deploro 0.2.1 → 0.3.1

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { createRequire } from "module";
 import { Command } from "commander";
 
 // src/commands/login.ts
@@ -148,6 +149,11 @@ async function logoutCommand() {
 }
 
 // src/lib/api.ts
+function errorMessage(status, body, statusText) {
+  const parts = [body.error ?? statusText];
+  if (body.detail && body.detail !== body.error) parts.push(body.detail);
+  return `${status} ${parts.join(" \u2014 ")}`;
+}
 async function apiRequest(path, options, configOverride) {
   const config = configOverride ?? requireConfig();
   const headers = {
@@ -159,7 +165,7 @@ async function apiRequest(path, options, configOverride) {
   const res = await fetch(`${config.baseUrl}${path}`, { ...options, headers });
   if (!res.ok) {
     const body = await res.json().catch(() => ({ error: res.statusText }));
-    throw new Error(`${res.status} ${body.error ?? res.statusText}`);
+    throw new Error(errorMessage(res.status, body, res.statusText));
   }
   return res.json();
 }
@@ -175,7 +181,7 @@ async function apiRequestNoProject(path, options) {
   });
   if (!res.ok) {
     const body = await res.json().catch(() => ({ error: res.statusText }));
-    throw new Error(`${res.status} ${body.error ?? res.statusText}`);
+    throw new Error(errorMessage(res.status, body, res.statusText));
   }
   return res.json();
 }
@@ -226,6 +232,44 @@ function json(data) {
 }
 
 // src/commands/db.ts
+async function dbCreateCommand() {
+  const config = requireProject();
+  const data = await apiRequestNoProject(
+    `/api/projects/${config.projectId}/database`,
+    { method: "POST" }
+  );
+  console.log(`\u2713 Database ready: ${data.database_name}`);
+}
+async function dbInfoCommand() {
+  const config = requireProject();
+  const { projects } = await apiRequestNoProject("/api/projects");
+  const project = projects.find((p) => p.id === config.projectId);
+  if (!project) {
+    console.error("Active project not found or not visible to this token. Run: deploro projects");
+    process.exit(1);
+  }
+  console.log("\n\u2500\u2500 DATABASE \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+  console.log(`  Project       : ${project.slug}`);
+  console.log(`  Database name : ${project.database_name ?? "(not provisioned \u2014 run: deploro db create)"}`);
+  console.log("");
+  if (project.database_name) {
+    console.log(
+      "Direct PostgreSQL access (host/port/user/password) is not available.\nThe database lives on an internal network reachable only by Deploro's own\nSQL proxy \u2014 and Cloudflare Workers can't open raw TCP sockets regardless of\nnetwork reachability, so a deployed Worker can never use a connection string\neven if one were issued. There is no DATABASE_URL / HYPERDRIVE binding to\nconfigure on your deployed app; none is provisioned automatically.\n"
+    );
+    console.log(
+      "For a deployed Worker to read/write this project's data at runtime, call\nthe per-project REST API instead (every table gets one automatically):\n"
+    );
+    console.log(`  Base URL : ${config.baseUrl}/api/projects/${config.projectId}/studio`);
+    console.log(`  Spec     : ${config.baseUrl}/api/projects/${config.projectId}/studio/spec  (OpenAPI 3.1)`);
+    console.log(`  Auth     : Authorization: Bearer <project-scoped PAT>`);
+    console.log(`             create one with: deploro token create <name> --project ${project.slug}`);
+    console.log("");
+    console.log("To hand that to your deployed Worker as secrets:");
+    console.log(`  deploro hosting set-env DEPLORO_API_URL "${config.baseUrl}/api/projects/${config.projectId}/studio"`);
+    console.log(`  deploro hosting set-env DEPLORO_API_TOKEN "<pat>"`);
+    console.log("");
+  }
+}
 async function dbTablesCommand() {
   requireProject();
   const data = await apiRequest("/api/db/tables");
@@ -319,6 +363,9 @@ async function dbDropTableCommand(tableName, opts) {
 }
 
