@ductape/cli 0.3.16 → 0.3.18

package/dist/commands/app-actions.d.ts

@@ -0,0 +1,8 @@
+import { type CommandInteractiveFlags } from '../lib/interactive-opts.js';
+export declare function runAppActions(verb: string, opts: {
+    profile?: string;
+    app?: string;
+    action?: string;
+    file?: string;
+    json?: boolean;
+} & CommandInteractiveFlags): Promise<void>;

package/dist/commands/app-actions.js

@@ -0,0 +1,56 @@
+import { toInteractiveOpts } from '../lib/interactive-opts.js';
+import { bodyRequiredHint, resolveBody } from '../lib/read-body.js';
+import { createAppAction, deleteAppAction, getAppAction, listAppActions, updateAppAction, } from '../lib/platform-api.js';
+import { printJson } from '../lib/output.js';
+import { requireWorkspaceContext } from '../lib/workspace-context.js';
+const VERBS = ['list', 'get', 'create', 'update', 'delete'];
+export async function runAppActions(verb, opts) {
+    const v = verb.toLowerCase();
+    if (!VERBS.includes(v)) {
+        throw new Error(`Unknown apps actions verb "${verb}". Use: ${VERBS.join(', ')}`);
+    }
+    if (!opts.app)
+        throw new Error('Provide --app <app_tag>');
+    const ctx = requireWorkspaceContext({ profile: opts.profile });
+    const interactive = toInteractiveOpts(opts);
+    const body = v === 'create' || v === 'update'
+        ? await resolveBody({
+            ...interactive,
+            file: opts.file,
+            patch: v === 'update',
+            requireBody: v === 'create',
+        })
+        : undefined;
+    let result;
+    switch (v) {
+        case 'list':
+            result = await listAppActions(ctx, opts.app);
+            break;
+        case 'get':
+            if (!opts.action)
+                throw new Error('Provide --action <action_tag>');
+            result = await getAppAction(ctx, opts.app, opts.action);
+            break;
+        case 'create':
+            if (!body || Object.keys(body).length === 0) {
+                throw new Error(`create requires a body. ${bodyRequiredHint('apps:actions:create')}`);
+            }
+            result = await createAppAction(ctx, opts.app, body);
+            break;
+        case 'update': {
+            const actionTag = opts.action ?? body?.tag;
+            if (!actionTag)
+                throw new Error('update requires --action <action_tag>');
+            result = await updateAppAction(ctx, opts.app, actionTag, body ?? {});
+            break;
+        }
+        case 'delete':
+            if (!opts.action)
+                throw new Error('Provide --action <action_tag>');
+            result = await deleteAppAction(ctx, opts.app, opts.action);
+            break;
+        default:
+            throw new Error(`Unsupported: apps actions ${v}`);
+    }
+    printJson(result, Boolean(opts.json));
+}

package/dist/commands/features-sync.d.ts

@@ -0,0 +1,12 @@
+export interface FeaturesSyncOpts {
+    filter?: string;
+}
+/**
+ * Persists code-first Ductape Features to the live product. Unlike `ductape db migrate` (which
+ * executes declarative migration files directly), a Feature's handler is real application code
+ * that typically depends on the app's own services (repositories, DB connections, DI). Ductape
+ * cannot safely execute that code in isolation — so this command delegates to a "features:sync"
+ * npm script that the project itself owns and controls, giving a single consistent entrypoint
+ * across every Ductape project regardless of framework.
+ */
+export declare function runFeaturesSync(opts: FeaturesSyncOpts): Promise<void>;

