@geekmidas/cli 10.0.0-alpha.17 → 10.0.0-alpha.19

package/dist/index.mjs

@@ -1,15 +1,15 @@
 #!/usr/bin/env -S npx tsx
 import { n as __require, t as __exportAll } from "./rolldown-runtime-BhDjJH2R.mjs";
 import { i as DEFAULT_CACHE, r as ConstructGenerator, s as isPartitionedRoutes, t as discover } from "./discover-CK-n3w6b.mjs";
-import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DPnPkWyH.mjs";
-import { C as InvalidStages, E as stageProblems, O as getPublicEnvPrefix, T as deployedProblems, a as getAppBuildOrder, k as stripPublicPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, w as assertDeployedStage, y as isDeployTargetSupported } from "./workspace-DI-M3BnN.mjs";
-import { C as storageBackendFor, S as providerOf, _ as LOCAL_CA_PATH, a as loadEnvFiles, b as cacheBackendFor, c as resolveServicePorts, d as constructGlobs, f as derivedContainers, g as COMPOSE_PATH, i as isPortAvailable, l as rewriteUrlsWithPorts, m as usesConstructs, n as createEntryWrapper, o as loadSecretsForApp, p as reconcileWorkspace, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as applyPostgres, x as eventsBackendFor, y as resourceName } from "./credentials-fJP5-fa1.mjs";
+import { i as loadConfig, l as derivedApps, n as getAppNameFromCwd, o as loadWorkspaceConfig, r as loadAppConfig, s as parseModuleConfig } from "./config-DdKkoUE1.mjs";
+import { A as stripPublicPrefix, C as InvalidStages, D as stageProblems, E as deployedProblems, T as assertDeployedStage, a as getAppBuildOrder, k as getPublicEnvPrefix, o as getAppGkmConfig, s as getDependencyEnvVars, t as allConstructGlobs, v as getDeployTargetError, y as isDeployTargetSupported } from "./workspace-Bu3xNCej.mjs";
+import { C as storageBackendFor, S as providerOf, _ as LOCAL_CA_PATH, a as loadEnvFiles, b as cacheBackendFor, c as resolveServicePorts, d as constructGlobs, f as derivedContainers, g as COMPOSE_PATH, i as isPortAvailable, l as rewriteUrlsWithPorts, m as usesConstructs, n as createEntryWrapper, o as loadSecretsForApp, p as reconcileWorkspace, r as findAvailablePort, s as prepareEntryCredentials, t as createCredentialsPreload, u as startWorkspaceServices, v as applyPostgres, x as eventsBackendFor, y as resourceName } from "./credentials-lbv-j0Be.mjs";
 import { a as generateServiceCredentials, i as generateSecurePassword, n as generateConnectionUrls, o as rotateServicePassword, t as createStageSecrets } from "./generator-LfZU7NlU.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-TP0x118M.mjs";
-import { a as openapiCommand, c as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, r as generateOpenApiFrom, s as EndpointGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-DolhBm6r.mjs";
+import { a as openapiCommand, c as runtimeFor, n as generateOpenApi, o as resolveOpenApiConfig, r as generateOpenApiFrom, s as EndpointGenerator, t as OPENAPI_OUTPUT_PATH$1 } from "./openapi-DfjbhrsM.mjs";
 import { i as withRoutes, r as withCompute } from "./emit-Bzq7JsMP.mjs";
-import { i as writeDockerEnvFromSecrets, r as generateFullstackCustomSecrets } from "./reconcile-fmoluZmZ.mjs";
-import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-4A4S2hcw.mjs";
+import { i as writeDockerEnvFromSecrets, r as generateFullstackCustomSecrets } from "./reconcile-gb1lz1Dk.mjs";
+import { a as isRemoteStore, n as pullStageSecrets, r as pushStageSecrets, t as NoStoredSecrets } from "./transfer-DjFZRgub.mjs";
 import { createRequire } from "node:module";
 import { Command } from "commander";
 import { stdin, stdout } from "node:process";
@@ -37,7 +37,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { lookup } from "node:dns/promises";
 import prompts from "prompts";
 //#region package.json
-var version = "10.0.0-alpha.17";
+var version = "10.0.0-alpha.19";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -7937,7 +7937,7 @@ function workspaceConstructsGlobs(structure, appsDir) {
 * impossible.
 *
 * Instructions live in `AGENTS.md` because that is the file every tool reads.
-* `CLAUDE.md` points at it rather than copying it: two files saying the same
+* `CLAUDE.md` imports it rather than copying it: two files saying the same
 * thing is two files to keep in step, and the copy that drifts is always the
 * one nobody opened.
 *
@@ -7956,19 +7956,25 @@ function generateAgentFiles(options, template) {
 	}];
 }
 /**
-* The pointer.
+* The import.
 *
-* Deliberately short and deliberately not a summary — a summary is a second
-* copy of the conventions that ages independently of the first.
+* `@AGENTS.md` rather than a link: Claude Code loads an `@` import into context
+* with the file that names it, and follows no links. A link left the
+* conventions one step away from an agent that never took it — it read the
+* pointer and nothing it pointed at.
+*
+* Deliberately not a summary — a summary is a second copy of the conventions
+* that ages independently of the first.
 */
 function claudeContent() {
 	return `# CLAUDE.md
 
