@faable/faable 1.11.0 → 1.12.1

package/dist/api/FaableApi.js

@@ -79,6 +79,15 @@ class FaableApi {
     async getAppSecrets(app_id) {
         return firstPage(data(this.client.get(`/secret/${app_id}`)));
     }
+    // Replace the app's whole secret set (the endpoint deletes and recreates).
+    // This is the only mutation path that triggers an immediate restart of the
+    // app; the per-secret upsert/delete endpoints are not used by the CLI.
+    // The endpoint stamps the created secrets with the team from the request
+    // context, which a CLI user token does not carry — pass the app's team
+    // (from getApp) so it travels as the `x-faable-team` header.
+    async createSecretsBatch(context_id, team, secrets) {
+        return data(this.client.post(`/secret/createbatch`, { context_id, secrets }, { headers: { "x-faable-team": team } }));
+    }
     async updateApp(app_id, params) {
         return data(this.client.post(`/app/${app_id}`, params));
     }

package/dist/commands/deploy/index.js

@@ -1,17 +1,24 @@
 import { requireApi } from '../../api/context.js';
 import { Configuration } from '../../lib/Configuration.js';
 import { log } from '../../log.js';
+import { link } from '../link/index.js';
 import { plan_summary } from './buildpacks/Buildpack.js';
 import { detect_buildpack, get_buildpack, buildpack_names } from './buildpacks/registry.js';
 import { check_environment } from './check_environment.js';
 import { git_context } from './git_context.js';
+import { resolve_app_id } from './resolve_app_id.js';
+import { secrets } from './secrets/index.js';
 import { upload_tag } from './upload_tag.js';
 
 const deploy = {
     command: 'deploy [app_id]',
     describe: 'Deploy a faable app',
     builder: yargs => {
+        // Product subcommands live under `deploy` (yargs matches them before the
+        // app_id positional, so `faable deploy <app_id>` keeps working).
         return yargs
+            .command(secrets)
+            .command(link)
             .positional('app_id', {
             type: 'string',
             description: 'App Identifier'
@@ -37,14 +44,7 @@ const deploy = {
         // build thinking happens here; build() below just executes the plan.
         const config = Configuration.instance().deployConfig();
         const plan = await detect_buildpack({ workdir, config }, args.buildpack || config.buildpack);
-        // app_id resolution (the user never has to look one up):
-        //  1. explicit positional (monorepo escape hatch)
-        //  2. OIDC in CI — the backend resolves the app from the linked repository
-        //  3. locally — the app saved by `faable link` in faable.json
-        const app_id = args.app_id || ctx.appId || Configuration.instance().app_id;
-        if (!app_id) {
-            throw new Error('No app linked to this repository. Run "faable link" to link it (or link it from the dashboard).');
-        }
+        const app_id = await resolve_app_id(args.app_id, ctx.appId, api, workdir);
         const app = await api.getApp(app_id);
         // Check if we can build docker images
         await check_environment();

package/dist/commands/deploy/resolve_app_id.js

@@ -0,0 +1,33 @@
+import { Configuration } from '../../lib/Configuration.js';
+import { getGitRemoteUrl } from '../../lib/git_remote.js';
+import { log } from '../../log.js';
+
+// app_id resolution (the user never has to look one up):
+//  1. explicit (positional on `deploy`, --app on subcommands)
+//  2. OIDC in CI — the backend resolves the app from the linked repository
+//  3. locally — the app saved by `faable deploy link` in faable.json
+//  4. locally — the app whose linked repository matches the git origin remote
+//     of the working directory (repos are connected in the dashboard when the
+//     app is created, so most working copies never ran `link`)
+const resolve_app_id = async (explicit, ctxAppId, api, workdir = process.cwd()) => {
+    const app_id = explicit || ctxAppId || Configuration.instance().app_id;
+    if (app_id)
+        return app_id;
+    const repository = await getGitRemoteUrl(workdir);
+    if (repository) {
+        const apps = await api.list();
+        const matches = apps.filter(app => app.repository === repository);
+        if (matches.length === 1) {
+            const app = matches[0];
+            log.info(`🔎 Detected app "${app.name}" (${app.id}) from repository ${repository}`);
+            return app.id;
+        }
+        if (matches.length > 1) {
+            const ids = matches.map(app => `${app.name} (${app.id})`).join(', ');
+            throw new Error(`Repository ${repository} is linked to several apps: ${ids}. Pass the app explicitly.`);
+        }
+    }
+    throw new Error('No app linked to this repository. Link it from the dashboard (or run "faable deploy link"), or pass the app explicitly.');
+};
+
+export { resolve_app_id };

