ardent-cli-beta 0.0.19 → 0.0.20

package/README.md

@@ -32,11 +32,15 @@ retained disk, and reports the control plane's refusal, with its stated fallback
 changed, and prints only its connection URL to stdout. Progress, credential
 revocation instructions and driver requirements go to stderr. `--driver` selects
 `libpq` (default), `node`, `jdbc` or `prisma`; `--json` returns the active branch,
-operation and credential. `--print` remains accepted. The credential stays active
+operation and credential. Repeat `--allow-cidr` at creation to restrict branch
+connections, for example `--allow-cidr 192.0.2.0/24 --allow-cidr 2001:db8::/32`.
+The allowlist is fixed at creation and applies to every credential on the branch;
+omitting it preserves unrestricted ingress. `--print` remains accepted. The credential stays active
 after exit. This uses `branch connect --print`'s lifecycle and requires a control
 plane that issues credentials while branches start (`docs/DECISIONS.md` section 17).
 
-Use `branch create <name> --to-env` to write `DATABASE_URL` to `.env` in the
+Use `branch create <name> --to-env` or `branch connect --to-env` to write
+`DATABASE_URL` to `.env` in the
 current directory instead of printing the URL. The selected `--driver` still
 applies. This option cannot be combined with `--print` or `--json`.
 `writeBranchEnv` preserves unrelated entries and refuses an existing
@@ -48,6 +52,8 @@ does not coordinate with other editors. Values use a quote delimiter absent
 from the connection string; newline, NUL, or values containing all three dotenv
 quote delimiters are refused. Use a dotenv reader without variable expansion.
 Custom destination filenames remain future work.
+`branch connect --to-env` keeps the issued credential instead of opening psql;
+`--role` still selects a source role with a fresh branch-only password.
 
 `branch connect` needs a selected active branch, an installed PostgreSQL 16+ `psql`, and the
 system `script` utility on macOS or Linux. It requests a read/write credential for the branch,

package/dist/branches/client.d.ts

@@ -13,7 +13,7 @@ export interface BranchOperation {
     };
 }
 export declare function listBranches(token: string, connectorID: string): Promise<Branch[]>;
-export declare function createBranch(token: string, connectorID: string, name: string): Promise<BranchOperation>;
+export declare function createBranch(token: string, connectorID: string, name: string, allowedCIDRs?: string[]): Promise<BranchOperation>;
 export declare function deleteBranch(token: string, connectorID: string, name: string): Promise<BranchOperation>;
 export type BranchLifecycleAction = 'wake' | 'suspend' | 'recover';
 export declare function transitionBranch(token: string, connectorID: string, name: string, action: BranchLifecycleAction): Promise<BranchOperation>;

package/dist/branches/client.js

@@ -9,9 +9,9 @@ export async function listBranches(token, connectorID) {
     }
     return branches;
 }
-export async function createBranch(token, connectorID, name) {
+export async function createBranch(token, connectorID, name, allowedCIDRs) {
     const result = await request(token, '/branches', {
-        method: 'POST', body: JSON.stringify({ connector_id: connectorID, name, request_id: randomUUID() }),
+        method: 'POST', body: JSON.stringify({ connector_id: connectorID, name, allowed_cidrs: allowedCIDRs, request_id: randomUUID() }),
     });
     validateOperation(result, connectorID, name);
     return result;

package/dist/commands/branch/connect.d.ts

@@ -5,6 +5,7 @@ export default class BranchConnect extends ArdentCommand {
     static flags: {
         driver: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         print: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'to-env': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         role: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     static helpGroup: string;

package/dist/commands/branch/connect.js

@@ -5,6 +5,7 @@ import { listBranches } from '../../branches/client.js';
 import { connectToBranch } from '../../branches/connection.js';
 import { validSourceRole } from '../../branches/credentials.js';
 import { DRIVERS, validDriver } from '../../branches/drivers.js';
+import { writeBranchEnv } from '../../branches/env.js';
 import { checkPsql } from '../../branches/psql.js';
 import { recoverBranchCredentials } from '../../branches/recovery.js';
 import { ArdentCommand } from '../../command.js';
@@ -18,13 +19,15 @@ export default class BranchConnect extends ArdentCommand {
             options: [...DRIVERS],
         }),
         print: Flags.boolean({ description: 'Print a connection string for --driver and keep the credential active, instead of opening psql' }),
+        'to-env': Flags.boolean({ description: 'Write DATABASE_URL to .env instead of opening psql', exclusive: ['print', 'json'] }),
         role: Flags.string({ description: 'Sign in as this source role on the branch (for example postgres), with a fresh password that works on this branch only' }),
     };
     static helpGroup = 'Branches';
     async run() {
         const { flags } = await this.parse(BranchConnect);
         const sourceRole = flags.role;
-        const print = flags.print;
+        const toEnv = flags['to-env'];
+        const print = flags.print || toEnv;
         if (!validDriver(flags.driver))
             this.error(`--driver must be one of ${DRIVERS.join(', ')}.`);
         const driver = flags.driver;
@@ -79,9 +82,15 @@ export default class BranchConnect extends ArdentCommand {
         const as = sourceRole === undefined ? '' : ` as source role ${sourceRole}, with a new branch-only password,`;
         const verb = print ? `Issuing a ${driver} connection string for` : 'Connecting to';
         say(`${verb} branch ${terminalText(branch.name)} in connector ${terminalText(connector.name)}${as} via ${terminalText(new URL(API_URL).origin)}...`);
-        return connectToBranch({
+        const result = await connectToBranch({
             configDir: this.config.configDir, token: session.token, branchID: branch.id, sourceRole, print, driver,
-            json: this.jsonEnabled(), say, log: (message) => this.log(message), warn: (message) => this.warn(message),
+            json: this.jsonEnabled() || toEnv, deliver: toEnv ? writeBranchEnv : undefined,
+            say, log: (message) => this.log(message), warn: (message) => this.warn(message),
         });
+        if (toEnv) {
+            say('Wrote DATABASE_URL to .env.');
+            return;
+        }
+        return result;
     }
 }