-The conventions for this project live in [AGENTS.md](./AGENTS.md).
+@AGENTS.md
 
-Read that file before writing code here. It is the single copy, kept that way
-on purpose: anything repeated here would be a second thing to keep in step, and
-the stale one is always the copy nobody opened.
+The conventions for this project live in \`AGENTS.md\`, imported above. It is
+the single copy, kept that way on purpose: anything repeated here would be a
+second thing to keep in step, and the stale one is always the copy nobody
+opened.
 `;
 }
 function agentsContent(options, template) {
@@ -8113,15 +8119,15 @@ per endpoint:
 
 \`\`\`typescript
 import { z } from 'zod';
-import { router } from '../constructs/router.ts';
+import { router } from '~/router.ts';
 
 export const createUser = router
   .post('/users')
   .body(z.object({ name: z.string(), email: z.email() }))
   .output(z.object({ id: z.uuid() }))
-  .handle(async ({ body, logger${database ? ", services" : ""} }) => {
+  .handle(async ({ body, logger${database ? ", db" : ""} }) => {
     logger.info({ name: body.name }, 'creating user');
-${database ? `    const user = await services.database
+${database ? `    const user = await db
       .insertInto('users')
       .values({ name: body.name, email: body.email })
       .returningAll()
@@ -8141,13 +8147,20 @@ beside it is a second app that shadows the real one.
 
 ### Branching the factory
 
-Share what a *group* of endpoints needs by branching once, in its own file:
+Share what a *group* of endpoints needs by branching once, in
+\`src/router.ts\`. A branch starts from the surface itself — there is no
+factory object to reach through first:
 
 \`\`\`typescript
-export const router = api.endpoints${database ? ".database(database)" : ""};
+export const router = api${database ? ".database(database)" : ""};
 export const sessionRouter = router.session(/* … */);
 \`\`\`
 
+A branch is a new factory; the surface is untouched, so a route built straight
+from \`api\` gets none of what the branch added. What one endpoint alone needs —
+a bucket, a cache, another construct — goes on that endpoint with
+\`.dependsOn([...])\`, and arrives in \`services\`.
+
 Branch for a group, never for a single endpoint — a one-endpoint branch is
 indirection with nothing on the other side of it.`;
 }
@@ -8194,17 +8207,29 @@ The database is a **construct**, not a hand-rolled service. Declaring it is what
 makes a Postgres exist locally and a database exist on deploy — nothing names
 \`postgres\` in config.
 
