@coffre/cli 0.1.13 → 0.1.15

package/dist/main.js

@@ -1,12 +1,270 @@
 #!/usr/bin/env node
-import { T as init, _ as select, a as keys, c as Cancelled, f as openTerminal, h as release, u as hiddenLine, v as style, w as KINDS } from "./keys-BCKUEb-Y.js";
+import { n as init, t as KINDS } from "./init-2xGelVG1.js";
+import { a as keys } from "./keys-DDdMwm0N.js";
+import { a as openTerminal, c as release, d as style, r as hiddenLine, t as Cancelled, u as select } from "./tty-BDa14JX2.js";
 import { i as isRole, r as assignableToEnvironment, t as ROLES } from "./access-CO1kGjWW.js";
 import { inspect, parseArgs, promisify } from "node:util";
 import { execFile, spawn } from "node:child_process";
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { homedir, hostname } from "node:os";
+import { appendFileSync, chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { EOL, homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, timingSafeEqual } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+/**
+* The line to show, or null: nothing pending, or nothing told. An instance
+* older than this notice has no `instance` on `/me` at all.
+*/
+function noticeFor(origin, instance) {
+	if (instance === null || instance === void 0 || !Array.isArray(instance.migrations?.known)) return null;
+	const pending = instance.migrations.known.slice(instance.migrations.applied);
+	if (pending.length === 0) return null;
+	return `${pending.length === 1 ? "1 migration" : `${pending.length} migrations`} pending on ${origin} (${pending.join(", ")}): run \`coffre migrate\``;
+}
+/**
+* The notice for `origin`, at most once a day: null without asking when it
+* was asked less than a day ago; otherwise `me` is asked, and the time kept,
+* whatever the answer. A failure to ask says nothing, and is not kept.
+*/
+async function dailyNotice(origin, now, checked, me) {
+	const last = checked.read()[origin];
+	if (last !== void 0 && now - last < 864e5) return null;
+	let instance;
+	try {
+		({instance} = await me());
+	} catch {
+		return null;
+	}
+	checked.write({
+		...checked.read(),
+		[origin]: now
+	});
+	return noticeFor(origin, instance);
+}
+//#endregion
+//#region ../core/dist/dotenv.js
+const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+function parseDotenv(input) {
+	const entries = [];
+	const problems = [];
+	const seen = /* @__PURE__ */ new Set();
+	const lines = input.split(/\r\n|\n|\r/);
+	for (let index = 0; index < lines.length; index++) {
+		const lineNumber = index + 1;
+		const trimmed = lines[index].trim();
+		if (trimmed === "" || trimmed.startsWith("#")) continue;
+		const withoutExport = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
+		const equals = withoutExport.indexOf("=");
+		if (equals === -1) {
+			problems.push({
+				line: lineNumber,
+				text: trimmed,
+				reason: "no \"=\" on this line"
+			});
+			continue;
+		}
+		const key = withoutExport.slice(0, equals).trim();
+		if (!KEY_RE.test(key)) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "key must match ^[A-Za-z_][A-Za-z0-9_]*$"
+			});
+			continue;
+		}
+		let rest = withoutExport.slice(equals + 1).trim();
+		let value;
+		if (rest.startsWith("\"")) {
+			const closing = findClosingQuote(rest, "\"");
+			if (closing === -1) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unterminated double quote (multi-line values are not supported)"
+				});
+				continue;
+			}
+			value = unescapeDoubleQuoted(rest.slice(1, closing));
+			if (trailingIsSignificant(rest.slice(closing + 1))) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unexpected text after the closing quote"
+				});
+				continue;
+			}
+		} else if (rest.startsWith("'")) {
+			const closing = rest.indexOf("'", 1);
+			if (closing === -1) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unterminated single quote (multi-line values are not supported)"
