bod-cli 0.8.4 → 0.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.8.4",
+  "version": "0.9.2",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/commands/env.ts

@@ -1,27 +1,16 @@
 import { defineCommand } from 'citty'
 import chalk from 'chalk'
+import { writeFileSync } from 'fs'
 import { loadConfig, getResolvedInstance } from '../config'
 import { BodClient } from '../client'
+import { printTable } from '../utils/output'
 import { resolveAppId, resolveAppName } from '../utils/resolve'
 
-const listCmd = defineCommand({
-  meta: { name: 'list', description: 'List env vars' },
-  args: {
-    app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
-  },
-  async run({ args }) {
-    const { url, apiKey } = getResolvedInstance(loadConfig())
-    const client = new BodClient(url, apiKey)
-    const appId = await resolveAppId(client, resolveAppName(args.app))
-    const detail = await client.get<any>(`/apps/${appId}`)
-    const env = detail.env ?? {}
-    if (Object.keys(env).length === 0) {
-      console.log(chalk.dim('No environment variables set.'))
-      return
-    }
-    for (const [k, v] of Object.entries(env)) console.log(`${k}=${v}`)
-  },
-})
+// --- Bodify global secrets store types (mirror the agent /secrets API contract) ---
+interface Scope { app?: string; env?: string; group?: string }
+interface MaskedEntry { scope: Scope; masked: string; updatedAt: number; updatedBy?: string }
+interface MaskedVar { key: string; description?: string; createdAt: number; updatedAt: number; entries: MaskedEntry[] }
+interface ResolvedEnv { environment?: string; values: Record<string, string> }
 
 function parseDotEnv(content: string): Record<string, string> {
   const env: Record<string, string> = {}
@@ -44,19 +33,115 @@ function parseDotEnv(content: string): Record<string, string> {
   return env
 }
 
