". configured: ${names.length > 0 ? names.join(", ") : "(none)"}`);
+  }
+  return match;
+};
+var resolveValuesForDeployment = async (config, deployment) => {
+  const merged = {};
+  for (const [key, value] of Object.entries(deployment.extras ?? {})) {
+    validateKey(key);
+    merged[key] = value;
+  }
+  if ((deployment.secretNames ?? []).length > 0) {
+    if (config.secrets === undefined) {
+      throw new Error(`deployment "${deployment.name}" declares secretNames but config.secrets is not set`);
+    }
+    for (const name of deployment.secretNames ?? []) {
+      const resolved = await config.secrets.resolve(name);
+      if (resolved === null) {
+        throw new Error(`secret "${name}" not found in broker (deployment: ${deployment.name})`);
+      }
+      if (merged[name] !== undefined) {
+        throw new Error(`"${name}" defined in BOTH extras and secretNames for ${deployment.name}`);
+      }
+      merged[name] = resolved.value;
+    }
+  }
+  return merged;
+};
+var shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+var readRemoteFile = async (deployment) => {
+  const target = await deployment.target();
+  const sentinel = "__ABS_DEPLOY_ENV_ABSENT__";
+  const result = await target.exec(`if [ -f ${shellQuote(deployment.remotePath)} ]; then cat ${shellQuote(deployment.remotePath)}; else echo ${sentinel}; fi`);
+  if (result.exitCode !== 0) {
+    throw new Error(`failed to read ${deployment.remotePath}: exit ${result.exitCode}: ${result.stderr || result.stdout}`);
+  }
+  if (result.stdout.trim() === sentinel)
+    return;
+  return result.stdout;
+};
+var writeRemoteFile = async (deployment, contents) => {
+  const target = await deployment.target();
+  const tempPath = `${deployment.remotePath}.new.${Math.floor(Date.now() / 1000)}`;
+  const dir = deployment.remotePath.split("/").slice(0, -1).join("/") || "/";
+  const mkdir = await target.exec(`mkdir -p ${shellQuote(dir)}`);
+  if (mkdir.exitCode !== 0) {
+    throw new Error(`mkdir ${dir} failed: ${mkdir.stderr || mkdir.stdout}`);
+  }
+  const write = await target.exec(`cat > ${shellQuote(tempPath)}`, {
+    stdin: contents
+  });
+  if (write.exitCode !== 0) {
+    throw new Error(`write to ${tempPath} failed: ${write.stderr || write.stdout}`);
+  }
+  const mode = deployment.mode ?? "600";
+  const chmod = await target.exec(`chmod ${shellQuote(mode)} ${shellQuote(tempPath)}`);
+  if (chmod.exitCode !== 0) {
+    throw new Error(`chmod failed: ${chmod.stderr || chmod.stdout}`);
+  }
+  if (deployment.owner !== undefined) {
+    const chown = await target.exec(`chown ${shellQuote(deployment.owner)} ${shellQuote(tempPath)}`);
+    if (chown.exitCode !== 0) {
+      throw new Error(`chown failed: ${chown.stderr || chown.stdout}`);
+    }
+  }
+  const mv = await target.exec(`mv ${shellQuote(tempPath)} ${shellQuote(deployment.remotePath)}`);
+  if (mv.exitCode !== 0) {
+    throw new Error(`mv failed: ${mv.stderr || mv.stdout}`);
+  }
+  if (deployment.reload !== undefined) {
+    const reload = await target.exec(deployment.reload);
+    if (reload.exitCode !== 0) {
+      throw new Error(`reload command failed: ${reload.stderr || reload.stdout}`);
+    }
+  }
+};
+var runEnv = async (config, args, mode) => {
+  const { verb, positional, flags } = args;
+  const stage = positional[0];
+  if (stage === undefined) {
+    throw new Error(`usage: env ${verb} <stage>`);
+  }
+  const deployment = findDeployment(config, stage);
+  switch (verb) {
+    case "pull": {
+      const remoteText = await readRemoteFile(deployment);
+      if (remoteText === undefined) {
+        if (mode === "json")
+          writeJson({ exists: false });
+        else
+          writeErr(`(no env file at ${deployment.remotePath})`);
+        return 2;
+      }
+      if (mode === "json") {
+        writeJson({
+          exists: true,
+          path: deployment.remotePath,
+          values: parseEnvFile(remoteText)
+        });
+      } else {
+        writeOut(remoteText);
+      }
+      return 0;
+    }
+    case "push": {
+      const resolved = await resolveValuesForDeployment(config, deployment);
+      const next = serializeEnvFile(resolved);
+      await writeRemoteFile(deployment, next);
+      const message = `pushed ${Object.keys(resolved).length} keys to ${stage}:${deployment.remotePath}`;
+      if (mode === "json") {
+        writeJson({
+          keys: Object.keys(resolved).sort(),
+          path: deployment.remotePath,
+          pushed: true,
+          stage
+        });
+      } else {
+        writeOut(message);
+      }
+      return 0;
+    }
+    case "diff": {
