@everystack/cli 0.2.18 → 0.2.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/commands/secrets.ts

@@ -13,8 +13,11 @@
  * Requires IAM permissions: ssm:GetParameter, s3:GetObject, s3:PutObject, kms:Decrypt.
  */
 
+import fs from 'node:fs/promises';
+import path from 'node:path';
 import { step, success, fail, info, warn } from '../output.js';
 import { loadSstSecrets, putSstSecrets } from '../utils/secrets.js';
+import { parseDotenv, serializeDotenv } from '../utils/dotenv.js';
 
 interface SecretsContext {
   appName: string;
@@ -112,6 +115,101 @@ async function removeSecret(ctx: SecretsContext, name: string): Promise<void> {
   success(`${name} removed from stage "${ctx.stage}"`);
 }
 
+// ---------------------------------------------------------------------------
+// Import
+// ---------------------------------------------------------------------------
+
+async function importSecrets(
+  ctx: SecretsContext,
+  filePath: string,
+  flags: Record<string, string>,
+): Promise<void> {
+  step(`Importing secrets from ${filePath}...`);
+
+  let content: string;
+  try {
+    content = await fs.readFile(path.resolve(filePath), 'utf8');
+  } catch (err: any) {
+    if (err.code === 'ENOENT') {
+      fail(`File not found: ${filePath}`);
+    } else {
+      fail(`Could not read file: ${err.message}`);
+    }
+    process.exit(1);
+  }
+
+  const parsed = parseDotenv(content);
+  const parsedCount = Object.keys(parsed).length;
+
+  if (parsedCount === 0) {
+    warn(`No secrets found in ${filePath}`);
+    return;
+  }
+
+  let merged: Record<string, string>;
+
+  if (flags.replace === 'true') {
+    // Replace mode: parsed entries become the entire secrets map
+    const existing = await loadSstSecrets(ctx);
+    const existingCount = Object.keys(existing).length;
+    if (existingCount > 0) {
+      warn(`Replacing all ${existingCount} existing secret(s)`);
+    }
+    merged = parsed;
+  } else {
+    // Merge mode (default): add new keys, overwrite matching keys, preserve the rest
+    const existing = await loadSstSecrets(ctx);
+    const existingKeys = new Set(Object.keys(existing));
+    let updated = 0;
+    for (const key of Object.keys(parsed)) {
+      if (existingKeys.has(key)) updated++;
+    }
+    merged = { ...existing, ...parsed };
+    const newCount = parsedCount - updated;
+    const detail = updated > 0 ? ` (${newCount} new, ${updated} updated)` : '';
+    await putSstSecrets(ctx, merged);
+    success(`${parsedCount} secret(s) imported to stage "${ctx.stage}"${detail}`);
+    return;
+  }
+
+  await putSstSecrets(ctx, merged);
+  success(`${parsedCount} secret(s) imported to stage "${ctx.stage}"`);
+}
+
+// ---------------------------------------------------------------------------
+// Export
+// ---------------------------------------------------------------------------
+
+async function exportSecrets(ctx: SecretsContext, filePath: string | undefined): Promise<void> {
+  if (filePath) {
+    step(`Exporting secrets from ${ctx.appName}/${ctx.stage}...`);
+  }
+
+  const secrets = await loadSstSecrets(ctx);
+  const count = Object.keys(secrets).length;
+
+  if (count === 0) {
+    warn('No secrets to export');
+    return;
+  }
+
+  const serialized = serializeDotenv(secrets);
+
+  if (filePath) {
+    const resolved = path.resolve(filePath);
+    try {
+      await fs.writeFile(resolved, serialized, 'utf8');
+    } catch (err: any) {
+      fail(`Could not write file: ${err.message}`);
+      process.exit(1);
+    }
+    success(`${count} secret(s) exported to ${filePath}`);
+  } else {
+    // Stdout mode: raw output, pipeable
+    process.stdout.write(serialized);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Command entry point
 // ---------------------------------------------------------------------------
@@ -174,6 +272,23 @@ export async function secretsCommand(
         break;
       }
 
+      case 'import': {
+        const filePath = positionalArgs[0];
+        if (!filePath) {
+          fail('Missing file path');
+          info('Usage: everystack secrets import <file> --stage <stage> [--replace]');
+          process.exit(1);
+        }
+        await importSecrets(ctx, filePath, flags);
+        break;
+      }
+
+      case 'export': {
+        const filePath = positionalArgs[0]; // optional — stdout if omitted
+        await exportSecrets(ctx, filePath);
+        break;
+      }
+
       default:
         fail(`Unknown secrets subcommand: ${subcommand}`);
         printSecretsHelp();
@@ -195,12 +310,21 @@ Usage:
   everystack secrets get  <name>       --stage <name>    Print a secret value
   everystack secrets set  <name> <value> --stage <name>  Set or update a secret
   everystack secrets remove <name>     --stage <name>    Delete a secret
+  everystack secrets import <file>     --stage <name>    Import secrets from .env file (merge)
+  everystack secrets export [file]     --stage <name>    Export secrets to .env file (or stdout)
 
