@apso/cli 0.47.0 → 0.47.2

package/dist/commands/deploy.js

@@ -100,7 +100,7 @@ class Deploy extends base_command_1.default {
             }
         }
         // Trigger build
-        const build = await (0, upgrade_1.withUpgradeRetry)(() => services_1.buildApi.trigger(link.workspaceSlug, link.serviceSlug, env));
+        const build = await (0, upgrade_1.withUpgradeRetry)(() => services_1.buildApi.trigger(link.workspaceSlug, link.serviceSlug, env), { workspaceSlug: link.workspaceSlug, serviceId: service.id });
         this.log(`Build started: ${build.id}`);
         if (flags["no-wait"]) {
             this.log(`Deploy triggered. Run 'apso status --env ${env}' to check progress.`);

package/dist/commands/env/add.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const base_command_1 = tslib_1.__importDefault(require("../../lib/base-command"));
 const services_1 = require("../../lib/api/services");
 const environments_1 = require("../../lib/environments");
+const upgrade_1 = require("../../lib/upgrade");
 class EnvAdd extends base_command_1.default {
     async run() {
         const { flags } = await this.parse(EnvAdd);
@@ -16,7 +17,7 @@ class EnvAdd extends base_command_1.default {
         const ok = await (0, environments_1.confirmOrExit)(this, flags.yes, `Add staging to "${service.name}"? This starts the paid staging add-on.`);
         if (!ok)
             return this.log("Cancelled.");
-        await services_1.envApi.addStaging(service.id);
+        await (0, upgrade_1.withUpgradeRetry)(() => services_1.envApi.addStaging(service.id), (0, environments_1.pageContext)(service));
         this.log(`Staging is being created for "${service.name}". Deploy to it with 'apso deploy --env staging'.`);
     }
 }

package/dist/commands/env/list.js

@@ -15,6 +15,10 @@ class EnvList extends base_command_1.default {
             this.log(JSON.stringify(envs, null, 2));
             return;
         }
+        // Production's row appears with the first deploy; until then say so rather than print nothing.
+        if (!envs.some((e) => e.environment === "production")) {
+            this.log(`${"production".padEnd(12)}${"not deployed yet".padEnd(22)}-`);
+        }
         for (const e of envs) {
             this.log(`${e.environment.padEnd(12)}${(e.buildStatus || e.status || "-").padEnd(22)}${(_a = e.url) !== null && _a !== void 0 ? _a : "-"}`);
         }

package/dist/commands/generate.js

@@ -152,6 +152,7 @@ class Generate extends base_command_1.default {
                     relationships: entityRelationships,
                     allEntities: entities,
                     apiType: lowerCaseApiType,
+                    auth,
                 }),
                 generator.generateService({
                     entity,

package/dist/commands/mcp/serve.js

@@ -368,6 +368,7 @@ class McpServe extends base_command_1.default {
                             relationships: entityRelationships,
                             allEntities: entities,
                             apiType: lowerCaseApiType,
+                            auth,
                         }),
                         generator.generateService({
                             entity,

package/dist/commands/open.js

@@ -36,7 +36,7 @@ class Open extends base_command_1.default {
         }
         else {
             // Open the dashboard (default)
-            const dashboardUrl = `${config.webUrl}/workspaces/${link.workspaceSlug}/services/${link.serviceSlug}`;
+            const dashboardUrl = `${config.webUrl}/${link.workspaceSlug}/services/${link.serviceId}/dashboard`;
             this.log(`Opening dashboard: ${dashboardUrl}`);
             openUrl(dashboardUrl);
         }

package/dist/commands/promote.js

@@ -6,6 +6,7 @@ const core_1 = require("@oclif/core");
 const base_command_1 = tslib_1.__importDefault(require("../lib/base-command"));
 const services_1 = require("../lib/api/services");
 const environments_1 = require("../lib/environments");
+const upgrade_1 = require("../lib/upgrade");
 const spinner_1 = require("../lib/utils/spinner");
 class Promote extends base_command_1.default {
     async run() {
@@ -23,7 +24,7 @@ class Promote extends base_command_1.default {
         const ok = await (0, environments_1.confirmOrExit)(this, flags.yes, `Promote staging to production for "${service.name}"?`);
         if (!ok)
             return this.log("Cancelled.");
-        await services_1.envApi.promote(service.id);
+        await (0, upgrade_1.withUpgradeRetry)(() => services_1.envApi.promote(service.id), (0, environments_1.pageContext)(service));
         if (flags["no-wait"]) {
             this.log("Promote started. Run 'apso status' to check progress.");
             return;

