@geekmidas/cli 0.37.0 → 0.39.0

package/dist/index.cjs

@@ -27,7 +27,7 @@ const node_module = require_chunk.__toESM(require("node:module"));
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "0.37.0";
+var version = "0.38.0";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -240,7 +240,7 @@ async function prompt$1(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please provide --token option.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$1, reject) => {
+		return new Promise((resolve$2, reject) => {
 			let value = "";
 			const cleanup = () => {
 				process.stdin.setRawMode(false);
@@ -257,7 +257,7 @@ async function prompt$1(message, hidden = false) {
 				if (c === "\n" || c === "\r") {
 					cleanup();
 					process.stdout.write("\n");
-					resolve$1(value);
+					resolve$2(value);
 				} else if (c === "") {
 					cleanup();
 					process.stdout.write("\n");
@@ -892,15 +892,15 @@ function loadEnvFiles(envConfig, cwd = process.cwd()) {
 * @internal Exported for testing
 */
 async function isPortAvailable(port) {
-	return new Promise((resolve$1) => {
+	return new Promise((resolve$2) => {
 		const server = (0, node_net.createServer)();
 		server.once("error", (err) => {
-			if (err.code === "EADDRINUSE") resolve$1(false);
-			else resolve$1(false);
+			if (err.code === "EADDRINUSE") resolve$2(false);
+			else resolve$2(false);
 		});
 		server.once("listening", () => {
 			server.close();
-			resolve$1(true);
+			resolve$2(true);
 		});
 		server.listen(port);
 	});
@@ -1491,7 +1491,7 @@ async function workspaceDevCommand(workspace, options) {
 	};
 	process.on("SIGINT", shutdown);
 	process.on("SIGTERM", shutdown);
-	return new Promise((resolve$1, reject) => {
+	return new Promise((resolve$2, reject) => {
 		turboProcess.on("error", (error) => {
 			logger$8.error("❌ Turbo error:", error);
 			reject(error);
@@ -1499,7 +1499,7 @@ async function workspaceDevCommand(workspace, options) {
 		turboProcess.on("exit", (code) => {
 			if (endpointWatcher) endpointWatcher.close().catch(() => {});
 			if (code !== null && code !== 0) reject(new Error(`Turbo exited with code ${code}`));
-			else resolve$1();
+			else resolve$2();
 		});
 	});
 }
@@ -1542,19 +1542,43 @@ function findSecretsRoot(startDir) {
 	return startDir;
 }
 /**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
 */
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const credentialsInjection = secretsJsonPath ? `import { Credentials } from '@geekmidas/envkit/credentials';
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { Credentials } from '@geekmidas/envkit/credentials';
 import { existsSync, readFileSync } from 'node:fs';
 
-// Inject dev secrets into Credentials (before app import)
+// Inject dev secrets into Credentials
 const secretsPath = '${secretsJsonPath}';
 if (existsSync(secretsPath)) {
-  Object.assign(Credentials, JSON.parse(readFileSync(secretsPath, 'utf-8')));
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  Object.assign(Credentials, secrets);
+  // Debug: uncomment to verify preload is running
+  // console.log('[gkm preload] Injected', Object.keys(secrets).length, 'credentials');
 }
-
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await (0, node_fs_promises.writeFile)(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
 ` : "";
 	const content = `#!/usr/bin/env node
 /**
@@ -1580,7 +1604,8 @@ async function prepareEntryCredentials(options) {
 		workspaceAppPort = appConfig.app.port;
 		secretsRoot = appConfig.workspaceRoot;
 		appName = appConfig.appName;
-	} catch {
+	} catch (error) {
+		logger$8.log(`⚠️  Could not load workspace config: ${error.message}`);
 		secretsRoot = findSecretsRoot(cwd);
 		appName = require_config.getAppNameFromCwd(cwd) ?? void 0;
 	}
@@ -1610,7 +1635,7 @@ async function entryDevCommand(options) {
 	if (!(0, node_fs.existsSync)(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$8.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.port });
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
 	if (appName) logger$8.log(`📦 App: ${appName} (port ${resolvedPort})`);
 	logger$8.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
