bod-cli 0.9.1 → 0.9.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/commands/env.ts

@@ -7,7 +7,7 @@ import { printTable } from '../utils/output'
 import { resolveAppId, resolveAppName } from '../utils/resolve'
 
 // --- Bodify global secrets store types (mirror the agent /secrets API contract) ---
-interface Scope { app?: string; env?: string }
+interface Scope { app?: string; env?: string; group?: string }
 interface MaskedEntry { scope: Scope; masked: string; updatedAt: number; updatedBy?: string }
 interface MaskedVar { key: string; description?: string; createdAt: number; updatedAt: number; entries: MaskedEntry[] }
 interface ResolvedEnv { environment?: string; values: Record<string, string> }
@@ -33,22 +33,42 @@ function parseDotEnv(content: string): Record<string, string> {
   return env
 }
 
-/** Build a secrets scope from the app arg + flags. `--global` drops the app axis. */
-function buildScope(app: string | undefined, env: string | undefined, global: boolean): Scope {
+/** Build a secrets scope from the app arg + flags. `--global` drops the app axis;
+ *  `--group` scopes to a named group (apps that inherit it) instead of one app. */
+function buildScope(app: string | undefined, env: string | undefined, global: boolean, group?: string): Scope {
   const scope: Scope = {}
-  if (!global && app) scope.app = app
+  if (group) scope.group = group
+  else if (!global && app) scope.app = app
   if (env) scope.env = env
   return scope
 }
 
-/** Guard: --global and a positional <app> are mutually exclusive. */
-function assertScopeFlags(app: string | undefined, global: boolean) {
-  if (global && app) {
-    console.error(chalk.red('Pass either <app> or --global, not both.'))
+/** Citty binds the FIRST positional to `app`, but under --global/--group there is no
+ *  app — the leading positional is really the next one (KEY=VALUE / key). Shift it back
+ *  so `app` is undefined and `rest` holds the real positionals. Returns the genuine app
+ *  only when no scope flag was passed. */
+function resolvePositionals(app: string | undefined, rest: (string | undefined)[], global: boolean, group?: string) {
+  if (global || group) return { app: undefined, rest: [app, ...rest].filter((p): p is string => p !== undefined) }
+  return { app, rest: rest.filter((p): p is string => p !== undefined) }
+}
+
+/** Guard: <app>, --global and --group are mutually exclusive (they pick the scope's
+ *  primary axis). --env is orthogonal and combines with any of them. */
+function assertScopeFlags(app: string | undefined, global: boolean, group?: string) {
+  const picked = [app && '<app>', global && '--global', group && '--group'].filter(Boolean)
+  if (picked.length > 1) {
+    console.error(chalk.red(`Pass only one of ${picked.join(', ')} — they are mutually exclusive.`))
     process.exit(1)
   }
 }
 