 Examples:
   everystack secrets list --stage production
   everystack secrets set MAPBOX_API_KEY "pk.abc123" --stage production
   everystack secrets get JWT_SECRET --stage dev
   everystack secrets remove OLD_KEY --stage dev
+  everystack secrets import .env.production --stage production
+  everystack secrets import .env --stage dev --replace
+  everystack secrets export --stage dev > .env.local
+  everystack secrets export secrets.env --stage production
+
+Flags:
+  --replace   (import only) Replace all secrets instead of merging
 
 Interop:
   Secrets are stored in the SST Ion S3 state backend with AES-256-GCM encryption.

package/src/cli/index.ts

@@ -196,6 +196,8 @@ Usage:
   everystack secrets get       <name> --stage <name>                Print a secret value
   everystack secrets set       <name> <value> --stage <name>        Set or update a secret
   everystack secrets remove    <name> --stage <name>                Delete a secret
+  everystack secrets import    <file> --stage <name> [--replace]    Import secrets from .env file
+  everystack secrets export    [file] --stage <name>                Export secrets to .env format
 
 Stage resolution:
   --stage <name>  Discover AWS resources for the given stage by querying AWS APIs.

package/src/cli/utils/dotenv.ts

@@ -0,0 +1,105 @@
+/**
+ * Pure .env parser and serializer. No dependencies.
+ *
+ * Supports:
+ *   KEY=value
+ *   KEY="double quoted value"
+ *   KEY='single quoted value'
+ *   # comments (full-line)
+ *   Empty/whitespace-only lines (skipped)
+ *   export KEY=value (optional prefix)
+ *   Escape sequences in double quotes: \n, \r, \t, \\, \"
+ *   UTF-8 BOM stripping
+ */
+
+/**
+ * Parse a .env-formatted string into key-value pairs.
+ * Duplicate keys: last one wins.
+ */
+export function parseDotenv(content: string): Record<string, string> {
+  const result: Record<string, string> = {};
+
+  // Strip UTF-8 BOM
+  const clean = content.charCodeAt(0) === 0xfeff ? content.slice(1) : content;
+
+  for (const rawLine of clean.split('\n')) {
+    const line = rawLine.trim();
+
+    // Skip empty lines and comments
+    if (!line || line.startsWith('#')) continue;
+
+    // Strip optional `export ` prefix
+    const stripped = line.startsWith('export ') ? line.slice(7) : line;
+
+    // Find first `=`
+    const eqIndex = stripped.indexOf('=');
+    if (eqIndex === -1) continue;
+
+    const key = stripped.slice(0, eqIndex).trim();
+    if (!key) continue;
+
+    let value = stripped.slice(eqIndex + 1);
+
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      // Double-quoted: strip quotes and process escapes
+      value = value.slice(1, -1);
+      // Process escapes — use a single pass to avoid double-expansion
+      value = value.replace(/\\([nrt"\\])/g, (_, ch) => {
+        switch (ch) {
+          case 'n': return '\n';
+          case 'r': return '\r';
+          case 't': return '\t';
+          case '"': return '"';
+          case '\\': return '\\';
+          default: return ch;
+        }
+      });
+    } else if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
+      // Single-quoted: strip quotes, literal (no escape processing)
+      value = value.slice(1, -1);
+    } else {
+      // Unquoted: trim whitespace
+      value = value.trim();
+    }
+
+    result[key] = value;
+  }
+
+  return result;
+}
+
+/**
+ * Serialize a key-value map to .env format.
+ *
+ * Keys are sorted alphabetically for deterministic output.
+ * Values are double-quoted when they contain whitespace, quotes, #, backslashes, or newlines.
+ */
+export function serializeDotenv(secrets: Record<string, string>): string {
+  const keys = Object.keys(secrets).sort();
+  if (keys.length === 0) return '';
+
+  const lines: string[] = [];
+
+  for (const key of keys) {
+    const value = secrets[key];
+
+    if (needsQuoting(value)) {
+      const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t');
+      lines.push(`${key}="${escaped}"`);
+    } else {
+      lines.push(`${key}=${value}`);
+    }
+  }
+
+  return lines.join('\n') + '\n';
+}
+
+function needsQuoting(value: string): boolean {
+  if (value === '') return true;
+  return /[\s"'#\\]/.test(value) || value.includes('\n');
+}