-const setCmd = defineCommand({
-  meta: { name: 'set', description: 'Set env var (KEY=VALUE or --file .env)' },
+/** Build a secrets scope from the app arg + flags. `--global` drops the app axis;
+ *  `--group` scopes to a named group (apps that inherit it) instead of one app. */
+function buildScope(app: string | undefined, env: string | undefined, global: boolean, group?: string): Scope {
+  const scope: Scope = {}
+  if (group) scope.group = group
+  else if (!global && app) scope.app = app
+  if (env) scope.env = env
+  return scope
+}
+
+/** Citty binds the FIRST positional to `app`, but under --global/--group there is no
+ *  app — the leading positional is really the next one (KEY=VALUE / key). Shift it back
+ *  so `app` is undefined and `rest` holds the real positionals. Returns the genuine app
+ *  only when no scope flag was passed. */
+function resolvePositionals(app: string | undefined, rest: (string | undefined)[], global: boolean, group?: string) {
+  if (global || group) return { app: undefined, rest: [app, ...rest].filter((p): p is string => p !== undefined) }
+  return { app, rest: rest.filter((p): p is string => p !== undefined) }
+}
+
+/** Guard: <app>, --global and --group are mutually exclusive (they pick the scope's
+ *  primary axis). --env is orthogonal and combines with any of them. */
+function assertScopeFlags(app: string | undefined, global: boolean, group?: string) {
+  const picked = [app && '<app>', global && '--global', group && '--group'].filter(Boolean)
+  if (picked.length > 1) {
+    console.error(chalk.red(`Pass only one of ${picked.join(', ')} — they are mutually exclusive.`))
+    process.exit(1)
+  }
+}
+
+/** Human label for a scope's primary axis (+ optional env). */
+function renderScope(scope: Scope): string {
+  const base = scope.app ? `app:${scope.app}` : scope.group ? `group:${scope.group}` : scope.env ? `env:${scope.env}` : 'all'
+  // env already shown as the base when it's the only axis; otherwise append it.
+  return (scope.app || scope.group) && scope.env ? `${base}/${scope.env}` : base
+}
+
+/** Quote a dotenv value if it contains characters that would break a bare assignment. */
+function quoteDotEnvValue(value: string): string {
+  if (/[\s"'#=$`\\]/.test(value) || value === '') {
+    return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
+  }
+  return value
+}
+
+const listCmd = defineCommand({
+  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global: all variables with scopes (masked).' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
-    pair: { type: 'positional', description: 'KEY=VALUE', required: false },
-    file: { type: 'string', alias: 'f', description: 'Path to .env file' },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    global: { type: 'boolean', alias: 'g', description: 'List all variables across scopes (masked)' },
+    group: { type: 'string', description: 'List masked entries scoped to a group; excludes <app>/--global' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
+
+    assertScopeFlags(args.app, !!args.global, args.group)
+
+    if (args.global || args.group) {
+      const vars = await client.get<MaskedVar[]>('/secrets/vars')
+      const rows: Record<string, unknown>[] = []
+      for (const v of vars) {
+        for (const e of v.entries) {
+          if (args.group && e.scope.group !== args.group) continue
+          rows.push({ key: v.key, scope: renderScope(e.scope), value: e.masked })
+        }
+      }
+      if (!rows.length) {
+        console.log(chalk.dim(args.group ? `No variables scoped to group:${args.group}.` : 'No variables set.'))
+        return
+      }
+      printTable(rows, ['key', 'scope', 'value'])
+      return
+    }
+
+    // Per-app: show fully resolved values for the chosen environment.
     const appId = await resolveAppId(client, resolveAppName(args.app))
-    const detail = await client.get<any>(`/apps/${appId}`)
-    const existing = detail.env ?? {}
+    const qs = args.env ? `?environment=${encodeURIComponent(args.env)}` : ''
+    const res = await client.get<ResolvedEnv>(`/apps/${appId}/env${qs}`)
+    const values = res.values ?? {}
+    if (Object.keys(values).length === 0) {
+      console.log(chalk.dim('No environment variables set.'))
+      return
+    }
+    for (const [k, v] of Object.entries(values)) console.log(`${k}=${v}`)
+  },
+})
+
+const setCmd = defineCommand({
+  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, and/or --env.' },
+  args: {
+    app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
+    pair: { type: 'positional', description: 'KEY=VALUE', required: false },
+    file: { type: 'string', alias: 'f', description: 'Path to .env file (bulk import)' },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    global: { type: 'boolean', alias: 'g', description: 'Shared var (no app); broadens reach' },
+    group: { type: 'string', description: 'Scope to a group (apps that inherit it); excludes <app>/--global' },
+  },
+  async run({ args }) {
+    const { url, apiKey } = getResolvedInstance(loadConfig())
+    const client = new BodClient(url, apiKey)
+
+    // Under --global/--group the leading positional is the pair, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.pair], !!args.global, args.group)
+    // Real conflict: a scope flag AND a surplus leading positional (a true <app>) before the pair.
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
+    const pair = (args.global || args.group) ? rest[0] : args.pair
+    const appName = args.global || args.group ? undefined : resolveAppName(app)
+    const scope = buildScope(appName, args.env, !!args.global, args.group)
 
     if (args.file) {
       const f = Bun.file(args.file)
@@ -64,49 +149,100 @@ const setCmd = defineCommand({
         console.error(chalk.red(`File not found: ${args.file}`))
         process.exit(1)
       }
-      const content = await f.text()
-      const parsed = parseDotEnv(content)
+      const parsed = parseDotEnv(await f.text())
       const keys = Object.keys(parsed)
       if (keys.length === 0) {
         console.error(chalk.red('No variables found in file.'))
         process.exit(1)
       }
-      await client.put(`/apps/${appId}`, { env: { ...existing, ...parsed } })
+      for (const key of keys) {
+        await client.put(`/secrets/vars/${encodeURIComponent(key)}`, { value: parsed[key], scope })
+      }
       console.log(chalk.green(`✓ Set ${keys.length} var(s): ${keys.join(', ')}`))
       return
     }
 
