@zuvo/cli 0.1.2 → 0.1.4

package/README.md

@@ -1,6 +1,6 @@
 # @zuvo/cli
 
-Login, link a project, deploy Edge Functions, and `db push` against [Zuvo](https://studio.zuvodev.com).
+Login, link a project, deploy Edge Functions, manage secrets, and `db push` against [Zuvo](https://studio.zuvodev.com).
 
 ```bash
 npm i -g @zuvo/cli
@@ -8,6 +8,10 @@ zuvo login
 zuvo projects list
 zuvo link --project <ref>
 zuvo functions deploy
+zuvo secrets set OPENAI_API_KEY=sk-…
+zuvo secrets set --env-file ./supabase/.env.local
+zuvo secrets list
+zuvo secrets unset OPENAI_API_KEY
 zuvo db push
 ```
 

package/dist/api.js

@@ -7,6 +7,12 @@ export class ApiError extends Error {
         this.name = 'ApiError';
     }
 }
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function shouldRetry(status) {
+    return status === 429 || status === 502 || status === 503 || status === 504;
+}
 export async function apiRequest(apiUrl, method, pathname, opts = {}) {
     const token = opts.token ?? (await loadAccessToken());
     const url = new URL(pathname.replace(/^\//, ''), `${apiUrl}/`);
@@ -14,34 +20,46 @@ export async function apiRequest(apiUrl, method, pathname, opts = {}) {
         if (value)
             url.searchParams.set(key, value);
     }
-    const headers = {
-        authorization: `Bearer ${token}`,
-        accept: 'application/json',
-    };
-    let body;
-    if (opts.form) {
-        body = opts.form;
-    }
-    else if (opts.json !== undefined) {
-        headers['content-type'] = 'application/json';
-        body = JSON.stringify(opts.json);
-    }
-    const response = await fetch(url, { method, headers, body });
-    const text = await response.text();
-    let parsed = text;
-    if (text) {
-        try {
-            parsed = JSON.parse(text);
+    // Control-plane GoTrue/PostgREST rate-limits batch deploys; retry longer.
+    const maxAttempts = Math.max(1, (opts.retries ?? 8) + 1);
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        const headers = {
+            authorization: `Bearer ${token}`,
+            accept: 'application/json',
+        };
+        let body;
+        if (opts.form) {
+            body = opts.form;
         }
-        catch {
-            parsed = text;
+        else if (opts.json !== undefined) {
+            headers['content-type'] = 'application/json';
+            body = JSON.stringify(opts.json);
         }
-    }
-    if (!response.ok) {
+        const response = await fetch(url, { method, headers, body });
+        const text = await response.text();
+        let parsed = text;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = text;
+            }
+        }
+        if (response.ok)
+            return parsed;
         const message = parsed && typeof parsed === 'object' && parsed !== null && 'message' in parsed
             ? String(parsed.message)
             : text || `HTTP ${response.status}`;
-        throw new ApiError(response.status, message);
+        lastError = new ApiError(response.status, message);
+        if (!shouldRetry(response.status) || attempt === maxAttempts)
+            break;
+        const retryAfter = Number(response.headers.get('retry-after') || '');
+        const backoffMs = Number.isFinite(retryAfter) && retryAfter > 0
+            ? Math.max(retryAfter * 1000, 2_000)
+            : Math.min(20_000, 1_000 * 2 ** (attempt - 1));
+        await sleep(backoffMs);
     }
-    return parsed;
+    throw lastError || new ApiError(500, 'Request failed');
 }

package/dist/argv.js

@@ -0,0 +1,33 @@
+const GLOBAL_VALUE_FLAGS = new Set(['--api-url']);
+const GLOBAL_BOOL_FLAGS = new Set(['-h', '--help']);
+/**
+ * Slice argv after `zuvo <verbs…>`, keeping subcommand flags.
+ *
+ * Global `parseArgs({ strict: false })` drops unknown options like
+ * `--env-file` but leaves the path as a positional — so secrets set
+ * thought the file path was a secret name. Rebuild from the raw argv
+ * instead of relying on global positionals for flag-bearing commands.
+ */
+export function argvAfterCommand(argv, ...verbs) {
+    const stripped = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (GLOBAL_BOOL_FLAGS.has(arg))
+            continue;
+        if (GLOBAL_VALUE_FLAGS.has(arg)) {
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('--api-url='))
+            continue;
+        stripped.push(arg);
+    }
+    let idx = 0;
+    for (const verb of verbs) {
+        if (stripped[idx] === verb)
+            idx += 1;
+        else
+            break;
+    }
+    return stripped.slice(idx);
+}

