@apso/cli 0.32.0 → 0.33.1

package/dist/lib/api/client.js

@@ -287,7 +287,14 @@ async function apiRequest(path, options = {}) {
             }
             // Handle server errors with retry
             if (response.status >= 500) {
-                lastError = new ApiClientError(errorData.message || "Server error", response.status, errorData.details);
+                // The BFF returns its message in `.error`; the backend uses `.message`.
+                const errObj = errorData;
+                const serverMsg = errorData.message ||
+                    (typeof errObj.error === "string"
+                        ? errObj.error
+                        : undefined) ||
+                    "Server error";
+                lastError = new ApiClientError(serverMsg, response.status, errorData.details);
                 await sleep(getBackoffDelay(attempt));
                 continue;
             }

package/dist/lib/api/services.d.ts

@@ -138,5 +138,16 @@ export declare const codeApi: {
         bucket?: string;
         key?: string;
     }>;
+    /**
+     * Record S3 metadata after the presigned PUT completes. Without this the
+     * service row's s3_code_key stays null and a server-side push fails with
+     * "No S3 code found". Mirrors the browser upload flow (upload-url -> PUT ->
+     * finalize).
+     */
+    finalize(serviceId: string): Promise<{
+        success: boolean;
+        version?: string;
+        size?: number;
+    }>;
 };
 export {};

package/dist/lib/api/services.js

@@ -377,4 +377,13 @@ exports.codeApi = {
     async getUploadUrl(serviceId) {
         return client_1.api.get(`/api/services/${serviceId}/code/upload-url`);
     },
+    /**
+     * Record S3 metadata after the presigned PUT completes. Without this the
+     * service row's s3_code_key stays null and a server-side push fails with
+     * "No S3 code found". Mirrors the browser upload flow (upload-url -> PUT ->
+     * finalize).
+     */
+    async finalize(serviceId) {
+        return client_1.api.post(`/api/services/${serviceId}/code/finalize`, {});
+    },
 };

package/dist/lib/deploy/server-push.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="node" />
 /// <reference types="node" />
-/** Zip the project source into a buffer, skipping build/vcs/dependency dirs. */
+/** Zip the project source into a buffer, skipping build/vcs/dependency/secret files. */
 export declare function zipProject(cwd: string): Buffer;
 /**
  * Server-side push: upload the project zip to S3 and have the platform push it

package/dist/lib/deploy/server-push.js

@@ -15,12 +15,28 @@ const EXCLUDE_DIRS = new Set([
     ".apso",
     "coverage",
 ]);
-/** Zip the project source into a buffer, skipping build/vcs/dependency dirs. */
+/**
+ * Never push local secrets to the repo. `.env` and `.env.*` (e.g. `.env.local`)
+ * routinely hold DB passwords and session secrets; `.env.example` is the one
+ * env file that is meant to be committed. The backend injects real production
+ * env at runtime, so these are never needed in the pushed code.
+ */
+function isSecretEnvFile(basename) {
+    if (basename === ".env.example" || basename === ".env.sample")
+        return false;
+    return basename === ".env" || basename.startsWith(".env.");
+}
+/** Zip the project source into a buffer, skipping build/vcs/dependency/secret files. */
 function zipProject(cwd) {
     const zip = new adm_zip_1.default();
     zip.addLocalFolder(cwd, "", (filename) => {
         const parts = filename.split(path.sep);
-        return !parts.some((p) => EXCLUDE_DIRS.has(p));
+        if (parts.some((p) => EXCLUDE_DIRS.has(p)))
+            return false;
+        const base = parts[parts.length - 1];
+        if (isSecretEnvFile(base))
+            return false;
+        return true;
     });
     return zip.toBuffer();
 }
@@ -41,6 +57,11 @@ async function serverSidePush(opts) {
     if (!res.ok) {
         throw new Error(`Code upload failed (${res.status}). ${await res.text().catch(() => "")}`);
     }
+    // Record the S3 metadata (bucket/key/version) on the service row. The
+    // presigned PUT lands the zip in S3 but does NOT persist where it went; the
+    // backend push reads s3_code_key from the DB, so without this it fails with
+    // "No S3 code found". Same three-step flow the browser upload uses.
+    await services_1.codeApi.finalize(opts.serviceId);
     await services_1.githubApi.push(opts.serviceId, opts.connectionId, {
         branch: opts.branch,
         message: opts.message,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.32.0",
+      "version": "0.33.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@biomejs/biome": "^1.9.4",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.32.0",
+  "version": "0.33.1",
   "commands": {
     "config": {
       "id": "config",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.32.0",
+  "version": "0.33.1",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",