package/dist/commands/deploy/secrets/index.js

@@ -0,0 +1,19 @@
+import { secrets_list } from './list.js';
+import { secrets_rm } from './rm.js';
+import { secrets_set } from './set.js';
+
+const secrets = {
+    command: 'secrets <command>',
+    describe: 'Manage app secrets (environment variables)',
+    builder: yargs => yargs
+        .command(secrets_list)
+        .command(secrets_set)
+        .command(secrets_rm)
+        .demandCommand(1, 'Specify a secrets command: list, set or rm'),
+    handler: () => {
+        // Unreachable: demandCommand(1) either routes to a subcommand or fails
+        // through the global .fail() in src/index.ts.
+    }
+};
+
+export { secrets };

package/dist/commands/deploy/secrets/list.js

@@ -0,0 +1,45 @@
+import { requireApi } from '../../../api/context.js';
+import { log } from '../../../log.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+import { mask_value } from './mask.js';
+
+const secrets_list = {
+    command: 'list',
+    describe: 'List app secrets (values masked by default)',
+    builder: yargs => yargs
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App Identifier (defaults to the linked app)'
+    })
+        .option('show', {
+        type: 'boolean',
+        default: false,
+        description: 'Reveal full secret values'
+    })
+        .example('$0 deploy secrets list', 'List secrets of the linked app (masked)')
+        .example('$0 deploy secrets list --show', 'Reveal full values')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        const secrets = await ctx.api.getAppSecrets(app_id);
+        if (secrets.length === 0) {
+            log.info(`🔐 No secrets set for ${app_id}.`);
+            return;
+        }
+        log.info(`🔐 ${secrets.length} secret(s) for ${app_id}:`);
+        const width = Math.max(...secrets.map(s => s.name.length));
+        const sorted = [...secrets].sort((a, b) => a.name.localeCompare(b.name));
+        for (const secret of sorted) {
+            const value = args.show ? secret.value : mask_value(secret.value);
+            const origin = secret.related_model === 'profile' ? '  (inherited from team profile)' : '';
+            log.info(`  ${secret.name.padEnd(width)}  ${value}${origin}`);
+        }
+        if (!args.show) {
+            log.info(`Use --show to reveal full values.`);
+        }
+    }
+};
+
+export { secrets_list };

package/dist/commands/deploy/secrets/mask.js

@@ -0,0 +1,12 @@
+const MIN_REVEAL_LENGTH = 8;
+// Short values are fully masked with a fixed-width dot run so their real
+// length is not leaked; longer ones show a 4-char prefix for recognition.
+const mask_value = (value) => {
+    if (value.length === 0)
+        return '(empty)';
+    if (value.length < MIN_REVEAL_LENGTH)
+        return '••••••';
+    return `${value.slice(0, 4)}…`;
+};
+
+export { mask_value };

package/dist/commands/deploy/secrets/merge.js

@@ -0,0 +1,34 @@
+// The mutation endpoint (`/secret/createbatch`) replaces the app's whole
+// secret set, so every change is a read-merge-replace over the CURRENT
+// app-scoped secrets. GET /secret/:app_id also returns secrets inherited
+// from the team profile — those must never be written back through the app
+// context (they would be copied down as app secrets), hence the
+// related_model filter.
+const app_scoped = (existing) => existing
+    .filter(s => s.related_model === 'app')
+    .map(s => ({ name: s.name, value: s.value }));
+// Upsert `updates` into the app's secrets: existing names are overwritten,
+// new names appended. Returns the full set to send to createbatch.
+const merge_app_secrets = (existing, updates) => {
+    const merged = new Map(app_scoped(existing).map(p => [p.name, p.value]));
+    for (const { name, value } of updates) {
+        merged.set(name, value);
+    }
+    return [...merged.entries()].map(([name, value]) => ({ name, value }));
+};
+// Remove one secret by name. Throws when the name is not an app-scoped
+// secret — with a dedicated hint when it exists but belongs to the team
+// profile (not manageable through the app context).
+const remove_app_secret = (existing, name) => {
+    const app_secrets = app_scoped(existing);
+    if (!app_secrets.some(p => p.name === name)) {
+        if (existing.some(s => s.related_model === 'profile' && s.name === name)) {
+            throw new Error(`"${name}" is inherited from the team profile and cannot be removed from the app. Manage team secrets from the dashboard.`);
+        }
+        const names = app_secrets.map(p => p.name).sort().join(', ') || '(none)';
+        throw new Error(`Secret "${name}" not found. Existing secrets: ${names}`);
+    }
+    return app_secrets.filter(p => p.name !== name);
+};
+
+export { merge_app_secrets, remove_app_secret };

