@geekmidas/cli 1.9.0 → 1.10.0

package/src/build/partitions.ts

@@ -0,0 +1,58 @@
+import type { Construct } from '@geekmidas/constructs';
+import type { GeneratedConstruct } from '../generators/Generator';
+
+export const DEFAULT_PARTITION = 'default';
+
+/**
+ * Group constructs by their partition field.
+ * Constructs without a partition are placed in the 'default' group.
+ */
+export function groupByPartition<T extends Construct>(
+	constructs: GeneratedConstruct<T>[],
+): Map<string, GeneratedConstruct<T>[]> {
+	const groups = new Map<string, GeneratedConstruct<T>[]>();
+
+	for (const construct of constructs) {
+		const partition = construct.partition ?? DEFAULT_PARTITION;
+		const group = groups.get(partition);
+		if (group) {
+			group.push(construct);
+		} else {
+			groups.set(partition, [construct]);
+		}
+	}
+
+	return groups;
+}
+
+/**
+ * Check if any construct across the given arrays has a non-undefined partition.
+ * When true, the manifest should use the partitioned shape for that construct type.
+ */
+export function hasPartitions<T extends Construct>(
+	constructs: GeneratedConstruct<T>[],
+): boolean {
+	return constructs.some((c) => c.partition !== undefined);
+}
+
+/**
+ * Group an info array by partition, using the partition values from
+ * the corresponding construct array. Both arrays must be the same length
+ * and in the same order.
+ */
+export function groupInfosByPartition<T>(
+	infos: T[],
+	constructs: GeneratedConstruct<any>[],
+): Record<string, T[]> {
+	const groups: Record<string, T[]> = {};
+
+	for (let i = 0; i < infos.length; i++) {
+		const partition = constructs[i]?.partition ?? DEFAULT_PARTITION;
+		if (!groups[partition]) {
+			groups[partition] = [];
+		}
+		groups[partition].push(infos[i]!);
+	}
+
+	return groups;
+}

package/src/deploy/sniffer.ts

@@ -4,6 +4,7 @@ import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import type { SniffResult } from '@geekmidas/envkit/sniffer';
+import { normalizeRoutes } from '../workspace/client-generator.js';
 import type { NormalizedAppConfig } from '../workspace/types.js';
 
 const __filename = fileURLToPath(import.meta.url);
@@ -155,7 +156,11 @@ export async function sniffAppEnvironment(
 
 	// 4. Route-based apps - load routes and call getEnvironment() on each construct
 	if (app.routes) {
-		const result = await sniffRouteFiles(app.routes, app.path, workspacePath);
+		const result = await sniffRouteFiles(
+			normalizeRoutes(app.routes),
+			app.path,
+			workspacePath,
+		);
 
 		if (logWarnings && result.error) {
 			console.warn(

package/src/dev/__tests__/index.spec.ts

@@ -12,6 +12,7 @@ import {
 	checkPortConflicts,
 	findAvailablePort,
 	generateAllDependencyEnvVars,
+	generateServerEntryContent,
 	isPortAvailable,
 	loadPortState,
 	loadSecretsForApp,
@@ -1678,3 +1679,51 @@ services:
 		expect(mappings).toEqual([]);
 	});
 });
+
+describe('generateServerEntryContent', () => {
+	it('should use dynamic import for createApp when secrets are provided', () => {
+		const content = generateServerEntryContent({
+			secretsJsonPath: '/tmp/dev-secrets.json',
+		});
+
+		// createApp must be a dynamic import so Credentials are populated first
+		expect(content).toContain("await import('./app.js')");
+		// Must NOT have a static import of createApp
+		expect(content).not.toMatch(/^import.*createApp/m);
+	});
+
+	it('should use dynamic import for createApp without secrets', () => {
+		const content = generateServerEntryContent({});
+
+		expect(content).toContain("await import('./app.js')");
+		expect(content).not.toMatch(/^import.*createApp/m);
+	});
+
+	it('should inject Credentials assignment before dynamic import', () => {
+		const content = generateServerEntryContent({
+			secretsJsonPath: '/tmp/dev-secrets.json',
+		});
+
+		const credentialsAssignIdx = content.indexOf('Object.assign(Credentials');
+		const dynamicImportIdx = content.indexOf("await import('./app.js')");
+
+		expect(credentialsAssignIdx).toBeGreaterThan(-1);
+		expect(dynamicImportIdx).toBeGreaterThan(-1);
+		expect(credentialsAssignIdx).toBeLessThan(dynamicImportIdx);
+	});
+
+	it('should not include credentials injection when no secrets path', () => {
+		const content = generateServerEntryContent({});
+
+		expect(content).not.toContain('Object.assign(Credentials');
+		expect(content).not.toContain('existsSync');
+	});
+
+	it('should use custom app import path when provided', () => {
+		const content = generateServerEntryContent({
+			appImportPath: './custom-app.js',
+		});
+
+		expect(content).toContain("await import('./custom-app.js')");
+	});
+});

