@geekmidas/cli 1.10.28 → 1.10.29

package/dist/{reconcile-DF8t4HC7.cjs → reconcile-CZtzdrnc.cjs}

@@ -1,4 +1,4 @@
-const require_fullstack_secrets = require('./fullstack-secrets-CsxU84eN.cjs');
+const require_fullstack_secrets = require('./fullstack-secrets-Bchl2MDd.cjs');
 
 //#region src/secrets/reconcile.ts
 /**
@@ -33,4 +33,4 @@ function reconcileMissingSecrets(secrets, workspace) {
 
 //#endregion
 exports.reconcileMissingSecrets = reconcileMissingSecrets;
-//# sourceMappingURL=reconcile-DF8t4HC7.cjs.map
+//# sourceMappingURL=reconcile-CZtzdrnc.cjs.map

package/dist/{reconcile-DF8t4HC7.cjs.map → reconcile-CZtzdrnc.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"reconcile-DF8t4HC7.cjs","names":["secrets: StageSecrets","workspace: NormalizedWorkspace","addedKeys: string[]"],"sources":["../src/secrets/reconcile.ts"],"sourcesContent":["import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,SAAgB,wBACfA,SACAC,WACyB;CACzB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,MAAK,WACJ,QAAO;CAGR,MAAM,iBAAiB,yDAA+B,UAAU;CAChE,MAAMC,YAAsB,CAAE;CAC9B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAQ;AAE1C,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,eAAe,CACxD,OAAM,OAAO,eAAe;AAC3B,eAAa,OAAO;AACpB,YAAU,KAAK,IAAI;CACnB;AAGF,KAAI,UAAU,WAAW,EACxB,QAAO;AAGR,QAAO;EACN,SAAS;GACR,GAAG;GACH,WAAW,qBAAI,QAAO,aAAa;GACnC,QAAQ;EACR;EACD;CACA;AACD"}
+{"version":3,"file":"reconcile-CZtzdrnc.cjs","names":["secrets: StageSecrets","workspace: NormalizedWorkspace","addedKeys: string[]"],"sources":["../src/secrets/reconcile.ts"],"sourcesContent":["import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,SAAgB,wBACfA,SACAC,WACyB;CACzB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,MAAK,WACJ,QAAO;CAGR,MAAM,iBAAiB,yDAA+B,UAAU;CAChE,MAAMC,YAAsB,CAAE;CAC9B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAQ;AAE1C,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,eAAe,CACxD,OAAM,OAAO,eAAe;AAC3B,eAAa,OAAO;AACpB,YAAU,KAAK,IAAI;CACnB;AAGF,KAAI,UAAU,WAAW,EACxB,QAAO;AAGR,QAAO;EACN,SAAS;GACR,GAAG;GACH,WAAW,qBAAI,QAAO,aAAa;GACnC,QAAQ;EACR;EACD;CACA;AACD"}

package/dist/{reconcile-BjWhjfSp.mjs → reconcile-DAAKa0YR.mjs}

@@ -1,4 +1,4 @@
-import { generateFullstackCustomSecrets } from "./fullstack-secrets-BDE7Sk93.mjs";
+import { generateFullstackCustomSecrets } from "./fullstack-secrets-P84v8zWn.mjs";
 
 //#region src/secrets/reconcile.ts
 /**
@@ -33,4 +33,4 @@ function reconcileMissingSecrets(secrets, workspace) {
 
 //#endregion
 export { reconcileMissingSecrets };
-//# sourceMappingURL=reconcile-BjWhjfSp.mjs.map
+//# sourceMappingURL=reconcile-DAAKa0YR.mjs.map

