@bussolabs/closeyourit-cli 0.2.0 → 0.3.0

package/dist/base.js

@@ -101,6 +101,13 @@ class BaseCommand extends core_1.Command {
             }
             return this.exit(1);
         }
+        // Oclif's default JSON formatter serializes the complete CommandError. That object references
+        // the command instance and therefore cfg/api.config, including the bearer token. Never pass an
+        // unknown error to that formatter in JSON mode: emit a deliberately small allow-listed envelope.
+        if (this.jsonEnabled()) {
+            this.logJson({ error: { code: error_codes_1.ErrorCodes.System.unexpected, message: 'Command failed' } });
+            return this.exit(1);
+        }
         return super.catch(error);
     }
 }

package/dist/commands/personal/delete.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class PersonalDelete extends BaseCommand {
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/delete.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalDelete extends base_1.BaseCommand {
+    static args = {
+        name: core_1.Args.string({ description: 'Secret name', required: true }),
+    };
+    static description = 'Delete a personal secret from the current organization';
+    static examples = ['<%= config.bin %> personal delete API_KEY'];
+    async run() {
+        const { args } = await this.parse(PersonalDelete);
+        const name = args.name.toUpperCase();
+        await this.api.delete(`/cli/v1/personal_secrets/${encodeURIComponent(name)}`);
+        if (!this.jsonEnabled()) {
+            this.log(`Personal secret ${name} deleted.`);
+        }
+        return { deleted: name };
+    }
+}
+exports.default = PersonalDelete;

package/dist/commands/personal/download.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class PersonalDownload extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        out: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/download.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalDownload extends base_1.BaseCommand {
+    static description = 'Download all your personal secrets as .env or JSON (to a file or stdout). Values with newlines: use --format json. Prefer `cyi personal run` to avoid writing plaintext to disk.';
+    static examples = [
+        '<%= config.bin %> personal download --out .env',
+        '<%= config.bin %> personal download --format json',
+    ];
+    static flags = {
+        format: core_1.Flags.string({ default: 'env', description: 'Output format', options: ['env', 'json'] }),
+        out: core_1.Flags.string({ description: 'Write to this file instead of stdout' }),
+    };
+    async run() {
+        const { flags } = await this.parse(PersonalDownload);
+        const res = await this.api.get('/cli/v1/personal_secrets/bundle');
+        const map = res.data ?? {};
+        const body = flags.format === 'json'
+            ? JSON.stringify(map, null, 2)
+            : Object.entries(map)
+                .map(([key, value]) => `${key}=${value}`)
+                .join('\n');
+        if (flags.out) {
+            await (0, promises_1.writeFile)(flags.out, `${body}\n`);
+            if (!this.jsonEnabled()) {
+                this.log(`Wrote ${Object.keys(map).length} personal secrets → ${flags.out}`);
+                this.warn('The file contains plaintext secrets. Prefer `cyi personal run` to inject them without touching disk.');
+            }
+        }
+        else if (!this.jsonEnabled()) {
+            this.log(body);
+        }
+        return { count: Object.keys(map).length, format: flags.format, out: flags.out ?? null };
+    }
+}
+exports.default = PersonalDownload;

package/dist/commands/personal/get.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class PersonalGet extends BaseCommand {
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/get.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalGet extends base_1.BaseCommand {
+    static args = {
+        name: core_1.Args.string({ description: 'Secret name', required: true }),
+    };
+    static description = 'Print the value of a single personal secret (pipeable).';
+    static examples = ['<%= config.bin %> personal get OPENAI_API_KEY'];
+    async run() {
+        const { args } = await this.parse(PersonalGet);
+        const res = await this.api.get('/cli/v1/personal_secrets/bundle');
+        const map = res.data ?? {};
+        const key = args.name.toUpperCase();
+        if (!(key in map)) {
+            this.error(`Personal secret not found: ${key}`, { exit: 1 });
+        }
+        if (!this.jsonEnabled()) {
+            this.log(map[key]);
+        }
+        return { name: key, value: map[key] };
+    }
+}
+exports.default = PersonalGet;

package/dist/commands/personal/import.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class PersonalImport extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'from-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/import.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const stdin_1 = require("../../lib/stdin");
+// Reuse the exact env/JSON parsers from the project-secrets twin so the two vaults never diverge.
+const import_1 = require("../secrets/import");
+class PersonalImport extends base_1.BaseCommand {
+    static description = 'Import many personal secrets at once (all-or-nothing) from a .env or JSON file';
+    static examples = [
+        '<%= config.bin %> personal import --from-file .env',
+        '<%= config.bin %> personal import --format json --from-file secrets.json',
+        'doppler secrets download --no-file --format json | <%= config.bin %> personal import --format json',
+    ];
+    static flags = {
+        'from-file': core_1.Flags.string({ description: 'Path to a .env or JSON file (default: read from stdin)' }),
+        format: core_1.Flags.string({ default: 'env', description: 'Input format', options: ['env', 'json'] }),
+    };
+    async run() {
+        const { flags } = await this.parse(PersonalImport);
+        let text;
+        if (flags['from-file']) {
+            text = await (0, promises_1.readFile)(flags['from-file'], 'utf8');
+        }
+        else {
+            if (process.stdin.isTTY) {
+                this.error('Provide --from-file or pipe the input via stdin (e.g. `doppler secrets download --format json | cyi personal import --format json`)', { exit: 1 });
+            }
+            text = await (0, stdin_1.readStream)();
+        }
+        const variables = flags.format === 'json' ? (0, import_1.parseJson)(text) : (0, import_1.parseEnv)(text);
+        if (variables.length === 0) {
+            this.error('No variables found in the input', { exit: 1 });
+        }
+        const res = await this.api.post('/cli/v1/personal_secrets/import', { variables });
+        if (!this.jsonEnabled()) {
+            this.log(`Imported ${res.data?.imported ?? variables.length} personal secrets.`);
+        }
+        return res;
+    }
+}
+exports.default = PersonalImport;