package/src/dev/index.ts

@@ -1832,6 +1832,85 @@ class EntryRunner {
 	}
 }
 
+/**
+ * Generate the content of the dev server entry file (server.ts).
+ * Uses dynamic import for createApp so Credentials are populated
+ * before any app modules evaluate.
+ * @internal Exported for testing
+ */
+export function generateServerEntryContent(options: {
+	secretsJsonPath?: string;
+	runtime?: Runtime;
+	enableOpenApi?: boolean;
+	appImportPath?: string;
+}): string {
+	const {
+		secretsJsonPath,
+		runtime = 'node',
+		enableOpenApi = false,
+		appImportPath = './app.js',
+	} = options;
+
+	const credentialsInjection = secretsJsonPath
+		? `import { Credentials } from '@geekmidas/envkit/credentials';
+import { existsSync, readFileSync } from 'node:fs';
+
+// Inject dev secrets into Credentials (must happen before app import)
+const secretsPath = '${secretsJsonPath}';
+if (existsSync(secretsPath)) {
+  Object.assign(Credentials, JSON.parse(readFileSync(secretsPath, 'utf-8')));
+}
+
+`
+		: '';
+
+	const serveCode =
+		runtime === 'bun'
+			? `Bun.serve({
+      port,
+      fetch: app.fetch,
+    });`
+			: `const { serve } = await import('@hono/node-server');
+    const server = serve({
+      fetch: app.fetch,
+      port,
+    });
+    // Inject WebSocket support if available
+    const injectWs = (app as any).__injectWebSocket;
+    if (injectWs) {
+      injectWs(server);
+      console.log('🔌 Telescope real-time updates enabled');
+    }`;
+
+	return `#!/usr/bin/env node
+/**
+ * Development server entry point
+ * This file is auto-generated by 'gkm dev'
+ */
+${credentialsInjection}
+const port = process.argv.includes('--port')
+  ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
+  : 3000;
+
+// Dynamic import so Credentials are populated before env.ts evaluates
+const { createApp } = await import('${appImportPath}');
+
+// createApp is async to support optional WebSocket setup
+const { app, start } = await createApp(undefined, ${enableOpenApi});
+
+// Start the server
+start({
+  port,
+  serve: async (app, port) => {
+    ${serveCode}
+  },
+}).catch((error) => {
+  console.error('Failed to start server:', error);
+  process.exit(1);
+});
+`;
+}
+
 class DevServer {
 	private serverProcess: ChildProcess | null = null;
 	private isRunning = false;
@@ -1997,72 +2076,14 @@ class DevServer {
 
 	private async createServerEntry(): Promise<void> {
 		const { writeFile: fsWriteFile } = await import('node:fs/promises');
-		const { relative, dirname } = await import('node:path');
 
 		const serverPath = join(this.appRoot, '.gkm', this.provider, 'server.ts');
 