-    if (!args.pair || !args.pair.includes('=')) {
-      console.error(chalk.red('Format: bod env set <app> KEY=VALUE  or  bod env set <app> -f .env'))
+    if (!pair || !pair.includes('=')) {
+      console.error(chalk.red('Format: bod env set <app> KEY=VALUE  or  bod env set <app> -f .env  (use --global for a shared var)'))
       process.exit(1)
     }
-    const [key, ...vals] = args.pair.split('=')
-    const value = vals.join('=')
-    await client.put(`/apps/${appId}`, { env: { ...existing, [key]: value } })
+    const eqIdx = pair.indexOf('=')
+    const key = pair.slice(0, eqIdx)
+    const value = pair.slice(eqIdx + 1)
+    await client.put(`/secrets/vars/${encodeURIComponent(key)}`, { value, scope })
     console.log(chalk.green(`✓ Set ${key}`))
   },
 })
 
 const unsetCmd = defineCommand({
-  meta: { name: 'unset', description: 'Remove env var' },
+  meta: { name: 'unset', description: 'Remove one scoped entry of a secret. Use `rm` to delete the whole variable.' },
+  args: {
+    app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
+    key: { type: 'positional', description: 'Variable name', required: false },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    global: { type: 'boolean', alias: 'g', description: 'Target the shared (no-app) entry' },
+    group: { type: 'string', description: 'Target a group-scoped entry; excludes <app>/--global' },
+  },
+  async run({ args }) {
+    const { url, apiKey } = getResolvedInstance(loadConfig())
+    const client = new BodClient(url, apiKey)
+
+    // Under --global/--group the leading positional is the key, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.key], !!args.global, args.group)
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
+    const key = (args.global || args.group) ? rest[0] : args.key
+    if (!key) {
+      console.error(chalk.red('Variable name required: bod env unset <app> KEY  (use --global/--group for shared entries)'))
+      process.exit(1)
+    }
+    const appName = args.global || args.group ? undefined : resolveAppName(app)
+    const qs: string[] = []
+    if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
+    if (args.group) qs.push(`group=${encodeURIComponent(args.group)}`)
+    if (args.env) qs.push(`env=${encodeURIComponent(args.env)}`)
+    const suffix = qs.length ? `?${qs.join('&')}` : ''
+    await client.del(`/secrets/vars/${encodeURIComponent(key)}/entry${suffix}`)
+    console.log(chalk.green(`✓ Removed ${key}`))
+  },
+})
+
+const rmCmd = defineCommand({
+  meta: { name: 'rm', description: 'Delete an entire variable across ALL scopes.' },
   args: {
-    app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
     key: { type: 'positional', description: 'Variable name', required: true },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
-    const appId = await resolveAppId(client, resolveAppName(args.app))
+    await client.del(`/secrets/vars/${encodeURIComponent(args.key)}`)
+    console.log(chalk.green(`✓ Deleted ${args.key} (all scopes)`))
+  },
+})
 
-    const detail = await client.get<any>(`/apps/${appId}`)
-    const env = { ...(detail.env ?? {}) }
-    delete env[args.key]
-    await client.put(`/apps/${appId}`, { env })
-    console.log(chalk.green(`✓ Removed ${args.key}`))
+const pullCmd = defineCommand({
+  meta: { name: 'pull', description: 'Write an app\'s resolved env to a dotenv file (default .env, mode 0600).' },
+  args: {
+    app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    output: { type: 'string', alias: 'o', description: 'Output file (default .env)' },
+  },
+  async run({ args }) {
+    const { url, apiKey } = getResolvedInstance(loadConfig())
+    const client = new BodClient(url, apiKey)
+    const appId = await resolveAppId(client, resolveAppName(args.app))
+    const qs = args.env ? `?environment=${encodeURIComponent(args.env)}` : ''
+    const res = await client.get<ResolvedEnv>(`/apps/${appId}/env${qs}`)
+    const values = res.values ?? {}
+    const out = args.output ?? '.env'
+    const body = Object.entries(values)
+      .map(([k, v]) => `${k}=${quoteDotEnvValue(v)}`)
+      .join('\n')
+    writeFileSync(out, body ? body + '\n' : '', { mode: 0o600 })
+    console.log(chalk.green(`✓ Wrote ${Object.keys(values).length} var(s) to ${out}`))
   },
 })
 
 export default defineCommand({
-  meta: { name: 'env', description: 'Manage environment variables' },
-  subCommands: { list: listCmd, set: setCmd, unset: unsetCmd },
+  meta: { name: 'env', description: 'Manage environment variables (Bodify global secrets store)' },
+  subCommands: { list: listCmd, set: setCmd, unset: unsetCmd, rm: rmCmd, pull: pullCmd },
 })