 	if (Object.keys(credentials).length > 1) logger$8.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
@@ -1684,12 +1709,12 @@ var EntryRunner = class {
 			if (code !== null && code !== 0 && code !== 143) logger$8.error(`❌ Process exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$1) => setTimeout(resolve$1, 500));
+		await new Promise((resolve$2) => setTimeout(resolve$2, 500));
 		if (this.isRunning) logger$8.log(`\n🎉 Running at http://localhost:${this.port}`);
 	}
 	async restart() {
 		this.stopProcess();
-		await new Promise((resolve$1) => setTimeout(resolve$1, 500));
+		await new Promise((resolve$2) => setTimeout(resolve$2, 500));
 		await this.runProcess();
 	}
 	stop() {
@@ -1761,7 +1786,7 @@ var DevServer = class {
 			if (code !== null && code !== 0 && signal !== "SIGTERM") logger$8.error(`❌ Server exited with code ${code}`);
 			this.isRunning = false;
 		});
-		await new Promise((resolve$1) => setTimeout(resolve$1, 1e3));
+		await new Promise((resolve$2) => setTimeout(resolve$2, 1e3));
 		if (this.isRunning) {
 			logger$8.log(`\n🎉 Server running at http://localhost:${this.actualPort}`);
 			if (this.enableOpenApi) logger$8.log(`📚 API Docs available at http://localhost:${this.actualPort}/__docs`);
@@ -1796,7 +1821,7 @@ var DevServer = class {
 		let attempts = 0;
 		while (attempts < 30) {
 			if (await isPortAvailable(portToReuse)) break;
-			await new Promise((resolve$1) => setTimeout(resolve$1, 100));
+			await new Promise((resolve$2) => setTimeout(resolve$2, 100));
 			attempts++;
 		}
 		this.requestedPort = portToReuse;
@@ -1804,9 +1829,9 @@ var DevServer = class {
 	}
 	async createServerEntry() {
 		const { writeFile: fsWriteFile } = await import("node:fs/promises");
-		const { relative: relative$7, dirname: dirname$8 } = await import("node:path");
+		const { relative: relative$6, dirname: dirname$8 } = await import("node:path");
 		const serverPath = (0, node_path.join)(this.appRoot, ".gkm", this.provider, "server.ts");
-		const relativeAppPath = relative$7(dirname$8(serverPath), (0, node_path.join)(dirname$8(serverPath), "app.js"));
+		const relativeAppPath = relative$6(dirname$8(serverPath), (0, node_path.join)(dirname$8(serverPath), "app.js"));
 		const credentialsInjection = this.secretsJsonPath ? `import { Credentials } from '@geekmidas/envkit/credentials';
 import { existsSync, readFileSync } from 'node:fs';
 
@@ -1859,6 +1884,59 @@ start({
 		await fsWriteFile(serverPath, content);
 	}
 };
+/**
+* Run a command with secrets injected into Credentials.
+* Uses Node's --import flag to preload a script that populates Credentials
+* before the command loads any modules that depend on them.
+*
+* @example
+* ```bash
+* gkm exec -- npx @better-auth/cli migrate
+* gkm exec -- npx prisma migrate dev
+* ```
+*/
+async function execCommand(commandArgs, options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	if (commandArgs.length === 0) throw new Error("No command specified. Usage: gkm exec -- <command>");
+	const defaultEnv = loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$8.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
+	if (appName) logger$8.log(`📦 App: ${appName}`);
+	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
+	if (secretCount > 0) logger$8.log(`🔐 Loaded ${secretCount} secret(s)`);
+	const preloadDir = (0, node_path.join)(cwd, ".gkm");
+	await (0, node_fs_promises.mkdir)(preloadDir, { recursive: true });
+	const preloadPath = (0, node_path.join)(preloadDir, "credentials-preload.ts");
+	await createCredentialsPreload(preloadPath, secretsJsonPath);
+	const [cmd, ...args] = commandArgs;
+	if (!cmd) throw new Error("No command specified");
+	logger$8.log(`🚀 Running: ${commandArgs.join(" ")}`);
+	const existingNodeOptions = process.env.NODE_OPTIONS ?? "";
+	const tsxImport = "--import tsx";
+	const preloadImport = `--import ${preloadPath}`;
+	const nodeOptions = [
+		existingNodeOptions,
+		tsxImport,
+		preloadImport
+	].filter(Boolean).join(" ");
+	const child = (0, node_child_process.spawn)(cmd, args, {
+		cwd,
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...credentials,
+			NODE_OPTIONS: nodeOptions
+		}
+	});
+	const exitCode = await new Promise((resolve$2) => {
+		child.on("close", (code) => resolve$2(code ?? 0));
