@geekmidas/cli 0.18.0 → 0.19.0

package/src/init/generators/docker.ts

@@ -4,26 +4,47 @@ import type {
 	TemplateOptions,
 } from '../templates/index.js';
 
+export interface DatabaseAppConfig {
+	name: string;
+	password: string;
+}
+
 /**
  * Generate docker-compose.yml based on template and options
  */
 export function generateDockerFiles(
 	options: TemplateOptions,
 	template: TemplateConfig,
+	dbApps?: DatabaseAppConfig[],
 ): GeneratedFile[] {
 	const { database } = options;
 	const isServerless = template.name === 'serverless';
 	const hasWorker = template.name === 'worker';
+	const isFullstack = options.template === 'fullstack';
 
 	const services: string[] = [];
 	const volumes: string[] = [];
+	const files: GeneratedFile[] = [];
 
 	// PostgreSQL database
 	if (database) {
+		const initVolume =
+			isFullstack && dbApps?.length
+				? `
+      - ./docker/postgres/init.sh:/docker-entrypoint-initdb.d/init.sh:ro`
+				: '';
+
+		const envFile =
+			isFullstack && dbApps?.length
+				? `
+    env_file:
+      - ./docker/.env`
+				: '';
+
 		services.push(`  postgres:
     image: postgres:16-alpine
     container_name: ${options.name}-postgres
-    restart: unless-stopped
+    restart: unless-stopped${envFile}
     environment:
       POSTGRES_USER: postgres
       POSTGRES_PASSWORD: postgres
@@ -31,13 +52,27 @@ export function generateDockerFiles(
     ports:
       - '5432:5432'
     volumes:
-      - postgres_data:/var/lib/postgresql/data
+      - postgres_data:/var/lib/postgresql/data${initVolume}
     healthcheck:
       test: ['CMD-SHELL', 'pg_isready -U postgres']
       interval: 5s
       timeout: 5s
       retries: 5`);
 		volumes.push('  postgres_data:');
+
+		// Generate PostgreSQL init script and .env for fullstack template
+		if (isFullstack && dbApps?.length) {
+			files.push({
+				path: 'docker/postgres/init.sh',
+				content: generatePostgresInitScript(dbApps),
+			});
+
+			// Generate .env file for docker-compose (contains db passwords)
+			files.push({
+				path: 'docker/.env',
+				content: generateDockerEnv(dbApps),
+			});
+		}
 	}
 
 	// Redis - different setup for serverless vs standard
@@ -125,10 +160,82 @@ ${volumes.join('\n')}
 `;
 	}
 
-	return [
-		{
-			path: 'docker-compose.yml',
-			content: dockerCompose,
-		},
-	];
+	// Add docker-compose.yml to files
+	files.push({
+		path: 'docker-compose.yml',
+		content: dockerCompose,
+	});
+
+	return files;
+}
+
+/**
+ * Generate .env file for docker-compose with database passwords
+ */
+function generateDockerEnv(apps: DatabaseAppConfig[]): string {
+	const envVars = apps.map((app) => {
+		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
+		return `${envVar}=${app.password}`;
+	});
+
+	return `# Auto-generated docker environment file
+# Contains database passwords for docker-compose postgres init
+# This file is gitignored - do not commit to version control
+${envVars.join('\n')}
+`;
+}
+
+/**
+ * Generate PostgreSQL init shell script that creates per-app users with separate schemas
+ * Uses environment variables for passwords (more secure than hardcoded values)
+ * - api user: uses public schema
+ * - auth user: uses auth schema with search_path=auth
+ */
+function generatePostgresInitScript(apps: DatabaseAppConfig[]): string {
+	const userCreations = apps.map((app) => {
+		const userName = app.name.replace(/-/g, '_');
+		const envVar = `${app.name.toUpperCase()}_DB_PASSWORD`;
+		const isApi = app.name === 'api';
+		const schemaName = isApi ? 'public' : userName;
+
+		if (isApi) {
+			// API user uses public schema
+			return `
+# Create ${app.name} user (uses public schema)
+echo "Creating user ${userName}..."
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+    CREATE USER ${userName} WITH PASSWORD '$${envVar}';
+    GRANT ALL ON SCHEMA public TO ${userName};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${userName};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${userName};
+EOSQL
+`;
+		}
+		// Other users get their own schema with search_path
+		return `
+# Create ${app.name} user with dedicated schema
+echo "Creating user ${userName} with schema ${schemaName}..."
+psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+    CREATE USER ${userName} WITH PASSWORD '$${envVar}';
+    CREATE SCHEMA ${schemaName} AUTHORIZATION ${userName};
+    ALTER USER ${userName} SET search_path TO ${schemaName};
+    GRANT USAGE ON SCHEMA ${schemaName} TO ${userName};
+    GRANT ALL ON ALL TABLES IN SCHEMA ${schemaName} TO ${userName};
+    GRANT ALL ON ALL SEQUENCES IN SCHEMA ${schemaName} TO ${userName};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaName} GRANT ALL ON TABLES TO ${userName};
+    ALTER DEFAULT PRIVILEGES IN SCHEMA ${schemaName} GRANT ALL ON SEQUENCES TO ${userName};
+EOSQL
+`;
+	});
+
+	return `#!/bin/bash
+set -e
+
+# Auto-generated PostgreSQL init script
+# Creates per-app users with separate schemas in a single database
+# - api: uses public schema
+# - auth: uses auth schema (search_path=auth)
+${userCreations.join('\n')}
+echo "Database initialization complete!"
+`;
 }

