@tonbo/cli 0.14.0 → 0.14.1

package/dist/bin/tonbo.js

@@ -2,7 +2,7 @@
 
 // src/app.ts
 import { Command, InvalidArgumentError, Option } from "commander";
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 
 // ../../packages/tonbo-cli-core/dist/src/generated/contracts.js
 var agentNameContract = {
@@ -815,6 +815,38 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo machine shapes"
   },
+  "listMachineSecrets": {
+    "method": "GET",
+    "path": "/machines/{name}/secrets",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine secret list"
+  },
+  "setMachineSecret": {
+    "method": "PUT",
+    "path": "/machines/{name}/secrets/{key}",
+    "pathParams": [
+      "name",
+      "key"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine secret set"
+  },
+  "unsetMachineSecret": {
+    "method": "DELETE",
+    "path": "/machines/{name}/secrets/{key}",
+    "pathParams": [
+      "name",
+      "key"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine secret unset"
+  },
   "execMachineCommand": {
     "method": "POST",
     "path": "/machines/{name}/exec",
@@ -1644,6 +1676,11 @@ var machineTimings = {
   "wakeHoldSeconds": 25,
   "earlyReclaimSeconds": 120
 };
+var machineSecretLimits = {
+  "perMachine": 64,
+  "valueMaxBytes": 65536,
+  "totalMaxBytes": 262144
+};
 
 // ../../packages/tonbo-cli-core/dist/src/bearer.js
 var MANAGEMENT_AUDIENCE = cliSessionContract.audiences.management;
@@ -1923,6 +1960,21 @@ var ManagementApi = class {
   listMachines(key, page) {
     return this.page("listMachines", key, page);
   }
+  async listMachineSecrets(key, name) {
+    const answer = await this.request("listMachineSecrets", key, {
+      params: { name }
+    });
+    return answer.data;
+  }
+  setMachineSecret(key, name, secretKey, value) {
+    return this.call("setMachineSecret", key, {
+      params: { name, key: secretKey },
+      body: value
+    });
+  }
+  unsetMachineSecret(key, name, secretKey) {
+    return this.request("unsetMachineSecret", key, { params: { name, key: secretKey } });
+  }
   /**
    * A replay with the same idempotency key returns the Machine the first
    * request created, so a transport failure or a 5xx answer is retried here
@@ -4442,6 +4494,7 @@ import { Help } from "commander";
 
 // src/machine.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
+import { readFileSync } from "node:fs";
 