 // src/commands/auth.ts
+function isPatToken(accessToken) {
+  return accessToken.startsWith("gallium_pat_") || accessToken.startsWith("deploro_pat_");
+}
 async function authUsersCommand() {
   requireConfig();
   const data = await apiRequest("/api/auth/users");
@@ -345,30 +392,188 @@ async function authInviteCommand(email, opts) {
   }
 }
 async function authWhoamiCommand() {
+  requireConfig();
+  const data = await apiRequestNoProject("/api/auth/whoami");
+  if (data.authMethod === "pat") {
+    console.log("Authenticated via personal access token.");
+    console.log(`  User id : ${data.userId}`);
+    console.log(`  Role    : ${data.role}`);
+    console.log(`  Scopes  : ${(data.scopes ?? []).join(", ") || "(none)"}`);
+    console.log(`  Scoped to ${data.projects?.length ?? 0} project(s):`);
+    if (data.projects && data.projects.length > 0) {
+      table(data.projects.map((p) => ({ id: p.id, slug: p.slug, name: p.name })));
+    } else {
+      console.log("    (none \u2014 this token cannot access any project)");
+    }
+  } else {
+    console.log("Authenticated via browser session.");
+    console.log(`  User id : ${data.userId}`);
+    console.log(`  Role    : ${data.role}`);
+  }
+}
+function requireSessionAuth(config) {
+  if (isPatToken(config.accessToken)) {
+    console.error(
+      "Managing tokens requires a browser-session login, not a personal access token.\nRun 'deploro login' without --token (email + password) and try again."
+    );
+    process.exit(1);
+  }
+}
+async function tokenListCommand() {
   const config = requireConfig();
-  if (!config.accessToken.startsWith("gallium_pat_") && !config.accessToken.startsWith("deploro_pat_")) {
-    const res = await fetch(`${config.baseUrl}/api/auth/session`, {
-      headers: {
-        Authorization: `Bearer ${config.accessToken}`,
-        Cookie: `deploro_session=${config.accessToken}`
-      }
-    });
-    const body = await res.json().catch(() => null);
-    if (body?.data?.user) {
-      const u = body.data.user;
-      table([{ id: u.id, name: u.name, email: u.email, role: u.role }]);
-      if (body.data.session?.expiresAt) {
-        console.log(`Session expires: ${new Date(body.data.session.expiresAt).toLocaleString()}`);
-      }
-      return;
+  requireSessionAuth(config);
+  const data = await apiRequestNoProject("/api/auth/tokens");
+  table(
+    data.tokens.map((t) => ({
+      id: t.id,
+      name: t.name,
+      prefix: `${t.token_prefix}\u2026`,
+      scopes: t.scopes.join(","),
+      projects: t.project_ids.length,
+      expires: new Date(t.expires_at).toLocaleDateString(),
+      status: t.revoked_at ? "revoked" : "active"
+    }))
+  );
+}
+async function tokenCreateCommand(name, opts) {
+  const config = requireConfig();
+  requireSessionAuth(config);
+  const scopes = !opts.read && !opts.write ? ["read"] : [opts.read && "read", opts.write && "write"].filter(Boolean);
+  let projectIds;
+  if (opts.project) {
+    const list = await apiRequestNoProject(
+      "/api/projects"
+    );
+    const wanted = opts.project.split(",").map((s) => s.trim().toLowerCase());
+    projectIds = list.projects.filter((p) => wanted.includes(p.id) || wanted.includes(p.slug.toLowerCase()) || wanted.includes(p.name.toLowerCase())).map((p) => p.id);
+    if (projectIds.length === 0) {
+      console.error(`No project matches "${opts.project}". Run: deploro projects`);
+      process.exit(1);
     }
-    console.error("Session is expired or invalid. Run: deploro login");
+  } else if (config.projectId) {
+    projectIds = [config.projectId];
+  } else {
+    console.error("No project specified. Pass --project <slug> or set an active project with 'deploro use'.");
     process.exit(1);
   }
-  const data = await apiRequestNoProject("/api/projects");
-  console.log("Authenticated via personal access token.");
-  console.log(`  Worker   : ${config.baseUrl}`);
-  console.log(`  Projects : ${data.projects.length} visible (the token is scoped to the projects chosen at creation)`);
+  const days = Number(opts.days ?? 90);
+  const data = await apiRequestNoProject(
+    "/api/auth/tokens",
+    { method: "POST", body: JSON.stringify({ name, scopes, projectIds, expiresInDays: days }) }
+  );
+  console.log("\u2713 Token created \u2014 copy it now, it will not be shown again:");
+  console.log(`
+  ${data.token}
+`);
+  console.log(`  Scopes  : ${scopes.join(", ")}`);
