@faable/faable 4.2.0 → 4.3.0

package/dist/commands/deploy/waf/block.js

@@ -1,11 +1,12 @@
 import { requireApi } from '../../../api/context.js';
+import { print_json, json_option } from '../../../lib/listing.js';
 import { resolve_app_id } from '../resolve_app_id.js';
 import { add_rule } from './add_rule.js';
 
 const waf_block = {
     command: 'block [pattern]',
     describe: 'Block requests at the edge with a 403 (they never reach your app)',
-    builder: yargs => yargs
+    builder: yargs => json_option(yargs)
         .positional('pattern', {
         type: 'string',
         description: 'Anchored path regex, e.g. ^/\\.well-known/ (quote it in your shell)'
@@ -23,7 +24,7 @@ const waf_block = {
         .option('app', {
         alias: 'a',
         type: 'string',
-        description: 'App Identifier (defaults to the linked app)'
+        description: 'App id, name or slug (defaults to the linked app)'
     })
         .option('description', {
         alias: 'd',
@@ -56,7 +57,7 @@ const waf_block = {
         const ctx = await requireApi();
         const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
         const app = await ctx.api.getApp(app_id);
-        await add_rule({
+        const waf = await add_rule({
             api: ctx.api,
             app_id,
             app_name: app.name,
@@ -66,8 +67,11 @@ const waf_block = {
             query: args.query,
             action: 'deny',
             description: args.description,
-            force: args.force
+            force: args.force,
+            json: args.json
         });
+        if (args.json)
+            print_json(waf);
     }
 };
 

package/dist/commands/deploy/waf/list.js

@@ -11,7 +11,7 @@ const waf_list = {
         .option('app', {
         alias: 'a',
         type: 'string',
-        description: 'App Identifier (defaults to the linked app)'
+        description: 'App id, name or slug (defaults to the linked app)'
     })
         .example('$0 deploy waf list', 'Show the rules protecting the linked app')
         .showHelpOnFail(false),

package/dist/commands/deploy/waf/rm.js

@@ -1,4 +1,5 @@
 import { requireApi } from '../../../api/context.js';
+import { print_json, json_option } from '../../../lib/listing.js';
 import { log } from '../../../log.js';
 import { resolve_app_id } from '../resolve_app_id.js';
 import { describe_selector } from './add_rule.js';
@@ -6,7 +7,7 @@ import { describe_selector } from './add_rule.js';
 const waf_rm = {
     command: 'rm [pattern]',
     describe: 'Remove one of your WAF rules',
-    builder: yargs => yargs
+    builder: yargs => json_option(yargs)
         .positional('pattern', {
         type: 'string',
         description: 'The exact pattern to remove (see `faable deploy waf list`)'
@@ -32,7 +33,7 @@ const waf_rm = {
         .option('app', {
         alias: 'a',
         type: 'string',
-        description: 'App Identifier (defaults to the linked app)'
+        description: 'App id, name or slug (defaults to the linked app)'
     })
         .check(({ pattern, userAgent, query }) => {
         if (!pattern && !userAgent && !query) {
@@ -47,12 +48,14 @@ const waf_rm = {
         const ctx = await requireApi();
         const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
         const app = await ctx.api.getApp(app_id);
-        await ctx.api.removeAppWafRule(app_id, {
+        const waf = await ctx.api.removeAppWafRule(app_id, {
             pattern: args.pattern,
             user_agent: args.userAgent,
             query: args.query,
             action: args.action
         });
+        if (args.json)
+            return print_json(waf);
         log.info(`🗑️  Removed ${describe_selector({
             pattern: args.pattern,
             user_agent: args.userAgent,

package/dist/commands/deploy/waf/sink.js

@@ -1,11 +1,12 @@
 import { requireApi } from '../../../api/context.js';
+import { print_json, json_option } from '../../../lib/listing.js';
 import { resolve_app_id } from '../resolve_app_id.js';
 import { add_rule } from './add_rule.js';
 
 const waf_sink = {
     command: 'sink [pattern]',
     describe: 'Answer requests with a 404 from Faable, without waking your app',
-    builder: yargs => yargs
+    builder: yargs => json_option(yargs)
         .positional('pattern', {
         type: 'string',
         description: 'Anchored path regex, e.g. ^/robots\\.txt$ (quote it in your shell)'
@@ -23,7 +24,7 @@ const waf_sink = {
         .option('app', {
         alias: 'a',
         type: 'string',
-        description: 'App Identifier (defaults to the linked app)'
+        description: 'App id, name or slug (defaults to the linked app)'
     })
         .option('description', {
         alias: 'd',
@@ -57,7 +58,7 @@ const waf_sink = {
         const ctx = await requireApi();
         const app_id = await resolve_app_id(args.app, ctx.appId, ctx.api);
         const app = await ctx.api.getApp(app_id);
-        await add_rule({
+        const waf = await add_rule({
             api: ctx.api,
             app_id,
             app_name: app.name,
@@ -67,8 +68,11 @@ const waf_sink = {
             query: args.query,
             action: 'sink',
             description: args.description,
-            force: args.force
+            force: args.force,
+            json: args.json
         });
+        if (args.json)
+            print_json(waf);
     }
 };
 

