@geekmidas/cli 0.37.0 → 0.39.0

package/dist/index.mjs

@@ -26,7 +26,7 @@ import prompts from "prompts";
 
 //#region package.json
 var name = "@geekmidas/cli";
-var version = "0.37.0";
+var version = "0.39.0";
 var description = "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs";
 var private$1 = false;
 var type = "module";
@@ -1541,19 +1541,43 @@ function findSecretsRoot(startDir) {
 	return startDir;
 }
 /**
-* Create a wrapper script that injects secrets before importing the entry file.
-* @internal Exported for testing
+* Generate the credentials injection code snippet.
+* This is the common logic used by both entry wrapper and exec preload.
+* @internal
 */
-async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
-	const credentialsInjection = secretsJsonPath ? `import { Credentials } from '@geekmidas/envkit/credentials';
+function generateCredentialsInjection(secretsJsonPath) {
+	return `import { Credentials } from '@geekmidas/envkit/credentials';
 import { existsSync, readFileSync } from 'node:fs';
 
-// Inject dev secrets into Credentials (before app import)
+// Inject dev secrets into Credentials
 const secretsPath = '${secretsJsonPath}';
 if (existsSync(secretsPath)) {
-  Object.assign(Credentials, JSON.parse(readFileSync(secretsPath, 'utf-8')));
+  const secrets = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+  Object.assign(Credentials, secrets);
+  // Debug: uncomment to verify preload is running
+  // console.log('[gkm preload] Injected', Object.keys(secrets).length, 'credentials');
 }
-
+`;
+}
+/**
+* Create a preload script that injects secrets into Credentials.
+* Used by `gkm exec` to inject secrets before running any command.
+* @internal Exported for testing
+*/
+async function createCredentialsPreload(preloadPath, secretsJsonPath) {
+	const content = `/**
+ * Credentials preload generated by 'gkm exec'
+ * This file is loaded via NODE_OPTIONS="--import <path>"
+ */
+${generateCredentialsInjection(secretsJsonPath)}`;
+	await writeFile(preloadPath, content);
+}
+/**
+* Create a wrapper script that injects secrets before importing the entry file.
+* @internal Exported for testing
+*/
+async function createEntryWrapper(wrapperPath, entryPath, secretsJsonPath) {
+	const credentialsInjection = secretsJsonPath ? `${generateCredentialsInjection(secretsJsonPath)}
 ` : "";
 	const content = `#!/usr/bin/env node
 /**
@@ -1579,7 +1603,8 @@ async function prepareEntryCredentials(options) {
 		workspaceAppPort = appConfig.app.port;
 		secretsRoot = appConfig.workspaceRoot;
 		appName = appConfig.appName;
-	} catch {
+	} catch (error) {
+		logger$8.log(`⚠️  Could not load workspace config: ${error.message}`);
 		secretsRoot = findSecretsRoot(cwd);
 		appName = getAppNameFromCwd(cwd) ?? void 0;
 	}
@@ -1609,7 +1634,7 @@ async function entryDevCommand(options) {
 	if (!existsSync(entryPath)) throw new Error(`Entry file not found: ${entryPath}`);
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) logger$8.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
-	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.port });
+	const { credentials, resolvedPort, secretsJsonPath, appName } = await prepareEntryCredentials({ explicitPort: options.portExplicit ? options.port : void 0 });
 	if (appName) logger$8.log(`📦 App: ${appName} (port ${resolvedPort})`);
 	logger$8.log(`🚀 Starting entry file: ${entry} on port ${resolvedPort}`);
 	if (Object.keys(credentials).length > 1) logger$8.log(`🔐 Loaded ${Object.keys(credentials).length - 1} secret(s) + PORT`);
@@ -1858,6 +1883,59 @@ start({
 		await fsWriteFile(serverPath, content);
 	}
 };
+/**
+* Run a command with secrets injected into Credentials.
+* Uses Node's --import flag to preload a script that populates Credentials
+* before the command loads any modules that depend on them.
+*
+* @example
+* ```bash
+* gkm exec -- npx @better-auth/cli migrate
+* gkm exec -- npx prisma migrate dev
+* ```
+*/
+async function execCommand(commandArgs, options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	if (commandArgs.length === 0) throw new Error("No command specified. Usage: gkm exec -- <command>");
+	const defaultEnv = loadEnvFiles(".env");
+	if (defaultEnv.loaded.length > 0) logger$8.log(`📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	const { credentials, secretsJsonPath, appName } = await prepareEntryCredentials({ cwd });
+	if (appName) logger$8.log(`📦 App: ${appName}`);
+	const secretCount = Object.keys(credentials).filter((k) => k !== "PORT").length;
+	if (secretCount > 0) logger$8.log(`🔐 Loaded ${secretCount} secret(s)`);
+	const preloadDir = join(cwd, ".gkm");
+	await mkdir(preloadDir, { recursive: true });
+	const preloadPath = join(preloadDir, "credentials-preload.ts");
+	await createCredentialsPreload(preloadPath, secretsJsonPath);
+	const [cmd, ...args] = commandArgs;
+	if (!cmd) throw new Error("No command specified");
+	logger$8.log(`🚀 Running: ${commandArgs.join(" ")}`);
+	const existingNodeOptions = process.env.NODE_OPTIONS ?? "";
+	const tsxImport = "--import tsx";
+	const preloadImport = `--import ${preloadPath}`;
+	const nodeOptions = [
+		existingNodeOptions,
+		tsxImport,
+		preloadImport
+	].filter(Boolean).join(" ");
+	const child = spawn(cmd, args, {
+		cwd,
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...credentials,
+			NODE_OPTIONS: nodeOptions
+		}
+	});
+	const exitCode = await new Promise((resolve$1) => {
+		child.on("close", (code) => resolve$1(code ?? 0));
+		child.on("error", (error) => {
+			logger$8.error(`Failed to run command: ${error.message}`);
+			resolve$1(1);
+		});
+	});
+	if (exitCode !== 0) process.exit(exitCode);
+}
 