-		const relativeAppPath = relative(
-			dirname(serverPath),
-			join(dirname(serverPath), 'app.js'),
-		);
-
-		// Generate credentials injection code if secrets are available
-		const credentialsInjection = this.secretsJsonPath
-			? `import { Credentials } from '@geekmidas/envkit/credentials';
-import { existsSync, readFileSync } from 'node:fs';
-
-// Inject dev secrets into Credentials (must happen before app import)
-const secretsPath = '${this.secretsJsonPath}';
-if (existsSync(secretsPath)) {
-  Object.assign(Credentials, JSON.parse(readFileSync(secretsPath, 'utf-8')));
-}
-
-`
-			: '';
-
-		const serveCode =
-			this.runtime === 'bun'
-				? `Bun.serve({
-      port,
-      fetch: app.fetch,
-    });`
-				: `const { serve } = await import('@hono/node-server');
-    const server = serve({
-      fetch: app.fetch,
-      port,
-    });
-    // Inject WebSocket support if available
-    const injectWs = (app as any).__injectWebSocket;
-    if (injectWs) {
-      injectWs(server);
-      console.log('🔌 Telescope real-time updates enabled');
-    }`;
-
-		const content = `#!/usr/bin/env node
-/**
- * Development server entry point
- * This file is auto-generated by 'gkm dev'
- */
-${credentialsInjection}import { createApp } from './${relativeAppPath.startsWith('.') ? relativeAppPath : `./${relativeAppPath}`}';
-
-const port = process.argv.includes('--port')
-  ? Number.parseInt(process.argv[process.argv.indexOf('--port') + 1])
-  : 3000;
-
-// createApp is async to support optional WebSocket setup
-const { app, start } = await createApp(undefined, ${this.enableOpenApi});
-
-// Start the server
-start({
-  port,
-  serve: async (app, port) => {
-    ${serveCode}
-  },
-}).catch((error) => {
-  console.error('Failed to start server:', error);
-  process.exit(1);
-});
-`;
+		const content = generateServerEntryContent({
+			secretsJsonPath: this.secretsJsonPath,
+			runtime: this.runtime,
+			enableOpenApi: this.enableOpenApi,
+		});
 
 		await fsWriteFile(serverPath, content);
 	}

package/src/generators/Generator.ts

@@ -3,7 +3,11 @@ import type { Construct } from '@geekmidas/constructs';
 import fg from 'fast-glob';
 import kebabCase from 'lodash.kebabcase';
 import type { BuildContext } from '../build/types';
-import type { LegacyProvider, Routes } from '../types';
+import {
+	isPartitionedRoutes,
+	type LegacyProvider,
+	type Routes,
+} from '../types';
 
 export interface GeneratorOptions {
 	provider?: LegacyProvider;
@@ -38,12 +42,22 @@ export abstract class ConstructGenerator<T extends Construct, R = void> {
 	): Promise<GeneratedConstruct<T>[]> {
 		const logger = console;
 
-		// Normalize patterns to array
-		const globPatterns = Array.isArray(patterns)
-			? patterns
-			: patterns
-				? [patterns]
-				: [];
+		// Extract glob patterns and optional partition function
+		let globPatterns: string[];
+		let partitionFn: ((filepath: string) => string) | undefined;
+
+		if (isPartitionedRoutes(patterns)) {
+			globPatterns = Array.isArray(patterns.paths)
+				? patterns.paths
+				: [patterns.paths];
+			partitionFn = patterns.partition;
+		} else {
+			globPatterns = Array.isArray(patterns)
+				? patterns
+				: patterns
+					? [patterns]
+					: [];
+		}
 
 		// Find all files
 		const files = fg.stream(globPatterns, {
@@ -61,6 +75,9 @@ export abstract class ConstructGenerator<T extends Construct, R = void> {
 				const importPath = bustCache ? `${file}?t=${Date.now()}` : file;
 				const module = await import(importPath);
 