package/dist/commands/whoami/index.js

@@ -1,4 +1,3 @@
-import { log } from '../../log.js';
 import { getMe } from '../../api/auth.js';
 import { resolveTenant } from '../../api/auth_admin.js';
 import { FaableApi } from '../../api/FaableApi.js';
@@ -7,6 +6,7 @@ import { loadLiveCredentials } from '../../api/session.js';
 import { bearer_strategy } from '../../api/strategies/bearer.strategy.js';
 import { CredentialsStore } from '../../lib/CredentialsStore.js';
 import { print_json, print, json_option } from '../../lib/listing.js';
+import { CliError, NOT_LOGGED_IN } from '../../lib/errors.js';
 
 // Who you are, and what the CLI acts on: the active project and the Auth
 // tenant `faable auth` would manage. The context is best-effort — a missing
@@ -50,8 +50,7 @@ const whoami = {
                 print(`Logged in as: ${config.email} (API key)`);
                 return;
             }
-            log.error("❌ Not logged in. Run 'faable login' first.");
-            process.exit(1);
+            throw new CliError("not_logged_in", NOT_LOGGED_IN);
         }
         let me;
         try {
@@ -59,9 +58,8 @@ const whoami = {
             // has no /me route.
             me = await getMe(token);
         }
-        catch {
-            log.error("❌ Not logged in or session expired");
-            process.exit(1);
+        catch (e) {
+            throw new CliError("session_expired", "Your Faable session has expired or is invalid. Run `faable login` to sign in again.", { status: 401, cause: e });
         }
         const { project, tenant } = await describeContext(token);
         if (args.json) {

package/dist/index.js

@@ -12,6 +12,8 @@ import { version } from './config.js';
 import { Configuration } from './lib/Configuration.js';
 import { setProjectFlag, configuredProject } from './api/project.js';
 import { ContextStore } from './lib/ContextStore.js';
+import { CliError, error_json } from './lib/errors.js';
+import { is_non_interactive } from './lib/interactive.js';
 import { notifyIfUpdateAvailable } from './lib/UpdateChecker.js';
 import { log } from './log.js';
 
@@ -27,7 +29,11 @@ const project_badge = async () => {
     const { project_name } = await new ContextStore().load();
     return ` · project ${project_name ?? configured.ref}`;
 };
-const wants_json = () => process.argv.includes('--json');
+// A program is reading: errors go out as JSON on stderr.
+const wants_json = () => process.argv.includes('--json') || is_non_interactive();
+const fail_json = (err) => {
+    process.stderr.write(JSON.stringify(error_json(err)) + '\n');
+};
 // yargs re-runs before-validation middlewares once per nested command level
 // (`deploy secrets` = 2 runs), so keep the banner and update check to one.
 let banner_shown = false;
@@ -46,7 +52,10 @@ yg.scriptName('faable')
     // whose stdout IS the export.
     const exports_to_stdout = argv._.slice(0, 3).join(' ') === 'auth users export' && !argv.file;
     // Nor when nobody is watching stderr (a script, the MCP server).
-    if (argv.json || exports_to_stdout || !process.stderr.isTTY)
+    if (argv.json ||
+        exports_to_stdout ||
+        !process.stderr.isTTY ||
+        is_non_interactive())
         return;
     log.info(`Faable CLI ${version}${await project_badge()}`);
     // `upgrade` does its own (forced) check
@@ -58,6 +67,11 @@ yg.scriptName('faable')
     alias: 'config',
     description: 'Path to the local `faable.json` file',
     string: true
+})
+    .option('non-interactive', {
+    description: 'Never prompt nor infer the app from the working directory; errors as JSON (env FAABLE_NONINTERACTIVE=1)',
+    boolean: true,
+    global: true
 })
     .option('p', {
     alias: 'project',
@@ -93,16 +107,10 @@ yg.scriptName('faable')
     .fail(function (msg, err) {
     if (err) {
         // With --json the caller is a program: the error as JSON too, on
-        // stderr, so it can tell a 404 from a 403 without parsing prose.
+        // stderr, so it can tell a 404 from a 403 without parsing prose
+        // (codes in lib/errors.ts).
         if (wants_json()) {
-            const e = err;
-            process.stderr.write(JSON.stringify({
-                error: {
-                    message: e.message,
-                    ...(e.code ? { code: e.code } : {}),
-                    ...(e.status ? { status: e.status } : {})
-                }
-            }) + '\n');
+            fail_json(err);
         }
         else {
             log.error(`❌ ${err.message}`);
@@ -111,18 +119,25 @@ yg.scriptName('faable')
         return;
     }
     if (msg) {
-        // Validation failure (unknown command, missing subcommand…): show the
-        // help, then fail red — a bad invocation must not exit 0.
-        yg.showHelp();
-        log.error(`❌ ${msg}`);
         // The one unknown command worth naming: an app id passed positionally.
         // `faable deploy <app_id> secrets list` used to deploy the working
         // directory instead of listing secrets, so the id now lives in a flag —
         // say so, or the migration reads as the CLI having lost a feature.
         const stray = /Unknown commands?: (app_[A-Za-z0-9_-]+)/.exec(msg);
-        if (stray) {
-            log.error(`The app id goes in a flag, not as an argument: faable deploy --app ${stray[1]} [subcommand]`);
+        const hint = stray
+            ? `The app id goes in a flag, not as an argument: faable deploy --app ${stray[1]} [subcommand]`
+            : undefined;
+        if (wants_json()) {
+            // A program built a bad argv: no help screen, just the reason.
+            fail_json(new CliError('usage', hint ? `${msg}. ${hint}` : msg));
+            process.exit(1);
         }
+        // Validation failure (unknown command, missing subcommand…): show the
+        // help, then fail red — a bad invocation must not exit 0.
+        yg.showHelp();
+        log.error(`❌ ${msg}`);
+        if (hint)
+            log.error(hint);
         process.exit(1);
     }
 })