 //#endregion
 //#region src/build/manifests.ts
@@ -1928,10 +2006,15 @@ const logger$6 = console;
 async function buildCommand(options) {
 	const loadedConfig = await loadWorkspaceConfig();
 	if (loadedConfig.type === "workspace") {
-		logger$6.log("📦 Detected workspace configuration");
-		return workspaceBuildCommand(loadedConfig.workspace, options);
+		const cwd = resolve(process.cwd());
+		const workspaceRoot = resolve(loadedConfig.workspace.root);
+		const isAtWorkspaceRoot = cwd === workspaceRoot;
+		if (isAtWorkspaceRoot) {
+			logger$6.log("📦 Detected workspace configuration");
+			return workspaceBuildCommand(loadedConfig.workspace, options);
+		}
 	}
-	const config$1 = await loadConfig();
+	const config$1 = loadedConfig.type === "workspace" ? (await loadAppConfig()).gkmConfig : await loadConfig();
 	const resolved = resolveProviders(config$1, options);
 	const productionConfigFromGkm = getProductionConfigFromGkm(config$1);
 	const production = normalizeProductionConfig(options.production ?? false, productionConfigFromGkm);
@@ -3375,26 +3458,22 @@ function getImageRef(registry, imageName, tag) {
 }
 /**
 * Build Docker image
+* @param imageRef - Full image reference (registry/name:tag)
+* @param appName - Name of the app (used for Dockerfile.{appName} in workspaces)
 */
-async function buildImage(imageRef) {
+async function buildImage(imageRef, appName) {
 	logger$4.log(`\n🔨 Building Docker image: ${imageRef}`);
 	const cwd = process.cwd();
-	const inMonorepo = isMonorepo(cwd);
-	if (inMonorepo) logger$4.log("   Generating Dockerfile for monorepo (turbo prune)...");
+	const lockfilePath = findLockfilePath(cwd);
+	const lockfileDir = lockfilePath ? dirname(lockfilePath) : cwd;
+	const inMonorepo = lockfileDir !== cwd;
+	if (appName || inMonorepo) logger$4.log("   Generating Dockerfile for monorepo (turbo prune)...");
 	else logger$4.log("   Generating Dockerfile...");
 	await dockerCommand({});
-	let buildCwd = cwd;
-	let dockerfilePath = ".gkm/docker/Dockerfile";
-	if (inMonorepo) {
-		const lockfilePath = findLockfilePath(cwd);
-		if (lockfilePath) {
-			const monorepoRoot = dirname(lockfilePath);
-			const appRelPath = relative(monorepoRoot, cwd);
-			dockerfilePath = join(appRelPath, ".gkm/docker/Dockerfile");
-			buildCwd = monorepoRoot;
-			logger$4.log(`   Building from monorepo root: ${monorepoRoot}`);
-		}
-	}
+	const dockerfileSuffix = appName ? `.${appName}` : "";
+	const dockerfilePath = `.gkm/docker/Dockerfile${dockerfileSuffix}`;
+	const buildCwd = lockfilePath && (inMonorepo || appName) ? lockfileDir : cwd;
+	if (buildCwd !== cwd) logger$4.log(`   Building from workspace root: ${buildCwd}`);
 	try {
 		execSync(`DOCKER_BUILDKIT=1 docker build --platform linux/amd64 -f ${dockerfilePath} -t ${imageRef} .`, {
 			cwd: buildCwd,
@@ -3431,7 +3510,7 @@ async function deployDocker(options) {
 	const { stage, tag, skipPush, masterKey, config: config$1 } = options;
 	const imageName = config$1.imageName;
 	const imageRef = getImageRef(config$1.registry, imageName, tag);
-	await buildImage(imageRef);
+	await buildImage(imageRef, config$1.appName);
 	if (!skipPush) if (!config$1.registry) logger$4.warn("\n⚠️  No registry configured. Use --skip-push or configure docker.registry in gkm.config.ts");