-An endpoint reaches it by declaring the dependency, and gets it typed:
+The router in \`src/router.ts\` names it — \`api.database(database)\` — and
+every endpoint built from that router gets it as \`db\`, typed by the
+construct's schema:
 
 \`\`\`typescript
 export const listUsers = router
   .get('/users')
   .output(z.array(z.object({ id: z.uuid() })))
-  .handle(async ({ services }) => {
-    return services.database.selectFrom('users').selectAll().execute();
+  .handle(async ({ db }) => {
+    return db.selectFrom('users').selectAll().execute();
   });
 \`\`\`
 
+An endpoint that needs a different database names it itself, and gets that
+one as \`db\` instead — the router's is unchanged for every other route:
+
+\`\`\`typescript
+export const monthly = router
+  .get('/reports/monthly')
+  .database(reports)
+  .handle(async ({ db }) => db.selectFrom('totals').selectAll().execute());
+\`\`\`
+
 Queries go through Kysely. Never open your own connection pool — the one the
 construct provides is the one that gets credentials, pooling and shutdown.`;
 }
@@ -8382,26 +8407,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.17",
-	"@geekmidas/auth": "~10.0.0-alpha.17",
-	"@geekmidas/cache": "~10.0.0-alpha.17",
-	"@geekmidas/client": "~10.0.0-alpha.17",
-	"@geekmidas/cloud": "~10.0.0-alpha.17",
-	"@geekmidas/constructs": "~10.0.0-alpha.17",
-	"@geekmidas/db": "~10.0.0-alpha.17",
-	"@geekmidas/emailkit": "~10.0.0-alpha.17",
-	"@geekmidas/envkit": "~10.0.0-alpha.17",
-	"@geekmidas/errors": "~10.0.0-alpha.17",
-	"@geekmidas/events": "~10.0.0-alpha.17",
-	"@geekmidas/logger": "~10.0.0-alpha.17",
-	"@geekmidas/manifest": "~10.0.0-alpha.17",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.17",
-	"@geekmidas/schema": "~10.0.0-alpha.17",
-	"@geekmidas/services": "~10.0.0-alpha.17",
-	"@geekmidas/storage": "~10.0.0-alpha.17",
-	"@geekmidas/studio": "~10.0.0-alpha.17",
-	"@geekmidas/telescope": "~10.0.0-alpha.17",
-	"@geekmidas/testkit": "~10.0.0-alpha.17",
+	"@geekmidas/audit": "~10.0.0-alpha.19",
+	"@geekmidas/auth": "~10.0.0-alpha.19",
+	"@geekmidas/cache": "~10.0.0-alpha.19",
+	"@geekmidas/client": "~10.0.0-alpha.19",
+	"@geekmidas/cloud": "~10.0.0-alpha.19",
+	"@geekmidas/constructs": "~10.0.0-alpha.19",
+	"@geekmidas/db": "~10.0.0-alpha.19",
+	"@geekmidas/emailkit": "~10.0.0-alpha.19",
+	"@geekmidas/envkit": "~10.0.0-alpha.19",
+	"@geekmidas/errors": "~10.0.0-alpha.19",
+	"@geekmidas/events": "~10.0.0-alpha.19",
+	"@geekmidas/logger": "~10.0.0-alpha.19",
+	"@geekmidas/manifest": "~10.0.0-alpha.19",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.19",
+	"@geekmidas/schema": "~10.0.0-alpha.19",
+	"@geekmidas/services": "~10.0.0-alpha.19",
+	"@geekmidas/storage": "~10.0.0-alpha.19",
+	"@geekmidas/studio": "~10.0.0-alpha.19",
+	"@geekmidas/telescope": "~10.0.0-alpha.19",
+	"@geekmidas/testkit": "~10.0.0-alpha.19",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -10749,7 +10774,7 @@ import { authService, type Session } from './services/auth.ts';
  * this router. Depend on other constructs per endpoint with \`.dependsOn([…])\`.` : `
  * Depend on constructs per endpoint with \`.dependsOn([…])\`.`}
  */
-export const router = api.endpoints${options.constructs.database ? ".database(database)" : ""};
+export const router = api${options.constructs.database ? ".database(database)" : ""};
 