package/src/init/generators/env.ts

@@ -5,136 +5,16 @@ import type {
 } from '../templates/index.js';
 
 /**
- * Generate environment files (.env, .env.example, .env.development, .env.test, .gitignore)
+ * Generate environment-related files (.gitignore only).
+ * Note: .env files are no longer generated. Use `gkm secrets:init` to initialize
+ * encrypted secrets stored in `.gkm/secrets/{stage}.json` with keys stored at
+ * `~/.gkm/{project-name}/{stage}.key`.
  */
 export function generateEnvFiles(
 	options: TemplateOptions,
-	template: TemplateConfig,
+	_template: TemplateConfig,
 ): GeneratedFile[] {
-	const { database } = options;
-	const isServerless = template.name === 'serverless';
-	const hasWorker = template.name === 'worker';
-
-	// Build base env content
-	let baseEnv = `# Application
-NODE_ENV=development
-PORT=3000
-LOG_LEVEL=info
-`;
-
-	if (isServerless) {
-		baseEnv = `# AWS
-STAGE=dev
-AWS_REGION=us-east-1
-LOG_LEVEL=info
-`;
-	}
-
-	if (database) {
-		baseEnv += `
-# Database
-DATABASE_URL=postgresql://user:password@localhost:5432/mydb
-`;
-	}
-
-	if (hasWorker) {
-		baseEnv += `
-# Message Queue
-RABBITMQ_URL=amqp://localhost:5672
-`;
-	}
-
-	baseEnv += `
-# Authentication
-JWT_SECRET=your-secret-key-change-in-production
-`;
-
-	// Development env
-	let devEnv = `# Development Environment
-NODE_ENV=development
-PORT=3000
-LOG_LEVEL=debug
-`;
-
-	if (isServerless) {
-		devEnv = `# Development Environment
-STAGE=dev
-AWS_REGION=us-east-1
-LOG_LEVEL=debug
-`;
-	}
-
-	if (database) {
-		devEnv += `
-# Database
-DATABASE_URL=postgresql://postgres:postgres@localhost:5432/mydb_dev
-`;
-	}
-
-	if (hasWorker) {
-		devEnv += `
-# Message Queue
-RABBITMQ_URL=amqp://localhost:5672
-`;
-	}
-
-	devEnv += `
-# Authentication
-JWT_SECRET=dev-secret-not-for-production
-`;
-
-	// Test env
-	let testEnv = `# Test Environment
-NODE_ENV=test
-PORT=3001
-LOG_LEVEL=error
-`;
-
-	if (isServerless) {
-		testEnv = `# Test Environment
-STAGE=test
-AWS_REGION=us-east-1
-LOG_LEVEL=error
-`;
-	}
-
-	if (database) {
-		testEnv += `
-# Database
-DATABASE_URL=postgresql://postgres:postgres@localhost:5432/mydb_test
-`;
-	}
-
-	if (hasWorker) {
-		testEnv += `
-# Message Queue
-RABBITMQ_URL=amqp://localhost:5672
-`;
-	}
-
-	testEnv += `
-# Authentication
-JWT_SECRET=test-secret-not-for-production
-`;
-
-	const files: GeneratedFile[] = [
-		{
-			path: '.env.example',
-			content: baseEnv,
-		},
-		{
-			path: '.env',
-			content: baseEnv,
-		},
-		{
-			path: '.env.development',
-			content: devEnv,
-		},
-		{
-			path: '.env.test',
-			content: testEnv,
-		},
-	];
+	const files: GeneratedFile[] = [];
 