package/dist/lib/api/client.d.ts

@@ -9,6 +9,12 @@
  * - Timeout handling
  */
 import { ApiRequestOptions } from "./types";
+/**
+ * Refusals the user resolves in the web app, and where: "service" is the
+ * service's Deployments page (size and staging), "billing" the workspace's
+ * Billing page.
+ */
+export declare const APP_FIX_PAGES: Record<string, "service" | "billing">;
 /**
  * Custom error class for API errors
  */

package/dist/lib/api/client.js

@@ -10,7 +10,7 @@
  * - Timeout handling
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.api = exports.apiRequest = exports.checkNetworkConnectivity = exports.ApiClientError = void 0;
+exports.api = exports.apiRequest = exports.checkNetworkConnectivity = exports.ApiClientError = exports.APP_FIX_PAGES = void 0;
 const config_1 = require("../config");
 /**
  * Default request timeout in milliseconds
@@ -24,6 +24,17 @@ const MAX_RETRIES = 3;
  * Base delay for exponential backoff in milliseconds
  */
 const BACKOFF_BASE_DELAY = 1000;
+/**
+ * Refusals the user resolves in the web app, and where: "service" is the
+ * service's Deployments page (size and staging), "billing" the workspace's
+ * Billing page.
+ */
+exports.APP_FIX_PAGES = {
+    STAGING_REQUIRES_PAID_SERVICE: "service",
+    STAGING_ADDON_REQUIRED: "service",
+    STAGING_ADDON_PURCHASE_FAILED: "service",
+    SERVICE_SUSPENDED: "billing",
+};
 /**
  * Custom error class for API errors
  */
@@ -45,7 +56,9 @@ class ApiClientError extends Error {
      * upgrading (e.g. the free-tier service or deploy limit).
      */
     isLimitError() {
-        return (this.statusCode === 403 &&
+        if (this.code && this.code in exports.APP_FIX_PAGES)
+            return true;
+        return ((this.statusCode === 403 || this.statusCode === 402) &&
             (this.code === "SERVICE_LIMIT_REACHED" ||
                 this.code === "LIMIT_REACHED" ||
                 Boolean(this.upgradeUrl)));
@@ -306,7 +319,12 @@ async function apiRequest(path, options = {}) {
             }
             // Client errors - don't retry
             const limit = extractLimitInfo(errorData);
-            const clientError = new ApiClientError(limit.message || errorData.message || "Request failed", response.status, errorData.details);
+            // The app's API routes put their sentence in `.error`; the backend uses `.message`.
+            const appError = errorData.error;
+            const clientError = new ApiClientError(limit.message ||
+                errorData.message ||
+                (typeof appError === "string" ? appError : undefined) ||
+                "Request failed", response.status, errorData.details);
             clientError.code = limit.code;
             clientError.upgradeUrl = limit.upgradeUrl;
             throw clientError;

package/dist/lib/environments.d.ts

@@ -1,7 +1,9 @@
 import type { Command } from "@oclif/core";
 import { type ServiceEnv } from "./api/services";
 import type { Service } from "./api/types";
+import type { PageContext } from "./upgrade";
 export declare const envFlag: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
 export declare const asEnv: (value: string | undefined) => ServiceEnv;
 export declare function linkedService(cmd: Command): Promise<Service>;
+export declare function pageContext(service: Service): PageContext;
 export declare function confirmOrExit(cmd: Command, yes: boolean, question: string): Promise<boolean>;

package/dist/lib/environments.js

@@ -23,7 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.confirmOrExit = exports.linkedService = exports.asEnv = exports.envFlag = void 0;
+exports.confirmOrExit = exports.pageContext = exports.linkedService = exports.asEnv = exports.envFlag = void 0;
 const core_1 = require("@oclif/core");
 const config_1 = require("./config");
 const services_1 = require("./api/services");
@@ -46,6 +46,12 @@ async function linkedService(cmd) {
     return services_1.servicesApi.get(link.workspaceId, link.serviceSlug);
 }
 exports.linkedService = linkedService;
+// Where the linked service lives in the web app, for links to the page that fixes a refusal.
+function pageContext(service) {
+    var _a;
+    return { workspaceSlug: (_a = config_1.projectLink.read()) === null || _a === void 0 ? void 0 : _a.workspaceSlug, serviceId: service.id };
+}
+exports.pageContext = pageContext;
 // Asks before a step that costs money or replaces something; headless runs must pass --yes.
 async function confirmOrExit(cmd, yes, question) {
     if (yes)

