@eide/foir-cli 0.26.0 → 0.28.0

package/dist/cli.js

@@ -1215,13 +1215,14 @@ function createAppsMethods(client) {
         create2(UpdateAppRequestSchema, { tenantId, projectId, name })
       );
     },
-    async confirmUpdateApp(tenantId, projectId, name, newManifestHash) {
+    async confirmUpdateApp(tenantId, projectId, name, newManifestHash, force = false) {
       const resp = await client.confirmUpdateApp(
         create2(ConfirmUpdateAppRequestSchema, {
           tenantId,
           projectId,
           name,
-          newManifestHash
+          newManifestHash,
+          force
         })
       );
       return resp.app;
@@ -9360,10 +9361,167 @@ function registerConfigsCommands(program2, globalOpts) {
 }
 
 // src/commands/apps.ts
+import chalk17 from "chalk";
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync7, watch as fsWatch } from "fs";
+import { resolve as resolvePath } from "path";
 import {
   AppSchema,
   ValidateManifestResponseSchema
 } from "@eide/foir-proto-ts/apps/v1/apps_service_pb";
+
+// src/lib/tunnel.ts
+import { spawn } from "child_process";
+import { once } from "events";
+import chalk16 from "chalk";
+async function startTunnel(opts) {
+  const host = opts.host ?? "localhost";
+  if (opts.kind === "cloudflared") return startCloudflared(host, opts.port, opts.logs ?? true);
+  if (opts.kind === "ngrok") return startNgrok(opts.port, opts.logs ?? true);
+  throw new Error(`Unknown tunnel kind: ${opts.kind}`);
+}
+var CLOUDFLARED_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+function startCloudflared(host, port, logs) {
+  return new Promise((resolve8, reject) => {
+    let child;
+    try {
+      child = spawn(
+        "cloudflared",
+        [
+          "tunnel",
+          "--no-autoupdate",
+          // Ignore ~/.cloudflared/config.yaml if present. Without this, a
+          // user's existing named-tunnel ingress takes precedence over --url
+          // and every quick-tunnel request falls through to the catch-all
+          // 404. (Spent half a day diagnosing this once — don't relive it.)
+          "--config",
+          "/dev/null",
+          "--url",
+          `http://${host}:${port}`
+        ],
+        { stdio: ["ignore", "pipe", "pipe"] }
+      );
+    } catch (err) {
+      reject(new Error(`Failed to spawn cloudflared: ${err.message}`));
+      return;
+    }
+    let resolved = false;
+    let buffered = "";
+    const onData = (chunk) => {
+      const text = chunk.toString("utf-8");
+      if (logs) process.stderr.write(chalk16.dim(text));
+      buffered += text;
+      const match = buffered.match(CLOUDFLARED_URL_RE);
+      if (match && !resolved) {
+        resolved = true;
+        const url = match[0];
+        const exited = waitForExit(child);
+        resolve8({
+          url,
+          exited,
+          stop: () => stopChild(child)
+        });
+      }
+    };
+    child.stdout.on("data", onData);
+    child.stderr.on("data", onData);
+    child.once("error", (err) => {
+      if (resolved) return;
+      const msg = err.code === "ENOENT" ? "cloudflared not found on PATH. Install: `brew install cloudflared` or https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/" : `cloudflared failed to start: ${err.message}`;
+      reject(new Error(msg));
+    });
+    child.once("exit", (code) => {
+      if (!resolved) {
+        reject(new Error(`cloudflared exited (code ${code ?? "null"}) before a tunnel URL appeared. Output:
+${buffered}`));
+      }
+    });
+    setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        void stopChild(child).catch(() => void 0);
+        reject(new Error("Timed out waiting for cloudflared to print a tunnel URL."));
+      }
+    }, 3e4).unref();
+  });
+}
+function startNgrok(port, logs) {
+  return new Promise((resolve8, reject) => {
+    let child;
+    try {
+      child = spawn("ngrok", ["http", String(port), "--log=stdout"], {
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+    } catch (err) {
+      reject(new Error(`Failed to spawn ngrok: ${err.message}`));
+      return;
+    }
+    if (logs) {
+      child.stdout.on("data", (c) => process.stderr.write(chalk16.dim(c.toString("utf-8"))));
+      child.stderr.on("data", (c) => process.stderr.write(chalk16.dim(c.toString("utf-8"))));
+    }
+    let resolved = false;
+    child.once("error", (err) => {