package/dist/{reconcile-BjWhjfSp.mjs.map → reconcile-DAAKa0YR.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"reconcile-BjWhjfSp.mjs","names":["secrets: StageSecrets","workspace: NormalizedWorkspace","addedKeys: string[]"],"sources":["../src/secrets/reconcile.ts"],"sourcesContent":["import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,SAAgB,wBACfA,SACAC,WACyB;CACzB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,MAAK,WACJ,QAAO;CAGR,MAAM,iBAAiB,+BAA+B,UAAU;CAChE,MAAMC,YAAsB,CAAE;CAC9B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAQ;AAE1C,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,eAAe,CACxD,OAAM,OAAO,eAAe;AAC3B,eAAa,OAAO;AACpB,YAAU,KAAK,IAAI;CACnB;AAGF,KAAI,UAAU,WAAW,EACxB,QAAO;AAGR,QAAO;EACN,SAAS;GACR,GAAG;GACH,WAAW,qBAAI,QAAO,aAAa;GACnC,QAAQ;EACR;EACD;CACA;AACD"}
+{"version":3,"file":"reconcile-DAAKa0YR.mjs","names":["secrets: StageSecrets","workspace: NormalizedWorkspace","addedKeys: string[]"],"sources":["../src/secrets/reconcile.ts"],"sourcesContent":["import { generateFullstackCustomSecrets } from '../setup/fullstack-secrets.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\nimport type { StageSecrets } from './types.js';\n\nexport interface ReconcileResult {\n\t/** The updated secrets with missing keys backfilled */\n\tsecrets: StageSecrets;\n\t/** Keys that were added */\n\taddedKeys: string[];\n}\n\n/**\n * Reconcile missing custom secrets for a workspace.\n *\n * Compares current secrets against what generateFullstackCustomSecrets()\n * would produce and backfills any missing keys without overwriting\n * existing values.\n *\n * @returns ReconcileResult if keys were added, null if secrets are up-to-date\n */\nexport function reconcileMissingSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n): ReconcileResult | null {\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (!isMultiApp) {\n\t\treturn null;\n\t}\n\n\tconst expectedCustom = generateFullstackCustomSecrets(workspace);\n\tconst addedKeys: string[] = [];\n\tconst mergedCustom = { ...secrets.custom };\n\n\tfor (const [key, value] of Object.entries(expectedCustom)) {\n\t\tif (!(key in mergedCustom)) {\n\t\t\tmergedCustom[key] = value;\n\t\t\taddedKeys.push(key);\n\t\t}\n\t}\n\n\tif (addedKeys.length === 0) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\tsecrets: {\n\t\t\t...secrets,\n\t\t\tupdatedAt: new Date().toISOString(),\n\t\t\tcustom: mergedCustom,\n\t\t},\n\t\taddedKeys,\n\t};\n}\n"],"mappings":";;;;;;;;;;;;AAoBA,SAAgB,wBACfA,SACAC,WACyB;CACzB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,MAAK,WACJ,QAAO;CAGR,MAAM,iBAAiB,+BAA+B,UAAU;CAChE,MAAMC,YAAsB,CAAE;CAC9B,MAAM,eAAe,EAAE,GAAG,QAAQ,OAAQ;AAE1C,MAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,eAAe,CACxD,OAAM,OAAO,eAAe;AAC3B,eAAa,OAAO;AACpB,YAAU,KAAK,IAAI;CACnB;AAGF,KAAI,UAAU,WAAW,EACxB,QAAO;AAGR,QAAO;EACN,SAAS;GACR,GAAG;GACH,WAAW,qBAAI,QAAO,aAAa;GACnC,QAAQ;EACR;EACD;CACA;AACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/cli",
-  "version": "1.10.28",
+  "version": "1.10.29",
   "description": "CLI tools for building Lambda handlers, server applications, and generating OpenAPI specs",
   "private": false,
   "type": "module",
@@ -56,11 +56,11 @@
     "prompts": "~2.4.2",
     "tsx": "~4.20.3",
     "yaml": "~2.8.2",
-    "@geekmidas/constructs": "~3.0.5",
-    "@geekmidas/errors": "~1.0.0",
+    "@geekmidas/constructs": "~3.0.6",
     "@geekmidas/envkit": "~1.0.4",
-    "@geekmidas/schema": "~1.0.0",
-    "@geekmidas/logger": "~1.0.0"
+    "@geekmidas/errors": "~1.0.0",
+    "@geekmidas/logger": "~1.0.0",
+    "@geekmidas/schema": "~1.0.0"
   },
   "devDependencies": {
     "@types/lodash.kebabcase": "^4.1.9",

package/src/init/__tests__/generators.spec.ts

@@ -814,13 +814,15 @@ describe('generateTestFiles', () => {
 		expect(configFile!.content).toContain('~/services/database.ts');
 	});
 
-	it('should use PostgresKyselyMigrator in globalSetup', () => {
+	it('should use PostgresKyselyMigrator with runInitScript in globalSetup', () => {
 		const files = generateTestFiles(baseOptions, minimalTemplate);
 		const setupFile = files.find((f) => f.path === 'test/globalSetup.ts');
 		expect(setupFile).toBeDefined();
 		expect(setupFile!.content).toContain('PostgresKyselyMigrator');
-		expect(setupFile!.content).toContain('_test');
-		expect(setupFile!.content).toContain('migrateToLatest');
+		expect(setupFile!.content).toContain('runInitScript');
+		expect(setupFile!.content).toContain('afterCreate');
+		expect(setupFile!.content).toContain('Credentials');
+		expect(setupFile!.content).toContain('PGBOSS_DB_PASSWORD');
 	});
 
 	it('should use KyselyFactory in factory files', () => {

package/src/init/generators/package.ts

@@ -38,6 +38,7 @@ export function generatePackageJson(
 		devDependencies['@geekmidas/testkit'] =
 			GEEKMIDAS_VERSIONS['@geekmidas/testkit'];
 		devDependencies['@faker-js/faker'] = '~9.8.0';
+		devDependencies['kysely-ctl'] = '~0.10.0';
 		devDependencies['vite-tsconfig-paths'] = '~5.1.0';
 	}
 