package/dist/commands/branch/create.d.ts

@@ -8,6 +8,7 @@ export default class BranchCreate extends ArdentCommand {
     static strict: boolean;
     static description: string;
     static flags: {
+        'allow-cidr': import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
         driver: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         print: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'to-env': import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/commands/branch/create.js

@@ -14,6 +14,7 @@ export default class BranchCreate extends ArdentCommand {
     static strict = false;
     static description = 'Create a branch in the selected connector and print its connection URL when ready';
     static flags = {
+        'allow-cidr': Flags.string({ multiple: true, multipleNonGreedy: true, description: 'Allow connections only from these IPv4/IPv6 CIDRs; repeat for each network. Fixed at creation; omitted means unrestricted.' }),
         driver: Flags.string({ default: 'libpq', options: [...DRIVERS], description: 'Connection string format: libpq, node, jdbc or prisma' }),
         print: Flags.boolean({ description: 'Print the connection string when ready (the default behavior)' }),
         'to-env': Flags.boolean({ description: 'Write DATABASE_URL to .env instead of printing it', exclusive: ['print', 'json'] }),
@@ -38,7 +39,7 @@ export default class BranchCreate extends ArdentCommand {
             say(`Creating branch ${target}...`);
         let accepted;
         try {
-            const result = await createBranch(session.token, session.selectedConnector.id, name);
+            const result = await createBranch(session.token, session.selectedConnector.id, name, flags['allow-cidr']);
             accepted = result;
             const credential = await connectToBranch({
                 configDir: this.config.configDir, token: session.token, branchID: result.branch.id,

package/oclif.manifest.json

@@ -127,6 +127,16 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "to-env": {
+          "description": "Write DATABASE_URL to .env instead of opening psql",
+          "exclusive": [
+            "print",
+            "json"
+          ],
+          "name": "to-env",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "role": {
           "description": "Sign in as this source role on the branch (for example postgres), with a fresh password that works on this branch only",
           "name": "role",
@@ -170,6 +180,13 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "allow-cidr": {
+          "description": "Allow connections only from these IPv4/IPv6 CIDRs; repeat for each network. Fixed at creation; omitted means unrestricted.",
+          "name": "allow-cidr",
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
         "driver": {
           "description": "Connection string format: libpq, node, jdbc or prisma",
           "name": "driver",
@@ -891,5 +908,5 @@
       ]
     }
   },
-  "version": "0.0.19"
+  "version": "0.0.20"
 }

package/openapi.json

@@ -1608,6 +1608,12 @@
           "updated_at"
         ],
         "properties": {
+          "allowed_cidrs": {
+            "type": "array",
+            "maxItems": 64,
+            "items": {"type": "string"},
+            "description": "IPv4/IPv6 CIDRs allowed to connect. Empty or omitted means unrestricted. Immutable after creation; host bits are masked and duplicates removed. Mapped IPv6 prefixes are refused."
+          },
           "id": {
             "type": "string"
           },
@@ -1872,6 +1878,12 @@
           "request_id"
         ],
         "properties": {
+          "allowed_cidrs": {
+            "type": "array",
+            "maxItems": 64,
+            "items": {"type": "string"},
+            "description": "IPv4/IPv6 CIDRs allowed to connect. Empty or omitted means unrestricted. Immutable after creation; host bits are masked and duplicates removed. Mapped IPv6 prefixes are refused."
+          },
           "connector_id": {
             "type": "string",
             "minLength": 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ardent-cli-beta",
-  "version": "0.0.19",
+  "version": "0.0.20",
   "description": "The Ardent command-line interface",
   "license": "Apache-2.0",
   "type": "module",