@geekmidas/cli 10.0.0-alpha.35 → 10.0.0-alpha.37

package/dist/index.mjs

@@ -4,7 +4,7 @@ import { c as isPartitionedRoutes, i as ConstructGenerator, t as discover } from
 import { a as loadConfig, c as parseModuleConfig, i as loadAppConfig, l as appKey, r as getAppNameFromCwd, s as loadWorkspaceConfig, u as derivedApps } from "./config-Dss1WwtH.mjs";
 import { D as assertDeployedStage, E as TEST_STAGE, O as deployedProblems, T as InvalidStages, a as getAppBuildOrder, b as getDeployTargetError, k as stageProblems, m as stripPublicPrefix, o as getAppGkmConfig, p as getPublicEnvPrefix, t as allConstructGlobs, x as isDeployTargetSupported } from "./workspace-CsL76tpc.mjs";
 import { c as getKeyPath, i as setCustomSecret, n as readStageSecrets, o as toEmbeddableSecrets, r as secretsExist, s as writeStageSecrets, t as maskPassword } from "./storage-BjTLjDDp.mjs";
-import { _ as findAvailablePort, b as loadSecretsForApp, c as applyPostgres, d as cacheBackendFor, f as eventsBackendFor, g as createEntryWrapper, h as createCredentialsPreload, i as reconcileWorkspace, l as resourceName, m as storageBackendFor, n as constructGlobs, o as COMPOSE_PATH, p as providerOf, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as rootSite, v as isPortAvailable, x as prepareEntryCredentials, y as loadEnvFiles } from "./workspace-CIiGijNi.mjs";
+import { C as loadEnvFiles, S as isPortAvailable, T as prepareEntryCredentials, _ as providerOf, b as createEntryWrapper, c as forgetState, d as pgClient, f as resourceName, g as eventsBackendFor, h as cacheBackendFor, i as reconcileWorkspace, l as applyPostgres, m as primaryPortKey, n as constructGlobs, o as COMPOSE_PATH, p as rootSite, r as derivedContainers, s as LOCAL_CA_PATH, t as backendsOf, u as quoteIdentifier, v as storageBackendFor, w as loadSecretsForApp, x as findAvailablePort, y as createCredentialsPreload } from "./workspace-BtXCL1C8.mjs";
 import { n as EndpointGenerator, r as runtimeFor } from "./OpenApiTsGenerator-hDINScnz.mjs";
 import { generateOpenApi, openapiCommand, resolveOpenApiConfig } from "./openapi.mjs";
 import { a as writeTestHarness, i as TEST_MANIFEST_ENV, n as TEST_READY_FILE, o as cacheBackendsIn, s as driversFor, t as TEST_READY_ENV } from "./ready-D1BCiaYU.mjs";
@@ -37,7 +37,7 @@ import { Subscriber } from "@geekmidas/constructs/subscribers";
 import { Topic } from "@geekmidas/constructs/topic";
 import { lookup } from "node:dns/promises";
 //#region package.json
-var version = "10.0.0-alpha.35";
+var version = "10.0.0-alpha.37";
 //#endregion
 //#region src/auth/credentials.ts
 /**
@@ -1087,9 +1087,9 @@ async function workspaceDevCommand(workspace, options) {
 		...reconciled.env
 	};
 	if (options.migrate || options.seed) {
-		const { prepareDevDatabases } = await import("./migrate-C-D9xIbb.mjs");
+		const { prepareDevDatabases } = await import("./migrate-_2J3lFT5.mjs");
 		await prepareDevDatabases(workspace, reconciled.env, { seed: !!options.seed });
-	} else await import("./migrate-C-D9xIbb.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
+	} else await import("./migrate-_2J3lFT5.mjs").then(({ reportPendingMigrations }) => reportPendingMigrations(workspace, reconciled.env)).catch((error) => {
 		logger$10.log(`⚠️  Could not check for pending migrations: ${error instanceof Error ? error.message : String(error)}`);
 	});
 	const appUrls = {};
@@ -8798,26 +8798,26 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.35",
-	"@geekmidas/auth": "~10.0.0-alpha.35",
-	"@geekmidas/cache": "~10.0.0-alpha.35",