+				});
+				continue;
+			}
+			value = rest.slice(1, closing);
+			if (trailingIsSignificant(rest.slice(closing + 1))) {
+				problems.push({
+					line: lineNumber,
+					text: key,
+					reason: "unexpected text after the closing quote"
+				});
+				continue;
+			}
+		} else {
+			const comment = rest.indexOf(" #");
+			if (comment !== -1) rest = rest.slice(0, comment);
+			value = rest.trim();
+		}
+		if (value.includes("\0")) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "value contains a NUL byte, which cannot be passed in an environment"
+			});
+			continue;
+		}
+		if (seen.has(key)) {
+			problems.push({
+				line: lineNumber,
+				text: key,
+				reason: "duplicate key in this file"
+			});
+			continue;
+		}
+		seen.add(key);
+		entries.push({
+			key,
+			value,
+			line: lineNumber
+		});
+	}
+	return {
+		entries,
+		problems
+	};
+}
+/** True when what follows a closing quote is neither whitespace nor a comment. */
+function trailingIsSignificant(rest) {
+	const trimmed = rest.trim();
+	return trimmed !== "" && !trimmed.startsWith("#");
+}
+function findClosingQuote(text, quote) {
+	for (let index = 1; index < text.length; index++) {
+		if (text[index] === "\\") {
+			index++;
+			continue;
+		}
+		if (text[index] === quote) return index;
+	}
+	return -1;
+}
+/**
+* Expand escapes inside a double-quoted value.
+*
+* Deliberately minimal: only the escapes that are necessary. `\n` and `\r`
+* because multi-line values (PEM keys) cannot otherwise be expressed on one
+* line, and `\\` `\"` `\'` because quoting needs them.
+*
+* EVERYTHING ELSE IS PRESERVED VERBATIM, backslash included. The obvious
+* implementation -- returning the character and dropping the backslash for
+* unknown escapes -- silently mangles credentials: `"C:\path\to\file"` came
+* out as `C:path<TAB>ofile`, and `"\d+\w"` as `d+w`. A secrets store that
+* quietly rewrites what you gave it is worse than one that refuses.
+*
+* A value that should contain no interpretation at all belongs in single
+* quotes, which are literal.
+*/
+function unescapeDoubleQuoted(text) {
+	return text.replace(/\\(.)/g, (match, character) => {
+		switch (character) {
+			case "n": return "\n";
+			case "r": return "\r";
+			case "\\":
+			case "\"":
+			case "'": return character;
+			default: return match;
+		}
+	});
+}
+/** Values that read the same unquoted: no spaces, quotes, `#`, `$` or backslashes. */
+const PLAIN_VALUE = /^[A-Za-z0-9_./:@+,=%?-]*$/;
+/**
+* Write entries as a .env file that `parseDotenv` reads back exactly.
+*
+* Plain values stay bare; anything else is single-quoted, which is literal;
+* values holding a quote or a line break are double-quoted with the four
+* escapes the parser knows (`\\`, `\"`, `\n`, `\r`).
+*/
+function formatDotenv(entries) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertEnvironmentEntry(key, value);
+		out += `${key}=${quoteDotenv(value)}\n`;
+	}
+	return out;
+}
+/** Reject names and values that cannot be passed intact in an environment. */
+function assertEnvironmentEntry(key, value) {
+	if (!KEY_RE.test(key)) throw new Error(`${JSON.stringify(key)} is not a valid variable name`);
+	if (value.includes("\0")) throw new Error(`${key} contains a NUL byte`);
+}
+function quoteDotenv(value) {
+	if (PLAIN_VALUE.test(value)) return value;
+	if (!/['\n\r]/.test(value)) return `'${value}'`;
+	return `"${value.replace(/[\\"\n\r]/g, (character) => {
+		switch (character) {
+			case "\n": return "\\n";
+			case "\r": return "\\r";
+			default: return `\\${character}`;
+		}
+	})}"`;
+}
+/**
+* Write entries as POSIX shell `export` statements, for
+* `eval "$(coffre export … --format shell)"`. Single quotes are the only
+* shell quoting with no expansion inside; a single quote itself is written
+* as `'\''`.