 // src/volume.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
@@ -4479,7 +4532,19 @@ function volumeFields(volume) {
     ["Machine", boundText(volume)],
     ["Size", `${volume.size_gib} GiB`],
     ["Live bytes", `${bytes(volume.live_bytes)} (billed)`],
-    ["Last commit", volume.last_commit_at ?? "none yet"],
+    ["Last meter report", volume.last_commit_at ?? "none yet"],
+    [
+      "Restored to",
+      volume.restored_to ? `${volume.restored_to.committed_at} (generation ${volume.restored_to.data_generation})` : "none"
+    ],
+    [
+      "Backed up to",
+      volume.backed_up_to ? volume.backed_up_to.committed_at ? `${volume.backed_up_to.committed_at} (generation ${volume.backed_up_to.data_generation}; ${volume.backed_up_to.dirty_bytes} bytes pending copy)` : `empty snapshot (generation ${volume.backed_up_to.data_generation}; ${volume.backed_up_to.dirty_bytes} bytes pending copy)` : "unknown"
+    ],
+    [
+      "Cold GETs",
+      volume.cold ? `${volume.cold.demand_gets} demand, ${volume.cold.hydrate_gets} hydration` : "none"
+    ],
     ["Durability", VOLUME_DURABILITY_LINK],
     ["Created", volume.created_at]
   ]);
@@ -4595,7 +4660,9 @@ var MACHINE_ERROR_HINTS = {
   image_pulling: "The Machine's image is still being pulled; the request was not run. Try again shortly; `tonbo machine show` reports the image's state.",
   image_failed: "The Machine's image could not be pulled; `tonbo machine show` says why. Fix the image, then name it again with `tonbo machine update --image`.",
   machine_kind_mismatch: "That Machine is one of your computers: `tonbo machine show` and `tonbo machine delete` serve it, and nothing else does.",
-  volumes_not_offered: "Volumes are not offered to this account in the Machine's region yet; nothing was created or changed."
+  volumes_not_offered: "Volumes are not offered to this account in the Machine's region yet; nothing was created or changed.",
+  secret_env_conflict: "Use another secret key or remove the non-secret env variable with that name.",
+  secret_limit: "Reduce the number or byte size of this Machine's secrets."
 };
 var MACHINE_IMAGE_FAILURE_HINTS = {
   image_unavailable: "The registry no longer serves that image publicly, or served other bytes for it: publish it again, or use another image",
@@ -4704,7 +4771,9 @@ var MACHINE_WAKE_BLOCKED_HINTS = {
   meter_lag: "Tonbo could not confirm the account's usage in time; the next request tries again.",
   crash_backoff: "Its recent wakes failed; see `tonbo machine activations <name>`.",
   capacity: "No host had room for its shape; the next request tries again.",
-  region_closed: "Machines are closed in its region for now; the next request after they reopen wakes it."
+  region_closed: "Machines are closed in its region for now; the next request after they reopen wakes it.",
+  budget_slowdown: "Its budget is close to running out, and this wake would pass the budget's slow-down rate: sleep another Machine of the budget, or lower this one's shape, then wake it again. Machines already awake keep running.",
+  budget_exhausted: "Its budget is used up for the month: it wakes after the budget resets, or once a person raises it in the console."
 };
 var MACHINE_ACCOUNT_EGRESS_BLOCKED_HINT = "If this is the free egress cap: 10 GiB a month without purchased credit; buy credit at <billing> to lift it.";
 function conditionText(name, condition, billing) {
@@ -4885,7 +4954,7 @@ function specWarnings(deps, _ports, envKeys) {
   const secret = envKeys.filter((key) => SECRET_LOOKING.test(key)).sort();
   if (secret.length)
     deps.notice(
-      `${secret.join(", ")} ${secret.length === 1 ? "looks" : "look"} secret: env values are readable by every member through the API; Machine secrets come later.`
+      `${secret.join(", ")} ${secret.length === 1 ? "looks" : "look"} secret: env values are readable by every member through the API; use Machine secrets for private values.`
     );
 }
 function waitTimeout(options) {
@@ -4912,6 +4981,41 @@ async function waitForMachine(deps, key, name, firstWait, every, timeout, settle
     wait = every;
   }
 }
+function secretFromFile(key, file, delivery) {
+  if (!key || !file) throw new Error("Pass a secret as KEY=FILE.");
+  const bytes2 = readFileSync(file === "-" ? 0 : file);
+  if (bytes2.byteLength > machineSecretLimits.valueMaxBytes)
+    throw new Error(`Secret ${key} exceeds the ${machineSecretLimits.valueMaxBytes}-byte limit.`);
+  if (delivery === "file") return { delivery, value_base64: bytes2.toString("base64") };
+  let value;
+  try {
+    value = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+  } catch {
+    throw new Error(`Secret ${key} is not UTF-8; use --secret-file for binary bytes.`);
+  }
+  return { delivery, value };
+}
+function createSecrets(options) {
+  const values = {};
+  let total = 0;
+  for (const [delivery, entries] of [
+    ["env", options.secretEnv],
+    ["file", options.secretFile]
+  ]) {
+    for (const entry of entries ?? []) {
+      const separator = entry.indexOf("=");
+      if (separator < 1) throw new Error("Pass a secret as KEY=FILE.");
+      const key = entry.slice(0, separator);
+      if (Object.hasOwn(values, key)) throw new Error(`Secret ${key} was named twice.`);
+      const secret = secretFromFile(key, entry.slice(separator + 1), delivery);
+      total += "value" in secret ? Buffer.byteLength(secret.value, "utf8") : Buffer.from(secret.value_base64, "base64").byteLength;
+      if (Object.keys(values).length >= machineSecretLimits.perMachine || total > machineSecretLimits.totalMaxBytes)
+        throw new Error("Machine secrets exceed their count or total byte limit.");
+      values[key] = secret;
+    }
+  }
+  return values;
+}
 function deleteAfterSeconds(option) {
   if (typeof option === "number") return option;
   return option === false ? null : void 0;
@@ -4964,6 +5068,50 @@ async function machineListCommand(deps, options = {}) {
       );
   });
 }
+async function machineSecretListCommand(deps, name, options = {}) {
+  await machineCommand(async () => {
+    const secrets = await deps.api.listMachineSecrets(await deps.auth.apiKey(), name);
+    print(
+      deps,
+      options.json,
+      secrets,
+      secrets.length ? table(
+        ["KEY", "DELIVERY", "VERSION", "UPDATED", "BY"],
+        secrets.map((secret) => [
+          secret.key,
+          secret.delivery,
+          String(secret.version),
+          secret.updated_at,
+          secret.updated_by.sub
+        ])
+      ) : `Machine ${name} has no secrets.`