-	"@geekmidas/client": "~10.0.0-alpha.35",
-	"@geekmidas/cloud": "~10.0.0-alpha.35",
-	"@geekmidas/constructs": "~10.0.0-alpha.35",
-	"@geekmidas/db": "~10.0.0-alpha.35",
-	"@geekmidas/emailkit": "~10.0.0-alpha.35",
-	"@geekmidas/envkit": "~10.0.0-alpha.35",
-	"@geekmidas/errors": "~10.0.0-alpha.35",
-	"@geekmidas/events": "~10.0.0-alpha.35",
-	"@geekmidas/logger": "~10.0.0-alpha.35",
-	"@geekmidas/manifest": "~10.0.0-alpha.35",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.35",
-	"@geekmidas/schema": "~10.0.0-alpha.35",
-	"@geekmidas/services": "~10.0.0-alpha.35",
-	"@geekmidas/storage": "~10.0.0-alpha.35",
-	"@geekmidas/studio": "~10.0.0-alpha.35",
-	"@geekmidas/telescope": "~10.0.0-alpha.35",
-	"@geekmidas/testkit": "~10.0.0-alpha.35",
+	"@geekmidas/audit": "~10.0.0-alpha.37",
+	"@geekmidas/auth": "~10.0.0-alpha.37",
+	"@geekmidas/cache": "~10.0.0-alpha.37",
+	"@geekmidas/client": "~10.0.0-alpha.37",
+	"@geekmidas/cloud": "~10.0.0-alpha.37",
+	"@geekmidas/constructs": "~10.0.0-alpha.37",
+	"@geekmidas/db": "~10.0.0-alpha.37",
+	"@geekmidas/emailkit": "~10.0.0-alpha.37",
+	"@geekmidas/envkit": "~10.0.0-alpha.37",
+	"@geekmidas/errors": "~10.0.0-alpha.37",
+	"@geekmidas/events": "~10.0.0-alpha.37",
+	"@geekmidas/logger": "~10.0.0-alpha.37",
+	"@geekmidas/manifest": "~10.0.0-alpha.37",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.37",
+	"@geekmidas/schema": "~10.0.0-alpha.37",
+	"@geekmidas/services": "~10.0.0-alpha.37",
+	"@geekmidas/storage": "~10.0.0-alpha.37",
+	"@geekmidas/studio": "~10.0.0-alpha.37",
+	"@geekmidas/telescope": "~10.0.0-alpha.37",
+	"@geekmidas/testkit": "~10.0.0-alpha.37",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -9596,9 +9596,7 @@ import { EnvironmentParser } from '@geekmidas/envkit';
  * \`MobileApp\` construct's \`.dependsOn([api, auth])\` is where every value
  * here comes from, so none of it is written down.
  *
- * - \`APP_SCHEME\`: the URL scheme for this stage — \`${scheme}\` deployed,
- *   \`${scheme}-dev\` locally, so a development build and the store build on
- *   one phone never answer each other's links.
+ * - \`APP_SCHEME\`: the URL scheme — \`${scheme}\`, the same on every stage.
  * - \`EXPO_PUBLIC_API_URL\` / \`EXPO_PUBLIC_AUTH_URL\`: where the servers
  *   answer. Locally that is their own port on \`localhost\`, which
  *   \`config.ts\` points at the machine Metro was served from.
@@ -10909,7 +10907,7 @@ export const authDb = database.schema<Record<string, never>, 'AuthDb'>('AuthDb')
 	files.push(usersMigration());
 	files.push({
 		path: "constructs/auth.ts",
-		content: `import { BetterAuth } from '@geekmidas/constructs/auth';
+		content: `${frontendFramework === "expo" ? "import { expo } from '@better-auth/expo';\n" : ""}import { BetterAuth } from '@geekmidas/constructs/auth';
 import { authDb } from './database.ts';
 
 /**
@@ -10924,7 +10922,11 @@ import { authDb } from './database.ts';
 export const auth = new BetterAuth('Auth', {
   path: 'apps/auth',
   database: authDb,
-  basePath: '/api/auth',
+  basePath: '/api/auth',${frontendFramework === "expo" ? `
+  // The mobile app signs in through Better Auth's Expo plugin: it sends its
+  // scheme as the origin, and this is what reads it. The construct refuses to
+  // start without it once a MobileApp depends on this server.
+  options: { plugins: [expo()] },` : ""}
 });
 `
 	});
@@ -10963,7 +10965,7 @@ import { auth } from './auth.ts';
  * The mobile app — a construct like a site, which is what makes it an app.