package/dist/commands/deploy/secrets/parse_pairs.js

@@ -0,0 +1,26 @@
+// API limits for a secret (mirrors the server-side schema).
+const NAME_MAX = 255;
+const VALUE_MAX = 50000;
+// Split each "KEY=VALUE" on the FIRST '=' only, so values may contain '='.
+// An empty value ("KEY=") is allowed — it is a legitimate way to blank a
+// secret. Throws on the first invalid pair so callers can validate the whole
+// input before writing anything.
+const parse_pairs = (inputs) => {
+    return inputs.map(raw => {
+        const idx = raw.indexOf('=');
+        if (idx <= 0) {
+            throw new Error(`Invalid secret "${raw}". Expected KEY=VALUE (e.g. DATABASE_URL=postgres://...).`);
+        }
+        const name = raw.slice(0, idx);
+        const value = raw.slice(idx + 1);
+        if (name.length > NAME_MAX) {
+            throw new Error(`Secret name "${name.slice(0, 32)}…" exceeds ${NAME_MAX} characters.`);
+        }
+        if (value.length > VALUE_MAX) {
+            throw new Error(`Value for "${name}" exceeds ${VALUE_MAX} characters.`);
+        }
+        return { name, value };
+    });
+};
+
+export { NAME_MAX, VALUE_MAX, parse_pairs };

package/dist/commands/deploy/secrets/rm.js

@@ -0,0 +1,59 @@
+import prompts from 'prompts';
+import { requireApi } from '../../../api/context.js';
+import { log } from '../../../log.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+import { remove_app_secret } from './merge.js';
+
+const secrets_rm = {
+    command: 'rm <name>',
+    describe: 'Remove a secret by name',
+    builder: yargs => yargs
+        .positional('name', {
+        type: 'string',
+        demandOption: true,
+        description: 'Secret name'
+    })
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App Identifier (defaults to the linked app)'
+    })
+        .option('yes', {
+        alias: 'y',
+        type: 'boolean',
+        default: false,
+        description: 'Skip the confirmation prompt'
+    })
+        .example('$0 deploy secrets rm API_KEY', 'Remove API_KEY after confirmation')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        // Mutations go through createbatch (replace-all), so compute the
+        // remaining set first — this also rejects unknown names and secrets
+        // inherited from the team profile.
+        const app = await ctx.api.getApp(app_id);
+        const secrets = await ctx.api.getAppSecrets(app_id);
+        const remaining = remove_app_secret(secrets, args.name);
+        if (!args.yes) {
+            // In a non-TTY run without --yes, prompts resolves undefined → cancel.
+            const { confirm } = await prompts({
+                type: 'toggle',
+                name: 'confirm',
+                message: `Remove secret "${args.name}" from ${app_id}?`,
+                initial: false,
+                active: 'yes',
+                inactive: 'no'
+            });
+            if (!confirm) {
+                log.info('Cancelled.');
+                return;
+            }
+        }
+        await ctx.api.createSecretsBatch(app.id, app.team, remaining);
+        log.info(`🗑️ Removed secret ${args.name} from ${app_id}.`);
+        log.info(`ℹ️ The app is restarting to apply the changes.`);
+    }
+};
+
+export { secrets_rm };

package/dist/commands/deploy/secrets/set.js

@@ -0,0 +1,48 @@
+import { requireApi } from '../../../api/context.js';
+import { log } from '../../../log.js';
+import { resolve_app_id } from '../resolve_app_id.js';
+import { merge_app_secrets } from './merge.js';
+import { parse_pairs } from './parse_pairs.js';
+
+const secrets_set = {
+    command: 'set <pairs...>',
+    describe: 'Set one or more secrets as KEY=VALUE',
+    builder: yargs => yargs
+        .positional('pairs', {
+        type: 'string',
+        array: true,
+        demandOption: true,
+        description: 'KEY=VALUE pairs (quote values containing spaces)'
+    })
+        .option('app', {
+        alias: 'a',
+        type: 'string',
+        description: 'App Identifier (defaults to the linked app)'
+    })
+        .example('$0 deploy secrets set API_KEY=abc123', 'Set a single secret')
+        .example('$0 deploy secrets set A=1 DB_URL=postgres://u:p@host/db', 'Set several at once (values may contain "=")')
+        .showHelpOnFail(false),
+    handler: async (args) => {
+        // Validate ALL pairs before writing ANY, so one malformed pair aborts the
+        // whole command with no partial writes.
+        const parsed = parse_pairs(args.pairs);
+        const ctx = await requireApi();
+        const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
+        // getApp also validates access to the app and provides the team the
+        // batch endpoint requires as request context.
+        const app = await ctx.api.getApp(app_id);
+        const existing = await ctx.api.getAppSecrets(app_id);
+        const merged = merge_app_secrets(existing, parsed);
+        await ctx.api.createSecretsBatch(app.id, app.team, merged);
+        const current = new Set(existing.filter(s => s.related_model === 'app').map(s => s.name));
+        for (const { name } of parsed) {
+            log.info(current.has(name)
+                ? `🔑 Updated secret ${name} on ${app_id}`
+                : `🔑 Added secret ${name} to ${app_id}`);
+        }
+        log.info(`✅ ${parsed.length} secret(s) saved to ${app_id}.`);
+        log.info(`ℹ️ The app is restarting to apply the changes.`);
+    }
+};
+
+export { secrets_set };

