bod-cli 0.10.2 → 0.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/commands/env.ts

@@ -6,6 +6,21 @@ import { BodClient } from '../client'
 import { printTable } from '../utils/output'
 import { resolveAppId, resolveAppName } from '../utils/resolve'
 
+// --- Subs PLATFORM PROVIDER scope (mirror bodify subs.secrets.ts) ---
+// Provider credentials (Stripe secret key, Apple shared secret, Play SA) are money
+// credentials. They must NOT land in any app's process env, so they live under a
+// PSEUDO app id that no real app equals and no deploy can resolve. The server's
+// resolveScope passes any `__subs__~`-prefixed app string through VERBATIM (no
+// name→id resolution) — that verbatim pass-through is the whole point, so the CLI
+// must send the literal string as scope.app.
+const SUBS_SCOPE_PREFIX = '__subs__~'
+/** Platform-wide provider scope — one credential shared by every app. Note the DOUBLE ~. */
+const SUBS_GLOBAL_SCOPE_APP = `${SUBS_SCOPE_PREFIX}~global`
+/** Per-app provider override — the suffix MUST be the app UUID, never its name. */
+function subsAppScope(appId: string): string {
+  return `${SUBS_SCOPE_PREFIX}${appId}`
+}
+
 // --- Bodify global secrets store types (mirror the agent /secrets API contract) ---
 interface Scope { app?: string; env?: string; group?: string }
 interface MaskedEntry { scope: Scope; masked: string; updatedAt: number; updatedBy?: string }
@@ -43,23 +58,44 @@ function buildScope(app: string | undefined, env: string | undefined, global: bo
   return scope
 }
 
-/** Citty binds the FIRST positional to `app`, but under --global/--group there is no
- *  app — the leading positional is really the next one (KEY=VALUE / key). Shift it back
+/** Subs flags collapse the app positional the same way --global/--group do (there is
+ *  no <app> positional — the pseudo scope IS the app axis). */
+interface SubsFlags { subs?: boolean; subsApp?: string }
+function isSubsMode(s: SubsFlags): boolean {
+  return !!s.subs || !!s.subsApp
+}
+
+/** Citty binds the FIRST positional to `app`, but under --global/--group/--subs there is
+ *  no app — the leading positional is really the next one (KEY=VALUE / key). Shift it back
  *  so `app` is undefined and `rest` holds the real positionals. Returns the genuine app
  *  only when no scope flag was passed. */
-function resolvePositionals(app: string | undefined, rest: (string | undefined)[], global: boolean, group?: string) {
-  if (global || group) return { app: undefined, rest: [app, ...rest].filter((p): p is string => p !== undefined) }
+function resolvePositionals(app: string | undefined, rest: (string | undefined)[], global: boolean, group?: string, subs?: SubsFlags) {
+  if (global || group || (subs && isSubsMode(subs))) return { app: undefined, rest: [app, ...rest].filter((p): p is string => p !== undefined) }
   return { app, rest: rest.filter((p): p is string => p !== undefined) }
 }
 
-/** Guard: <app>, --global and --group are mutually exclusive (they pick the scope's
- *  primary axis). --env is orthogonal and combines with any of them. */
-function assertScopeFlags(app: string | undefined, global: boolean, group?: string) {
-  const picked = [app && '<app>', global && '--global', group && '--group'].filter(Boolean)
+/** Guard: <app>, --global, --group, --subs and --subs-app are mutually exclusive (they
+ *  pick the scope's primary axis). --env is orthogonal to app/group/global — but the subs
+ *  pseudo scope is app-only (its reader matches scope.app by strict equality and ignores
+ *  env), so --env with a subs flag would write an entry nothing can ever read: forbid it. */
+function assertScopeFlags(app: string | undefined, global: boolean, group: string | undefined, subs: SubsFlags, env?: string) {
+  const picked = [app && '<app>', global && '--global', group && '--group', subs.subs && '--subs', subs.subsApp && '--subs-app'].filter(Boolean)
   if (picked.length > 1) {
     console.error(chalk.red(`Pass only one of ${picked.join(', ')} — they are mutually exclusive.`))
     process.exit(1)
   }
+  if (isSubsMode(subs) && env) {
+    console.error(chalk.red('--env cannot combine with --subs/--subs-app: the provider scope is app-only and an env-scoped entry would be unreadable.'))
+    process.exit(1)
+  }
+}
+
+/** Build the literal `__subs__~…` scope.app for a subs write/read.
+ *  Global → `__subs__~~global` sent verbatim. Per-app → resolve NAME→id client-side
+ *  (the server won't resolve a `__subs__~` string), THEN prefix. */
+async function buildSubsScopeApp(client: BodClient, subs: SubsFlags): Promise<string> {
+  if (subs.subsApp) return subsAppScope(await resolveAppId(client, subs.subsApp))
+  return SUBS_GLOBAL_SCOPE_APP
 }
 