  *
  * \`.dependsOn()\` is the single fact behind what a mobile app otherwise has
- * written down by hand: its API and auth URLs, its URL scheme per stage, the
+ * written down by hand: its API and auth URLs, its URL scheme, the
  * scheme in the auth server's trusted origins, Better Auth's Expo plugin, and
  * sign-in links a phone can open.
  */
@@ -15147,7 +15149,7 @@ var NoStoredSecrets = class extends Error {
 	}
 };
 async function reconcile(secrets, workspace, stage) {
-	const { derivedContainers } = await import("./workspace-CIiGijNi.mjs").then((n) => n.a);
+	const { derivedContainers } = await import("./workspace-BtXCL1C8.mjs").then((n) => n.a);
 	const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 	return result ? {
 		secrets: result.secrets,
@@ -15446,6 +15448,56 @@ function printSummary(workspace, stage) {
 	logger$1.log("");
 }
 //#endregion
+//#region src/test/teardown.ts
+/**
+* Dropping the test stage's databases when a suite ends.
+*
+* Reconcile never drops — the line it draws is at data. The test stage's data
+* is the exception: every test runs in a transaction rolled back after it, so
+* nothing in these databases is anyone's, and a database kept between runs is
+* one whose migrations already ran — an edited migration is never applied to
+* it again. So each run starts from a database it created, and drops it when
+* the suite ends: the Vitest global setup's teardown.
+*/
+/**
+* Drop the databases the last setup recorded, and forget the test stage's
+* reconcile, so the next run provisions them from nothing.
+*
+* A no-op when nothing is recorded — no run yet, or one already torn down —
+* so running it twice, or before a setup, is harmless.
+*/
+async function dropTestDatabases(cwd, root, sql = pgClient) {
+	const readyPath = join(cwd, TEST_READY_FILE);
+	const ready = await readReady(readyPath);
+	const recorded = ready?.databases;
+	if (!ready || !recorded) return [];
+	const client = sql(recorded.port);
+	for (const name of recorded.names) {
+		if (!name.endsWith(`_test`)) throw new NotATestDatabase(name);
+		await client.query(void 0, `DROP DATABASE IF EXISTS ${quoteIdentifier(name)} WITH (FORCE)`);
+	}
+	await forgetState(root, TEST_STAGE);
+	const { databases: _dropped, ...rest } = ready;
+	await writeFile(readyPath, JSON.stringify(rest, null, 2));
+	return recorded.names;
+}
+async function readReady(path) {
+	try {
+		return JSON.parse(await readFile(path, "utf-8"));
+	} catch {
+		return;
+	}
+}
+/** A name recorded for the test stage without the test stage's suffix. */
+var NotATestDatabase = class extends Error {
+	database;
+	constructor(database) {
+		super(`Refusing to drop '${database}': only the test stage's databases (named '…_${TEST_STAGE}') are dropped after a suite. Delete ${TEST_READY_FILE} if it was edited by hand.`);
+		this.database = database;
+		this.name = "NotATestDatabase";
+	}
+};
+//#endregion
 //#region src/test/index.ts
 /**
 * Run tests with secrets, dependency URLs, and .env files loaded.
@@ -15454,6 +15506,10 @@ function printSummary(workspace, stage) {
 async function testCommand(options = {}) {
 	const cwd = process.cwd();
 	const stage = options.stage ?? await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.stages.local).catch(() => void 0);
+	if (options.teardown) {
+		await teardown(cwd);
+		return;
+	}
 	if (!stage) throw new NoStageToTest();
 	console.log(`\n🧪 Running tests with ${stage} environment...\n`);
 	if (options.autoSetup || Boolean(process.env.GKM_AUTO_SETUP)) {
@@ -15462,6 +15518,7 @@ async function testCommand(options = {}) {
 	}
 	const defaultEnv = loadEnvFiles(".env");
 	if (defaultEnv.loaded.length > 0) console.log(`  📦 Loaded env: ${defaultEnv.loaded.join(", ")}`);
+	if (!options.prepare) await teardown(cwd);
 	const result = await prepareEntryCredentials({
 		stage,
 		startDocker: !options.prepare,
@@ -15502,7 +15559,8 @@ async function testCommand(options = {}) {
 	const readyPath = join(cwd, TEST_READY_FILE);
 	await writeFile(readyPath, JSON.stringify({
 		env: result.secretsJsonPath,
-		...manifestPath ? { manifest: manifestPath } : {}
+		...manifestPath ? { manifest: manifestPath } : {},
+		...testDatabases(result.reconciled)
 	}, null, 2));
 	if (options.setup) {
 		console.log(`  🧪 Test stage ready: ${TEST_READY_FILE}`);
@@ -15541,12 +15599,29 @@ async function testCommand(options = {}) {
 		});
 	});
 }
+/** Drop what the last setup created — see `dropTestDatabases`. */
+async function teardown(cwd) {
+	const dropped = await dropTestDatabases(cwd, await loadWorkspaceConfig(cwd).then((loaded) => loaded.workspace.root).catch(() => cwd));
+	if (dropped.length > 0) console.log(`  🧹 Dropped ${dropped.join(", ")}`);
+}
+/**
+* The test stage's Postgres databases, to drop when the suite ends — those
+* the plan provisions, on the port the shared container answers.