package/dist/index.js

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 import { parseArgs } from 'node:util';
 import { apiRequest, ApiError } from './api.js';
+import { argvAfterCommand } from './argv.js';
 import { apiUrlFromEnv, deleteAccessToken, isAccessToken, requireLinkedRef, saveLinkedRef, } from './config.js';
 import { encodeFunctionForm, listFunctionSlugs, loadFunctionBundle } from './functions.js';
 import { loginBrowser, loginWithToken } from './login.js';
 import { loadLocalMigrations, pendingMigrations } from './migrations.js';
+import { loadSecretsEnvFile, parseSecretArgs } from './secrets.js';
 function usage() {
     return `Usage: zuvo <command>
 
@@ -15,6 +17,10 @@ Commands:
   link --project <ref>
   functions list
   functions deploy [slug]
+  secrets list
+  secrets set NAME=VALUE [NAME=VALUE ...]
+  secrets set --env-file <path>
+  secrets unset NAME [NAME ...]
   db push
 
 Global:
@@ -142,9 +148,76 @@ async function cmdFunctionsDeploy(apiUrl, argv) {
     if (!slugs.length) {
         throw new Error('No functions to deploy (expected supabase/functions/<slug>).');
     }
-    for (const name of slugs) {
-        await deployOne(apiUrl, ref, name);
+    const failures = [];
+    for (let i = 0; i < slugs.length; i++) {
+        const name = slugs[i];
+        try {
+            await deployOne(apiUrl, ref, name);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            failures.push({ slug: name, message });
+            console.error(`Failed ${name}: ${message}`);
+            if (slug)
+                throw error;
+        }
+        // Space out multi-deploys so PostgREST/GoTrue do not rate-limit the next auth.
+        if (i < slugs.length - 1) {
+            await new Promise((r) => setTimeout(r, 1_500));
+        }
+    }
+    if (failures.length) {
+        throw new Error(`Deploy finished with ${failures.length} failure(s): ${failures
+            .map((f) => f.slug)
+            .join(', ')}`);
+    }
+}
+async function cmdSecretsList(apiUrl) {
+    const ref = await requireLinkedRef();
+    const rows = await apiRequest(apiUrl, 'GET', `/v1/projects/${ref}/secrets`);
+    if (!Array.isArray(rows) || !rows.length) {
+        console.log('No secrets.');
+        return;
+    }
+    for (const row of rows) {
+        console.log([row.name, row.updated_at].filter(Boolean).join('\t'));
+    }
+}
+async function cmdSecretsSet(apiUrl, argv) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        options: {
+            'env-file': { type: 'string' },
+            'api-url': { type: 'string' },
+        },
+        allowPositionals: true,
+        strict: false,
+    });
+    const ref = await requireLinkedRef();
+    const fromFile = typeof values['env-file'] === 'string' && values['env-file'].trim()
+        ? await loadSecretsEnvFile(values['env-file'].trim())
+        : [];
+    const fromArgs = parseSecretArgs(positionals);
+    const pairs = [...fromFile, ...fromArgs];
+    if (!pairs.length) {
+        throw new Error('Usage: zuvo secrets set NAME=VALUE [NAME=VALUE ...] | --env-file <path>');
+    }
+    // API rejects empty values — fail locally with a clear message.
+    for (const pair of pairs) {
+        if (!pair.value) {
+            throw new Error(`Secret ${pair.name} has an empty value`);
+        }
     }
+    await apiRequest(apiUrl, 'POST', `/v1/projects/${ref}/secrets`, { json: pairs });
+    console.log(`Set ${pairs.map((p) => p.name).join(', ')}`);
+}
+async function cmdSecretsUnset(apiUrl, argv) {
+    const names = argv.filter((arg) => !arg.startsWith('-')).map((n) => n.trim()).filter(Boolean);
+    if (!names.length)
+        throw new Error('Usage: zuvo secrets unset NAME [NAME ...]');
+    const ref = await requireLinkedRef();
+    await apiRequest(apiUrl, 'DELETE', `/v1/projects/${ref}/secrets`, { json: names });
+    console.log(`Unset ${names.join(', ')}`);
 }
 async function cmdDbPush(apiUrl) {
     const ref = await requireLinkedRef();
@@ -177,7 +250,7 @@ async function main() {
         console.log(usage());
         return;
     }
-    const [command, sub, ...rest] = global.positionals;
+    const [command, sub] = global.positionals;
     const apiUrl = global.apiUrl;
     try {
         if (command === 'login')
@@ -191,7 +264,13 @@ async function main() {
         else if (command === 'functions' && sub === 'list')
             await cmdFunctionsList(apiUrl);
         else if (command === 'functions' && sub === 'deploy')
-            await cmdFunctionsDeploy(apiUrl, rest);
+            await cmdFunctionsDeploy(apiUrl, argvAfterCommand(argv, 'functions', 'deploy'));
+        else if (command === 'secrets' && (sub === 'list' || !sub))
+            await cmdSecretsList(apiUrl);
+        else if (command === 'secrets' && sub === 'set')
+            await cmdSecretsSet(apiUrl, argvAfterCommand(argv, 'secrets', 'set'));
+        else if (command === 'secrets' && (sub === 'unset' || sub === 'delete'))
+            await cmdSecretsUnset(apiUrl, argvAfterCommand(argv, 'secrets', sub));
         else if (command === 'db' && sub === 'push')
             await cmdDbPush(apiUrl);
         else {
@@ -201,7 +280,7 @@ async function main() {
     }
     catch (error) {
         if (error instanceof ApiError && error.status === 403) {
-            fail('Forbidden. Deploy and db push require owner, admin, or developer.');
+            fail('Forbidden. Functions, secrets, and db push require owner, admin, or developer.');
         }
         fail(error);
     }