+/** Human label for a scope's primary axis (+ optional env). */
+function renderScope(scope: Scope): string {
+  const base = scope.app ? `app:${scope.app}` : scope.group ? `group:${scope.group}` : scope.env ? `env:${scope.env}` : 'all'
+  // env already shown as the base when it's the only axis; otherwise append it.
+  return (scope.app || scope.group) && scope.env ? `${base}/${scope.env}` : base
+}
+
 /** Quote a dotenv value if it contains characters that would break a bare assignment. */
 function quoteDotEnvValue(value: string): string {
   if (/[\s"'#=$`\\]/.test(value) || value === '') {
@@ -63,28 +83,27 @@ const listCmd = defineCommand({
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'List all variables across scopes (masked)' },
+    group: { type: 'string', description: 'List masked entries scoped to a group; excludes <app>/--global' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    if (args.global) {
+    assertScopeFlags(args.app, !!args.global, args.group)
+
+    if (args.global || args.group) {
       const vars = await client.get<MaskedVar[]>('/secrets/vars')
-      if (!vars.length) {
-        console.log(chalk.dim('No variables set.'))
-        return
-      }
       const rows: Record<string, unknown>[] = []
       for (const v of vars) {
         for (const e of v.entries) {
-          const scope = e.scope.app
-            ? `app:${e.scope.app}${e.scope.env ? `/${e.scope.env}` : ''}`
-            : e.scope.env
-              ? `env:${e.scope.env}`
-              : 'all'
-          rows.push({ key: v.key, scope, value: e.masked })
+          if (args.group && e.scope.group !== args.group) continue
+          rows.push({ key: v.key, scope: renderScope(e.scope), value: e.masked })
         }
       }
+      if (!rows.length) {
+        console.log(chalk.dim(args.group ? `No variables scoped to group:${args.group}.` : 'No variables set.'))
+        return
+      }
       printTable(rows, ['key', 'scope', 'value'])
       return
     }
@@ -110,15 +129,19 @@ const setCmd = defineCommand({
     file: { type: 'string', alias: 'f', description: 'Path to .env file (bulk import)' },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Shared var (no app); broadens reach' },
+    group: { type: 'string', description: 'Scope to a group (apps that inherit it); excludes <app>/--global' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    // --global has no app; otherwise resolve the app NAME (server resolves name→id).
-    assertScopeFlags(args.app, !!args.global)
-    const appName = args.global ? undefined : resolveAppName(args.app)
-    const scope = buildScope(appName, args.env, !!args.global)
+    // Under --global/--group the leading positional is the pair, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.pair], !!args.global, args.group)
+    // Real conflict: a scope flag AND a surplus leading positional (a true <app>) before the pair.
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
+    const pair = (args.global || args.group) ? rest[0] : args.pair
+    const appName = args.global || args.group ? undefined : resolveAppName(app)
+    const scope = buildScope(appName, args.env, !!args.global, args.group)
 
     if (args.file) {
       const f = Bun.file(args.file)
@@ -139,13 +162,13 @@ const setCmd = defineCommand({
       return
     }
 
-    if (!args.pair || !args.pair.includes('=')) {
+    if (!pair || !pair.includes('=')) {
       console.error(chalk.red('Format: bod env set <app> KEY=VALUE  or  bod env set <app> -f .env  (use --global for a shared var)'))
       process.exit(1)
     }
-    const eqIdx = args.pair.indexOf('=')
-    const key = args.pair.slice(0, eqIdx)
-    const value = args.pair.slice(eqIdx + 1)
+    const eqIdx = pair.indexOf('=')
+    const key = pair.slice(0, eqIdx)
+    const value = pair.slice(eqIdx + 1)
     await client.put(`/secrets/vars/${encodeURIComponent(key)}`, { value, scope })
     console.log(chalk.green(`✓ Set ${key}`))
   },
@@ -155,22 +178,31 @@ const unsetCmd = defineCommand({
   meta: { name: 'unset', description: 'Remove one scoped entry of a secret. Use `rm` to delete the whole variable.' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
-    key: { type: 'positional', description: 'Variable name', required: true },
+    key: { type: 'positional', description: 'Variable name', required: false },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Target the shared (no-app) entry' },
+    group: { type: 'string', description: 'Target a group-scoped entry; excludes <app>/--global' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    assertScopeFlags(args.app, !!args.global)
-    const appName = args.global ? undefined : resolveAppName(args.app)
+    // Under --global/--group the leading positional is the key, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.key], !!args.global, args.group)
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
+    const key = (args.global || args.group) ? rest[0] : args.key
+    if (!key) {
+      console.error(chalk.red('Variable name required: bod env unset <app> KEY  (use --global/--group for shared entries)'))
+      process.exit(1)
+    }
+    const appName = args.global || args.group ? undefined : resolveAppName(app)
     const qs: string[] = []
     if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
+    if (args.group) qs.push(`group=${encodeURIComponent(args.group)}`)
     if (args.env) qs.push(`env=${encodeURIComponent(args.env)}`)
     const suffix = qs.length ? `?${qs.join('&')}` : ''
-    await client.del(`/secrets/vars/${encodeURIComponent(args.key)}/entry${suffix}`)
-    console.log(chalk.green(`✓ Removed ${args.key}`))
+    await client.del(`/secrets/vars/${encodeURIComponent(key)}/entry${suffix}`)
+    console.log(chalk.green(`✓ Removed ${key}`))
   },
 })