 /** Human label for a scope's primary axis (+ optional env). */
@@ -78,18 +114,39 @@ function quoteDotEnvValue(value: string): string {
 }
 
 const listCmd = defineCommand({
-  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global/--group: variables in that scope (masked).' },
+  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global/--group/--subs: variables in that scope (masked).' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'List all variables across scopes (masked)' },
     group: { type: 'string', description: 'List masked entries scoped to a group; excludes <app>/--global' },
+    subs: { type: 'boolean', description: 'List masked platform-GLOBAL subs provider secrets (__subs__~~global; money creds kept out of app envs)' },
+    'subs-app': { type: 'string', description: 'List masked per-app subs provider secrets for this app name/id (__subs__~<appId>)' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    assertScopeFlags(args.app, !!args.global, args.group)
+    const subs: SubsFlags = { subs: !!args.subs, subsApp: args['subs-app'] }
+    assertScopeFlags(args.app, !!args.global, args.group, subs, args.env)
+
+    if (isSubsMode(subs)) {
+      const scopeApp = await buildSubsScopeApp(client, subs)
+      const vars = await client.get<MaskedVar[]>('/secrets/vars')
+      const rows: Record<string, unknown>[] = []
+      for (const v of vars) {
+        for (const e of v.entries) {
+          if (e.scope.app !== scopeApp) continue
+          rows.push({ key: v.key, scope: renderScope(e.scope), value: e.masked })
+        }
+      }
+      if (!rows.length) {
+        console.log(chalk.dim(`No subs provider secrets set for scope app:${scopeApp}.`))
+        return
+      }
+      printTable(rows, ['key', 'scope', 'value'])
+      return
+    }
 
     if (args.global || args.group) {
       const vars = await client.get<MaskedVar[]>('/secrets/vars')
@@ -122,7 +179,7 @@ const listCmd = defineCommand({
 })
 
 const setCmd = defineCommand({
-  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, --group, and/or --env.' },
+  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, --group, --subs/--subs-app, and/or --env.' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
     pair: { type: 'positional', description: 'KEY=VALUE', required: false },
@@ -130,18 +187,24 @@ const setCmd = defineCommand({
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Shared var (no app); broadens reach' },
     group: { type: 'string', description: 'Scope to a group (apps that inherit it); excludes <app>/--global' },
+    subs: { type: 'boolean', description: 'Platform-GLOBAL subs provider secret (__subs__~~global). For money creds (Stripe/Apple/Play) — kept OUT of every app env; NOT --global.' },
+    'subs-app': { type: 'string', description: 'Per-app subs provider override for this app name/id (resolved to __subs__~<appId>)' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    // Under --global/--group the leading positional is the pair, not an app — shift it.
-    const { app, rest } = resolvePositionals(args.app, [args.pair], !!args.global, args.group)
+    const subs: SubsFlags = { subs: !!args.subs, subsApp: args['subs-app'] }
+    const subsMode = isSubsMode(subs)
+    // Under --global/--group/--subs the leading positional is the pair, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.pair], !!args.global, args.group, subs)
     // Real conflict: a scope flag AND a surplus leading positional (a true <app>) before the pair.
-    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
-    const pair = (args.global || args.group) ? rest[0] : args.pair
-    const appName = args.global || args.group ? undefined : resolveAppName(app)
-    const scope = buildScope(appName, args.env, !!args.global, args.group)
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group, subs, args.env)
+    const pair = (args.global || args.group || subsMode) ? rest[0] : args.pair
+    const appName = args.global || args.group || subsMode ? undefined : resolveAppName(app)
+    const scope = subsMode
+      ? { app: await buildSubsScopeApp(client, subs) }
+      : buildScope(appName, args.env, !!args.global, args.group)
 