 // The auth client available, but the session not enforced.
 export const r = router.services([authService]);
@@ -10795,7 +10820,7 @@ import { database } from '${constructsImport("database")}';` : ""}
  * this router. Depend on other constructs per endpoint with \`.dependsOn([…])\`.` : `
  * Depend on constructs per endpoint with \`.dependsOn([…])\`.`}
  */
-export const router = api.endpoints${options.constructs.database ? ".database(database)" : ""};
+export const router = api${options.constructs.database ? ".database(database)" : ""};
 `
 		});
 		if (options.constructs.database && declares) files.push(...databaseFiles());
@@ -11678,10 +11703,9 @@ function generateSourceFiles(options, template) {
 function generateTestFiles(options, _template) {
 	if (!options.constructs.database) return [];
 	const db = databaseFor();
-	const declares = !options.monorepo;
-	const schema = declares ? "../src/constructs/database.ts" : "~/services/database.ts";
-	const runtimeUrl = declares ? db.urlKey : "DATABASE_URL";
-	const ownerUrl = declares ? db.ownerUrlKey : "DATABASE_URL";
+	const schema = !options.monorepo ? "../src/constructs/database.ts" : "~/services/database.ts";
+	const runtimeUrl = db.urlKey;
+	const ownerUrl = db.ownerUrlKey;
 	return [
 		{
 			path: "kysely.config.ts",
@@ -15040,7 +15064,6 @@ function createFreshWorkspaceSecrets(stage, workspace, containers = []) {
 	const secrets = createStageSecrets(stage, serviceNames, { projectName: workspace.name });
 	if (Object.keys(workspace.apps).length > 1) secrets.custom = generateFullstackCustomSecrets(workspace, containers);
 	else secrets.custom = {
-		NODE_ENV: "development",
 		PORT: "3000",
 		LOG_LEVEL: "debug",
 		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
@@ -15738,7 +15761,7 @@ program.command("secrets:push").description("Send a deployed stage's secrets to
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pushStageSecrets } = await import("./transfer-4A4S2hcw.mjs").then((n) => n.i);
+		const { pushStageSecrets } = await import("./transfer-DjFZRgub.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pushStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -15753,7 +15776,7 @@ program.command("secrets:pull").description("Bring a deployed stage's secrets fr
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { pullStageSecrets } = await import("./transfer-4A4S2hcw.mjs").then((n) => n.i);
+		const { pullStageSecrets } = await import("./transfer-DjFZRgub.mjs").then((n) => n.i);
 		const { workspace } = await loadWorkspaceConfig();
 		const { addedKeys } = await pullStageSecrets(workspace, options.stage, { profile: options.profile });
 		for (const key of addedKeys) console.log(`  + ${key} (reconciled)`);
@@ -15768,7 +15791,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
 		const { loadWorkspaceConfig } = await import("./config.mjs");
-		const { reconcileMissingSecrets } = await import("./reconcile-fmoluZmZ.mjs").then((n) => n.n);
+		const { reconcileMissingSecrets } = await import("./reconcile-gb1lz1Dk.mjs").then((n) => n.n);
 		const { readStageSecrets, writeStageSecrets } = await import("./storage-TP0x118M.mjs").then((n) => n.a);
 		const { workspace } = await loadWorkspaceConfig();
 		const stage = options.stage ?? workspace.stages.local;
@@ -15777,7 +15800,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./credentials-fJP5-fa1.mjs").then((n) => n.h);
+		const { derivedContainers } = await import("./credentials-lbv-j0Be.mjs").then((n) => n.h);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);
@@ -15836,7 +15859,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-CAfKyYPN.mjs");
+		const { deployGithubCommand } = await import("./github-DW3CP-4D.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		console.error(formatError(error));