+      const remoteText = await readRemoteFile(deployment);
+      const remote = remoteText === undefined ? {} : parseEnvFile(remoteText);
+      const next = await resolveValuesForDeployment(config, deployment);
+      const allKeys = [
+        ...new Set([...Object.keys(remote), ...Object.keys(next)])
+      ].sort();
+      const rows = [];
+      for (const key of allKeys) {
+        const before = remote[key];
+        const after = next[key];
+        if (before === undefined) {
+          rows.push({
+            detail: "(new)",
+            key,
+            status: "added"
+          });
+        } else if (after === undefined) {
+          rows.push({
+            detail: "(removed)",
+            key,
+            status: "removed"
+          });
+        } else if (before === after) {
+          if (flags.all === true) {
+            rows.push({ detail: "(unchanged)", key, status: "same" });
+          }
+        } else {
+          rows.push({
+            detail: `before \u2260 after`,
+            key,
+            status: "changed"
+          });
+        }
+      }
+      if (mode === "json") {
+        writeJson({ diff: rows, stage });
+      } else {
+        if (rows.length === 0) {
+          writeOut(`no differences (${allKeys.length} keys match)`);
+        } else {
+          writeOut(renderTable(["key", "status", "detail"], rows.map((r) => [r.key, r.status, r.detail])));
+        }
+      }
+      return 0;
+    }
+    default:
+      throw new Error(`unknown env verb: "${verb}". try: pull | push | diff`);
+  }
+};
+
+// src/commands/deploy.ts
+var findDeployment2 = (config, stage) => {
+  const match = (config.deployments ?? []).find((d) => d.name === stage);
+  if (match === undefined) {
+    const names = (config.deployments ?? []).map((d) => d.name);
+    throw new Error(`unknown deployment "${stage}". configured: ${names.length > 0 ? names.join(", ") : "(none)"}`);
+  }
+  return match;
+};
+var requireDeployer = async (deployment) => {
+  if (deployment.deployer === undefined) {
+    throw new Error(`deployment "${deployment.name}" has no deployer() factory in config`);
+  }
+  return deployment.deployer();
+};
+var runDeploy = async (config, args, mode) => {
+  const { verb, positional, flags } = args;
+  const stage = positional[0];
+  if (stage === undefined) {
+    throw new Error(`usage: deploy ${verb} <stage>`);
+  }
+  const deployment = findDeployment2(config, stage);
+  const deployer = await requireDeployer(deployment);
+  switch (verb) {
+    case "releases": {
+      if (deployer.listReleases === undefined) {
+        throw new Error("the deployer for this stage does not implement listReleases()");
+      }
+      const releases = await deployer.listReleases();
+      if (mode === "json") {
+        writeJson({ releases, stage });
+      } else {
+        const rows = releases.map((release) => [
+          release.active === true ? "*" : " ",
+          release.id,
+          new Date(release.at).toISOString(),
+          formatRelativeTime(Date.now() - release.at)
+        ]);
+        writeOut(renderTable(["", "id", "at", "age"], rows));
+      }
+      return 0;
+    }
+    case "status": {
+      const releases = deployer.listReleases ? await deployer.listReleases() : [];
+      const currentId = deployer.currentReleaseId ? await deployer.currentReleaseId() : undefined;
+      if (mode === "json") {
+        writeJson({
+          currentReleaseId: currentId ?? null,
+          recentReleases: releases.slice(0, 5),
+          stage
+        });
+      } else {
+        writeOut(`stage: ${stage}`);
+        writeOut(`current release: ${currentId ?? "(unknown)"}`);
+        if (releases.length > 0) {
+          writeOut(`
+recent releases:`);
+          const rows = releases.slice(0, 5).map((release) => [
+            release.active === true ? "*" : " ",
+            release.id,
+            formatRelativeTime(Date.now() - release.at)
+          ]);
+          writeOut(renderTable(["", "id", "age"], rows));
+        }
+      }
+      return 0;
+    }
+    case "rollback": {
+      if (deployer.rollback === undefined) {
+        throw new Error("the deployer for this stage does not implement rollback()");
+      }
+      let target = typeof flags.to === "string" ? flags.to : undefined;
+      if (target === undefined) {
+        if (deployer.listReleases === undefined) {
+          throw new Error("rollback without --to requires deployer.listReleases() to find the previous release");
+        }
+        const releases = await deployer.listReleases();
+        if (releases.length < 2) {