package/dist/secrets.js

@@ -0,0 +1,52 @@
+import { readFile } from 'node:fs/promises';
+/** Parse `NAME=VALUE` or `NAME VALUE` style CLI args into secret pairs. */
+export function parseSecretArgs(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg.startsWith('-'))
+            continue;
+        const eq = arg.indexOf('=');
+        if (eq > 0) {
+            const name = arg.slice(0, eq).trim();
+            const value = arg.slice(eq + 1);
+            if (!name)
+                throw new Error(`Invalid secret: ${arg}`);
+            out.push({ name, value });
+            continue;
+        }
+        const next = args[i + 1];
+        if (!next || next.startsWith('-') || next.includes('=')) {
+            if (/[./]/.test(arg) || arg.endsWith('.env') || arg.includes('.env.')) {
+                throw new Error(`Missing value for ${arg}. To load a file use: zuvo secrets set --env-file ${arg}`);
+            }
+            throw new Error(`Missing value for secret ${arg} (use NAME=VALUE)`);
+        }
+        out.push({ name: arg.trim(), value: next });
+        i++;
+    }
+    return out;
+}
+/** Load KEY=VALUE pairs from a dotenv-style file (comments and blanks ignored). */
+export async function loadSecretsEnvFile(filePath) {
+    const text = await readFile(filePath, 'utf8');
+    const out = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq <= 0)
+            throw new Error(`Invalid line in ${filePath}: ${raw}`);
+        const name = line.slice(0, eq).trim();
+        let value = line.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        if (!name)
+            throw new Error(`Invalid line in ${filePath}: ${raw}`);
+        out.push({ name, value });
+    }
+    return out;
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@zuvo/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
-  "description": "Zuvo CLI — login, link, functions deploy, and db push",
+  "description": "Zuvo CLI — login, link, functions deploy, secrets, and db push",
   "license": "MIT",
   "bin": {
     "zuvo": "bin/zuvo.js"