@hakopod/cli 0.1.0-alpha.1 → 0.1.0-alpha.2

package/README.md

@@ -51,8 +51,12 @@ Credentials and resumable deployment state live outside the source repository in
 `HAKOPOD_CLI_HOME` to use another protected directory. Files are written atomically
 with owner-only permissions; Windows uses the account profile's directory ACLs.
 Sessions expire after twelve hours and can be revoked in account security. Logout
-attempts server revocation and always removes local credentials. No passwords or
-provider tokens are requested by the terminal. Never commit CLI state to Git.
+attempts server revocation and always removes local credentials. Account login happens in the browser. Before deployment, missing application
+secrets can be entered with hidden terminal input or explicitly generated.
+Generation creates a random password, not a provider-issued API credential.
+Noninteractive runs stop with the missing names, including when using `--yes`.
+Secret values are sent directly to scoped storage and never saved in CLI state.
+Never commit CLI state to Git.
 
 Use an engine/Cloud server release containing npm CLI device-scope support. Older
 servers may expose only the image-based Go CLI API. That CLI remains available for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hakopod/cli",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.2",
   "description": "Guided Git deployments to Hakopod Cloud and self-hosted Hakopod",
   "type": "module",
   "license": "Apache-2.0",

package/src/main.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { Writable } from "node:stream";
 import { parseArgs } from "node:util";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
@@ -54,6 +55,36 @@ async function ask(label, fallback = "") {
     ).trim() || fallback
   );
 }
+async function askSecret(label) {
+  if (!stdin.isTTY) throw new Error("Secret input requires an interactive terminal.");
+  rl?.close(); rl = undefined;
+  let muted = false;
+  const output = new Writable({ write(chunk, encoding, done) { if (!muted) stdout.write(chunk, encoding); done(); } });
+  const secretInput = createInterface({ input: stdin, output, terminal: true });
+  try {
+    const result = secretInput.question(`${label} (hidden): `);
+    muted = true;
+    return await result;
+  } finally { secretInput.close(); stdout.write("\n"); }
+}
+async function setupSecrets(api, config, plan) {
+  const missing = plan.missing_secrets || [];
+  if (!missing.length) return;
+  if (!stdin.isTTY) throw new Error(`Missing application secrets: ${missing.map(clean).join(", ")}. Save them in the dashboard or through POST /api/v1/secrets/{name}, then retry. No deployment was submitted.`);
+  for (const name of missing) {
+    say(`Missing secret: ${name}`);
+    const mode = await choose("Secret value", [
+      { label: "Enter an existing value (hidden)", value: "value" },
+      { label: "Generate a new random password (not a provider credential)", value: "generate" },
+      { label: "Cancel deployment", value: "cancel" },
+    ]);
+    if (mode === "cancel") throw new Error("Secret setup cancelled. No deployment was submitted.");
+    const body = mode === "generate" ? { generate: true } : { value: await askSecret(clean(name)) };
+    const query = new URLSearchParams({ project: config.project, environment: config.environment, application: plan.spec.name });
+    try { await api.call(`/secrets/${encodeURIComponent(name)}?${query}`, body); }
+    finally { delete body.value; }
+  }
+}
 async function choose(label, items) {
   if (!items.length) throw new Error(`No ${label.toLowerCase()} available.`);
   items.forEach((item, index) => say(`${index + 1}. ${item.label}`));
@@ -425,6 +456,7 @@ async function main() {
     show(
       `Review deployment\n${JSON.stringify({ image: run.image, changes: plan.changes, warnings: plan.warnings }, null, 2)}`,
     );
+    await setupSecrets(api, config, plan);
     await confirm("Deploy this built image", flags.yes);
     const deployment = await api.call(`${base}/deploy`, {
       expected_revision: plan.expected_revision,