+      if (resolved) return;
+      resolved = true;
+      const msg = err.code === "ENOENT" ? "ngrok not found on PATH. Install: `brew install ngrok` or https://ngrok.com/download" : `ngrok failed to start: ${err.message}`;
+      reject(new Error(msg));
+    });
+    child.once("exit", (code) => {
+      if (resolved) return;
+      resolved = true;
+      reject(new Error(`ngrok exited (code ${code ?? "null"}) before a tunnel URL was available.`));
+    });
+    const deadline = Date.now() + 3e4;
+    const poll = async () => {
+      while (!resolved && Date.now() < deadline) {
+        try {
+          const resp = await fetch("http://127.0.0.1:4040/api/tunnels");
+          if (resp.ok) {
+            const data = await resp.json();
+            const https = data.tunnels.find((t) => t.public_url.startsWith("https://"));
+            if (https) {
+              resolved = true;
+              resolve8({
+                url: https.public_url,
+                exited: waitForExit(child),
+                stop: () => stopChild(child)
+              });
+              return;
+            }
+          }
+        } catch {
+        }
+        await new Promise((r) => setTimeout(r, 250));
+      }
+      if (!resolved) {
+        resolved = true;
+        void stopChild(child).catch(() => void 0);
+        reject(new Error("Timed out waiting for ngrok local API at http://127.0.0.1:4040."));
+      }
+    };
+    void poll();
+  });
+}
+function waitForExit(child) {
+  return once(child, "exit").then(([code]) => code ?? null);
+}
+async function stopChild(child) {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  child.kill("SIGTERM");
+  const killed = await Promise.race([
+    once(child, "exit").then(() => true),
+    new Promise((r) => setTimeout(() => r(false), 3e3))
+  ]);
+  if (!killed && child.exitCode === null) {
+    child.kill("SIGKILL");
+    await once(child, "exit").catch(() => void 0);
+  }
+}
+
+// src/commands/apps.ts
+var FOIR_APPS_HOST_ENV = "FOIR_APPS_HOST";
+var WATCH_FILES = ["foir.config.ts", "foir.config.js", "foir.config.mjs", "foir.config.json"];
 function registerAppsCommands(program2, globalOpts) {
   const apps = program2.command("apps").description("Install and manage apps");
   apps.command("list").description("List installed apps").action(
@@ -9479,7 +9637,10 @@ function registerAppsCommands(program2, globalOpts) {
       }
     )
   );
-  apps.command("update <name>").description("Check for updates and apply if no rejected changes").option("--dry-run", "Show the diff without applying").action(
+  apps.command("update <name>").description("Check for updates and apply if no rejected changes").option("--dry-run", "Show the diff without applying").option(
+    "--force",
+    "Apply even when the diff contains REJECTED changes (admin override; printed warning lists what got bypassed)"
+  ).action(
     withErrorHandler(
       globalOpts,
       async (name, cmdOpts) => {
@@ -9501,18 +9662,23 @@ function registerAppsCommands(program2, globalOpts) {
             console.error(`[${classLabel}] ${change.path}: ${change.description}`);
           }
         }
+        const force = !!cmdOpts.force;
         const hasRejected = updateResp.changes.some((c) => c.class === 3);
-        if (hasRejected) {
+        if (hasRejected && !force) {
           throw new Error(
-            "update rejected: one or more changes require admin resolution; see diff above"
+            "update rejected: one or more changes require admin resolution; rerun with --force to override"
           );
         }
+        if (hasRejected && !opts.quiet) {
+          warn("forcing through REJECTED changes \u2014 admin override");
+        }
         if (cmdOpts.dryRun) return;
         const app = await client.apps.confirmUpdateApp(
           resolved.project.tenantId,
           resolved.project.id,
           name,
-          updateResp.newManifestHash
+          updateResp.newManifestHash,
+          force
         );
         if (opts.json) {
           formatOutputProto(AppSchema, app, opts);
@@ -9587,6 +9753,203 @@ function registerAppsCommands(program2, globalOpts) {
       throw new Error(`manifest has ${resp.issues.length} issue(s)`);
     })
   );
+  apps.command("dev").description(
+    "Spin up a public tunnel to a local app dev server so foir admin can iframe it."
