@fonderie/cli 0.2.1 → 0.3.0

package/bin/fonderie.mjs

@@ -286,11 +286,118 @@ function doAdd() {
   console.log(`\nMigrations run automatically on boot (InternalMigrationRunner above). Set DATABASE_URL and start the app.`);
 }
 
+// ── fonderie config|secret <verb> — manage a live deployment over the admin API ─
+// Thin client over @fonderie/config's /admin/* surface. Auth + endpoint come from
+// the environment so the LLM never handles the token inline:
+//   FONDERIE_ADMIN_URL   e.g. https://app.example.com
+//   FONDERIE_ADMIN_TOKEN the bootstrap admin token
+//   FONDERIE_ACTOR       optional — recorded on writes (X-Actor)
+async function adminFetch(method, path, body) {
+  const base = process.env.FONDERIE_ADMIN_URL;
+  const token = process.env.FONDERIE_ADMIN_TOKEN;
+  if (!base || !token) {
+    console.error('Set FONDERIE_ADMIN_URL and FONDERIE_ADMIN_TOKEN to manage a deployment.');
+    process.exit(1);
+  }
+  const headers = { authorization: `Bearer ${token}` };
+  if (body !== undefined) headers['content-type'] = 'application/json';
+  if (process.env.FONDERIE_ACTOR) headers['x-actor'] = process.env.FONDERIE_ACTOR;
+  const res = await fetch(base.replace(/\/$/, '') + path, {
+    method,
+    headers,
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+  const json = await res.json().catch(() => ({}));
+  if (res.status >= 400) {
+    console.error(json.explanation || json.reason || `HTTP ${res.status}`);
+    if (json.details) console.error(JSON.stringify(json.details));
+    process.exit(res.status === 409 ? 2 : 1); // 409 conflict → exit 2 (reload + retry)
+  }
+  const result = json.result;
+  console.log(typeof result === 'string' ? result : JSON.stringify(result, null, 2));
+}
+
+// The supported management verbs (kubectl-inspired) — the single source of truth
+// for the CLI's config/secret surface. Each maps to a method + optional path
+// suffix + what it requires (a key, a body value, a --to-version).
+const VERBS = {
+  get:      { method: 'GET',    needsKey: false },
+  set:      { method: 'PUT',    needsKey: true, needsValue: true },
+  delete:   { method: 'DELETE', needsKey: true },
+  history:  { method: 'GET',    needsKey: true, suffix: '/revisions' },
+  rollback: { method: 'POST',   needsKey: true, suffix: '/rollback', needsToVersion: true },
+  reveal:   { method: 'POST',   needsKey: true, suffix: '/reveal', secretOnly: true },
+};
+
+// config `value` is parsed (so `set flag true` stores a boolean); secrets stay raw strings.
+function parseValue(raw) {
+  try { return JSON.parse(raw); } catch { return raw; }
+}
+
+// Per-resource scope/value shape. config & secret scope by environment and carry
+// a `value`; templates scope by locale and carry `text` (+ optional subject/html).
+const RESOURCE_SHAPE = {
+  config:   { scopeFlag: '--env',    scopeParam: 'environment', valueKey: 'value' },
+  secret:   { scopeFlag: '--env',    scopeParam: 'environment', valueKey: 'value', rawValue: true },
+  template: { scopeFlag: '--locale', scopeParam: 'locale',      valueKey: 'text' },
+};
+
+async function resourceCmd(resource, base) {
+  const shape = RESOURCE_SHAPE[resource];
+  const verb = argv[1];
+  const spec = VERBS[verb];
+  if (!spec || (spec.secretOnly && resource !== 'secret')) return usageErr(resource);
+
+  const key = argv[2];
+  if (spec.needsKey && !key) return usageErr(resource);
+
+  const scope = arg(shape.scopeFlag, undefined);
+  const q = scope ? `?${shape.scopeParam}=${encodeURIComponent(scope)}` : '';
+  const enc = (k) => encodeURIComponent(k);
+
+  const path = spec.needsKey || key
+    ? `${base}/${enc(key)}${spec.suffix ?? ''}${q}`
+    : `${base}${q}`;
+
+  let body;
+  if (spec.needsValue) {
+    const raw = argv[3];
+    if (raw === undefined) { console.error(`usage: fonderie ${resource} set <key> <value>`); process.exit(1); }
+    body = { [shape.valueKey]: shape.rawValue ? String(raw) : parseValue(raw) };
+    if (scope) body[shape.scopeParam] = scope;
+    if (resource === 'template') {
+      const subject = arg('--subject', undefined);
+      const html = arg('--html', undefined);
+      if (subject !== undefined) body.subject = subject;
+      if (html !== undefined) body.html = html;
+    }
+    const ifVersion = arg('--if-version', undefined);
+    if (ifVersion !== undefined) body.ifVersion = Number(ifVersion);
+  } else if (spec.needsToVersion) {
+    const toVersion = Number(arg('--to-version'));
+    if (!Number.isInteger(toVersion)) { console.error('rollback needs --to-version <n>'); process.exit(1); }
+    body = { toVersion };
+    if (scope) body[shape.scopeParam] = scope;
+  }
+
+  return adminFetch(spec.method, path, body);
+}
+
+function usageErr(resource) {
+  const verbs = Object.keys(VERBS).filter((v) => !VERBS[v].secretOnly || resource === 'secret');
+  const scopeFlag = (RESOURCE_SHAPE[resource] ?? { scopeFlag: '--env' }).scopeFlag;
+  console.error(`usage: fonderie ${resource} <${verbs.join('|')}> [key] [value] [${scopeFlag} <s>] [--if-version <n>] [--to-version <n>]`);
+  process.exit(1);
+}
+
 // ── dispatch ────────────────────────────────────────────────────────────────
 if (cmd === 'query') doQuery();
 else if (cmd === 'skill') doSkill();
 else if (cmd === 'add') doAdd();
 else if (cmd === 'init') doInit();
+else if (cmd === 'config') resourceCmd('config', '/admin/config').catch((e) => { console.error(e.message); process.exit(1); });
+else if (cmd === 'secret') resourceCmd('secret', '/admin/secrets').catch((e) => { console.error(e.message); process.exit(1); });
+else if (cmd === 'template') resourceCmd('template', '/admin/templates').catch((e) => { console.error(e.message); process.exit(1); });
 else {
   console.log(`fonderie — the Fonderie CLI (lazy skills for coding agents)
 