+*/
+function formatShellExports(entries) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertEnvironmentEntry(key, value);
+		out += `export ${key}='${value.replaceAll("'", "'\\''")}'\n`;
+	}
+	return out;
+}
+//#endregion
+//#region src/github-env.ts
+/** The runner decodes %, CR and LF in command data, in this escaping order.
+* https://github.com/actions/toolkit/blob/main/packages/core/src/command.ts
+*/
+function githubMasks(entries) {
+	let out = "";
+	for (const [, value] of entries) for (const mask of /* @__PURE__ */ new Set([value, ...value.split(/\r\n|\r|\n/)])) {
+		if (mask === "") continue;
+		out += `::add-mask::${mask.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A")}\n`;
+	}
+	return out;
+}
+/** Multiline-safe environment records, consumed by GitHub after the step.
+* https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#multiline-strings
+* Match the host's framing newline, including on Windows, so a trailing CR
+* in the value is not mistaken for part of that newline.
+*/
+function githubEnvironment(entries, nextDelimiter = () => `coffre_${randomUUID()}`, newline = EOL) {
+	let out = "";
+	for (const [key, value] of entries) {
+		assertEnvironmentEntry(key, value);
+		if (key.toUpperCase() === "NODE_OPTIONS") throw new Error(`${key} cannot be set through GITHUB_ENV`);
+		let delimiter;
+		do
+			delimiter = nextDelimiter();
+		while (value.includes(delimiter));
+		out += `${key}<<${delimiter}${newline}${value}${newline}${delimiter}${newline}`;
+	}
+	return out;
+}
+//#endregion
 //#region ../client/dist/index.js
 /** The API's error shape, `{ error, message }`, with the HTTP status. */
 const COFFRE_ERROR = Symbol.for("@coffre/client:CoffreError");
@@ -1521,199 +1779,6 @@ async function pickCheck() {
 	}
 }
 //#endregion
-//#region ../core/dist/dotenv.js
-const KEY_RE = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
-function parseDotenv(input) {
-	const entries = [];
-	const problems = [];
-	const seen = /* @__PURE__ */ new Set();
-	const lines = input.split(/\r\n|\n|\r/);
-	for (let index = 0; index < lines.length; index++) {
-		const lineNumber = index + 1;
-		const trimmed = lines[index].trim();
-		if (trimmed === "" || trimmed.startsWith("#")) continue;
-		const withoutExport = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
-		const equals = withoutExport.indexOf("=");
-		if (equals === -1) {
-			problems.push({
-				line: lineNumber,
-				text: trimmed,
-				reason: "no \"=\" on this line"
-			});
-			continue;
-		}
-		const key = withoutExport.slice(0, equals).trim();
-		if (!KEY_RE.test(key)) {
-			problems.push({
-				line: lineNumber,
-				text: key,
-				reason: "key must match ^[A-Za-z_][A-Za-z0-9_]*$"
-			});
-			continue;
-		}
-		let rest = withoutExport.slice(equals + 1).trim();
-		let value;
-		if (rest.startsWith("\"")) {
-			const closing = findClosingQuote(rest, "\"");
-			if (closing === -1) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unterminated double quote (multi-line values are not supported)"
-				});
-				continue;
-			}
-			value = unescapeDoubleQuoted(rest.slice(1, closing));
-			if (trailingIsSignificant(rest.slice(closing + 1))) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unexpected text after the closing quote"
-				});
-				continue;
-			}
-		} else if (rest.startsWith("'")) {
-			const closing = rest.indexOf("'", 1);
-			if (closing === -1) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unterminated single quote (multi-line values are not supported)"
-				});
-				continue;
-			}
-			value = rest.slice(1, closing);
-			if (trailingIsSignificant(rest.slice(closing + 1))) {