package/dist/commands/features-sync.js

@@ -0,0 +1,54 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { findProjectConfig } from '../lib/config.js';
+import { fail } from '../lib/output.js';
+const CONVENTION_HINT = `
+Ductape convention for code-first Features:
+  1. Define every Feature under ductape/features/ (e.g. ductape/features/src/my-feature.ts),
+     each calling ductape.feature.define({ ... }) from a registerXFeature(ductape) export.
+  2. In your app's normal startup path, register only LOCAL function/operation handlers
+     (ductape.sdk.functions.register(...)) — no network call, safe on every boot.
+  3. Add a "features:sync" script to package.json that boots just enough of your app to
+     construct real dependencies (no HTTP listener) and calls every registerXFeature(...) once.
+  4. Run it explicitly with \`ductape features sync\` — never automatically on app boot.
+
+This mirrors \`ductape db migrate\`: Features are defined in source, but persisted to the live
+product via an explicit command, so a slow or unreachable Ductape API can never block your app
+from starting.
+`;
+/**
+ * Persists code-first Ductape Features to the live product. Unlike `ductape db migrate` (which
+ * executes declarative migration files directly), a Feature's handler is real application code
+ * that typically depends on the app's own services (repositories, DB connections, DI). Ductape
+ * cannot safely execute that code in isolation — so this command delegates to a "features:sync"
+ * npm script that the project itself owns and controls, giving a single consistent entrypoint
+ * across every Ductape project regardless of framework.
+ */
+export async function runFeaturesSync(opts) {
+    const found = findProjectConfig();
+    if (!found)
+        fail('No linked project. Run `ductape link` from your project directory (or `ductape init`).');
+    const { dir } = found;
+    const packageJsonPath = path.join(dir, 'package.json');
+    if (!fs.existsSync(packageJsonPath)) {
+        fail(`No package.json found at ${dir}.\n${CONVENTION_HINT}`);
+    }
+    const pkg = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    if (!pkg.scripts?.['features:sync']) {
+        fail(`package.json at ${dir} has no "features:sync" script.\n${CONVENTION_HINT}`);
+    }
+    const featuresDir = path.join(dir, 'ductape', 'features');
+    if (!fs.existsSync(featuresDir)) {
+        console.warn(`Warning: ductape/features/ does not exist at ${dir}. Proceeding anyway — your ` +
+            '"features:sync" script may look elsewhere, but the convention is ductape/features/.');
+    }
+    const npmArgs = ['run', 'features:sync'];
+    if (opts.filter)
+        npmArgs.push('--', opts.filter);
+    console.log(`Running "npm ${npmArgs.join(' ')}" in ${dir} ...\n`);
+    const result = spawnSync('npm', npmArgs, { cwd: dir, stdio: 'inherit' });
+    if (result.status !== 0) {
+        fail(`features:sync exited with code ${result.status ?? 1}.`);
+    }
+}

package/dist/commands/resources.d.ts

@@ -25,6 +25,7 @@ export declare function runNotificationMessageCrud(verb: string, opts: {
     notification?: string;
     file?: string;
     json?: boolean;
+    product?: string;
 }): Promise<void>;
 export declare function runResourceCrud(typeName: string, verb: string, opts: {
     tag?: string;

package/dist/commands/resources.js

@@ -230,7 +230,9 @@ export async function runNotificationMessageCrud(verb, opts) {
     }
     const session = requireSession();
     const proxy = getSdkProxy(session);
-    const product = session.project.product_tag;
+    // Explicit --product avoids silently resolving to whatever product happens to be linked in
+    // the current working directory — see resources.ts's runResourceCrud for the same pattern.
+    const product = opts.product ?? session.project.product_tag;
     const body = ['create', 'update'].includes(crud)
         ? await resolveBody({ file: opts.file, patch: crud === 'update', requireBody: crud === 'create', interactive: false })
         : undefined;
@@ -346,7 +348,7 @@ export async function runResourceCrud(typeName, verb, opts, extraArgs) {
         try {
             const reconciliation = await reconcileCreatedComponent(proxy, module, productTag, createdTag);
             if (!reconciliation.resource) {
-                throw new DuctapeOperationError(`${error.message} Reconciliation polled the administrative product catalogue ${reconciliation.attempts} time(s) for ${reconciliation.elapsed_ms}ms and did not find "${createdTag}".`, { ...error.details, code: 'MUTATION_OUTCOME_UNKNOWN', mutationState: 'unknown' });
+                throw new DuctapeOperationError(`${error.message} Reconciliation polled the administrative product catalogue for product "${productTag}" ${reconciliation.attempts} time(s) for ${reconciliation.elapsed_ms}ms and did not find "${createdTag}". If this product tag looks wrong, pass --product explicitly instead of relying on the linked project.`, { ...error.details, code: 'MUTATION_OUTCOME_UNKNOWN', mutationState: 'unknown' });
             }
             printJson({
                 created: true,