@@ -300,6 +407,11 @@ else {
   fonderie query <concept>                         what to install for a capability
   fonderie query --concepts                        list every capability
 
+  fonderie config <get|set|delete|history|rollback> [key] [value] [--env <e>] [--if-version <n>] [--to-version <n>]
+  fonderie secret <get|set|delete|history|rollback|reveal> [key] [value] [--env <e>] ...
+  fonderie template <get|set|delete|history|rollback> [type] [text] [--locale <l>] [--subject <s>] [--html <h>] ...
+      manage a live deployment over its admin API — set FONDERIE_ADMIN_URL + FONDERIE_ADMIN_TOKEN
+
 Zero deps. No MCP server. A binary + markdown that runs in any agent harness.`);
   if (cmd && cmd !== 'help' && cmd !== '--help') process.exit(2);
 }

package/bin/fonderie.test.mjs

@@ -4,11 +4,14 @@
 // asserts `skill` writes a router + bodies, and `query` answers correctly.
 // Zero deps; exits non-zero on failure.
 
-import { execFileSync } from 'node:child_process';
+import { execFileSync, execFile } from 'node:child_process';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
+import { createServer } from 'node:http';
+import { promisify } from 'node:util';
+const execFileP = promisify(execFile);
 
 const here = dirname(fileURLToPath(import.meta.url));
 const bin = join(here, 'fonderie.mjs');
@@ -86,4 +89,58 @@ if (!/basic-auth/.test(addErr)) fail('add unknown-recipe error should list avail
 // help lists the add command
 if (!/fonderie add <capability>/.test(run(['help']))) fail('help missing `fonderie add`');
 