 	// Only add .gitignore for non-monorepo (monorepo has it at root)
 	if (!options.monorepo) {
@@ -145,7 +25,7 @@ node_modules/
 dist/
 .gkm/
 
-# Environment
+# Environment (legacy - use gkm secrets instead)
 .env
 .env.local
 .env.*.local

package/src/init/generators/index.ts

@@ -1,3 +1,4 @@
+export { generateAuthAppFiles } from './auth.js';
 export { generateConfigFiles } from './config.js';
 export { generateEnvFiles } from './env.js';
 export { generatePackageJson } from './package.js';

package/src/init/generators/models.ts

@@ -42,10 +42,12 @@ export function generateModelsPackage(
 		},
 	};
 
-	// tsconfig.json for models - extends root
+	// tsconfig.json for models - library package that builds to dist
 	const tsConfig = {
 		extends: '../../tsconfig.json',
 		compilerOptions: {
+			declaration: true,
+			declarationMap: true,
 			outDir: './dist',
 			rootDir: './src',
 		},

package/src/init/generators/monorepo.ts

@@ -3,6 +3,7 @@ import type {
 	TemplateConfig,
 	TemplateOptions,
 } from '../templates/index.js';
+import { GEEKMIDAS_VERSIONS } from '../versions.js';
 
 /**
  * Generate monorepo root files (pnpm-workspace.yaml, root package.json, etc.)
@@ -15,24 +16,31 @@ export function generateMonorepoFiles(
 		return [];
 	}
 
+	const isFullstack = options.template === 'fullstack';
+
 	// Root package.json for monorepo
 	const rootPackageJson = {
 		name: options.name,
 		version: '0.0.1',
 		private: true,
 		type: 'module',
+		packageManager: 'pnpm@10.13.1',
 		scripts: {
-			dev: 'turbo dev',
-			build: 'turbo build',
-			test: 'turbo test',
-			'test:once': 'turbo test:once',
+			dev: isFullstack ? 'gkm dev' : 'turbo dev',
+			build: isFullstack ? 'gkm build' : 'turbo build',
+			test: isFullstack ? 'gkm test' : 'turbo test',
+			'test:once': isFullstack ? 'gkm test --run' : 'turbo test:once',
 			typecheck: 'turbo typecheck',
 			lint: 'biome lint .',
 			fmt: 'biome format . --write',
 			'fmt:check': 'biome format .',
+			...(options.deployTarget === 'dokploy'
+				? { deploy: 'gkm deploy --provider dokploy --stage production' }
+				: {}),
 		},
 		devDependencies: {
-			'@biomejs/biome': '~1.9.4',
+			'@biomejs/biome': '~2.3.0',
+			'@geekmidas/cli': GEEKMIDAS_VERSIONS['@geekmidas/cli'],
 			turbo: '~2.3.0',
 			typescript: '~5.8.2',
 			vitest: '~4.0.0',
@@ -50,7 +58,7 @@ export function generateMonorepoFiles(
 
 	// Root biome.json
 	const biomeConfig = {
-		$schema: 'https://biomejs.dev/schemas/1.9.4/schema.json',
+		$schema: 'https://biomejs.dev/schemas/2.3.0/schema.json',
 		vcs: {
 			enabled: true,
 			clientKind: 'git',
@@ -136,6 +144,7 @@ dist/
 .env
 .env.local
 .env.*.local
+docker/.env
 
 # IDE
 .idea/
@@ -164,6 +173,7 @@ coverage/
 `;
 
 	// Root tsconfig.json - base config for all packages
+	// Using turbo typecheck to run tsc --noEmit in each app/package
 	const tsConfig = {
 		compilerOptions: {
 			target: 'ES2022',
@@ -175,14 +185,29 @@ coverage/
 			skipLibCheck: true,
 			forceConsistentCasingInFileNames: true,
 			resolveJsonModule: true,
-			declaration: true,
-			declarationMap: true,
-			composite: true,
 		},
 		exclude: ['node_modules', 'dist'],
 	};
 