+  ).option("-p, --port <port>", "Local port serving the app (default 8787 \u2014 wrangler default)", "8787").option(
+    "--host <host>",
+    "Local host to forward to. Use 127.0.0.1 or [::1] when the dev server binds to only one IP family.",
+    "localhost"
+  ).option(
+    "-t, --tunnel <kind>",
+    "Tunnel provider: cloudflared (default), ngrok, or none (use --url)",
+    "cloudflared"
+  ).option("--url <url>", "BYO tunnel URL; pairs with --tunnel none").option("--push", "Run `foir push` once after the tunnel comes up, with FOIR_APPS_HOST set").option("--watch", "Re-run `foir push` on foir.config.* changes (implies --push)").action(
+    withErrorHandler(
+      globalOpts,
+      async (cmdOpts) => {
+        const opts = globalOpts();
+        const port = Number(cmdOpts.port);
+        if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+          throw new Error(`--port must be an integer between 1 and 65535 (got "${cmdOpts.port}")`);
+        }
+        const kind = cmdOpts.tunnel;
+        if (kind !== "cloudflared" && kind !== "ngrok" && kind !== "none") {
+          throw new Error(`--tunnel must be one of: cloudflared, ngrok, none (got "${kind}")`);
+        }
+        const doPush = !!cmdOpts.push || !!cmdOpts.watch;
+        const doWatch = !!cmdOpts.watch;
+        if (kind === "none") {
+          if (!cmdOpts.url) {
+            throw new Error("--tunnel none requires --url <public-https-url>");
+          }
+          if (!/^https:\/\//.test(cmdOpts.url)) {
+            throw new Error("--url must be an https:// URL");
+          }
+          await runDevSession({
+            publicUrl: cmdOpts.url,
+            port,
+            kind: "byo",
+            json: !!opts.json
+          });
+          if (doPush) {
+            await runPush(hostOf(cmdOpts.url), !!opts.json);
+          }
+          if (doWatch) {
+            await runWatchLoop(hostOf(cmdOpts.url), !!opts.json);
+          }
+          return;
+        }
+        if (!opts.json) {
+          console.error(chalk17.dim(`Starting ${kind} tunnel \u2192 http://${cmdOpts.host}:${port}\u2026`));
+        }
+        const handle = await startTunnel({
+          kind,
+          port,
+          host: cmdOpts.host,
+          logs: !opts.json
+        });
+        let stopped = false;
+        let watcher = null;
+        const stop = async () => {
+          if (stopped) return;
+          stopped = true;
+          watcher?.close();
+          await handle.stop();
+        };
+        process.once("SIGINT", () => {
+          void stop().finally(() => process.exit(0));
+        });
+        process.once("SIGTERM", () => {
+          void stop().finally(() => process.exit(0));
+        });
+        await runDevSession({
+          publicUrl: handle.url,
+          port,
+          localHost: cmdOpts.host,
+          kind,
+          json: !!opts.json
+        });
+        const host = hostOf(handle.url);
+        if (doPush) {
+          await runPush(host, !!opts.json);
+        }
+        if (doWatch) {
+          watcher = startWatchLoop(host, !!opts.json);
+        }
+        await handle.exited;
+        watcher?.close();
+      }
+    )
+  );
+}
+function runDevSession(info) {
+  if (info.json) {
+    formatOutput(
+      {
+        tunnel: info.kind,
+        port: info.port,
+        publicUrl: info.publicUrl
+      },
+      { json: true }
+    );
+    return Promise.resolve();
+  }
+  const host = hostOf(info.publicUrl);
+  console.log();
+  console.log(chalk17.bold.green("  Tunnel ready"));
+  console.log(`  ${chalk17.bold(info.publicUrl)} ${chalk17.dim("\u2192")} http://${info.localHost ?? "localhost"}:${info.port}`);
+  console.log();
+  console.log(chalk17.dim("  Point `foir push` at the tunnel so app manifests resolve here."));
+  console.log(chalk17.dim("  If your foir.config.ts uses an env-gated source (recommended):"));
+  console.log(chalk17.dim(`    FOIR_APPS_HOST=${host} foir push`));
+  console.log(chalk17.dim("  Otherwise: update apps.<name>.source in foir.config.ts to a URL on"));
+  console.log(chalk17.dim(`  ${host} and run foir push.`));
+  console.log();
+  if (info.kind === "byo") {
+    console.log(chalk17.dim("  (BYO tunnel \u2014 leaving lifecycle to you.)"));
+    return Promise.resolve();
+  }
+  console.log(chalk17.dim("  Press Ctrl+C to stop the tunnel."));
+  return Promise.resolve();
+}
+function hostOf(url) {
+  try {
+    return new URL(url).host;
+  } catch {
+    return url;
+  }
+}
+function runPush(host, jsonMode) {
+  return new Promise((resolve8, reject) => {