+		child.on("error", (error) => {
+			logger$8.error(`Failed to run command: ${error.message}`);
+			resolve$2(1);
+		});
+	});
+	if (exitCode !== 0) process.exit(exitCode);
+}
 
 //#endregion
 //#region src/build/manifests.ts
@@ -1929,10 +2007,15 @@ const logger$6 = console;
 async function buildCommand(options) {
 	const loadedConfig = await require_config.loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
-		logger$6.log("📦 Detected workspace configuration");
-		return workspaceBuildCommand(loadedConfig.workspace, options);
+		const cwd = (0, node_path.resolve)(process.cwd());
+		const workspaceRoot = (0, node_path.resolve)(loadedConfig.workspace.root);
+		const isAtWorkspaceRoot = cwd === workspaceRoot;
+		if (isAtWorkspaceRoot) {
+			logger$6.log("📦 Detected workspace configuration");
+			return workspaceBuildCommand(loadedConfig.workspace, options);
+		}
 	}
-	const config = await require_config.loadConfig();
+	const config = loadedConfig.type === "workspace" ? (await require_config.loadAppConfig()).gkmConfig : await require_config.loadConfig();
 	const resolved = resolveProviders(config, options);
 	const productionConfigFromGkm = getProductionConfigFromGkm(config);
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
@@ -2098,7 +2181,7 @@ async function workspaceBuildCommand(workspace, options) {
 	try {
 		const turboCommand = getTurboCommand(pm);
 		logger$6.log(`Running: ${turboCommand}`);
-		await new Promise((resolve$1, reject) => {
+		await new Promise((resolve$2, reject) => {
 			const child = (0, node_child_process.spawn)(turboCommand, {
 				shell: true,
 				cwd: workspace.root,
@@ -2109,7 +2192,7 @@ async function workspaceBuildCommand(workspace, options) {
 				}
 			});
 			child.on("close", (code) => {
-				if (code === 0) resolve$1();
+				if (code === 0) resolve$2();
 				else reject(new Error(`Turbo build failed with exit code ${code}`));
 			});
 			child.on("error", (err) => {
@@ -3376,26 +3459,22 @@ function getImageRef(registry, imageName, tag) {
 }
 /**
 * Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param appName - Name of the app (used for Dockerfile.{appName} in workspaces)
 */
-async function buildImage(imageRef) {
+async function buildImage(imageRef, appName) {
 	logger$4.log(`\n🔨 Building Docker image: ${imageRef}`);
 	const cwd = process.cwd();
-	const inMonorepo = isMonorepo(cwd);
-	if (inMonorepo) logger$4.log("   Generating Dockerfile for monorepo (turbo prune)...");
+	const lockfilePath = findLockfilePath(cwd);
+	const lockfileDir = lockfilePath ? (0, node_path.dirname)(lockfilePath) : cwd;
+	const inMonorepo = lockfileDir !== cwd;
+	if (appName || inMonorepo) logger$4.log("   Generating Dockerfile for monorepo (turbo prune)...");
 	else logger$4.log("   Generating Dockerfile...");
 	await dockerCommand({});
-	let buildCwd = cwd;
-	let dockerfilePath = ".gkm/docker/Dockerfile";
-	if (inMonorepo) {
-		const lockfilePath = findLockfilePath(cwd);
-		if (lockfilePath) {
-			const monorepoRoot = (0, node_path.dirname)(lockfilePath);
-			const appRelPath = (0, node_path.relative)(monorepoRoot, cwd);
-			dockerfilePath = (0, node_path.join)(appRelPath, ".gkm/docker/Dockerfile");
-			buildCwd = monorepoRoot;
-			logger$4.log(`   Building from monorepo root: ${monorepoRoot}`);
-		}
-	}
+	const dockerfileSuffix = appName ? `.${appName}` : "";
+	const dockerfilePath = `.gkm/docker/Dockerfile${dockerfileSuffix}`;
+	const buildCwd = lockfilePath && (inMonorepo || appName) ? lockfileDir : cwd;
+	if (buildCwd !== cwd) logger$4.log(`   Building from workspace root: ${buildCwd}`);
 	try {
 		(0, node_child_process.execSync)(`DOCKER_BUILDKIT=1 docker build --platform linux/amd64 -f ${dockerfilePath} -t ${imageRef} .`, {
 			cwd: buildCwd,
@@ -3432,7 +3511,7 @@ async function deployDocker(options) {
 	const { stage, tag, skipPush, masterKey, config } = options;
 	const imageName = config.imageName;
 	const imageRef = getImageRef(config.registry, imageName, tag);
-	await buildImage(imageRef);
+	await buildImage(imageRef, config.appName);
 	if (!skipPush) if (!config.registry) logger$4.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 	else await pushImage(imageRef);