-	return [
+	// Vitest config for workspace
+	const vitestConfig = `import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['apps/**/*.{test,spec}.ts', 'packages/**/*.{test,spec}.ts'],
+    exclude: ['**/node_modules/**', '**/dist/**'],
+    coverage: {
+      provider: 'v8',
+      reporter: ['text', 'json', 'html'],
+      exclude: ['**/node_modules/**', '**/dist/**', '**/*.d.ts'],
+    },
+  },
+});
+`;
+
+	const files: GeneratedFile[] = [
 		{
 			path: 'package.json',
 			content: `${JSON.stringify(rootPackageJson, null, 2)}\n`,
@@ -203,9 +228,128 @@ coverage/
 			path: 'turbo.json',
 			content: `${JSON.stringify(turboConfig, null, 2)}\n`,
 		},
+		{
+			path: 'vitest.config.ts',
+			content: vitestConfig,
+		},
 		{
 			path: '.gitignore',
 			content: gitignore,
 		},
 	];
+
+	// Add workspace config for fullstack template
+	if (isFullstack) {
+		files.push({
+			path: 'gkm.config.ts',
+			content: generateWorkspaceConfig(options),
+		});
+	}
+
+	return files;
+}
+
+/**
+ * Generate gkm.config.ts with defineWorkspace for fullstack template
+ */
+function generateWorkspaceConfig(options: TemplateOptions): string {
+	const { telescope, services, deployTarget, routesStructure } = options;
+
+	// Get routes glob pattern
+	const getRoutesGlob = (): string => {
+		switch (routesStructure) {
+			case 'centralized-endpoints':
+				return './src/endpoints/**/*.ts';
+			case 'centralized-routes':
+				return './src/routes/**/*.ts';
+			case 'domain-based':
+				return './src/**/routes/*.ts';
+		}
+	};
+
+	let config = `import { defineWorkspace } from '@geekmidas/cli/config';
+
+export default defineWorkspace({
+  name: '${options.name}',
+  apps: {
+    api: {
+      type: 'backend',
+      path: 'apps/api',
+      port: 3000,
+      routes: '${getRoutesGlob()}',
+      envParser: './src/config/env#envParser',
+      logger: './src/config/logger#logger',`;
+
+	if (telescope) {
+		config += `
+      telescope: {
+        enabled: true,
+        path: '/__telescope',
+      },`;
+	}
+
+	config += `
+      openapi: {
+        enabled: true,
+      },
+    },
+    auth: {
+      type: 'backend',
+      path: 'apps/auth',
+      port: 3002,
+      envParser: './src/config/env#envParser',
+      logger: './src/config/logger#logger',
+    },
+    web: {
+      type: 'frontend',
+      framework: 'nextjs',
+      path: 'apps/web',
+      port: 3001,
+      dependencies: ['api', 'auth'],
+      client: {
+        output: './src/api',
+      },
+    },
+  },
+  shared: {
+    packages: ['packages/*'],
+    models: {
+      path: 'packages/models',
+      schema: 'zod',
+    },
+  },`;
+
+	// Add services if any are selected
+	if (services.db || services.cache || services.mail) {
+		config += `
+  services: {`;
+		if (services.db) {
+			config += `
+    db: true,`;
+		}
+		if (services.cache) {
+			config += `
+    cache: true,`;
+		}
+		if (services.mail) {
+			config += `
+    mail: true,`;
+		}
+		config += `
+  },`;
+	}
+
+	// Add deploy config if dokploy is selected
+	if (deployTarget === 'dokploy') {
+		config += `
+  deploy: {
+    default: 'dokploy',
+  },`;
+	}
+
+	config += `
+});
+`;
+
+	return config;
 }

package/src/init/generators/package.ts

@@ -4,6 +4,7 @@ import {
 	type TemplateConfig,
 	type TemplateOptions,
 } from '../templates/index.js';
+import { GEEKMIDAS_VERSIONS } from '../versions.js';
 
 /**
  * Generate package.json with dependencies based on template and options
@@ -21,15 +22,16 @@ export function generatePackageJson(
 
 	// Add optional dependencies based on user choices
 	if (telescope) {
-		dependencies['@geekmidas/telescope'] = 'workspace:*';
+		dependencies['@geekmidas/telescope'] =
+			GEEKMIDAS_VERSIONS['@geekmidas/telescope'];
 	}
 
 	if (studio) {
-		dependencies['@geekmidas/studio'] = 'workspace:*';
+		dependencies['@geekmidas/studio'] = GEEKMIDAS_VERSIONS['@geekmidas/studio'];
 	}
 
 	if (database) {
-		dependencies['@geekmidas/db'] = 'workspace:*';
+		dependencies['@geekmidas/db'] = GEEKMIDAS_VERSIONS['@geekmidas/db'];
 		dependencies.kysely = '~0.28.2';
 		dependencies.pg = '~8.16.0';
 		devDependencies['@types/pg'] = '~8.15.0';