-				problems.push({
-					line: lineNumber,
-					text: key,
-					reason: "unexpected text after the closing quote"
-				});
-				continue;
-			}
-		} else {
-			const comment = rest.indexOf(" #");
-			if (comment !== -1) rest = rest.slice(0, comment);
-			value = rest.trim();
-		}
-		if (value.includes("\0")) {
-			problems.push({
-				line: lineNumber,
-				text: key,
-				reason: "value contains a NUL byte, which cannot be passed in an environment"
-			});
-			continue;
-		}
-		if (seen.has(key)) {
-			problems.push({
-				line: lineNumber,
-				text: key,
-				reason: "duplicate key in this file"
-			});
-			continue;
-		}
-		seen.add(key);
-		entries.push({
-			key,
-			value,
-			line: lineNumber
-		});
-	}
-	return {
-		entries,
-		problems
-	};
-}
-/** True when what follows a closing quote is neither whitespace nor a comment. */
-function trailingIsSignificant(rest) {
-	const trimmed = rest.trim();
-	return trimmed !== "" && !trimmed.startsWith("#");
-}
-function findClosingQuote(text, quote) {
-	for (let index = 1; index < text.length; index++) {
-		if (text[index] === "\\") {
-			index++;
-			continue;
-		}
-		if (text[index] === quote) return index;
-	}
-	return -1;
-}
-/**
-* Expand escapes inside a double-quoted value.
-*
-* Deliberately minimal: only the escapes that are necessary. `\n` and `\r`
-* because multi-line values (PEM keys) cannot otherwise be expressed on one
-* line, and `\\` `\"` `\'` because quoting needs them.
-*
-* EVERYTHING ELSE IS PRESERVED VERBATIM, backslash included. The obvious
-* implementation -- returning the character and dropping the backslash for
-* unknown escapes -- silently mangles credentials: `"C:\path\to\file"` came
-* out as `C:path<TAB>ofile`, and `"\d+\w"` as `d+w`. A secrets store that
-* quietly rewrites what you gave it is worse than one that refuses.
-*
-* A value that should contain no interpretation at all belongs in single
-* quotes, which are literal.
-*/
-function unescapeDoubleQuoted(text) {
-	return text.replace(/\\(.)/g, (match, character) => {
-		switch (character) {
-			case "n": return "\n";
-			case "r": return "\r";
-			case "\\":
-			case "\"":
-			case "'": return character;
-			default: return match;
-		}
-	});
-}
-/** Values that read the same unquoted: no spaces, quotes, `#`, `$` or backslashes. */
-const PLAIN_VALUE = /^[A-Za-z0-9_./:@+,=%?-]*$/;
-/**
-* Write entries as a .env file that `parseDotenv` reads back exactly.
-*
-* Plain values stay bare; anything else is single-quoted, which is literal;
-* values holding a quote or a line break are double-quoted with the four
-* escapes the parser knows (`\\`, `\"`, `\n`, `\r`).
-*/
-function formatDotenv(entries) {
-	let out = "";
-	for (const [key, value] of entries) {
-		assertWritable(key, value);
-		out += `${key}=${quoteDotenv(value)}\n`;
-	}
-	return out;
-}
-function assertWritable(key, value) {
-	if (!KEY_RE.test(key)) throw new Error(`${JSON.stringify(key)} is not a valid variable name`);
-	if (value.includes("\0")) throw new Error(`${key} contains a NUL byte`);
-}
-function quoteDotenv(value) {
-	if (PLAIN_VALUE.test(value)) return value;
-	if (!/['\n\r]/.test(value)) return `'${value}'`;
-	return `"${value.replace(/[\\"\n\r]/g, (character) => {
-		switch (character) {
-			case "\n": return "\\n";
-			case "\r": return "\\r";
-			default: return `\\${character}`;
-		}
-	})}"`;
-}
-/**
-* Write entries as POSIX shell `export` statements, for
-* `eval "$(coffre export … --format shell)"`. Single quotes are the only
-* shell quoting with no expansion inside; a single quote itself is written
-* as `'\''`.