package/dist/lib/generators/go.js

@@ -244,8 +244,10 @@ class GoGenerator extends base_1.BaseGenerator {
         ];
     }
     async generateDto(options) {
+        var _a;
         const { entity, relationships, allEntities, apiType } = options;
         const { name: entityName, fields = [] } = entity;
+        const scopeFields = new Set((_a = (0, guards_1.entityScope)(entity, Boolean(options.auth))) === null || _a === void 0 ? void 0 : _a.fields.map((f) => f.field));
         const columns = this.getGoFieldsForTemplate(fields, entityName);
         const relationshipsTemplate = (0, relationships_1.getRelationshipForTemplate)(entityName, relationships, allEntities);
         // Add Go-specific properties to relationships
@@ -258,6 +260,8 @@ class GoGenerator extends base_1.BaseGenerator {
                 camelReferenceName: (0, casing_1.camelCase)(rel.referenceName || rel.name),
                 pluralName: (0, casing_1.pascalCase)((0, pluralize_1.default)(rel.name)),
                 camelPluralName: (0, casing_1.camelCase)((0, pluralize_1.default)(rel.name)),
+                // The service sets a scopeBy foreign key from the caller on create.
+                scoped: scopeFields.has(`${(0, casing_1.camelCase)(rel.referenceName || rel.name)}Id`),
             };
         });
         const primaryKeyColumns = columns.filter((column) => column.primary === true);

package/dist/lib/generators/typescript.js

@@ -109,7 +109,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         ];
     }
     async generateController(options) {
-        var _a, _b;
+        var _a;
         const { entity, relationships, relationshipMap, auth } = options;
         const { name: entityName } = entity;
         const relationshipsForTemplate = (0, relationships_1.getRelationshipForTemplate)(entityName, relationships);
@@ -128,9 +128,22 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         const ctrlName = `${entityName}Controller`;
         const pluralEntityName = (0, pluralize_1.default)(entityName);
         const primaryKeyType = entity.primaryKeyType || "serial";
-        const scopes = auth
-            ? (_b = (_a = (0, guards_1.getScopedEntities)([entity], relationshipMap)[0]) === null || _a === void 0 ? void 0 : _a.scopes) !== null && _b !== void 0 ? _b : []
-            : [];
+        const scoped = auth
+            ? (0, guards_1.getScopedEntities)([entity], relationshipMap)[0]
+            : undefined;
+        const scopes = (_a = scoped === null || scoped === void 0 ? void 0 : scoped.scopes) !== null && _a !== void 0 ? _a : [];
+        // Only emitted when scopeOptions differ from the defaults, so services
+        // without them keep the same generated controller.
+        const scopeOptions = scoped &&
+            (scoped.bypassRoles.length > 0 ||
+                !scoped.injectOnCreate ||
+                ["find", "get", "create", "update", "delete"].some((op) => !scoped.enforceOn.includes(op)))
+            ? {
+                enforceOn: scoped.enforceOn,
+                bypassRoles: scoped.bypassRoles,
+                injectOnCreate: scoped.injectOnCreate,
+            }
+            : undefined;
         const data = {
             svcName,
             ctrlName,
@@ -145,6 +158,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             // ids ScopeGuard loaded for the caller into req.apsoScope.
             crudAuth: scopes.filter((s) => s.direct),
             crudAuthNested: scopes.filter((s) => s.fkField),
+            scopeOptions,
         };
         const controllerContent = await this.renderTemplate("./rest/controller-rest", data);
         const specContent = await this.renderTemplate("./rest/controller-rest-spec", data);

package/dist/lib/templates/go/dto/dto.eta

@@ -51,7 +51,7 @@ type <%= it.entityName %>Create struct {
 <% }); -%>
 <% it.associations.forEach((assoc) => { -%>
 <% if (assoc.type === 'ManyToOne' || (assoc.type === 'OneToOne' && assoc.isOwner)) { -%>
-	<%= assoc.referenceName || assoc.name %>ID <%= assoc.primaryKeyGoType || 'uint' %> `json:"<%= assoc.camelReferenceName || assoc.camelName %>Id" validate:"required"`
+	<%= assoc.referenceName || assoc.name %>ID <%= assoc.primaryKeyGoType || 'uint' %> `json:"<%= assoc.camelReferenceName || assoc.camelName %>Id"<% if (!assoc.scoped) { %> validate:"required"<% } %>`
 <% } -%>
 <% }) -%>
 }