package/dist/commands/personal/list.d.ts

@@ -0,0 +1,6 @@
+import { BaseCommand } from '../../base';
+export default class PersonalList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/list.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class PersonalList extends base_1.BaseCommand {
+    static description = 'List your personal secret names for the current organization. Never prints values.';
+    static examples = ['<%= config.bin %> personal list', '<%= config.bin %> personal list --json'];
+    async run() {
+        await this.parse(PersonalList);
+        const res = await this.api.get('/cli/v1/personal_secrets');
+        if (!this.jsonEnabled()) {
+            const rows = (res.data ?? []).map((secret) => [String(secret.name ?? ''), String(secret.description ?? '')]);
+            this.log((0, output_1.renderTable)(['NAME', 'DESCRIPTION'], rows));
+        }
+        return res;
+    }
+}
+exports.default = PersonalList;

package/dist/commands/personal/run.d.ts

@@ -0,0 +1,8 @@
+import { BaseCommand } from '../../base';
+export default class PersonalRun extends BaseCommand {
+    static strict: boolean;
+    static enableJsonFlag: boolean;
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/run.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const subprocess_1 = require("../../lib/subprocess");
+class PersonalRun extends base_1.BaseCommand {
+    // Everything after `--` is the child command + its args (not parsed as flags).
+    static strict = false;
+    // The output belongs to the child process, not to us.
+    static enableJsonFlag = false;
+    static description = 'Run a command with your personal secrets injected as env vars (like `doppler run`). Secrets never touch disk.';
+    static examples = [
+        '<%= config.bin %> personal run -- bundle exec rails server',
+        '<%= config.bin %> personal run -- printenv OPENAI_API_KEY',
+    ];
+    async run() {
+        const { argv } = await this.parse(PersonalRun);
+        const parts = argv;
+        if (parts.length === 0) {
+            this.error('Provide a command to run after `--`, e.g. `cyi personal run -- printenv`', { exit: 1 });
+        }
+        const { data } = await this.api.get('/cli/v1/personal_secrets/bundle');
+        const [command, ...commandArgs] = parts;
+        const code = await (0, subprocess_1.runCommand)(command, commandArgs, { ...process.env, ...(data ?? {}) });
+        // Propagate the child's exit code (0 on success) so `cyi personal run … && next` behaves like the child.
+        this.exit(code);
+    }
+}
+exports.default = PersonalRun;

package/dist/commands/personal/set.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class PersonalSet extends BaseCommand {
+    static args: {
+        assignment: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        value: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/personal/set.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class PersonalSet extends base_1.BaseCommand {
+    static args = {
+        assignment: core_1.Args.string({ description: 'NAME=VALUE, or just NAME with --value', required: true }),
+    };
+    static description = 'Set (create or update) a personal secret for the current organization';
+    static examples = [
+        '<%= config.bin %> personal set OPENAI_API_KEY=sk-live-...',
+        '<%= config.bin %> personal set API_KEY --value s3cr3t --description "Stripe key"',
+    ];
+    static flags = {
+        value: core_1.Flags.string({ description: 'Secret value (use when the arg is just NAME)' }),
+        description: core_1.Flags.string({ description: 'Optional description' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PersonalSet);
+        const eq = args.assignment.indexOf('=');
+        const name = eq === -1 ? args.assignment : args.assignment.slice(0, eq);
+        const value = eq === -1 ? flags.value : args.assignment.slice(eq + 1);
+        if (value === undefined) {
+            this.error('Provide a value: use NAME=VALUE or pass --value', { exit: 1 });
+        }
+        const res = await this.api.post('/cli/v1/personal_secrets', {
+            name,
+            value,
+            description: flags.description,
+        });
+        if (!this.jsonEnabled()) {
+            this.log(`Personal secret ${String(name).toUpperCase()} saved.`);
+        }
+        return res;
+    }
+}
+exports.default = PersonalSet;

package/dist/commands/whoami.js

@@ -2,11 +2,30 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const base_1 = require("../base");
 class Whoami extends base_1.BaseCommand {
-    static description = 'Show the authenticated account, organization, token and permissions';
+    static description = 'Show the authenticated account, organization, token prefix and permissions';
     static examples = ['<%= config.bin %> whoami', '<%= config.bin %> whoami --json'];
     async run() {
         const res = await this.api.get('/cli/v1/whoami');
-        const who = res.data;
+        // Rebuild from an allow-list. If a future backend accidentally includes a token secret or other
+        // authentication internals, `--json` must not proxy them to stdout.
+        const who = {
+            account: res.data.account && {
+                id: res.data.account.id,
+                name: res.data.account.name,
+                email: res.data.account.email,
+            },
+            organization: res.data.organization && {
+                id: res.data.organization.id,
+                name: res.data.organization.name,
+                slug: res.data.organization.slug,
+            },
+            token: res.data.token && {
+                id: res.data.token.id,
+                name: res.data.token.name,
+                prefix: res.data.token.prefix,
+            },
+            permissions: res.data.permissions,
+        };
         if (!this.jsonEnabled()) {
             this.log(`Account:     ${who.account?.name ?? '-'} <${who.account?.email ?? '-'}>`);
             this.log(`Organization: ${who.organization?.name ?? '-'} (${who.organization?.slug ?? '-'})`);