package/dist/lib/errors.js

@@ -0,0 +1,31 @@
+class CliError extends Error {
+    code;
+    status;
+    action;
+    constructor(code, message, extra = {}) {
+        super(message, extra.cause === undefined ? undefined : { cause: extra.cause });
+        this.name = 'CliError';
+        this.code = code;
+        if (extra.status !== undefined)
+            this.status = extra.status;
+        if (extra.action !== undefined)
+            this.action = extra.action;
+    }
+}
+// The JSON body of a failure, from any error: a CliError, a FaableApi error
+// (which carries status/code/action) or a plain Error.
+const error_json = (err) => {
+    const e = (err ?? {});
+    const message = e.message || String(err);
+    return {
+        error: {
+            message,
+            ...(e.code ? { code: e.code } : {}),
+            ...(e.status ? { status: e.status } : {}),
+            ...(e.action ? { action: e.action } : {})
+        }
+    };
+};
+const NOT_LOGGED_IN = "Not logged in. Run 'faable login' first.";
+
+export { CliError, NOT_LOGGED_IN, error_json };

package/dist/lib/interactive.js

@@ -0,0 +1,45 @@
+import prompts from 'prompts';
+import { CliError } from './errors.js';
+
+// Non-interactive mode: FAABLE_NONINTERACTIVE=1 or the global
+// --non-interactive flag. A program drives the CLI (the Faable MCP server sets
+// it on every call), so:
+//
+//   - no prompt is ever shown: a confirmation without --yes is an error
+//     (`confirmation_required`), never a silent "Cancelled." with exit 0;
+//   - nothing is inferred from the working directory: the app comes from
+//     --app, never from faable.json or the git remote of wherever the process
+//     happens to run (see find_app_id);
+//   - `deploy launch` needs --yes, --app and --workdir spelled out;
+//   - errors are JSON on stderr, as with --json.
+//
+// Opt-in rather than "no TTY": CI runs without one and `faable deploy` there
+// must keep deploying unattended.
+const is_non_interactive = (env = process.env, argv = process.argv) => ['1', 'true'].includes((env.FAABLE_NONINTERACTIVE ?? '').toLowerCase()) ||
+    argv.includes('--non-interactive');
+// Ask before something destructive. True to go ahead, false when the person
+// said no. Throws `confirmation_required` when nobody can answer: in
+// non-interactive mode, or when stdin/stderr are not a terminal (prompts
+// would otherwise resolve undefined and the command would report a
+// cancellation as a clean exit 0 that a caller reads as success).
+//
+// The prompt is drawn on stderr: stdout carries data only.
+const confirm = async (opts) => {
+    if (opts.yes)
+        return true;
+    if (is_non_interactive() || !process.stdin.isTTY || !process.stderr.isTTY) {
+        throw new CliError('confirmation_required', `${opts.message} — confirmation needed: pass --yes.`);
+    }
+    const { confirm } = await prompts({
+        type: 'toggle',
+        name: 'confirm',
+        message: opts.message,
+        initial: false,
+        active: 'yes',
+        inactive: 'no',
+        stdout: process.stderr
+    }, { onCancel: () => false });
+    return !!confirm;
+};
+
+export { confirm, is_non_interactive };

package/dist/lib/listing.js

@@ -72,6 +72,10 @@ const print = (line = '') => {
 const print_json = (data) => {
     print(JSON.stringify(data, null, 2));
 };
+// A write that had nothing to do (no failed deployment to retry, nothing in
+// flight to cancel). Exit 0 — it is not an error — but said in the data, so a
+// caller never mistakes it for the thing having happened.
+const print_noop = (reason) => print_json({ result: 'noop', reason });
 // The rerun hint for the next page, on stderr (the logger's): shown to a
 // person, invisible to a pipe.
 const more_hint = (page) => page.has_more
@@ -88,4 +92,4 @@ const table_lines = (headers, rows) => {
     return [render(headers), ...rows.map(render)];
 };
 
-export { DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE, as_list, fetch_page, from_paginator, json_option, list_options, more_hint, print, print_json, table_lines };
+export { DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE, as_list, fetch_page, from_paginator, json_option, list_options, more_hint, print, print_json, print_noop, table_lines };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",