+    );
+  });
+}
+async function machineSecretSetCommand(deps, name, secretKey, options) {
+  await machineCommand(async () => {
+    const entry = await deps.api.setMachineSecret(
+      await deps.auth.apiKey(),
+      name,
+      secretKey,
+      secretFromFile(secretKey, options.from, options.delivery ?? "env")
+    );
+    print(
+      deps,
+      options.json,
+      entry,
+      `Set ${entry.key} on Machine ${name} (version ${entry.version}; applies at the next activation).`
+    );
+  });
+}
+async function machineSecretUnsetCommand(deps, name, secretKey) {
+  await machineCommand(async () => {
+    await deps.api.unsetMachineSecret(await deps.auth.apiKey(), name, secretKey);
+    deps.output(
+      `Removed ${secretKey} from Machine ${name}; the next activation will not receive it.`
+    );
+  });
+}
 function conditionsCell(machine) {
   const conditions = machine.status.conditions ?? [];
   if (!conditions.length) return "-";
@@ -5046,6 +5194,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
     if (!options.image) throw new Error("Pass --image <reference>.");
     const timeout = waitTimeout(options);
     const env = parseEnv(options.env ?? []);
+    const secrets = createSecrets(options);
     const ports = withDefault(parsePorts(options.port ?? []), options.defaultPort);
     const key = await deps.auth.apiKey();
     const bound = typeof options.volume === "string" ? await resolveVolumeBinding(deps, key, options.volume) : null;
@@ -5068,6 +5217,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
           command: command.length ? command : void 0,
           ports: ports.length ? ports : void 0,
           env: Object.keys(env).length ? env : void 0,
+          ...Object.keys(secrets).length ? { secrets } : {},
           sleep_after_seconds: options.sleepAfter,
           idle_action: options.idleAction,
           stop_grace_seconds: options.stopGrace,
@@ -5713,7 +5863,7 @@ var COMMAND_HELP = {
   "tonbo machine create": {
     about: [
       "Creates a Machine, a VM booted from an image in one region. It has no database of its own: `--database <name>` binds one of the account's databases of its region, which it then reaches at `TONBO_DATABASE_URL`, and a database binds one Machine at a time; its files can last on a Volume (`--volume`), and its program can open any other database by URL with a key. The image is a public OCI image with a linux/arm64 variant, from Docker Hub or another public registry (`nginx:1.27`, `ghcr.io/org/app:v1`, or one pinned by digest), or `tonbo.dev/platform`, the platform image. A registry reachable only over IPv6, one named by an IP address, and one that redirects its manifests are refused. The CLI resolves a registry image to its linux/arm64 digest, and the image is pulled before the Machine leaves `creating`.",
-      "The Machine is served at `https://<name>-<account>.tonbo.sh` on its default port. `--port <port>` serves a private port, which takes a member's token, and `--port <port>:public` an open one, which needs the `machines.public` capability. A command after `--` replaces the image's CMD. The CLI warns on stderr when the Machine has no port, since nothing can wake it then, and when an `--env` key looks secret: env values are readable by every member through the API.",
+      "The Machine is served at `https://<name>-<account>.tonbo.sh` on its default port. `--port <port>` serves a private port, which takes a member's token, and `--port <port>:public` an open one, which needs the `machines.public` capability. A command after `--` replaces the image's CMD. `--secret-env KEY=FILE` and `--secret-file KEY=FILE` read initial secrets from local files and store them with the Machine before its first boot; their values are never returned. The CLI warns on stderr when the Machine has no port, since nothing can wake it then, and when an `--env` key looks secret: env values are readable by every member through the API.",
       "The answer is the Machine while it is `creating`. With `--wait` the CLI reads it until it is `active` or `failed`, or `--timeout` passes: a failure prints what to do and exits 1, and a timeout says it is still creating and undoes nothing. A creation the network or a 5xx answer did not confirm is sent at most three times with the same idempotency key, each retry after its `Retry-After` (at most 30 s) or a short backoff; a `name_taken` refusal says which Machine holds the name and how old it is, in case it is yours from a lost reply. In a region not open for Machines the creation is refused with `region_not_offered`, and nothing is created."
     ],
     examples: ["tonbo machine create web --image nginx:1.27 --port 80:public --wait"],
@@ -5738,6 +5888,28 @@ var COMMAND_HELP = {
     examples: ["tonbo machine show web"],
     arguments: NAME("Machine")
   },
+  "tonbo machine secret list": {
+    about: [
+      "Lists a Machine's secret keys, delivery, version and last writer. The values are never returned."
+    ],
+    examples: ["tonbo machine secret list web"],
+    arguments: { name: "the Machine whose secrets to list" }
+  },
+  "tonbo machine secret set": {
+    about: [
+      "Reads the secret from a local file, or standard input with `--from -`, without putting its value in shell history. `env` delivers UTF-8 text as an environment variable; `file` delivers arbitrary bytes under `$TONBO_SECRETS_DIR`. The new value applies at the next activation."
+    ],
+    examples: ["tonbo machine secret set web API_KEY --from ./api-key.txt"],
+    arguments: { name: "the Machine to change", key: "the secret's environment or file name" },
+    defaults: { "--delivery": "env" }
+  },
+  "tonbo machine secret unset": {
+    about: [
+      "Removes a Machine secret whether or not it exists. A running activation keeps its existing value until the next activation."
+    ],
+    examples: ["tonbo machine secret unset web API_KEY"],
+    arguments: { name: "the Machine to change", key: "the secret to remove" }
+  },
   "tonbo machine update": {
     about: [
       "Changes only what its options name. It reads the Machine and sends the ETag it read, or `--if-match`'s, so a change someone made in between is refused with `precondition_failed` rather than overwritten; a Machine whose creation failed is refused with `machine_failed`. `--env` and `--unset-env` change single variables; `--port` replaces every port, and the current default port stays the default while it is still listed.",
@@ -6526,7 +6698,7 @@ async function sshCertificateIssueCommand(deps, options) {
 