package/dist/index.js

@@ -17,6 +17,7 @@ import { runResourceCrud, runResourcesList, runEventTopicCrud, runNotificationMe
 import { runCloud, runCloudPreflight } from './commands/cloud.js';
 import { runDb, runDbContext } from './commands/db.js';
 import { runDbMigrate, runDbMigrateStatus, runDbMigrateRollback } from './commands/db-migrate.js';
+import { runFeaturesSync } from './commands/features-sync.js';
 import { runDbSchemaGenerate, runDbSchemaPush } from './commands/db-schema.js';
 import { runGraph } from './commands/graph.js';
 import { runSecretImportEnv, runSecrets } from './commands/secrets.js';
@@ -26,6 +27,7 @@ import { runCompletion } from './commands/completion.js';
 import { runProducts, runProductApps, runProductAppActions, runProductComponents, runProductEnvironments } from './commands/products.js';
 import { runApps } from './commands/apps.js';
 import { runAppsImport } from './commands/apps-import.js';
+import { runAppActions } from './commands/app-actions.js';
 import { runMarketplace } from './commands/marketplace.js';
 import { runApply } from './commands/apply.js';
 import { runMigrateCodebase } from './commands/migrate-codebase.js';
@@ -662,6 +664,49 @@ apps
     version: opts.version,
     json: opts.json,
 })));
+const appActions = apps.command('actions').description("An app's own actions (endpoints). resource is a path relative to each of the app's " +
+    'environment base_urls (e.g. "/v1/users/{id}"), not a full URL.');
+appActions
+    .command('list')
+    .requiredOption('--app <tag>', 'App tag')
+    .option('--profile <name>')
+    .option('--json', 'JSON output')
+    .action(wrap((opts) => runAppActions('list', opts)));
+appActions
+    .command('get')
+    .requiredOption('--app <tag>', 'App tag')
+    .requiredOption('--action <tag>', 'Action tag')
+    .option('--profile <name>')
+    .option('--json', 'JSON output')
+    .action(wrap((opts) => runAppActions('get', opts)));
+appActions
+    .command('create')
+    .requiredOption('--app <tag>', 'App tag')
+    // NOTE: cannot use -f/--file here — it collides with the parent `apps` command's own -f/--file
+    // option (used by `apps create`/`apps update`). Commander resolves a flag shared by an ancestor
+    // and a descendant command against the ancestor, so the value never reaches this subcommand's
+    // own opts, and requiredOption fails even when -f is supplied. Same fix as productEnvironments
+    // create/update (--env-file) above.
+    .requiredOption('--action-file <path>', 'JSON body: { tag, name, resource, method, description?, params?, query?, headers?, body?, response? }')
+    .option('--profile <name>')
+    .option('--json', 'JSON output')
+    .action(wrap((opts) => runAppActions('create', { ...opts, file: opts.actionFile })));
+appActions
+    .command('update')
+    .requiredOption('--app <tag>', 'App tag')
+    .requiredOption('--action <tag>', 'Action tag')
+    // See NOTE above on `create` — same -f/--file collision with the parent `apps` command.
+    .requiredOption('--action-file <path>', 'JSON body (partial update)')
+    .option('--profile <name>')
+    .option('--json', 'JSON output')
+    .action(wrap((opts) => runAppActions('update', { ...opts, file: opts.actionFile })));
+appActions
+    .command('delete')
+    .requiredOption('--app <tag>', 'App tag')
+    .requiredOption('--action <tag>', 'Action tag')
+    .option('--profile <name>')
+    .option('--json', 'JSON output')
+    .action(wrap((opts) => runAppActions('delete', opts)));
 program
     .command('marketplace')
     .description('Discover public apps by capability and inspect their actions')
@@ -696,6 +741,7 @@ notificationMessages
     .option('-t, --tag <tag>', 'Full notification:message tag')
     .option('-n, --notification <tag>', 'Notification tag for list')
     .option('-f, --file <path>', 'JSON template body for create/update')
+    .option('--product <tag>', 'Product tag (defaults to linked project)')
     .option('--json', 'JSON output')
     .action(wrap((verb, opts) => runNotificationMessageCrud(verb, opts)));
 resources.command('types').option('--json', 'JSON output').action(wrap((opts) => runResourcesList(Boolean(opts.json))));
@@ -781,6 +827,14 @@ db
         throw new Error('Specify a verb: connect | query');
     return runDb(verb, { file: opts.file, json: opts.json });
 }));
+const features = program.command('features').description('Code-first Ductape Features (ductape/features/)');
+features
+    .command('sync')
+    .description('Persist Features from ductape/features/ to the live product by running the project\'s own ' +
+    '"features:sync" npm script (see `ductape features sync --help` for the required convention). ' +
+    'Run explicitly, like `ductape db migrate` — never automatically on app boot.')
+    .argument('[filter]', 'Optional substring passed through to the project\'s features:sync script')
+    .action(wrap((filter) => runFeaturesSync({ filter })));
 const graph = program.command('graph').description('Graph runtime (graph-proxy)');
 graph
     .argument('<verb>', 'connect | query | createAction | validateAction | updateAction | …')