-console.log('fonderie CLI test: all assertions passed (skill, query installed/uninstalled, init wires idempotent fresh-keeping postinstall, add guards)');
+// ── config/secret management commands (thin client over the admin API) ──────
+// Uses async execFile so the in-process http fixture can respond (execFileSync
+// would block the event loop and deadlock the server).
+await (async () => {
+  const requests = [];
+  const server = createServer((req, res) => {
+    let raw = '';
+    req.on('data', (c) => { raw += c; });
+    req.on('end', () => {
+      requests.push({ method: req.method, url: req.url, auth: req.headers.authorization, actor: req.headers['x-actor'], body: raw ? JSON.parse(raw) : undefined });
+      if (req.url.includes('conflict')) {
+        res.writeHead(409, { 'content-type': 'application/json' });
+        res.end(JSON.stringify({ reason: 'VERSION_CONFLICT', explanation: 'stale', details: { currentVersion: 5 } }));
+        return;
+      }
+      res.writeHead(200, { 'content-type': 'application/json' });
+      res.end(JSON.stringify({ reason: 'OK', explanation: 'ok', result: { ok: true } }));
+    });
+  });
+  await new Promise((r) => server.listen(0, r));
+  const port = server.address().port;
+  const env = { ...process.env, FONDERIE_ADMIN_URL: `http://127.0.0.1:${port}`, FONDERIE_ADMIN_TOKEN: 'sekret', FONDERIE_ACTOR: 'ada' };
+  const cli = (args) => execFileP('node', [bin, ...args], { env });
+
+  await cli(['config', 'get']);
+  await cli(['config', 'set', 'feature.x', 'true']);
+  await cli(['config', 'history', 'feature.x']);
+  await cli(['config', 'rollback', 'feature.x', '--to-version', '2']);
+  await cli(['secret', 'reveal', 'stripe.key', '--env', 'prod']);
+
+  const find = (m, u) => requests.find((r) => r.method === m && r.url === u);
+  if (!find('GET', '/admin/config')?.auth?.includes('sekret')) fail('config get: wrong request/auth');
+  const set = find('PUT', '/admin/config/feature.x');
+  if (set?.body?.value !== true) fail('config set: value should parse to boolean true');
+  if (set?.actor !== 'ada') fail('config set: X-Actor not sent');
+  if (!find('GET', '/admin/config/feature.x/revisions')) fail('config history: wrong path');
+  if (find('POST', '/admin/config/feature.x/rollback')?.body?.toVersion !== 2) fail('rollback: toVersion body wrong');
+  if (!find('POST', '/admin/secrets/stripe.key/reveal?environment=prod')) fail('secret reveal: wrong path');
+
+  // 409 conflict → exit 2 (reload + retry)
+  let code = 0;
+  try { await cli(['config', 'set', 'conflict', 'x']); } catch (e) { code = e.code; }
+  if (code !== 2) fail(`409 conflict should exit 2, got ${code}`);
+
+  // missing env → exit 1 with guidance
+  let noEnvErr = '';
+  try { await execFileP('node', [bin, 'config', 'get'], { env: { ...process.env, FONDERIE_ADMIN_URL: '', FONDERIE_ADMIN_TOKEN: '' } }); }
+  catch (e) { noEnvErr = String(e.stderr || ''); }
+  if (!/FONDERIE_ADMIN_URL/.test(noEnvErr)) fail('missing-env should hint FONDERIE_ADMIN_URL');
+
+  server.close();
+  console.log('  ✓ config/secret management commands (get/set/history/rollback/reveal, 409→exit2, env guard)');
+})();
+
+console.log('fonderie CLI test: all assertions passed (skill, query installed/uninstalled, init wires idempotent fresh-keeping postinstall, add guards, config/secret management)');

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fonderie/cli",
-	"version": "0.2.1",
+	"version": "0.3.0",
 	"description": "The Fonderie CLI — teaches any coding agent the SDK without loading it eagerly. `fonderie skill` writes a lazy skill (a small router + per-package bodies read on demand); `fonderie query` answers what to install for a capability. Zero deps, runs anywhere.",
 	"keywords": [
 		"fonderie-js",