@zuvo/cli 0.1.1 → 0.1.3

package/README.md

@@ -1,6 +1,6 @@
 # @zuvo/cli
 
-Login, link a project, deploy Edge Functions, and `db push` against [Zuvo](https://studio.zuvodev.com).
+Login, link a project, deploy Edge Functions, manage secrets, and `db push` against [Zuvo](https://studio.zuvodev.com).
 
 ```bash
 npm i -g @zuvo/cli
@@ -8,6 +8,10 @@ zuvo login
 zuvo projects list
 zuvo link --project <ref>
 zuvo functions deploy
+zuvo secrets set OPENAI_API_KEY=sk-…
+zuvo secrets set --env-file ./supabase/.env.local
+zuvo secrets list
+zuvo secrets unset OPENAI_API_KEY
 zuvo db push
 ```
 

package/dist/index.js

@@ -5,6 +5,7 @@ import { apiUrlFromEnv, deleteAccessToken, isAccessToken, requireLinkedRef, save
 import { encodeFunctionForm, listFunctionSlugs, loadFunctionBundle } from './functions.js';
 import { loginBrowser, loginWithToken } from './login.js';
 import { loadLocalMigrations, pendingMigrations } from './migrations.js';
+import { loadSecretsEnvFile, parseSecretArgs } from './secrets.js';
 function usage() {
     return `Usage: zuvo <command>
 
@@ -15,6 +16,10 @@ Commands:
   link --project <ref>
   functions list
   functions deploy [slug]
+  secrets list
+  secrets set NAME=VALUE [NAME=VALUE ...]
+  secrets set --env-file <path>
+  secrets unset NAME [NAME ...]
   db push
 
 Global:
@@ -146,6 +151,53 @@ async function cmdFunctionsDeploy(apiUrl, argv) {
         await deployOne(apiUrl, ref, name);
     }
 }
+async function cmdSecretsList(apiUrl) {
+    const ref = await requireLinkedRef();
+    const rows = await apiRequest(apiUrl, 'GET', `/v1/projects/${ref}/secrets`);
+    if (!Array.isArray(rows) || !rows.length) {
+        console.log('No secrets.');
+        return;
+    }
+    for (const row of rows) {
+        console.log([row.name, row.updated_at].filter(Boolean).join('\t'));
+    }
+}
+async function cmdSecretsSet(apiUrl, argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        options: {
+            'env-file': { type: 'string' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const fromFile = typeof values['env-file'] === 'string' && values['env-file'].trim()
+        ? await loadSecretsEnvFile(values['env-file'].trim())
+        : [];
+    const fromArgs = parseSecretArgs(positionals);
+    const pairs = [...fromFile, ...fromArgs];
+    if (!pairs.length) {
+        throw new Error('Usage: zuvo secrets set NAME=VALUE [NAME=VALUE ...] | --env-file <path>');
+    }
+    // API rejects empty values — fail locally with a clear message.
+    for (const pair of pairs) {
+        if (!pair.value) {
+            throw new Error(`Secret ${pair.name} has an empty value`);
+        }
+    }
+    await apiRequest(apiUrl, 'POST', `/v1/projects/${ref}/secrets`, { json: pairs });
+    console.log(`Set ${pairs.map((p) => p.name).join(', ')}`);
+}
+async function cmdSecretsUnset(apiUrl, argv) {
+    const names = argv.filter((arg) => !arg.startsWith('-')).map((n) => n.trim()).filter(Boolean);
+    if (!names.length)
+        throw new Error('Usage: zuvo secrets unset NAME [NAME ...]');
+    const ref = await requireLinkedRef();
+    await apiRequest(apiUrl, 'DELETE', `/v1/projects/${ref}/secrets`, { json: names });
+    console.log(`Unset ${names.join(', ')}`);
+}
 async function cmdDbPush(apiUrl) {
     const ref = await requireLinkedRef();
     const local = await loadLocalMigrations();
@@ -192,6 +244,12 @@ async function main() {
             await cmdFunctionsList(apiUrl);
         else if (command === 'functions' && sub === 'deploy')
             await cmdFunctionsDeploy(apiUrl, rest);
+        else if (command === 'secrets' && (sub === 'list' || !sub))
+            await cmdSecretsList(apiUrl);
+        else if (command === 'secrets' && sub === 'set')
+            await cmdSecretsSet(apiUrl, rest);
+        else if (command === 'secrets' && (sub === 'unset' || sub === 'delete'))
+            await cmdSecretsUnset(apiUrl, rest);
         else if (command === 'db' && sub === 'push')
             await cmdDbPush(apiUrl);
         else {
@@ -201,7 +259,7 @@ async function main() {
     }
     catch (error) {
         if (error instanceof ApiError && error.status === 403) {
-            fail('Forbidden. Deploy and db push require owner, admin, or developer.');
+            fail('Forbidden. Functions, secrets, and db push require owner, admin, or developer.');
         }
         fail(error);
     }