+  console.log(`  Projects: ${projectIds.length}`);
+  console.log(`  Expires : in ${data.expiresInDays} days`);
+  console.log(`
+Use it with: deploro login --token ${data.token}`);
+}
+async function tokenRevokeCommand(id, opts) {
+  const config = requireConfig();
+  requireSessionAuth(config);
+  await confirmOrDie(`Revoke token ${id}?`, opts.yes);
+  await apiRequestNoProject(`/api/auth/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
+  console.log(`\u2713 Token ${id} revoked`);
+}
+
+// src/commands/migrate.ts
+import { readFileSync as readFileSync2 } from "fs";
+function readSqlOpt(inline, file, label) {
+  if (file) {
+    try {
+      return readFileSync2(file, "utf-8");
+    } catch (err) {
+      console.error(`Could not read --${label}-file "${file}": ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  }
+  return inline;
+}
+async function migrateCreateCommand(name, opts) {
+  requireProject();
+  const sqlUp = readSqlOpt(opts.up, opts.upFile, "up");
+  if (!sqlUp) {
+    console.error('Migration SQL is required: pass --up "<sql>" or --up-file <path>');
+    process.exit(1);
+  }
+  const sqlDown = readSqlOpt(opts.down, opts.downFile, "down");
+  const config = requireProject();
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/migrations`,
+    { method: "POST", body: JSON.stringify({ name, sql_up: sqlUp, sql_down: sqlDown }) }
+  );
+  console.log(`\u2713 Migration created: ${data.migration.name} (${data.migration.id})`);
+  console.log(`  Apply it with: deploro migrate apply ${data.migration.id}`);
+}
+async function migrateListCommand() {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/migrations`);
+  table(
+    data.migrations.map((m) => ({
+      id: m.id,
+      name: m.name,
+      status: m.applied_at ? "applied" : "pending",
+      applied_at: m.applied_at ? new Date(m.applied_at).toLocaleString() : "\u2014",
+      created_at: new Date(m.created_at).toLocaleDateString()
+    }))
+  );
+}
+async function resolveMigration(idOrName) {
+  const config = requireProject();
+  const data = await apiRequest(`/api/projects/${config.projectId}/migrations`);
+  const matches = data.migrations.filter((m) => m.id === idOrName || m.name === idOrName);
+  if (matches.length === 0) {
+    console.error(`No migration matches "${idOrName}". Run: deploro migrate list`);
+    process.exit(1);
+  }
+  if (matches.length > 1) {
+    console.error(`"${idOrName}" is ambiguous (matches ${matches.length} migrations by name) \u2014 use the id.`);
+    process.exit(1);
+  }
+  return { config, migration: matches[0] };
+}
+async function migrateApplyCommand(idOrName) {
+  const { config, migration } = await resolveMigration(idOrName);
+  if (migration.applied_at) {
+    console.error(`Migration "${migration.name}" is already applied.`);
+    process.exit(1);
+  }
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/migrations/${migration.id}/apply`,
+    { method: "POST" }
+  );
+  console.log(`\u2713 Applied: ${data.migration.name}`);
+  console.log(`  Applied at: ${data.migration.applied_at ? new Date(data.migration.applied_at).toLocaleString() : "(unknown)"}`);
+}
+async function migrateRollbackCommand(idOrName, opts) {
+  const { config, migration } = await resolveMigration(idOrName);
+  if (!migration.applied_at) {
+    console.error(`Migration "${migration.name}" has not been applied.`);
+    process.exit(1);
+  }
+  if (!migration.sql_down) {
+    console.error(`Migration "${migration.name}" has no rollback SQL defined.`);
+    process.exit(1);
+  }
+  await confirmOrDie(`Roll back "${migration.name}"? This runs its sql_down against the project database.`, opts.yes);
+  const data = await apiRequest(
+    `/api/projects/${config.projectId}/migrations/${migration.id}/rollback`,
+    { method: "POST" }
+  );
+  console.log(`\u2713 Rolled back: ${data.migration.name}`);
+}
+async function migrateDeleteCommand(idOrName, opts) {
+  const { config, migration } = await resolveMigration(idOrName);
+  if (migration.applied_at) {
+    console.error(`"${migration.name}" is applied \u2014 roll it back first: deploro migrate rollback ${migration.id}`);
+    process.exit(1);
+  }
+  await confirmOrDie(`Delete unapplied migration "${migration.name}"?`, opts.yes);
+  await apiRequest(`/api/projects/${config.projectId}/migrations/${migration.id}`, { method: "DELETE" });
+  console.log(`\u2713 Migration "${migration.name}" deleted`);
 }
 