-*/
-function formatShellExports(entries) {
-	let out = "";
-	for (const [key, value] of entries) {
-		assertWritable(key, value);
-		out += `export ${key}='${value.replaceAll("'", "'\\''")}'\n`;
-	}
-	return out;
-}
-//#endregion
 //#region src/main.ts
 /**
 * coffre CLI.
@@ -1797,8 +1862,59 @@ function client(to = target()) {
 		transport: (request) => send(request, to)
 	});
 }
+/** Whether this run has asked about pending migrations yet: once, before its first request. */
+let noticed = false;
+/** The commands that say nothing of pending migrations: migrate says as much itself; login has no session yet; verify sends only what it checks. */
+const QUIET = /* @__PURE__ */ new Set([
+	"migrate",
+	"login",
+	"verify"
+]);
+/**
+* A line on stderr, at most once a day per instance, when its database is
+* behind the code it runs (`notice.ts`). Not for a machine's credential:
+* only owners are told. Whatever goes wrong here, the command goes on.
+*/
+async function noticePending(to) {
+	if (noticed) return;
+	noticed = true;
+	if (QUIET.has(command ?? "") || process.env.COFFRE_TOKEN?.trim() || to.credential.kind === "access-service-token") return;
+	const line = await dailyNotice(to.origin, Date.now(), checkedFile, async () => {
+		const response = await fetch(`${to.origin}/api/me`, {
+			headers: await headersFor(to),
+			redirect: "manual"
+		});
+		if (!response.ok || !isJsonContentType(response.headers.get("content-type"))) throw new Error("no answer");
+		return await response.json();
+	}).catch(() => null);
+	if (line !== null) {
+		const s = style(process.stderr);
+		process.stderr.write(`${s.dim(`coffre: ${line}`)}\n`);
+	}
+}
+const CHECKED_PATH = join(homedir(), ".coffre", "checked.json");
+/** When each instance was last asked about its migrations: nothing secret, beside the credentials. */
+const checkedFile = {
+	read() {
+		try {
+			return JSON.parse(readFileSync(CHECKED_PATH, "utf8"));
+		} catch {
+			return {};
+		}
+	},
+	write(checked) {
+		try {
+			mkdirSync(dirname(CHECKED_PATH), {
+				recursive: true,
+				mode: 448
+			});
+			writeFileSync(CHECKED_PATH, `${JSON.stringify(checked)}\n`, { mode: 384 });
+		} catch {}
+	}
+};
 /** One request; every way it can fail is explained in terms of what to do next. */
 async function send(request, to) {
+	await noticePending(to);
 	let response;
 	try {
 		response = await fetch(request, { redirect: "manual" });
@@ -2108,14 +2224,22 @@ async function exportEnv(args) {
 		} },
 		allowPositionals: true
 	});
-	const usage = "usage: coffre export <project>/<environment> [--format dotenv|json|shell]";
+	const usage = "usage: coffre export <project>/<environment> [--format dotenv|json|shell|github]";
 	if (!positionals[0]) fail(usage);
 	const format = values.format;
-	if (format !== "dotenv" && format !== "json" && format !== "shell") fail(usage);
+	if (format !== "dotenv" && format !== "json" && format !== "shell" && format !== "github") fail(usage);
+	const githubEnv = process.env.GITHUB_ENV;
+	if (format === "github" && !githubEnv) fail("--format github requires GITHUB_ENV (run it in a GitHub Actions step)");
 	const { project, environment } = parsePath(positionals[0]);
 	const revealed = await client().secrets.reveal(`${project}/${environment}`);
 	const entries = Object.entries(revealed.values).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
-	process.stdout.write(format === "json" ? `${JSON.stringify(Object.fromEntries(entries), null, 2)}\n` : attempt(() => format === "shell" ? formatShellExports(entries) : formatDotenv(entries)));