package/src/init/generators/test.ts

@@ -18,6 +18,31 @@ export function generateTestFiles(
 	}
 
 	return [
+		// kysely.config.ts - Kysely CLI configuration for migrations
+		{
+			path: 'kysely.config.ts',
+			content: `import { Credentials } from '@geekmidas/envkit/credentials';
+import { PostgresDialect } from 'kysely';
+import { defineConfig } from 'kysely-ctl';
+import pg from 'pg';
+
+export default defineConfig({
+  dialect: new PostgresDialect({
+    pool: new pg.Pool({
+      password: Credentials.POSTGRES_PASSWORD,
+      user: Credentials.POSTGRES_USER,
+      database: Credentials.POSTGRES_DB,
+      port: Number(Credentials.POSTGRES_PORT),
+      host: Credentials.POSTGRES_HOST,
+    }),
+  }),
+  migrations: {
+    migrationFolder: './src/db/migrations',
+  },
+});
+`,
+		},
+
 		// test/config.ts - Wraps vitest `it` with transaction auto-rollback
 		{
 			path: 'test/config.ts',
@@ -39,36 +64,55 @@ export const it = wrapVitestKyselyTransaction<Database>(itVitest, {
 `,
 		},
 
-		// test/globalSetup.ts - Runs migrations on the test database
-		// Note: gkm test automatically rewrites DATABASE_URL to use a _test
-		// suffixed database and creates it if needed. This setup only runs
-		// migrations.
+		// test/globalSetup.ts - Creates test database, provisions users, runs migrations
 		{
 			path: 'test/globalSetup.ts',
-			content: `import { Kysely, PostgresDialect } from 'kysely';
-import pg from 'pg';
+			content: `import fs from 'node:fs/promises';
+import path from 'node:path';
+import { Credentials } from '@geekmidas/envkit/credentials';
 import { PostgresKyselyMigrator } from '@geekmidas/testkit/kysely';
-import type { Database } from '~/services/database.ts';
+import { runInitScript } from '@geekmidas/testkit/postgres';
+import { FileMigrationProvider, Kysely, PostgresDialect } from 'kysely';
+import pg from 'pg';
 
-export async function setup() {
-  const testUrl = process.env.DATABASE_URL;
-  if (!testUrl) throw new Error('DATABASE_URL is required for tests');
+export default async function globalSetup() {
+  const databaseUrl = Credentials.DATABASE_URL!;
+  const migrationFolder = path.resolve(import.meta.dirname, '../db/migrations');
 
-  // Run migrations on the test database
-  // (gkm test already rewrites DATABASE_URL to point to the _test database)
-  const db = new Kysely<Database>({
+  const db = new Kysely({
     dialect: new PostgresDialect({
-      pool: new pg.Pool({ connectionString: testUrl }),
+      pool: new pg.Pool({ connectionString: databaseUrl }),
     }),
   });
 
   const migrator = new PostgresKyselyMigrator({
+    uri: databaseUrl,
     db,
-    migrationsPath: './src/migrations',
+    afterCreate: async (uri) => {
+      const initScriptPath = path.resolve(process.cwd(), 'docker/postgres/init.sh');
+      const dbUrl = new URL(Credentials.DATABASE_URL!);
+      const apiUrl = new URL(Credentials.API_DATABASE_URL!);
+      const authUrl = new URL(Credentials.AUTH_DATABASE_URL!);
+
+      const env = {
+        POSTGRES_USER: dbUrl.username,
+        POSTGRES_DB: dbUrl.pathname.slice(1),
+        API_DB_PASSWORD: decodeURIComponent(apiUrl.password),
+        AUTH_DB_PASSWORD: decodeURIComponent(authUrl.password),
+        PGBOSS_DB_PASSWORD: Credentials.PGBOSS_DB_PASSWORD ?? 'pgboss-dev-password',
+      };
+
+      await runInitScript(initScriptPath, uri, env);
+    },
+    provider: new FileMigrationProvider({
+      fs,
+      path,
+      migrationFolder,
+    }),
   });
 
-  await migrator.migrateToLatest();
-  await db.destroy();
+  const teardown = await migrator.start();
+  return teardown;
 }
 `,
 		},

package/src/setup/fullstack-secrets.ts

@@ -107,6 +107,17 @@ export async function writeDockerEnvFromSecrets(
 		key.endsWith('_DB_PASSWORD'),
 	);
 
+	// Always include pgboss password when pgboss credentials exist
+	if (
+		secrets.services.pgboss &&
+		!dbPasswordEntries.some(([key]) => key === 'PGBOSS_DB_PASSWORD')
+	) {
+		dbPasswordEntries.push([
+			'PGBOSS_DB_PASSWORD',
+			secrets.services.pgboss.password,
+		]);
+	}
+
 	if (dbPasswordEntries.length === 0) {
 		return;
 	}