+    if (!jsonMode) {
+      console.log();
+      console.log(chalk17.dim(`\u2192 foir push  (${FOIR_APPS_HOST_ENV}=${host})`));
+    }
+    const entry = process.argv[1];
+    if (!entry) {
+      reject(new Error("Cannot locate foir CLI entry from process.argv; --push/--watch unavailable."));
+      return;
+    }
+    const child = spawn2(process.execPath, [entry, "push"], {
+      stdio: "inherit",
+      env: { ...process.env, [FOIR_APPS_HOST_ENV]: host }
+    });
+    child.once("error", (err) => reject(err));
+    child.once("exit", (code) => {
+      if (code === 0) resolve8();
+      else reject(new Error(`foir push exited with code ${code ?? "null"}`));
+    });
+  });
+}
+function startWatchLoop(host, jsonMode) {
+  const cwd = process.cwd();
+  const target = WATCH_FILES.map((n) => resolvePath(cwd, n)).find((p) => existsSync7(p));
+  if (!target) {
+    if (!jsonMode) {
+      console.error(chalk17.yellow(`! --watch: no foir.config.* in ${cwd}; skipping watch loop.`));
+    }
+    return null;
+  }
+  if (!jsonMode) {
+    console.log(chalk17.dim(`Watching ${target} \u2014 saving triggers foir push.`));
+  }
+  let pending = false;
+  let running = false;
+  let timer = null;
+  const tick = () => {
+    if (running) {
+      pending = true;
+      return;
+    }
+    running = true;
+    pending = false;
+    runPush(host, jsonMode).catch((err) => {
+      if (!jsonMode) console.error(chalk17.red(`push failed: ${err.message}`));
+    }).finally(() => {
+      running = false;
+      if (pending) tick();
+    });
+  };
+  const watcher = fsWatch(target, { persistent: true }, () => {
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(tick, 200);
+  });
+  return watcher;
+}
+function runWatchLoop(host, jsonMode) {
+  return new Promise((resolve8) => {
+    const watcher = startWatchLoop(host, jsonMode);
+    if (!watcher) {
+      resolve8();
+      return;
+    }
+    const close = () => {
+      watcher.close();
+      resolve8();
+    };
+    process.once("SIGINT", close);
+    process.once("SIGTERM", close);
+  });
 }
 async function requireProject(opts) {
   const resolved = await resolveProjectContext(opts);
@@ -9619,9 +9982,9 @@ function classToLabel(n) {
 }
 
 // src/commands/secrets.ts
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 import { promises as fs5 } from "fs";
-import { resolve as resolvePath } from "path";
+import { resolve as resolvePath2 } from "path";
 function registerSecretsCommands(program2, globalOpts) {
   const secrets = program2.command("secrets").description("Manage vault secrets");
   secrets.command("put").description("Store a new secret and print its ref").option("--label <label>", "Optional human-readable label").option("--app <name>", "Owner: app name (defaults to project-owned)").option("--file <path>", "Read plaintext from file (binary-safe)").option("--value <plaintext>", "Plaintext value (string only; prefer --file for binary)").action(
@@ -9919,14 +10282,14 @@ var PLAINTEXT_CONFIG_NAMES = [
 ];
 async function resolveSecretsConfigPath(explicit) {
   if (explicit) {
-    if (!existsSync7(explicit)) {
+    if (!existsSync8(explicit)) {
       throw new Error(`Secrets config not found: ${explicit}`);
     }
-    return resolvePath(explicit);
+    return resolvePath2(explicit);
   }
   for (const name of SECRETS_CONFIG_NAMES) {
-    const path3 = resolvePath(process.cwd(), name);
-    if (existsSync7(path3)) return path3;
+    const path3 = resolvePath2(process.cwd(), name);
+    if (existsSync8(path3)) return path3;
   }
   throw new Error(
     `No secrets config found. Looked for: ${SECRETS_CONFIG_NAMES.join(", ")}.`
@@ -9934,14 +10297,14 @@ async function resolveSecretsConfigPath(explicit) {
 }
 async function resolvePlaintextPath(explicit) {
   if (explicit) {
-    if (!existsSync7(explicit)) {
+    if (!existsSync8(explicit)) {
       throw new Error(`Plaintext file not found: ${explicit}`);
     }
-    return resolvePath(explicit);
+    return resolvePath2(explicit);
   }
   for (const name of PLAINTEXT_CONFIG_NAMES) {
-    const path3 = resolvePath(process.cwd(), name);
-    if (existsSync7(path3)) return path3;
+    const path3 = resolvePath2(process.cwd(), name);
+    if (existsSync8(path3)) return path3;
   }
   return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-cli",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -50,7 +50,7 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@eide/foir-proto-ts": "^0.70.0",
+    "@eide/foir-proto-ts": "^0.71.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",