@ductape/cli 0.3.16 → 0.3.17

package/dist/commands/features-sync.d.ts

@@ -0,0 +1,12 @@
+export interface FeaturesSyncOpts {
+    filter?: string;
+}
+/**
+ * Persists code-first Ductape Features to the live product. Unlike `ductape db migrate` (which
+ * executes declarative migration files directly), a Feature's handler is real application code
+ * that typically depends on the app's own services (repositories, DB connections, DI). Ductape
+ * cannot safely execute that code in isolation — so this command delegates to a "features:sync"
+ * npm script that the project itself owns and controls, giving a single consistent entrypoint
+ * across every Ductape project regardless of framework.
+ */
+export declare function runFeaturesSync(opts: FeaturesSyncOpts): Promise<void>;

package/dist/commands/features-sync.js

@@ -0,0 +1,54 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { findProjectConfig } from '../lib/config.js';
+import { fail } from '../lib/output.js';
+const CONVENTION_HINT = `
+Ductape convention for code-first Features:
+  1. Define every Feature under ductape/features/ (e.g. ductape/features/src/my-feature.ts),
+     each calling ductape.feature.define({ ... }) from a registerXFeature(ductape) export.
+  2. In your app's normal startup path, register only LOCAL function/operation handlers
+     (ductape.sdk.functions.register(...)) — no network call, safe on every boot.
+  3. Add a "features:sync" script to package.json that boots just enough of your app to
+     construct real dependencies (no HTTP listener) and calls every registerXFeature(...) once.
+  4. Run it explicitly with \`ductape features sync\` — never automatically on app boot.
+
+This mirrors \`ductape db migrate\`: Features are defined in source, but persisted to the live
+product via an explicit command, so a slow or unreachable Ductape API can never block your app
+from starting.
+`;
+/**
+ * Persists code-first Ductape Features to the live product. Unlike `ductape db migrate` (which
+ * executes declarative migration files directly), a Feature's handler is real application code
+ * that typically depends on the app's own services (repositories, DB connections, DI). Ductape
+ * cannot safely execute that code in isolation — so this command delegates to a "features:sync"
+ * npm script that the project itself owns and controls, giving a single consistent entrypoint
+ * across every Ductape project regardless of framework.
+ */
+export async function runFeaturesSync(opts) {
+    const found = findProjectConfig();
+    if (!found)
+        fail('No linked project. Run `ductape link` from your project directory (or `ductape init`).');
+    const { dir } = found;
+    const packageJsonPath = path.join(dir, 'package.json');
+    if (!fs.existsSync(packageJsonPath)) {
+        fail(`No package.json found at ${dir}.\n${CONVENTION_HINT}`);
+    }
+    const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    if (!pkg.scripts?.['features:sync']) {
+        fail(`package.json at ${dir} has no "features:sync" script.\n${CONVENTION_HINT}`);
+    }
+    const featuresDir = path.join(dir, 'ductape', 'features');
+    if (!fs.existsSync(featuresDir)) {
+        console.warn(`Warning: ductape/features/ does not exist at ${dir}. Proceeding anyway — your ` +
+            '"features:sync" script may look elsewhere, but the convention is ductape/features/.');
+    }
+    const npmArgs = ['run', 'features:sync'];
+    if (opts.filter)
+        npmArgs.push('--', opts.filter);
+    console.log(`Running "npm ${npmArgs.join(' ')}" in ${dir} ...\n`);
+    const result = spawnSync('npm', npmArgs, { cwd: dir, stdio: 'inherit' });
+    if (result.status !== 0) {
+        fail(`features:sync exited with code ${result.status ?? 1}.`);
+    }
+}

package/dist/commands/resources.d.ts

@@ -25,6 +25,7 @@ export declare function runNotificationMessageCrud(verb: string, opts: {
     notification?: string;
     file?: string;
     json?: boolean;
+    product?: string;
 }): Promise<void>;
 export declare function runResourceCrud(typeName: string, verb: string, opts: {
     tag?: string;

