@computesdk/cli 1.0.12 → 1.0.13

package/dist/index.js

@@ -981,6 +981,19 @@ function sanitizePathPart(name) {
 async function client(opts) {
   return new ActionsClient(await resolveActionsAuth(opts));
 }
+function assertVaultValueHost(auth) {
+  if (!isTrustedActionsHost(auth.baseUrl)) {
+    throw new ActionsCliError(
+      "untrusted_host",
+      `Refusing to send or read vault values at ${auth.baseUrl} \u2014 only computesdk.com and localhost hosts are allowed, even with --allow-untrusted-host.`
+    );
+  }
+}
+async function vaultValueClient(opts) {
+  const auth = await resolveActionsAuth(opts);
+  assertVaultValueHost(auth);
+  return new ActionsClient(auth);
+}
 function output(opts, data, render) {
   if (opts.json) {
     process.stdout.write(JSON.stringify(data, null, 2) + "\n");
@@ -1384,6 +1397,42 @@ function dispatchBody(workflow, opts) {
     }
   };
 }
+function parseVaultKind(kind) {
+  if (kind === void 0 || kind === "secret" || kind === "variable") return kind ?? "secret";
+  throw new ActionsCliError("invalid_argument", `--kind must be secret or variable, got "${kind}".`);
+}
+function vaultPath(path5, params) {
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(params)) {
+    if (value !== void 0) search.set(key, value);
+  }
+  const query = search.toString();
+  return query ? `${path5}?${query}` : path5;
+}
+function vaultSetBody(name, value, opts) {
+  if (value === "") throw new ActionsCliError("invalid_argument", "The value is empty.");
+  if (opts.revealable && opts.kind === "variable") {
+    throw new ActionsCliError("invalid_argument", "--revealable applies to secrets; variables are always readable.");
+  }
+  return {
+    name,
+    kind: opts.kind,
+    value,
+    ...opts.revealable && { revealable: true },
+    ...opts.description !== void 0 && { description: opts.description },
+    ...opts.labels !== void 0 && opts.labels.length > 0 && { labels: opts.labels }
+  };
+}
+function formatVaultRow(item) {
+  const flags = [
+    item.kind,
+    ...item.revealable && item.kind === "secret" ? ["revealable"] : [],
+    `v${item.version}`,
+    ...item.source === "organization" ? ["inherited"] : [],
+    ...item.overridesOrganization ? ["overrides org"] : []
+  ];
+  return `${pc.cyan(safeTerm(item.name))}  ${pc.dim(flags.join(", "))}  ${pc.dim(`updated ${safeTerm(item.updatedAt)}`)}`;
+}
 function registerActionsCommands(program2) {
   const actions = program2.command("actions").alias("ci").description("Drive the benchmarks-platform Actions API").configureOutput({ outputError: usageErrorOutput });
   const common = (cmd) => cmd.option("--api-key <key>", "API key (default: $COMPUTE_API_KEY)").option("--base-url <url>", "API base URL (default: https://platform.computesdk.com)").option("--allow-untrusted-host", "send an explicit --api-key/env key to a non-computesdk, non-localhost --base-url (stored login credentials are never sent)").option("--json", "print machine-readable JSON");
@@ -1714,6 +1763,74 @@ function registerActionsCommands(program2) {
       fail(e, opts);
     }
   });
+  const vault = actions.command("vault").description("The org vault: secrets and variables (owner/admin key)");
+  const vaultScope = (cmd) => common(cmd).option("--repo <owner/repo>", "scope to a repo's own items instead of the org's").option("--kind <kind>", "secret or variable", "secret");
+  vaultScope(
+    vault.command("ls").description("List names and metadata (never values)")
+  ).action(async (opts) => {
+    try {
+      const path5 = vaultPath("/api/v1/vault", { repo: opts.repo, kind: parseVaultKind(opts.kind) });
+      const data = await (await client(opts)).get(path5);
+      output(opts, data, (d) => {
+        for (const item of d.items) console.log(formatVaultRow(item));
+      });
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  vaultScope(
+    vault.command("set").description("Store a value, read from stdin (or --from-file) and sent exactly as read").argument("<name>", "item name, e.g. NPM_TOKEN").option("--from-file <path>", "read the value from a file instead of stdin").option("--revealable", "let the value be read back with `vault get` (secrets; fixed at creation)").option("--description <text>", "what the item is for").option("--labels <labels...>", "labels (fixed at creation)")
+  ).action(async (name, opts) => {
+    try {
+      if (opts.fromFile === void 0 && process.stdin.isTTY) {
+        throw new ActionsCliError(
+          "invalid_argument",
+          'Pipe the value on stdin (e.g. printf %s "$VALUE" | compute actions vault set NAME) or pass --from-file.'
+        );
+      }
+      const value = readFileSync(opts.fromFile ?? 0, "utf8");
+      const kind = parseVaultKind(opts.kind);
+      const body = vaultSetBody(name, value, { ...opts, kind });
+      const result = await (await vaultValueClient(opts)).put(
+        vaultPath("/api/v1/vault", { repo: opts.repo }),
+        body
+      );
+      output(opts, result, (r) => {
+        const where = opts.repo ? safeTerm(opts.repo) : "org";
+        console.log(`saved  ${pc.cyan(safeTerm(r.item.name))}  ${pc.dim(`(${r.item.kind}, v${r.item.version}, ${where})`)}`);
+        if (/\r?\n$/.test(value)) {
+          console.error(pc.yellow("note: the stored value ends with a newline; use printf %s rather than echo to avoid one."));
+        }
+      });
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  vaultScope(
+    vault.command("get").description("Print a value: any variable, or a secret created --revealable").argument("<name>", "item name")
+  ).action(async (name, opts) => {
+    try {
+      const kind = parseVaultKind(opts.kind);
+      const result = await (await vaultValueClient(opts)).post(
+        vaultPath("/api/v1/vault/reveal", { repo: opts.repo }),
+        { name, kind }
+      );
+      output(opts, result, (r) => process.stdout.write(r.value));
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
+  vaultScope(
+    vault.command("rm").description("Delete an item (with --repo, only the repo's override)").argument("<name>", "item name")
+  ).action(async (name, opts) => {
+    try {
+      const path5 = vaultPath("/api/v1/vault", { repo: opts.repo, kind: parseVaultKind(opts.kind), name });
+      const result = await (await client(opts)).del(path5);
+      output(opts, result, (r) => console.log(`deleted  ${pc.cyan(safeTerm(r.name))}  ${pc.dim(`(${r.kind})`)}`));
+    } catch (e) {
+      fail(e, opts);
+    }
+  });
   common(
     actions.command("cancel").description("Cancel a run").argument("<run-id>", "run ID")
   ).action(async (runId, opts) => {