+*/
+function testDatabases(reconciled) {
+	const port = reconciled?.ports[primaryPortKey("postgres")];
+	const names = (reconciled?.plan.resources ?? []).filter((resource) => resource.kind === "database" && resource.provisions && resource.container === "postgres").map((resource) => resource.name);
+	return port !== void 0 && names.length > 0 ? { databases: {
+		port,
+		names
+	} } : {};
+}
 /**
 * Migrate the test stage just reconciled, then seed it: a test run never
 * starts without the reference data the app needs.
 */
 async function migrateTestStage(workspace, env) {
-	const { migrateAndSeed } = await import("./migrate-C-D9xIbb.mjs");
+	const { migrateAndSeed } = await import("./migrate-_2J3lFT5.mjs");
 	const { discover } = await import("./discover-CMxesskG.mjs").then((n) => n.n);
 	const sources = {};
 	const manifest = await discover({
@@ -15974,7 +16049,7 @@ program.command("exec").description("Run a command with secrets injected into Cr
 		process.exit(1);
 	}
 });
-program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
+program.command("test").description("Run tests with secrets loaded from environment").option("--stage <stage>", "Stage to load secrets from (default: stages.local)").option("--run", "Run tests once without watch mode").option("--watch", "Enable watch mode").option("--coverage", "Generate coverage report").option("--ui", "Open Vitest UI").option("--auto-setup", "Generate a fresh stage (secrets + key) from the workspace config when none exists (for CI; also via GKM_AUTO_SETUP)").option("--prepare", "Write the test manifest and #test harness, then stop — for a typecheck that runs before the suite").option("--setup", "Reconcile, migrate and seed the test stage and write the harness, then stop — what @geekmidas/cli/vitest runs").option("--teardown", "Drop the test stage's databases the last setup created, then stop — what @geekmidas/cli/vitest runs when the suite ends").argument("[pattern]", "Pattern to filter tests").action(async (pattern, options) => {
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
@@ -15991,7 +16066,7 @@ program.command("migrate").description("Apply each database construct's migratio
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrateCommand } = await import("./migrate-C-D9xIbb.mjs");
+		const { migrateCommand } = await import("./migrate-_2J3lFT5.mjs");
 		await migrateCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16005,7 +16080,7 @@ program.command("seed").description("Migrate, then run each database construct's
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { seedCommand } = await import("./migrate-C-D9xIbb.mjs");
+		const { seedCommand } = await import("./migrate-_2J3lFT5.mjs");
 		await seedCommand({
 			...options,
 			...construct ? { construct } : {}
@@ -16019,7 +16094,7 @@ program.command("migration").description("Write a construct's next migration: an
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { migrationCommand } = await import("./migrate-C-D9xIbb.mjs");
+		const { migrationCommand } = await import("./migrate-_2J3lFT5.mjs");
 		await migrationCommand({
 			construct,
 			...name ? { name } : {}
@@ -16187,7 +16262,7 @@ program.command("secrets:reconcile").description("Backfill missing custom secret
 			console.error(`No secrets found for stage "${stage}". Run "gkm secrets:init --stage ${stage}" first.`);
 			process.exit(1);
 		}
-		const { derivedContainers } = await import("./workspace-CIiGijNi.mjs").then((n) => n.a);
+		const { derivedContainers } = await import("./workspace-BtXCL1C8.mjs").then((n) => n.a);
 		const result = reconcileMissingSecrets(secrets, workspace, await derivedContainers(workspace, stage));
 		if (!result) {
 			console.log(`\n✓ Secrets for stage "${stage}" are up-to-date`);