 	logger$4.log("\n✅ Docker deployment ready!");
@@ -3736,7 +3815,7 @@ async function prompt(message, hidden = false) {
 	if (!process.stdin.isTTY) throw new Error("Interactive input required. Please configure manually.");
 	if (hidden) {
 		process.stdout.write(message);
-		return new Promise((resolve$1) => {
+		return new Promise((resolve$2) => {
 			let value = "";
 			const onData = (char) => {
 				const c = char.toString();
@@ -3745,7 +3824,7 @@ async function prompt(message, hidden = false) {
 					process.stdin.pause();
 					process.stdin.removeListener("data", onData);
 					process.stdout.write("\n");
-					resolve$1(value);
+					resolve$2(value);
 				} else if (c === "") {
 					process.stdin.setRawMode(false);
 					process.stdin.pause();
@@ -4144,11 +4223,25 @@ async function workspaceDeployCommand(workspace, options) {
 		await provisionServices(api, project.projectId, environmentId, workspace.name, dockerServices);
 	}
 	const deployedAppUrls = {};
+	if (!skipBuild) {
+		logger$1.log("\n🏗️  Building workspace...");
+		try {
+			await buildCommand({
+				provider: "server",
+				production: true,
+				stage
+			});
+			logger$1.log("   ✓ Workspace build complete");
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$1.log(`   ✗ Workspace build failed: ${message}`);
+			throw error;
+		}
+	}
 	logger$1.log("\n📦 Deploying applications...");
 	const results = [];
 	for (const appName of appsToDeployNames) {
 		const app = workspace.apps[appName];
-		const appPath = app.path;
 		logger$1.log(`\n   ${app.type === "backend" ? "⚙️" : "🌐"} Deploying ${appName}...`);
 		try {
 			const dokployAppName = `${workspace.name}-${appName}`;
@@ -4161,21 +4254,6 @@ async function workspaceDeployCommand(workspace, options) {
 				if (message.includes("already exists") || message.includes("duplicate")) logger$1.log(`      Application already exists`);
 				else throw error;
 			}
-			if (!skipBuild) {
-				logger$1.log(`      Building ${appName}...`);
-				const originalCwd = process.cwd();
-				const fullAppPath = `${workspace.root}/${appPath}`;
-				try {
-					process.chdir(fullAppPath);
-					await buildCommand({
-						provider: "server",
-						production: true,
-						stage
-					});
-				} finally {
-					process.chdir(originalCwd);
-				}
-			}
 			const imageName = `${workspace.name}-${appName}`;
 			const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
 			logger$1.log(`      Building Docker image: ${imageRef}`);
@@ -4185,7 +4263,8 @@ async function workspaceDeployCommand(workspace, options) {
 				skipPush: false,
 				config: {
 					registry,
-					imageName
+					imageName,
+					appName
 				}
 			});
 			const envVars = [`NODE_ENV=production`, `PORT=${app.port}`];
@@ -4553,7 +4632,9 @@ function generateAuthAppFiles(options) {
 			dev: "gkm dev --entry ./src/index.ts",
 			build: "tsc",
 			start: "node dist/index.js",
-			typecheck: "tsc --noEmit"
+			typecheck: "tsc --noEmit",
+			"db:migrate": "gkm exec -- npx @better-auth/cli migrate",
+			"db:generate": "gkm exec -- npx @better-auth/cli generate"
 		},
 		dependencies: {
 			[modelsPackage]: "workspace:*",
@@ -7393,9 +7474,9 @@ async function testCommand(options = {}) {
 			NODE_ENV: "test"
 		}
 	});
-	return new Promise((resolve$1, reject) => {
+	return new Promise((resolve$2, reject) => {
 		vitestProcess.on("close", (code) => {
-			if (code === 0) resolve$1();
+			if (code === 0) resolve$2();
 			else reject(new Error(`Tests failed with exit code ${code}`));
 		});
 		vitestProcess.on("error", (error) => {
@@ -7467,6 +7548,16 @@ program.command("dev").description("Start development server with automatic relo
 		process.exit(1);
 	}
 });
+program.command("exec").description("Run a command with secrets injected into Credentials").argument("<command...>", "Command to run (use -- before command)").action(async (commandArgs) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await execCommand(commandArgs);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Command failed");
+		process.exit(1);
+	}
+});
 program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from", "development").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();