+				// Compute partition name for this file (if partition function provided)
+				const partition = partitionFn ? partitionFn(file) : undefined;
+
 				// Check all exports for constructs
 				for (const [key, construct] of Object.entries(module)) {
 					if (this.isConstruct(construct)) {
@@ -72,6 +89,7 @@ export abstract class ConstructGenerator<T extends Construct, R = void> {
 								absolute: file,
 								relative: relative(process.cwd(), file),
 							},
+							partition,
 						});
 					}
 				}
@@ -95,4 +113,6 @@ export interface GeneratedConstruct<T extends Construct> {
 		absolute: string;
 		relative: string;
 	};
+	/** Partition name assigned by the partition function, if configured. */
+	partition?: string;
 }

package/src/generators/OpenApiTsGenerator.ts

@@ -681,7 +681,7 @@ export function createApi(options: CreateApiOptions) {
 // API Client Factory
 // ============================================================
 
-import { TypedFetcher, type FetcherOptions } from '@geekmidas/client/fetcher';
+import { createTypedFetcher, type FetcherOptions } from '@geekmidas/client/fetcher';
 import { createEndpointHooks } from '@geekmidas/client/endpoint-hooks';
 import type { QueryClient } from '@tanstack/react-query';
 
@@ -713,11 +713,11 @@ export interface CreateApiOptions extends Omit<FetcherOptions, 'baseURL'> {
  */
 export function createApi(options: CreateApiOptions) {
   const { queryClient, ...fetcherOptions } = options;
-  const fetcher = new TypedFetcher<paths>(fetcherOptions);
+  const request = createTypedFetcher<paths>(fetcherOptions);
 
-  const hooks = createEndpointHooks<paths>(fetcher.request.bind(fetcher), { queryClient });
+  const hooks = createEndpointHooks<paths>(request, { queryClient });
 
-  return Object.assign(fetcher.request.bind(fetcher), hooks);
+  return Object.assign(request, hooks);
 }
 `;
 

package/src/index.ts

@@ -518,8 +518,27 @@ program
 
 			const { loadWorkspaceConfig } = await import('./config');
 			const { pushSecrets } = await import('./secrets/sync');
+			const { reconcileMissingSecrets } = await import('./secrets/reconcile');
+			const { readStageSecrets, writeStageSecrets } = await import(
+				'./secrets/storage'
+			);
 
 			const { workspace } = await loadWorkspaceConfig();
+
+			const secrets = await readStageSecrets(options.stage, workspace.root);
+			if (secrets) {
+				const result = reconcileMissingSecrets(secrets, workspace);
+				if (result) {
+					await writeStageSecrets(result.secrets, workspace.root);
+					console.log(
+						`  Reconciled ${result.addedKeys.length} missing secret(s):`,
+					);
+					for (const key of result.addedKeys) {
+						console.log(`    + ${key}`);
+					}
+				}
+			}
+
 			await pushSecrets(options.stage, workspace);
 			console.log(`\n✓ Secrets pushed for stage "${options.stage}"`);
 		} catch (error) {
@@ -542,15 +561,27 @@ program
 			const { loadWorkspaceConfig } = await import('./config');
 			const { pullSecrets } = await import('./secrets/sync');
 			const { writeStageSecrets } = await import('./secrets/storage');
+			const { reconcileMissingSecrets } = await import('./secrets/reconcile');
 
 			const { workspace } = await loadWorkspaceConfig();
-			const secrets = await pullSecrets(options.stage, workspace);
+			let secrets = await pullSecrets(options.stage, workspace);
 
 			if (!secrets) {
 				console.error(`No remote secrets found for stage "${options.stage}".`);
 				process.exit(1);
 			}
 
+			const result = reconcileMissingSecrets(secrets, workspace);
+			if (result) {
+				secrets = result.secrets;
+				console.log(
+					`  Reconciled ${result.addedKeys.length} missing secret(s):`,
+				);
+				for (const key of result.addedKeys) {
+					console.log(`    + ${key}`);
+				}
+			}
+
 			await writeStageSecrets(secrets, workspace.root);
 			console.log(`\n✓ Secrets pulled for stage "${options.stage}"`);
 		} catch (error) {
@@ -559,6 +590,53 @@ program
 		}
 	});
 