 // src/app.ts
 var packageVersion = JSON.parse(
-  readFileSync(new URL("../../package.json", import.meta.url), "utf8")
+  readFileSync2(new URL("../../package.json", import.meta.url), "utf8")
 );
 function createDependencies(selection = {}) {
   const api = apiOrigin();
@@ -6900,6 +7072,10 @@ function createProgram(makeDependencies = createDependencies) {
       ).option("--no-database", "bind no database (the default)"),
       false
     ).option(
+      "--secret-env <KEY=FILE>",
+      "read a UTF-8 environment secret from FILE; repeat",
+      repeated
+    ).option("--secret-file <KEY=FILE>", "read binary file secret from FILE; repeat", repeated).option(
       "--idempotency-key <key>",
       "reuse the key of an unconfirmed creation to get the Machine it created"
     ).option("--wait", "wait until the Machine is active, or say why it failed").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
@@ -6913,6 +7089,29 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (name, options) => machineShowCommand(dependencies(), name, options)
   );
+  const machineSecret = machine.command("secret").description("manage a Machine's write-only secrets");
+  operationOptions(
+    machineSecret.command("list <name>").description("list secret keys and delivery, never values"),
+    "listMachineSecrets"
+  ).action(
+    async (name, options) => machineSecretListCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    machineSecret.command("set <name> <key>").description(
+      "set a secret from a local file or standard input; applies at the next activation"
+    ).requiredOption("--from <file>", "read the value from FILE, or - for standard input").addOption(
+      new Option("--delivery <mode>", "env or file (binary)").choices(["env", "file"]).default("env")
+    ),
+    "setMachineSecret"
+  ).action(
+    async (name, key, options) => machineSecretSetCommand(dependencies(), name, key, options)
+  );
+  operationOptions(
+    machineSecret.command("unset <name> <key>").description("remove a secret at the next activation"),
+    "unsetMachineSecret"
+  ).action(
+    async (name, key) => machineSecretUnsetCommand(dependencies(), name, key)
+  );
   operationOptions(
     machineSpecOptions(
       machine.command("update <name> [command...]").description(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tonbo/cli",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "The Tonbo CLI: sign in and manage account resources from the command line.",
   "homepage": "https://tonbo.dev",
   "bugs": {