+          throw new Error(`stage ${stage} has fewer than 2 releases \u2014 nothing to roll back to`);
+        }
+        const activeIndex = releases.findIndex((r) => r.active === true);
+        const previous = activeIndex >= 0 && activeIndex + 1 < releases.length ? releases[activeIndex + 1] : releases[1];
+        target = previous?.id;
+        if (target === undefined) {
+          throw new Error("could not determine previous release id");
+        }
+      }
+      await deployer.rollback(target);
+      if (mode === "json") {
+        writeJson({ rolledBackTo: target, stage });
+      } else {
+        writeOut(`${stage}: rolled back to ${target}`);
+      }
+      return 0;
+    }
+    default:
+      throw new Error(`unknown deploy verb: "${verb}". try: releases | status | rollback`);
+  }
+};
+
+// src/cli.ts
+var parseArgs = (argv) => {
+  const positional = [];
+  const flags = {};
+  let command;
+  let verb;
+  let index = 0;
+  while (index < argv.length) {
+    const arg = argv[index];
+    if (arg.startsWith("--")) {
+      const body = arg.slice(2);
+      const eq = body.indexOf("=");
+      if (eq >= 0) {
+        flags[body.slice(0, eq)] = body.slice(eq + 1);
+      } else {
+        const next = argv[index + 1];
+        if (next !== undefined && !next.startsWith("-")) {
+          flags[body] = next;
+          index += 1;
+        } else {
+          flags[body] = true;
+        }
+      }
+    } else if (command === undefined) {
+      command = arg;
+    } else if (verb === undefined) {
+      verb = arg;
+    } else {
+      positional.push(arg);
+    }
+    index += 1;
+  }
+  return { command, flags, positional, verb };
+};
+var HELP = `absolutejs \u2014 substrate CLI for the AbsoluteJS PaaS
+
+USAGE
+  absolutejs <command> <verb> [args...] [--flags]
+
+COMMANDS
+  secrets list                      list secret names + fingerprints from the broker
+  secrets get <name> [--show]       resolve one secret (--show prints plaintext)
+  secrets set <NAME>=<value>        put a value via the configured adapter
+  secrets rotate <name>             generate + persist a new value, fire onRotate
+
+  env push <stage>                  resolve secrets + extras, atomic write remote env file
+  env pull <stage>                  print the remote env file (or --json its values)
+  env diff <stage> [--all]          show what env push would change
+
+  deploy releases <stage>           list release history for a stage
+  deploy status <stage>             current release id + recent history
+  deploy rollback <stage> [--to <id>] roll back to <id> or the previous release
+
+GLOBAL FLAGS
+  --json                            machine-readable output
+  --help                            this banner
+
+CONFIG
+  Reads ./absolutejs.config.ts (walks parent dirs). Author it with:
+
+    import { defineConfig } from '@absolutejs/cli';
+    export default defineConfig({
+      secrets: /* SecretBroker */,
+      secretAdapter: /* SecretAdapter */,
+      deployments: [
+        { name: 'prod', target: () => ..., remotePath: '/etc/api.env',
+          secretNames: ['STRIPE_KEY'], reload: 'systemctl reload api' }
+      ],
+    });`;
+var main = async (argv) => {
+  const args = parseArgs(argv);
+  if (args.flags.help === true || args.command === undefined) {
+    writeOut(HELP);
+    return args.command === undefined && args.flags.help !== true ? 1 : 0;
+  }
+  const mode = args.flags.json === true ? "json" : "human";
+  const verb = args.verb;
+  if (verb === undefined) {
+    writeErr(`missing verb for "${args.command}". run \`absolutejs --help\``);
+    return 2;
+  }
+  try {
+    const { config } = await loadConfig();
+    switch (args.command) {
+      case "secrets":
+        return await runSecrets(config, {
+          flags: args.flags,
+          positional: args.positional,
+          verb
+        }, mode);
+      case "env":
+        return await runEnv(config, {
+          flags: args.flags,
+          positional: args.positional,
+          verb
+        }, mode);
+      case "deploy":
+        return await runDeploy(config, {
+          flags: args.flags,
+          positional: args.positional,
+          verb
+        }, mode);
+      default:
+        writeErr(`unknown command "${args.command}". try: secrets | env | deploy`);
+        return 2;
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (mode === "json") {
+      process.stdout.write(`${JSON.stringify({ error: message })}
+`);
+    } else {
+      writeErr(`error: ${message}`);
+    }
+    return 1;
+  }
+};
+export {
+  parseArgs,
+  main
+};
+
+//# debugId=1486CB5B222DF56264756E2164756E21
+//# sourceMappingURL=cli.js.map