     if (args.file) {
       const f = Bun.file(args.file)
@@ -182,22 +245,28 @@ const unsetCmd = defineCommand({
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Target the shared (no-app) entry' },
     group: { type: 'string', description: 'Target a group-scoped entry; excludes <app>/--global' },
+    subs: { type: 'boolean', description: 'Target the platform-GLOBAL subs provider entry (__subs__~~global)' },
+    'subs-app': { type: 'string', description: 'Target the per-app subs provider entry for this app name/id (__subs__~<appId>)' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    // Under --global/--group the leading positional is the key, not an app — shift it.
-    const { app, rest } = resolvePositionals(args.app, [args.key], !!args.global, args.group)
-    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
-    const key = (args.global || args.group) ? rest[0] : args.key
+    const subs: SubsFlags = { subs: !!args.subs, subsApp: args['subs-app'] }
+    const subsMode = isSubsMode(subs)
+    // Under --global/--group/--subs the leading positional is the key, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.key], !!args.global, args.group, subs)
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group, subs, args.env)
+    const key = (args.global || args.group || subsMode) ? rest[0] : args.key
     if (!key) {
-      console.error(chalk.red('Variable name required: bod env unset <app> KEY  (use --global/--group for shared entries)'))
+      console.error(chalk.red('Variable name required: bod env unset <app> KEY  (use --global/--group/--subs for shared entries)'))
       process.exit(1)
     }
-    const appName = args.global || args.group ? undefined : resolveAppName(app)
+    const appName = args.global || args.group || subsMode ? undefined : resolveAppName(app)
     const qs: string[] = []
-    if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
+    // Subs sends the literal __subs__~… as the app axis (server passes it through verbatim).
+    if (subsMode) qs.push(`app=${encodeURIComponent(await buildSubsScopeApp(client, subs))}`)
+    else if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
     if (args.group) qs.push(`group=${encodeURIComponent(args.group)}`)
     if (args.env) qs.push(`env=${encodeURIComponent(args.env)}`)
     const suffix = qs.length ? `?${qs.join('&')}` : ''