package/dist/lib/templates/guards/scope.guard.eta

@@ -168,7 +168,7 @@ export class ScopeGuard implements CanActivate {
     }
 
     // Check if user has bypass role
-    const userRoles: string[] = request.user?.roles || request.roles || [];
+    const userRoles: string[] = request.auth?.roles ?? request.user?.roles ?? request.roles ?? [];
     if (scopeConfig.bypassRoles.some(role => userRoles.includes(role))) {
       return true;
     }

package/dist/lib/templates/rest/controller-rest.eta

@@ -15,6 +15,26 @@ const nestedScope = (req: any, fk: string) => {
     return { [fk]: ids.length ? { $in: ids } : { $isnull: true, $notnull: true } };
 };
 <% } %>
+<% if (it.scopeOptions && (it.crudAuth.length || it.crudAuthNested.length)) { %>
+// .apsorc scopeOptions: which requests the tenant filter covers and which
+// roles skip it.
+const ENFORCE_ON = [<%~ it.scopeOptions.enforceOn.map((op) => `'${op}'`).join(', ') %>];
+const BYPASS_ROLES: string[] = [<%~ it.scopeOptions.bypassRoles.map((r) => `'${r}'`).join(', ') %>];
+const scopeOperation = (req: any) => {
+    switch (req.method) {
+        case 'GET': return req.params?.id ? 'get' : 'find';
+        case 'POST': return 'create';
+        case 'PUT':
+        case 'PATCH': return 'update';
+        case 'DELETE': return 'delete';
+        default: return 'find';
+    }
+};
+const skipScope = (req: any) => {
+    const roles: string[] = req.auth?.roles ?? req.user?.roles ?? [];
+    return roles.some((r) => BYPASS_ROLES.includes(r)) || !ENFORCE_ON.includes(scopeOperation(req));
+};
+<% } %>
 @Crud({
     model: {
         type: <%= it.entityName %>
@@ -63,7 +83,7 @@ const nestedScope = (req: any, fk: string) => {
 <% if (it.crudAuth.length || it.crudAuthNested.length) { %>
 // Every query and write is limited to the caller's tenant (.apsorc scopeBy).
 @CrudAuth({
-    filter: (req: any) => ({
+    filter: (req: any) => <% if (it.scopeOptions) { %>skipScope(req) ? {} : <% } %>({
 <% it.crudAuth.forEach((s) => { %>
         <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
 <% }) %>
@@ -71,7 +91,7 @@ const nestedScope = (req: any, fk: string) => {
         ...nestedScope(req, '<%= s.fkField %>'),
 <% }) %>
     }),
-    persist: (req: any) => ({
+    persist: (req: any) => <% if (it.scopeOptions) { %>skipScope(req)<% if (!it.scopeOptions.injectOnCreate) { %> || scopeOperation(req) === 'create'<% } %> ? {} : <% } %>({
 <% it.crudAuth.forEach((s) => { %>
         <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
 <% }) %>

package/dist/lib/types/generator.d.ts

@@ -181,6 +181,8 @@ export interface DtoGenerationOptions extends EntityGenerationOptions {
      * Include validation decorators/rules
      */
     includeValidation?: boolean;
+    /** With scopeBy, the service sets the tenant field, so create doesn't require it. */
+    auth?: AuthConfig;
 }
 /**
  * Options for generating migrations

package/dist/lib/upgrade.d.ts

@@ -7,13 +7,23 @@
  * "you've hit a limit, upgrade?" flow developers expect from modern CLIs.
  */
 import { ApiClientError } from "./api/client";
+/** Where the user is when the refusal happened, so the link can go to the exact page. */
+export interface PageContext {
+    workspaceSlug?: string;
+    serviceId?: string;
+}
+/** The web app page that resolves this refusal, and how to name it in a prompt. */
+export declare function fixPage(error: ApiClientError, ctx?: PageContext): {
+    url: string;
+    label: string;
+};
 /**
- * Prompt the user to upgrade after a limit error, open the upgrade page, and
- * wait for them to finish. Returns true if the caller should retry the action.
+ * Prompt the user to resolve a plan or billing refusal in the web app, open the
+ * page, and wait for them to finish. Returns true if the caller should retry.
  */
-export declare function promptUpgrade(error: ApiClientError): Promise<boolean>;
+export declare function promptUpgrade(error: ApiClientError, ctx?: PageContext): Promise<boolean>;
 /**
  * Run an action; if it fails with an upgradeable plan-limit error, offer to
  * upgrade and retry once.
  */
-export declare function withUpgradeRetry<T>(action: () => Promise<T>): Promise<T>;
+export declare function withUpgradeRetry<T>(action: () => Promise<T>, ctx?: PageContext): Promise<T>;