+	if (format === "github") {
+		process.stdout.write(githubMasks(entries));
+		attempt(() => appendFileSync(githubEnv, githubEnvironment(entries), {
+			encoding: "utf8",
+			mode: 384
+		}));
+	} else process.stdout.write(format === "json" ? `${JSON.stringify(Object.fromEntries(entries), null, 2)}\n` : attempt(() => format === "shell" ? formatShellExports(entries) : formatDotenv(entries)));
 	if (process.stderr.isTTY) {
 		const count = entries.length;
 		process.stderr.write(`coffre: read ${count} secret${count === 1 ? "" : "s"} from ${project}/${environment}; each read is in the audit log under your name\n`);
@@ -2392,6 +2516,30 @@ function initProject(args) {
 	const at = dir === process.cwd() ? null : positionals[0] ?? null;
 	process.stdout.write(`\nA ${kind === "workers" ? "Cloudflare Workers" : "Node"} deployment of coffre ${version}${at === null ? " here" : ` in ${at}`}. README.md takes it from there:\n\n${at === null ? "" : `  cd ${/\s/.test(at) ? `'${at}'` : at}\n`}  pnpm install\n`);
 }
+/**
+* The instance `coffre migrate` works on: the current one, or the one
+* `--url` names, with the session saved for it.
+*/
+function migrateTarget(url) {
+	if (url !== void 0) process.env.COFFRE_API_URL = url;
+	const to = target();
+	const api = client(to);
+	return {
+		origin: to.origin,
+		me: () => api.me(),
+		ready: async () => {
+			try {
+				return await (await fetch(`${to.origin}/readyz`, { redirect: "manual" })).json();
+			} catch {
+				return {
+					ok: false,
+					heartbeatAgeSeconds: null,
+					checkpointed: false
+				};
+			}
+		}
+	};
+}
 const USAGE = `coffre - secrets, with an audit log
 
   New deployment
@@ -2403,6 +2551,11 @@ const USAGE = `coffre - secrets, with an audit log
                                             Cloudflare too, and in an empty directory, the deployment
     coffre keys [--json]                    the app key, vault key and vault ID alone, shown the same way
 
+  Upgrade
+    coffre update [--yes]                   this CLI, and in a deployment, its coffre packages
+    coffre migrate [--url <url>] [--yes]    the instance's database, to the schema its version ships,
+                                            with the owner's connection string, asked for hidden
+
   Session
     coffre login [<url>] [--no-browser]     sign in, and make <url> the current instance
     coffre logout [<url>]
@@ -2414,7 +2567,7 @@ const USAGE = `coffre - secrets, with an audit log
     coffre get      <project>/<environment>/<KEY>
     coffre set      <project>/<environment>/<KEY> [value]   (reads stdin if omitted)
     coffre run      <project>/<environment> -- <command>
-    coffre export   <project>/<environment> [--format dotenv|json|shell]
+    coffre export   <project>/<environment> [--format dotenv|json|shell|github]
     coffre history  <project>/<environment>/<KEY>
     coffre rollback <project>/<environment>/<KEY> <version>
     coffre import   <project>/<environment> [--file .env] [--apply]
@@ -2453,7 +2606,13 @@ switch (command) {
 		await keys(rest);
 		break;
 	case "setup":
-		await (await import("./setup-BMmFAR3N.js")).setup(rest);
+		await (await import("./setup-Bs8q8Ily.js")).setup(rest);
+		break;
+	case "update":
+		await (await import("./update-eYzLTNoL.js")).update(rest);
+		break;
+	case "migrate":
+		await (await import("./migrate-ERNNgYO0.js")).migrate(rest, migrateTarget);
 		break;
 	case "login":
 		await login(rest);