package/dist/login.js

@@ -27,7 +27,8 @@ async function openBrowser(url) {
         }
     }
     if (platform === 'win32') {
-        await execFileAsync('cmd', ['/c', 'start', '', url]);
+        // cmd.exe treats `&` as a command separator. Quote the URL as one argument.
+        await execFileAsync('cmd', ['/c', 'start', '', `"${url.replaceAll('"', '')}"`]);
         return;
     }
     await execFileAsync('xdg-open', [url]);
@@ -68,14 +69,18 @@ export async function loginWithToken(token) {
     }
     await saveAccessToken(trimmed);
 }
-export function buildCliLoginUrl(opts) {
-    const studio = opts.studioUrl.replace(/\/$/, '');
-    const params = new URLSearchParams({
+export function packCliLoginPayload(opts) {
+    return Buffer.from(JSON.stringify({
         session_id: opts.sessionId,
         public_key: opts.publicKeyHex,
         token_name: opts.tokenName,
-    });
-    return `${studio}/cli/login?${params.toString()}`;
+    }), 'utf8').toString('base64url');
+}
+export function buildCliLoginUrl(opts) {
+    const studio = opts.studioUrl.replace(/\/$/, '');
+    // A single query param so Windows `start`, macOS Terminal, and VS Code
+    // hyperlinks cannot truncate `public_key` at `&`.
+    return `${studio}/cli/login?p=${packCliLoginPayload(opts)}`;
 }
 export async function loginBrowser(opts) {
     const { ecdh, publicKeyHex } = generateLoginKeyPair();

package/dist/secrets.js

@@ -0,0 +1,49 @@
+import { readFile } from 'node:fs/promises';
+/** Parse `NAME=VALUE` or `NAME VALUE` style CLI args into secret pairs. */
+export function parseSecretArgs(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg.startsWith('-'))
+            continue;
+        const eq = arg.indexOf('=');
+        if (eq > 0) {
+            const name = arg.slice(0, eq).trim();
+            const value = arg.slice(eq + 1);
+            if (!name)
+                throw new Error(`Invalid secret: ${arg}`);
+            out.push({ name, value });
+            continue;
+        }
+        const next = args[i + 1];
+        if (!next || next.startsWith('-') || next.includes('=')) {
+            throw new Error(`Missing value for secret ${arg} (use NAME=VALUE)`);
+        }
+        out.push({ name: arg.trim(), value: next });
+        i++;
+    }
+    return out;
+}
+/** Load KEY=VALUE pairs from a dotenv-style file (comments and blanks ignored). */
+export async function loadSecretsEnvFile(filePath) {
+    const text = await readFile(filePath, 'utf8');
+    const out = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq <= 0)
+            throw new Error(`Invalid line in ${filePath}: ${raw}`);
+        const name = line.slice(0, eq).trim();
+        let value = line.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        if (!name)
+            throw new Error(`Invalid line in ${filePath}: ${raw}`);
+        out.push({ name, value });
+    }
+    return out;
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@zuvo/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
-  "description": "Zuvo CLI — login, link, functions deploy, and db push",
+  "description": "Zuvo CLI — login, link, functions deploy, secrets, and db push",
   "license": "MIT",
   "bin": {
     "zuvo": "bin/zuvo.js"