 	else await pushImage(imageRef);
 	logger$4.log("\n✅ Docker deployment ready!");
@@ -4143,11 +4222,25 @@ async function workspaceDeployCommand(workspace, options) {
 		await provisionServices(api, project.projectId, environmentId, workspace.name, dockerServices);
 	}
 	const deployedAppUrls = {};
+	if (!skipBuild) {
+		logger$1.log("\n🏗️  Building workspace...");
+		try {
+			await buildCommand({
+				provider: "server",
+				production: true,
+				stage
+			});
+			logger$1.log("   ✓ Workspace build complete");
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Unknown error";
+			logger$1.log(`   ✗ Workspace build failed: ${message}`);
+			throw error;
+		}
+	}
 	logger$1.log("\n📦 Deploying applications...");
 	const results = [];
 	for (const appName of appsToDeployNames) {
 		const app = workspace.apps[appName];
-		const appPath = app.path;
 		logger$1.log(`\n   ${app.type === "backend" ? "⚙️" : "🌐"} Deploying ${appName}...`);
 		try {
 			const dokployAppName = `${workspace.name}-${appName}`;
@@ -4160,21 +4253,6 @@ async function workspaceDeployCommand(workspace, options) {
 				if (message.includes("already exists") || message.includes("duplicate")) logger$1.log(`      Application already exists`);
 				else throw error;
 			}
-			if (!skipBuild) {
-				logger$1.log(`      Building ${appName}...`);
-				const originalCwd = process.cwd();
-				const fullAppPath = `${workspace.root}/${appPath}`;
-				try {
-					process.chdir(fullAppPath);
-					await buildCommand({
-						provider: "server",
-						production: true,
-						stage
-					});
-				} finally {
-					process.chdir(originalCwd);
-				}
-			}
 			const imageName = `${workspace.name}-${appName}`;
 			const imageRef = registry ? `${registry}/${imageName}:${imageTag}` : `${imageName}:${imageTag}`;
 			logger$1.log(`      Building Docker image: ${imageRef}`);
@@ -4184,7 +4262,8 @@ async function workspaceDeployCommand(workspace, options) {
 				skipPush: false,
 				config: {
 					registry,
-					imageName
+					imageName,
+					appName
 				}
 			});
 			const envVars = [`NODE_ENV=production`, `PORT=${app.port}`];
@@ -4552,7 +4631,9 @@ function generateAuthAppFiles(options) {
 			dev: "gkm dev --entry ./src/index.ts",
 			build: "tsc",
 			start: "node dist/index.js",
-			typecheck: "tsc --noEmit"
+			typecheck: "tsc --noEmit",
+			"db:migrate": "gkm exec -- npx @better-auth/cli migrate",
+			"db:generate": "gkm exec -- npx @better-auth/cli generate"
 		},
 		dependencies: {
 			[modelsPackage]: "workspace:*",
@@ -7466,6 +7547,16 @@ program.command("dev").description("Start development server with automatic relo
 		process.exit(1);
 	}
 });
+program.command("exec").description("Run a command with secrets injected into Credentials").argument("<command...>", "Command to run (use -- before command)").action(async (commandArgs) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		await execCommand(commandArgs);
+	} catch (error) {
+		console.error(error instanceof Error ? error.message : "Command failed");
+		process.exit(1);
+	}
+});
 program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from", "development").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();