+program
+	.command('secrets:reconcile')
+	.description('Backfill missing custom secrets from workspace config')
+	.option('--stage <stage>', 'Stage name', 'development')
+	.action(async (options: { stage: string }) => {
+		try {
+			const globalOptions = program.opts();
+			if (globalOptions.cwd) {
+				process.chdir(globalOptions.cwd);
+			}
+
+			const { loadWorkspaceConfig } = await import('./config');
+			const { reconcileMissingSecrets } = await import('./secrets/reconcile');
+			const { readStageSecrets, writeStageSecrets } = await import(
+				'./secrets/storage'
+			);
+
+			const { workspace } = await loadWorkspaceConfig();
+			const secrets = await readStageSecrets(options.stage, workspace.root);
+
+			if (!secrets) {
+				console.error(
+					`No secrets found for stage "${options.stage}". Run "gkm secrets:init --stage ${options.stage}" first.`,
+				);
+				process.exit(1);
+			}
+
+			const result = reconcileMissingSecrets(secrets, workspace);
+
+			if (!result) {
+				console.log(`\n✓ Secrets for stage "${options.stage}" are up-to-date`);
+				return;
+			}
+
+			await writeStageSecrets(result.secrets, workspace.root);
+			console.log(
+				`\n✓ Reconciled ${result.addedKeys.length} missing secret(s) for stage "${options.stage}":`,
+			);
+			for (const key of result.addedKeys) {
+				console.log(`    + ${key}`);
+			}
+		} catch (error) {
+			console.error(error instanceof Error ? error.message : 'Command failed');
+			process.exit(1);
+		}
+	});
+
 // Deploy command
 program
 	.command('deploy')

package/src/init/versions.ts

@@ -30,14 +30,14 @@ export const GEEKMIDAS_VERSIONS = {
 	'@geekmidas/audit': '~1.0.0',
 	'@geekmidas/auth': '~1.0.0',
 	'@geekmidas/cache': '~1.0.0',
-	'@geekmidas/client': '~2.0.0',
+	'@geekmidas/client': '~3.0.0',
 	'@geekmidas/cloud': '~1.0.0',
-	'@geekmidas/constructs': '~1.1.1',
+	'@geekmidas/constructs': '~2.0.0',
 	'@geekmidas/db': '~1.0.0',
 	'@geekmidas/emailkit': '~1.0.0',
 	'@geekmidas/envkit': '~1.0.3',
 	'@geekmidas/errors': '~1.0.0',
-	'@geekmidas/events': '~1.0.0',
+	'@geekmidas/events': '~1.1.0',
 	'@geekmidas/logger': '~1.0.0',
 	'@geekmidas/rate-limit': '~1.0.0',
 	'@geekmidas/schema': '~1.0.0',
@@ -45,7 +45,7 @@ export const GEEKMIDAS_VERSIONS = {
 	'@geekmidas/storage': '~1.0.0',
 	'@geekmidas/studio': '~1.0.0',
 	'@geekmidas/telescope': '~1.0.0',
-	'@geekmidas/testkit': '~1.0.1',
+	'@geekmidas/testkit': '~1.0.2',
 	'@geekmidas/cli': CLI_VERSION,
 } as const;
 

package/src/openapi.ts

@@ -6,6 +6,7 @@ import { loadWorkspaceConfig } from './config.js';
 import { EndpointGenerator } from './generators/EndpointGenerator.js';
 import { OpenApiTsGenerator } from './generators/OpenApiTsGenerator.js';
 import type { GkmConfig, OpenApiConfig } from './types.js';
+import { normalizeRoutes } from './workspace/client-generator.js';
 
 interface OpenAPIOptions {
 	cwd?: string;
@@ -141,7 +142,7 @@ export async function openapiCommand(
 				if (app.type !== 'backend' || !app.routes) continue;
 
 				const appPath = join(workspaceRoot, app.path);
-				const routes = Array.isArray(app.routes) ? app.routes : [app.routes];
+				const routes = normalizeRoutes(app.routes);
 				const routesGlob = routes.map((r) => join(appPath, r));
 