package/dist/commands/resources.js

@@ -230,7 +230,9 @@ export async function runNotificationMessageCrud(verb, opts) {
     }
     const session = requireSession();
     const proxy = getSdkProxy(session);
-    const product = session.project.product_tag;
+    // Explicit --product avoids silently resolving to whatever product happens to be linked in
+    // the current working directory — see resources.ts's runResourceCrud for the same pattern.
+    const product = opts.product ?? session.project.product_tag;
     const body = ['create', 'update'].includes(crud)
         ? await resolveBody({ file: opts.file, patch: crud === 'update', requireBody: crud === 'create', interactive: false })
         : undefined;
@@ -346,7 +348,7 @@ export async function runResourceCrud(typeName, verb, opts, extraArgs) {
         try {
             const reconciliation = await reconcileCreatedComponent(proxy, module, productTag, createdTag);
             if (!reconciliation.resource) {
-                throw new DuctapeOperationError(`${error.message} Reconciliation polled the administrative product catalogue ${reconciliation.attempts} time(s) for ${reconciliation.elapsed_ms}ms and did not find "${createdTag}".`, { ...error.details, code: 'MUTATION_OUTCOME_UNKNOWN', mutationState: 'unknown' });
+                throw new DuctapeOperationError(`${error.message} Reconciliation polled the administrative product catalogue for product "${productTag}" ${reconciliation.attempts} time(s) for ${reconciliation.elapsed_ms}ms and did not find "${createdTag}". If this product tag looks wrong, pass --product explicitly instead of relying on the linked project.`, { ...error.details, code: 'MUTATION_OUTCOME_UNKNOWN', mutationState: 'unknown' });
             }
             printJson({
                 created: true,

package/dist/index.js

@@ -17,6 +17,7 @@ import { runResourceCrud, runResourcesList, runEventTopicCrud, runNotificationMe
 import { runCloud, runCloudPreflight } from './commands/cloud.js';
 import { runDb, runDbContext } from './commands/db.js';
 import { runDbMigrate, runDbMigrateStatus, runDbMigrateRollback } from './commands/db-migrate.js';
+import { runFeaturesSync } from './commands/features-sync.js';
 import { runDbSchemaGenerate, runDbSchemaPush } from './commands/db-schema.js';
 import { runGraph } from './commands/graph.js';
 import { runSecretImportEnv, runSecrets } from './commands/secrets.js';
@@ -696,6 +697,7 @@ notificationMessages
     .option('-t, --tag <tag>', 'Full notification:message tag')
     .option('-n, --notification <tag>', 'Notification tag for list')
     .option('-f, --file <path>', 'JSON template body for create/update')
+    .option('--product <tag>', 'Product tag (defaults to linked project)')
     .option('--json', 'JSON output')
     .action(wrap((verb, opts) => runNotificationMessageCrud(verb, opts)));
 resources.command('types').option('--json', 'JSON output').action(wrap((opts) => runResourcesList(Boolean(opts.json))));
@@ -781,6 +783,14 @@ db
         throw new Error('Specify a verb: connect | query');
     return runDb(verb, { file: opts.file, json: opts.json });
 }));
+const features = program.command('features').description('Code-first Ductape Features (ductape/features/)');
+features
+    .command('sync')
+    .description('Persist Features from ductape/features/ to the live product by running the project\'s own ' +
+    '"features:sync" npm script (see `ductape features sync --help` for the required convention). ' +
+    'Run explicitly, like `ductape db migrate` — never automatically on app boot.')
+    .argument('[filter]', 'Optional substring passed through to the project\'s features:sync script')
+    .action(wrap((filter) => runFeaturesSync({ filter })));
 const graph = program.command('graph').description('Graph runtime (graph-proxy)');
 graph
     .argument('<verb>', 'connect | query | createAction | validateAction | updateAction | …')

package/dist/lib/platform-api.js

@@ -241,8 +241,16 @@ export async function connectMarketplaceApp(ctx, product, appTag, envs) {
     if (!marketplaceApp || typeof marketplaceApp !== 'object')
         throw new Error(`Marketplace app "${appTag}" was not found`);
     const app = marketplaceApp;
-    if (app.status !== 'public')
-        throw new Error(`App "${appTag}" is not public in the marketplace`);
+    // DT-021: this was a blanket "must be public" guard that also rejected an app the caller's own
+    // workspace owns and never even reaches the backend to find out whether it would allow it.
+    // ductape_marketplace_inspect has no such restriction for the same private app, so the read path
+    // already treats same-workspace ownership as sufficient — mirror that here for connect.
+    const isOwnedByCallerWorkspace = String(app.workspace_id ?? '') === String(ctx.workspaceId ?? '')
+        && Boolean(ctx.workspaceId);
+    if (app.status !== 'public' && !isOwnedByCallerWorkspace) {
+        throw new Error(`App "${appTag}" is not public in the marketplace and is not owned by your workspace. ` +
+            'Only public marketplace apps or apps your own workspace created can be connected.');
+    }
     const versions = Array.isArray(app.versions) ? app.versions : [];
     const latest = versions.find((version) => version.latest === true) ?? versions[0];
     const availableAppEnvs = new Set((Array.isArray(latest?.envs) ? latest.envs : []).map((env) => String(env && typeof env === 'object' ? env.slug ?? '' : env)).filter(Boolean));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/cli",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "description": "Ductape CLI — local platform, login, link projects, and manage resources via the proxy (Workbench-compatible)",
   "type": "module",
   "main": "dist/index.js",