package/dist/lib/platform-api.d.ts

@@ -24,6 +24,11 @@ export declare function createApp(ctx: WorkspaceContext, body: Record<string, un
 export declare function updateApp(ctx: WorkspaceContext, appId: string, body: Record<string, unknown>): Promise<unknown>;
 export declare function updateAppViaProxy(ctx: WorkspaceContext, tag: string, body: Record<string, unknown>): Promise<unknown>;
 export declare function deleteApp(ctx: WorkspaceContext, appId: string): Promise<unknown>;
+export declare function listAppActions(ctx: WorkspaceContext, appTag: string): Promise<unknown>;
+export declare function getAppAction(ctx: WorkspaceContext, appTag: string, actionTag: string): Promise<unknown>;
+export declare function createAppAction(ctx: WorkspaceContext, appTag: string, body: Record<string, unknown>): Promise<unknown>;
+export declare function updateAppAction(ctx: WorkspaceContext, appTag: string, actionTag: string, body: Record<string, unknown>): Promise<unknown>;
+export declare function deleteAppAction(ctx: WorkspaceContext, appTag: string, actionTag: string): Promise<unknown>;
 export interface MarketplaceSearchOptions {
     query?: string;
     category?: string;

package/dist/lib/platform-api.js

@@ -241,8 +241,16 @@ export async function connectMarketplaceApp(ctx, product, appTag, envs) {
     if (!marketplaceApp || typeof marketplaceApp !== 'object')
         throw new Error(`Marketplace app "${appTag}" was not found`);
     const app = marketplaceApp;
-    if (app.status !== 'public')
-        throw new Error(`App "${appTag}" is not public in the marketplace`);
+    // DT-021: this was a blanket "must be public" guard that also rejected an app the caller's own
+    // workspace owns and never even reaches the backend to find out whether it would allow it.
+    // ductape_marketplace_inspect has no such restriction for the same private app, so the read path
+    // already treats same-workspace ownership as sufficient — mirror that here for connect.
+    const isOwnedByCallerWorkspace = String(app.workspace_id ?? '') === String(ctx.workspaceId ?? '')
+        && Boolean(ctx.workspaceId);
+    if (app.status !== 'public' && !isOwnedByCallerWorkspace) {
+        throw new Error(`App "${appTag}" is not public in the marketplace and is not owned by your workspace. ` +
+            'Only public marketplace apps or apps your own workspace created can be connected.');
+    }
     const versions = Array.isArray(app.versions) ? app.versions : [];
     const latest = versions.find((version) => version.latest === true) ?? versions[0];
     const availableAppEnvs = new Set((Array.isArray(latest?.envs) ? latest.envs : []).map((env) => String(env && typeof env === 'object' ? env.slug ?? '' : env)).filter(Boolean));
@@ -325,6 +333,26 @@ export async function deleteApp(ctx, appId) {
     };
     return client(ctx).delete(`/apps/v1/${appId}?${new URLSearchParams(q).toString()}`);
 }
+// —— App actions (sdk-proxy — admin op, requires access key) ——
+//
+// resource is a path RELATIVE to each of the app's environment base_urls
+// (e.g. "/v1/users/{id}", not a full URL) — Ductape joins base_url + resource
+// per environment at call time.
+export async function listAppActions(ctx, appTag) {
+    return unwrapList(await proxy(ctx).execute('actions', 'list', [appTag]));
+}
+export async function getAppAction(ctx, appTag, actionTag) {
+    return unwrapOne(await proxy(ctx).execute('actions', 'fetch', [appTag, actionTag]));
+}
+export async function createAppAction(ctx, appTag, body) {
+    return unwrapOne(await proxy(ctx).execute('actions', 'create', [appTag, body]));
+}
+export async function updateAppAction(ctx, appTag, actionTag, body) {
+    return unwrapOne(await proxy(ctx).execute('actions', 'update', [appTag, actionTag, body]));
+}
+export async function deleteAppAction(ctx, appTag, actionTag) {
+    return proxy(ctx).execute('actions', 'delete', [appTag, actionTag]);
+}
 function searchableMarketplaceText(app) {
     if (!app || typeof app !== 'object')
         return '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ductape/cli",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "description": "Ductape CLI — local platform, login, link projects, and manage resources via the proxy (Workbench-compatible)",
   "type": "module",
   "main": "dist/index.js",