 				const gkmConfig: GkmConfig = {

package/src/secrets/__tests__/reconcile.spec.ts

@@ -0,0 +1,123 @@
+import { describe, expect, it } from 'vitest';
+import { generateFullstackCustomSecrets } from '../../setup/fullstack-secrets';
+import type { NormalizedWorkspace } from '../../workspace/types';
+import { reconcileMissingSecrets } from '../reconcile';
+import type { StageSecrets } from '../types';
+
+function createMultiAppWorkspace(
+	overrides?: Partial<NormalizedWorkspace>,
+): NormalizedWorkspace {
+	return {
+		name: 'test-project',
+		root: '/tmp/test',
+		apps: {
+			api: {
+				type: 'backend',
+				path: 'apps/api',
+				port: 3000,
+				dependencies: [],
+				resolvedDeployTarget: 'dokploy',
+			},
+			web: {
+				type: 'frontend',
+				path: 'apps/web',
+				port: 3001,
+				dependencies: ['api'],
+				resolvedDeployTarget: 'dokploy',
+				framework: 'nextjs',
+			},
+		},
+		services: { db: true },
+		deploy: {},
+		shared: {},
+		secrets: {},
+		...overrides,
+	} as NormalizedWorkspace;
+}
+
+function createSecrets(custom: Record<string, string> = {}): StageSecrets {
+	return {
+		stage: 'development',
+		createdAt: '2024-01-01T00:00:00.000Z',
+		updatedAt: '2024-01-01T00:00:00.000Z',
+		services: {},
+		urls: {},
+		custom,
+	};
+}
+
+describe('reconcileMissingSecrets', () => {
+	it('should return null for single-app workspace', () => {
+		const workspace = createMultiAppWorkspace({
+			apps: {
+				api: {
+					type: 'backend',
+					path: 'apps/api',
+					port: 3000,
+					dependencies: [],
+					resolvedDeployTarget: 'dokploy',
+				},
+			},
+		}) as NormalizedWorkspace;
+
+		const result = reconcileMissingSecrets(createSecrets(), workspace);
+		expect(result).toBeNull();
+	});
+
+	it('should return null when no keys are missing', () => {
+		const workspace = createMultiAppWorkspace();
+		const expected = generateFullstackCustomSecrets(workspace);
+
+		const result = reconcileMissingSecrets(createSecrets(expected), workspace);
+		expect(result).toBeNull();
+	});
+
+	it('should backfill missing keys', () => {
+		const workspace = createMultiAppWorkspace();
+		const secrets = createSecrets();
+
+		const result = reconcileMissingSecrets(secrets, workspace);
+
+		expect(result).not.toBeNull();
+		expect(result!.addedKeys.length).toBeGreaterThan(0);
+		for (const key of result!.addedKeys) {
+			expect(result!.secrets.custom[key]).toBeDefined();
+		}
+	});
+
+	it('should never overwrite existing keys', () => {
+		const workspace = createMultiAppWorkspace();
+		const existingValue = 'my-custom-jwt-secret';
+		const secrets = createSecrets({
+			JWT_SECRET: existingValue,
+		});
+
+		const result = reconcileMissingSecrets(secrets, workspace);
+
+		expect(result).not.toBeNull();
+		expect(result!.secrets.custom.JWT_SECRET).toBe(existingValue);
+		expect(result!.addedKeys).not.toContain('JWT_SECRET');
+	});
+
+	it('should update updatedAt timestamp', () => {
+		const workspace = createMultiAppWorkspace();
+		const secrets = createSecrets();
+		const originalUpdatedAt = secrets.updatedAt;
+
+		const result = reconcileMissingSecrets(secrets, workspace);
+
+		expect(result).not.toBeNull();
+		expect(result!.secrets.updatedAt).not.toBe(originalUpdatedAt);
+	});
+
+	it('should backfill frontend URL keys', () => {
+		const workspace = createMultiAppWorkspace();
+		const secrets = createSecrets();
+
+		const result = reconcileMissingSecrets(secrets, workspace);
+
+		expect(result).not.toBeNull();
+		expect(result!.secrets.custom.WEB_URL).toBe('http://localhost:3001');
+		expect(result!.addedKeys).toContain('WEB_URL');
+	});
+});