package/dist/commands/link/index.js

@@ -1,28 +1,10 @@
 import { requireApi } from '../../api/context.js';
 import prompts from 'prompts';
 import { log } from '../../log.js';
-import { cmd } from '../../lib/cmd.js';
 import { Configuration } from '../../lib/Configuration.js';
+import { getGitRemoteUrl } from '../../lib/git_remote.js';
 import { workflowExists, DEPLOY_WORKFLOW_PATH, writeWorkflow, DEPLOY_DOCS_URL, DEPLOY_WORKFLOW_YAML } from './workflow_template.js';
 
-const getGitRemoteUrl = async (workdir) => {
-    try {
-        const { stdout } = await cmd("git remote get-url origin", { cwd: workdir });
-        const url = stdout?.toString().trim();
-        if (!url)
-            return undefined;
-        // Extract org/repo from github urls
-        const match = url.match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
-        if (match) {
-            return match[1];
-        }
-        return url;
-    }
-    catch {
-        log.warn("Could not detect git remote origin URL.");
-        return undefined;
-    }
-};
 const link = {
     command: "link",
     describe: "Link the local repository with a Faable app",
@@ -121,6 +103,18 @@ const link = {
         await setupDeployWorkflow(workdir);
     },
 };
+// Top-level `faable link` predates the per-product layout (`faable deploy link`).
+// Kept as a hidden alias so existing docs/scripts don't break; remove in a
+// future major.
+const link_deprecated = {
+    ...link,
+    describe: false,
+    deprecated: true,
+    handler: async (args) => {
+        log.warn('⚠️ "faable link" is deprecated, use "faable deploy link".');
+        await link.handler(args);
+    }
+};
 const setupDeployWorkflow = async (workdir) => {
     if (workflowExists(workdir)) {
         log.info(`Deploy workflow already present at ${DEPLOY_WORKFLOW_PATH}. Commit & push to "main" to deploy.`);
@@ -149,4 +143,4 @@ const setupDeployWorkflow = async (workdir) => {
     }
 };
 
-export { link };
+export { link, link_deprecated };

package/dist/index.js

@@ -1,7 +1,7 @@
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
 import { deploy } from './commands/deploy/index.js';
-import { link } from './commands/link/index.js';
+import { link_deprecated } from './commands/link/index.js';
 import { login } from './commands/login/index.js';
 import { logout } from './commands/logout/index.js';
 import { whoami } from './commands/whoami/index.js';
@@ -33,7 +33,7 @@ yg.scriptName('faable')
     .command(login)
     .command(logout)
     .command(whoami)
-    .command(link)
+    .command(link_deprecated)
     .demandCommand(1)
     .help()
     .fail(function (msg, err) {

package/dist/lib/git_remote.js

@@ -0,0 +1,37 @@
+import { spawn } from 'promisify-child-process';
+import { log } from '../log.js';
+
+// Returns the "org/repo" slug of the git origin remote (the format the API
+// stores in `app.repository`), the raw URL for non-GitHub remotes, or
+// undefined when there is no usable remote.
+//
+// This is a best-effort auto-detection: running outside a git repository (or
+// without an `origin` remote) is an expected, benign case, so failures are
+// swallowed at debug level — never surfaced as errors/warnings. It does NOT
+// go through `cmd()` on purpose: that helper loudly logs stderr and the exit
+// code, which is right for user-invoked build steps but pure noise here.
+const getGitRemoteUrl = async (workdir) => {
+    try {
+        const child = spawn('git', ['remote', 'get-url', 'origin'], {
+            encoding: 'utf8',
+            stdio: 'pipe',
+            cwd: workdir
+        });
+        const { stdout } = await child;
+        const url = stdout?.toString().trim();
+        if (!url)
+            return undefined;
+        // Extract org/repo from github urls
+        const match = url.match(/github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
+        if (match) {
+            return match[1];
+        }
+        return url;
+    }
+    catch {
+        log.debug('No git origin remote detected; skipping repo-based app lookup.');
+        return undefined;
+    }
+};
+
+export { getGitRemoteUrl };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.11.0",
+  "version": "1.12.1",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",