package/test/env-subs.test.ts

@@ -0,0 +1,122 @@
+// Verifies `bod env set/list/unset` with the subs PLATFORM PROVIDER flags emit the
+// exact `__subs__~…` scope.app the bodify vault requires — at the real CLI surface
+// (full citty parse + positional shift + name→id resolution), against a mock agent.
+import { test, expect, beforeAll, afterAll } from 'bun:test'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+
+const CLI = join(import.meta.dir, '..', 'src', 'cli.ts')
+const APP_ID = 'e1dba964-b944-4dd0-b971-fe72ee493bf6'
+const APP_NAME = 'blank'
+
+interface Captured { method: string; path: string; body: any }
+let captured: Captured[] = []
+let server: ReturnType<typeof Bun.serve>
+let home: string
+
+beforeAll(() => {
+  server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const url = new URL(req.url)
+      const body = req.method === 'PUT' || req.method === 'POST' ? await req.json().catch(() => null) : null
+      captured.push({ method: req.method, path: url.pathname + url.search, body })
+      if (url.pathname === '/api/apps') {
+        return Response.json([{ id: APP_ID, name: APP_NAME }])
+      }
+      if (url.pathname === '/api/secrets/vars' && req.method === 'GET') {
+        return Response.json([
+          { key: 'STRIPE_SECRET_KEY', createdAt: 0, updatedAt: 0, entries: [
+            { scope: { app: '__subs__~~global' }, masked: 'sk_l***', updatedAt: 0 },
+            { scope: { app: `__subs__~${APP_ID}` }, masked: 'sk_a***', updatedAt: 0 },
+            { scope: {}, masked: 'other***', updatedAt: 0 },
+          ] },
+        ])
+      }
+      return new Response('ok')
+    },
+  })
+  home = mkdtempSync(join(tmpdir(), 'bod-subs-test-'))
+  mkdirSync(join(home, '.bod'), { recursive: true })
+  writeFileSync(join(home, '.bod', 'config.json'), JSON.stringify({
+    defaultInstance: 'test',
+    instances: { test: { url: `http://localhost:${server.port}`, apiKey: 'test-key' } },
+  }))
+})
+
+afterAll(() => {
+  server?.stop(true)
+  rmSync(home, { recursive: true, force: true })
+})
+
+async function runCli(args: string[]) {
+  captured = []
+  const proc = Bun.spawn(['bun', CLI, ...args], {
+    env: { ...process.env, HOME: home, _BOD_INSTANCE_OVERRIDE: '', BOD_INSTANCE: '' },
+    stdout: 'pipe', stderr: 'pipe',
+  })
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  return { stdout, stderr, code }
+}
+
+test('env set --subs → scope.app is the literal __subs__~~global (verbatim, no resolution)', async () => {
+  const { code, stderr } = await runCli(['env', 'set', '--subs', 'STRIPE_SECRET_KEY=sk_live_platform'])
+  expect(code).toBe(0)
+  const put = captured.find(c => c.method === 'PUT' && c.path.startsWith('/api/secrets/vars/STRIPE_SECRET_KEY'))
+  expect(put).toBeTruthy()
+  expect(put!.body).toEqual({ value: 'sk_live_platform', scope: { app: '__subs__~~global' } })
+  // Global form must NOT resolve any app name→id.
+  expect(captured.some(c => c.path === '/api/apps')).toBe(false)
+  expect(stderr).toBe('')
+})
+
+test('env set --subs-app <name> → resolves name→id, then prefixes __subs__~<id>', async () => {
+  const { code } = await runCli(['env', 'set', '--subs-app', APP_NAME, 'STRIPE_SECRET_KEY=sk_live_app'])
+  expect(code).toBe(0)
+  // Name was resolved to id via /api/apps.
+  expect(captured.some(c => c.path === '/api/apps')).toBe(true)
+  const put = captured.find(c => c.method === 'PUT' && c.path.startsWith('/api/secrets/vars/STRIPE_SECRET_KEY'))
+  expect(put!.body).toEqual({ value: 'sk_live_app', scope: { app: `__subs__~${APP_ID}` } })
+})
+
+test('env set --subs-app accepts an app id directly', async () => {
+  const { code } = await runCli(['env', 'set', '--subs-app', APP_ID, 'APPLE_SHARED_SECRET=abc'])
+  expect(code).toBe(0)
+  const put = captured.find(c => c.method === 'PUT' && c.path.startsWith('/api/secrets/vars/APPLE_SHARED_SECRET'))
+  expect(put!.body).toEqual({ value: 'abc', scope: { app: `__subs__~${APP_ID}` } })
+})
+
+test('env set --subs --env is rejected (subs scope is app-only)', async () => {
+  const { code, stderr } = await runCli(['env', 'set', '--subs', '--env', 'prod', 'K=v'])
+  expect(code).toBe(1)
+  expect(stderr).toContain('app-only')
+})
+
+test('env set --subs --global is rejected (mutually exclusive)', async () => {
+  const { code, stderr } = await runCli(['env', 'set', '--subs', '--global', 'K=v'])
+  expect(code).toBe(1)
+  expect(stderr).toContain('mutually exclusive')
+})
+
+test('env list --subs shows only the platform-global provider entry (masked)', async () => {
+  const { code, stdout } = await runCli(['env', 'list', '--subs'])
+  expect(code).toBe(0)
+  expect(stdout).toContain('STRIPE_SECRET_KEY')
+  expect(stdout).toContain('sk_l***')
+  expect(stdout).not.toContain('sk_a***') // per-app entry excluded
+  expect(stdout).not.toContain('other***') // default-scoped entry excluded
+})
+
+test('env unset --subs deletes the __subs__~~global entry via app= query param', async () => {
+  const { code } = await runCli(['env', 'unset', '--subs', 'STRIPE_SECRET_KEY'])
+  expect(code).toBe(0)
+  const del = captured.find(c => c.method === 'DELETE')
+  expect(del).toBeTruthy()
+  expect(del!.path).toContain('/api/secrets/vars/STRIPE_SECRET_KEY/entry')
+  expect(del!.path).toContain(`app=${encodeURIComponent('__subs__~~global')}`)
+})