@zuvo/cli 0.1.3 → 0.1.4

package/dist/api.js

@@ -7,6 +7,12 @@ export class ApiError extends Error {
         this.name = 'ApiError';
     }
 }
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function shouldRetry(status) {
+    return status === 429 || status === 502 || status === 503 || status === 504;
+}
 export async function apiRequest(apiUrl, method, pathname, opts = {}) {
     const token = opts.token ?? (await loadAccessToken());
     const url = new URL(pathname.replace(/^\//, ''), `${apiUrl}/`);
@@ -14,34 +20,46 @@ export async function apiRequest(apiUrl, method, pathname, opts = {}) {
         if (value)
             url.searchParams.set(key, value);
     }
-    const headers = {
-        authorization: `Bearer ${token}`,
-        accept: 'application/json',
-    };
-    let body;
-    if (opts.form) {
-        body = opts.form;
-    }
-    else if (opts.json !== undefined) {
-        headers['content-type'] = 'application/json';
-        body = JSON.stringify(opts.json);
-    }
-    const response = await fetch(url, { method, headers, body });
-    const text = await response.text();
-    let parsed = text;
-    if (text) {
-        try {
-            parsed = JSON.parse(text);
+    // Control-plane GoTrue/PostgREST rate-limits batch deploys; retry longer.
+    const maxAttempts = Math.max(1, (opts.retries ?? 8) + 1);
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        const headers = {
+            authorization: `Bearer ${token}`,
+            accept: 'application/json',
+        };
+        let body;
+        if (opts.form) {
+            body = opts.form;
         }
-        catch {
-            parsed = text;
+        else if (opts.json !== undefined) {
+            headers['content-type'] = 'application/json';
+            body = JSON.stringify(opts.json);
         }
-    }
-    if (!response.ok) {
+        const response = await fetch(url, { method, headers, body });
+        const text = await response.text();
+        let parsed = text;
+        if (text) {
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = text;
+            }
+        }
+        if (response.ok)
+            return parsed;
         const message = parsed && typeof parsed === 'object' && parsed !== null && 'message' in parsed
             ? String(parsed.message)
             : text || `HTTP ${response.status}`;
-        throw new ApiError(response.status, message);
+        lastError = new ApiError(response.status, message);
+        if (!shouldRetry(response.status) || attempt === maxAttempts)
+            break;
+        const retryAfter = Number(response.headers.get('retry-after') || '');
+        const backoffMs = Number.isFinite(retryAfter) && retryAfter > 0
+            ? Math.max(retryAfter * 1000, 2_000)
+            : Math.min(20_000, 1_000 * 2 ** (attempt - 1));
+        await sleep(backoffMs);
     }
-    return parsed;
+    throw lastError || new ApiError(500, 'Request failed');
 }

package/dist/argv.js

@@ -0,0 +1,33 @@
+const GLOBAL_VALUE_FLAGS = new Set(['--api-url']);
+const GLOBAL_BOOL_FLAGS = new Set(['-h', '--help']);
+/**
+ * Slice argv after `zuvo <verbs…>`, keeping subcommand flags.
+ *
+ * Global `parseArgs({ strict: false })` drops unknown options like
+ * `--env-file` but leaves the path as a positional — so secrets set
+ * thought the file path was a secret name. Rebuild from the raw argv
+ * instead of relying on global positionals for flag-bearing commands.
+ */
+export function argvAfterCommand(argv, ...verbs) {
+    const stripped = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (GLOBAL_BOOL_FLAGS.has(arg))
+            continue;
+        if (GLOBAL_VALUE_FLAGS.has(arg)) {
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith('--api-url='))
+            continue;
+        stripped.push(arg);
+    }
+    let idx = 0;
+    for (const verb of verbs) {
+        if (stripped[idx] === verb)
+            idx += 1;
+        else
+            break;
+    }
+    return stripped.slice(idx);
+}

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { parseArgs } from 'node:util';
 import { apiRequest, ApiError } from './api.js';
+import { argvAfterCommand } from './argv.js';
 import { apiUrlFromEnv, deleteAccessToken, isAccessToken, requireLinkedRef, saveLinkedRef, } from './config.js';
 import { encodeFunctionForm, listFunctionSlugs, loadFunctionBundle } from './functions.js';
 import { loginBrowser, loginWithToken } from './login.js';
@@ -147,8 +148,28 @@ async function cmdFunctionsDeploy(apiUrl, argv) {
     if (!slugs.length) {
         throw new Error('No functions to deploy (expected supabase/functions/<slug>).');
     }
-    for (const name of slugs) {
-        await deployOne(apiUrl, ref, name);
+    const failures = [];
+    for (let i = 0; i < slugs.length; i++) {
+        const name = slugs[i];
+        try {
+            await deployOne(apiUrl, ref, name);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            failures.push({ slug: name, message });
+            console.error(`Failed ${name}: ${message}`);
+            if (slug)
+                throw error;
+        }
+        // Space out multi-deploys so PostgREST/GoTrue do not rate-limit the next auth.
+        if (i < slugs.length - 1) {
+            await new Promise((r) => setTimeout(r, 1_500));
+        }
+    }
+    if (failures.length) {
+        throw new Error(`Deploy finished with ${failures.length} failure(s): ${failures
+            .map((f) => f.slug)
+            .join(', ')}`);
     }
 }
 async function cmdSecretsList(apiUrl) {
@@ -229,7 +250,7 @@ async function main() {
         console.log(usage());
         return;
     }
-    const [command, sub, ...rest] = global.positionals;
+    const [command, sub] = global.positionals;
     const apiUrl = global.apiUrl;
     try {
         if (command === 'login')
@@ -243,13 +264,13 @@ async function main() {
         else if (command === 'functions' && sub === 'list')
             await cmdFunctionsList(apiUrl);
         else if (command === 'functions' && sub === 'deploy')
-            await cmdFunctionsDeploy(apiUrl, rest);
+            await cmdFunctionsDeploy(apiUrl, argvAfterCommand(argv, 'functions', 'deploy'));
         else if (command === 'secrets' && (sub === 'list' || !sub))
             await cmdSecretsList(apiUrl);
         else if (command === 'secrets' && sub === 'set')
-            await cmdSecretsSet(apiUrl, rest);
+            await cmdSecretsSet(apiUrl, argvAfterCommand(argv, 'secrets', 'set'));
         else if (command === 'secrets' && (sub === 'unset' || sub === 'delete'))
-            await cmdSecretsUnset(apiUrl, rest);
+            await cmdSecretsUnset(apiUrl, argvAfterCommand(argv, 'secrets', sub));
         else if (command === 'db' && sub === 'push')
             await cmdDbPush(apiUrl);
         else {

package/dist/secrets.js

@@ -17,6 +17,9 @@ export function parseSecretArgs(args) {
         }
         const next = args[i + 1];
         if (!next || next.startsWith('-') || next.includes('=')) {
+            if (/[./]/.test(arg) || arg.endsWith('.env') || arg.includes('.env.')) {
+                throw new Error(`Missing value for ${arg}. To load a file use: zuvo secrets set --env-file ${arg}`);
+            }
             throw new Error(`Missing value for secret ${arg} (use NAME=VALUE)`);
         }
         out.push({ name: arg.trim(), value: next });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuvo/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "description": "Zuvo CLI — login, link, functions deploy, secrets, and db push",
   "license": "MIT",