 // src/commands/hosting.ts
@@ -416,6 +621,17 @@ async function hostingSetEnvCommand(key, value) {
   });
   console.log(`\u2713 Secret '${key}' updated`);
 }
+async function hostingEnvCommand() {
+  requireConfig();
+  const data = await apiRequest("/api/hosting/env");
+  if (data.secrets.length === 0) {
+    console.log("No secrets set on the active project's Worker.");
+    return;
+  }
+  console.log("\nSecrets set on the active project's Worker (values are never returned by the API):\n");
+  for (const s of data.secrets) console.log(`  ${s.name}`);
+  console.log("");
+}
 var BARS = "\u2581\u2582\u2583\u2584\u2585\u2586\u2587\u2588";
 function spark(values) {
   if (values.length === 0) return "(no data)";
@@ -589,8 +805,9 @@ async function deployLogsCommand(deploymentId) {
 }
 
 // src/index.ts
+var pkg = createRequire(import.meta.url)("../package.json");
 var program = new Command();
-program.name("deploro").description("Deploro developer platform CLI").version("0.2.1");
+program.name("deploro").description("Deploro developer platform CLI").version(pkg.version);
 program.command("login").description("Log in to Deploro").option("--url <url>", "Worker base URL").option("--token <token>", "Personal access token from the Deploro dashboard").action(loginCommand);
 program.command("logout").description("Log out and clear local credentials").action(logoutCommand);
 program.command("projects").description("List projects").action(projectsListCommand);
@@ -598,6 +815,8 @@ program.command("create <name>").description("Create a new project (and set it a
 program.command("use <project>").description("Set the active project (accepts id, slug, or name)").action(useProjectCommand);
 program.command("delete <project>").description("Delete a project and its database (accepts id, slug, or name)").option("-y, --yes", "Skip confirmation prompt").action(projectsDeleteCommand);
 var db = program.command("db").description("Database commands");
+db.command("create").description("Provision the active project's database (idempotent)").action(dbCreateCommand);
+db.command("info").description("Show database status and how to reach it from a deployed app").action(dbInfoCommand);
 db.command("tables").description("List tables in the active project").action(dbTablesCommand);
 db.command("rows <table>").description("List rows in a table").option("--limit <n>", "Rows per page (max 200)", "20").option("--page <n>", "Page number", "1").option("--json", "Output raw JSON").action(dbRowsCommand);
 db.command("query <sql>").description("Run a SQL query (project admin)").option("--json", "Output raw JSON").action(dbQueryCommand);
@@ -606,13 +825,24 @@ db.command("insert <table>").description("Insert a row").requiredOption("--data
 db.command("update <table> <id>").description("Update a row by id").requiredOption("--data <json>", "Fields to update as a JSON object").action(dbUpdateCommand);
 db.command("delete-row <table> <id>").description("Delete a row by id").option("--yes", "Skip confirmation prompt").action(dbDeleteRowCommand);
 db.command("drop <table>").description("Drop a table and all its data (project admin)").option("--yes", "Skip confirmation prompt").action(dbDropTableCommand);
+var migrate = program.command("migrate").description("Database migration commands");
+migrate.command("create <name>").description("Register a new migration (admin)").option("--up <sql>", "Migration SQL (inline)").option("--up-file <path>", "Read migration SQL from a file").option("--down <sql>", "Rollback SQL (inline)").option("--down-file <path>", "Read rollback SQL from a file").action(migrateCreateCommand);
+migrate.command("list").description("List migrations for the active project").action(migrateListCommand);
+migrate.command("apply <id-or-name>").description("Apply a pending migration (admin)").action(migrateApplyCommand);
+migrate.command("rollback <id-or-name>").description("Roll back an applied migration (admin)").option("--yes", "Skip confirmation prompt").action(migrateRollbackCommand);
+migrate.command("delete <id-or-name>").description("Delete an unapplied migration (admin)").option("--yes", "Skip confirmation prompt").action(migrateDeleteCommand);
 var auth = program.command("auth").description("Auth management commands");
-auth.command("whoami").description("Show the current identity").action(authWhoamiCommand);
+auth.command("whoami").description("Show the current identity, and \u2014 for a token login \u2014 exactly what it's scoped to").action(authWhoamiCommand);
 auth.command("users").description("List platform users").action(authUsersCommand);
 auth.command("invite <email>").description("Invite a user by email").option("--admin", "Grant admin role").action(authInviteCommand);
+var token = program.command("token").description("Personal access token commands");
+token.command("list").description("List your personal access tokens").action(tokenListCommand);
+token.command("create <name>").description("Create a new project-scoped personal access token").option("--read", "Grant read scope").option("--write", "Grant write scope").option("--project <slugs>", "Comma-separated project slugs/ids/names (defaults to the active project)").option("--days <n>", "Expiry in days (1-365)", "90").action(tokenCreateCommand);
+token.command("revoke <id>").description("Revoke a personal access token").option("--yes", "Skip confirmation prompt").action(tokenRevokeCommand);
 var hosting = program.command("hosting").description("Hosting commands");
 hosting.command("status").description("Show Worker and VPS health").action(hostingStatusCommand);
 hosting.command("metrics").description("Show recent VPS CPU/memory/disk sparklines").action(hostingMetricsCommand);
+hosting.command("env").description("List secret names set on the active project's Worker (values are never returned)").action(hostingEnvCommand);
 hosting.command("set-env <key> <value>").description("Set a Worker secret").action(hostingSetEnvCommand);
 var deploy = program.command("deploy").description("Deployment commands");
 deploy.command("trigger").description("Trigger a manual deployment").action(deployCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploro",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Command-line interface for the Deploro developer platform — manage projects, databases, deployments, and hosting from your terminal.",
   "type": "module",
   "bin": {