package/dist/lib/upgrade.js

@@ -8,7 +8,7 @@
  * "you've hit a limit, upgrade?" flow developers expect from modern CLIs.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.withUpgradeRetry = exports.promptUpgrade = void 0;
+exports.withUpgradeRetry = exports.promptUpgrade = exports.fixPage = void 0;
 const tslib_1 = require("tslib");
 const child_process_1 = require("child_process");
 const inquirer_1 = tslib_1.__importDefault(require("inquirer"));
@@ -29,13 +29,31 @@ function openBrowser(url) {
         (0, child_process_1.exec)(command, () => resolve());
     });
 }
+/** The web app page that resolves this refusal, and how to name it in a prompt. */
+function fixPage(error, ctx = {}) {
+    const web = config_1.globalConfig.read().webUrl;
+    const where = error.code ? client_1.APP_FIX_PAGES[error.code] : undefined;
+    if (where === "service" && ctx.workspaceSlug && ctx.serviceId) {
+        return {
+            url: `${web}/${ctx.workspaceSlug}/services/${ctx.serviceId}/deployments`,
+            label: "the service's Deployments page",
+        };
+    }
+    if (where === "billing" && ctx.workspaceSlug) {
+        return { url: `${web}/${ctx.workspaceSlug}/billing`, label: "Billing" };
+    }
+    return {
+        url: `${web}${error.upgradeUrl || "/billing/upgrade"}`,
+        label: "the upgrade page",
+    };
+}
+exports.fixPage = fixPage;
 /**
- * Prompt the user to upgrade after a limit error, open the upgrade page, and
- * wait for them to finish. Returns true if the caller should retry the action.
+ * Prompt the user to resolve a plan or billing refusal in the web app, open the
+ * page, and wait for them to finish. Returns true if the caller should retry.
  */
-async function promptUpgrade(error) {
-    const config = config_1.globalConfig.read();
-    const upgradeUrl = `${config.webUrl}${error.upgradeUrl || "/billing/upgrade"}`;
+async function promptUpgrade(error, ctx = {}) {
+    const { url: upgradeUrl, label } = fixPage(error, ctx);
     console.log("");
     console.log(`  ⚠  ${error.message || "You've reached a plan limit."}`);
     console.log("");
@@ -43,12 +61,12 @@ async function promptUpgrade(error) {
         {
             type: "confirm",
             name: "proceed",
-            message: "Open the upgrade page in your browser?",
+            message: `Open ${label} in your browser?`,
             default: true,
         },
     ]);
     if (!proceed) {
-        console.log(`  You can upgrade any time at: ${upgradeUrl}`);
+        console.log(`  You can do this any time at: ${upgradeUrl}`);
         return false;
     }
     console.log("");
@@ -59,7 +77,7 @@ async function promptUpgrade(error) {
         {
             type: "confirm",
             name: "done",
-            message: "Press enter once your upgrade is complete to retry",
+            message: "Press enter once you are done there to retry",
             default: true,
         },
     ]);
@@ -70,7 +88,7 @@ exports.promptUpgrade = promptUpgrade;
  * Run an action; if it fails with an upgradeable plan-limit error, offer to
  * upgrade and retry once.
  */
-async function withUpgradeRetry(action) {
+async function withUpgradeRetry(action, ctx = {}) {
     try {
         return await action();
     }
@@ -79,10 +97,10 @@ async function withUpgradeRetry(action) {
             // Headless (agent/CI): never open a browser or prompt — surface the limit
             // as a clear error with the upgrade URL so the caller can act on it.
             if (!(0, interactive_1.isInteractive)()) {
-                const upgradeUrl = `${config_1.globalConfig.read().webUrl}${error.upgradeUrl || "/billing/upgrade"}`;
-                throw new Error(`${error.message || "Plan limit reached."} Upgrade at ${upgradeUrl}`);
+                const { url } = fixPage(error, ctx);
+                throw new Error(`${(error.message || "Plan limit reached").replace(/\.?$/, ".")} Resolve it at ${url}`);
             }
-            const retry = await promptUpgrade(error);
+            const retry = await promptUpgrade(error, ctx);
             if (retry) {
                 return action();
             }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.47.0",
+      "version": "0.47.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@apso/schema-tools": "^0.2.0",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.47.0",
+  "version": "0.47.2",
   "commands": {
     "config": {
       "id": "config",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.47.0",
+  "version": "0.47.2",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",