@geekmidas/cli 9.0.2 → 10.0.0-alpha.1

package/src/setup/index.ts

@@ -1,411 +0,0 @@
-import { existsSync } from 'node:fs';
-import { join } from 'node:path';
-import prompts from 'prompts';
-import { loadWorkspaceConfig } from '../config.js';
-import {
-	resolveServicePorts,
-	startWorkspaceServices,
-} from '../credentials/index.js';
-import {
-	createStageSecrets,
-	generateConnectionUrls,
-	generateLocalStackCredentials,
-	generateSecurePassword,
-	generateServiceCredentials,
-} from '../secrets/generator.js';
-import {
-	readStageSecrets,
-	secretsExist,
-	writeStageSecrets,
-} from '../secrets/storage.js';
-import { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';
-import type { StageSecrets } from '../secrets/types.js';
-import type { ComposeServiceName } from '../types.js';
-import type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';
-import {
-	generateFullstackCustomSecrets,
-	writeDockerEnvFromSecrets,
-} from './fullstack-secrets.js';
-
-const logger = console;
-
-export interface SetupOptions {
-	stage?: string;
-	force?: boolean;
-	skipDocker?: boolean;
-	yes?: boolean;
-}
-
-/**
- * Setup development environment.
- *
- * Orchestrates:
- * 1. Load workspace config
- * 2. Resolve secrets (local → SSM → generate fresh)
- * 3. Write docker/.env from secrets
- * 4. Start Docker services
- */
-export async function setupCommand(options: SetupOptions = {}): Promise<void> {
-	const stage = options.stage ?? 'development';
-
-	logger.log('\n🔧 Setting up development environment...\n');
-
-	// 1. Load workspace config
-	let loadedConfig: LoadedConfig;
-	try {
-		loadedConfig = await loadWorkspaceConfig();
-	} catch {
-		logger.error(
-			'❌ No gkm.config.ts found. Run this command from a workspace root.',
-		);
-		process.exit(1);
-	}
-
-	const { workspace } = loadedConfig;
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-
-	logger.log(`📦 Workspace: ${workspace.name}`);
-	logger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);
-	logger.log(`🔑 Stage: ${stage}\n`);
-
-	// 2. Resolve secrets
-	const secrets = await resolveSecrets(stage, workspace, options);
-
-	if (!secrets) {
-		logger.error('❌ Failed to resolve secrets. Exiting.');
-		process.exit(1);
-	}
-
-	// 3. Write docker/.env from secrets (always regenerated as derived file)
-	if (isMultiApp && workspace.services.db) {
-		await writeDockerEnvFromSecrets(secrets, workspace.root);
-		logger.log('📄 Generated docker/.env with database passwords');
-	}
-
-	// 4. Start Docker services with resolved ports
-	if (!options.skipDocker) {
-		const composeFile = join(workspace.root, 'docker-compose.yml');
-		if (existsSync(composeFile)) {
-			logger.log('');
-			const resolvedPorts = await resolveServicePorts(workspace.root);
-			await startWorkspaceServices(workspace, resolvedPorts.dockerEnv);
-		} else {
-			logger.log('⚠️  No docker-compose.yml found. Skipping Docker services.');
-		}
-	}
-
-	// Print summary
-	printSummary(workspace, stage);
-}
-
-/**
- * Resolve secrets with priority:
- * 1. Local secrets exist → use them (preserves manual additions)
- * 2. SSM configured and has secrets → pull and use
- * 3. Neither → generate fresh secrets
- *
- * --force skips checks 1 and 2 and always regenerates.
- */
-async function resolveSecrets(
-	stage: string,
-	workspace: NormalizedWorkspace,
-	options: SetupOptions,
-) {
-	// Force regeneration
-	if (options.force) {
-		logger.log('🔐 Generating fresh secrets (--force)...');
-		return generateFreshSecrets(stage, workspace, options);
-	}
-
-	// Check local secrets first
-	if (secretsExist(stage, workspace.root)) {
-		logger.log('🔐 Using existing local secrets');
-		const secrets = await readStageSecrets(stage, workspace.root);
-		if (secrets) {
-			// Reconcile: add any missing workspace-derived keys without overwriting
-			const reconciled = reconcileSecrets(secrets, workspace);
-			if (reconciled) {
-				await writeStageSecrets(reconciled, workspace.root);
-			}
-			return reconciled ?? secrets;
-		}
-	}
-
-	// Try SSM pull if configured
-	if (isSSMConfigured(workspace)) {
-		logger.log('☁️  Checking for remote secrets in SSM...');
-		try {
-			const remoteSecrets = await pullSecrets(stage, workspace);
-			if (remoteSecrets) {
-				logger.log('✅ Pulled secrets from SSM');
-				await writeStageSecrets(remoteSecrets, workspace.root);
-				return remoteSecrets;
-			}
-			logger.log('   No remote secrets found');
-		} catch (error) {
-			logger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);
-		}
-	}
-
-	// Generate fresh secrets
-	logger.log('🔐 Generating fresh development secrets...');
-	return generateFreshSecrets(stage, workspace, options);
-}
-
-/**
- * Reconcile existing secrets with expected workspace-derived keys.
- * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.
- * Returns the updated secrets if changes were made, or null if no changes needed.
- * @internal Exported for testing
- */
-export function reconcileSecrets(
-	secrets: StageSecrets,
-	workspace: NormalizedWorkspace,
-): StageSecrets | null {
-	let changed = false;
-	let result = { ...secrets };
-
-	// Reconcile service credentials: add missing services
-	const serviceMap: {
-		key: keyof typeof workspace.services;
-		name: ComposeServiceName;
-	}[] = [
-		{ key: 'db', name: 'postgres' },
-		{ key: 'cache', name: 'redis' },
-		{ key: 'storage', name: 'minio' },
-		{ key: 'mail', name: 'mailpit' },
-	];
-
-	for (const { key, name } of serviceMap) {
-		if (workspace.services[key] && !result.services[name]) {
-			const creds = generateServiceCredentials(name);
-			// Override defaults with project-derived names
-			if (name === 'minio') {
-				creds.bucket = workspace.name;
-				creds.username = workspace.name;
-			}
-			result = {
-				...result,
-				services: { ...result.services, [name]: creds },
-			};
-			result.urls = generateConnectionUrls(
-				result.services,
-				result.eventsBackend,
-			);
-			logger.log(`   🔄 Adding missing service credentials: ${name}`);
-			changed = true;
-		}
-	}
-
-	// Always add pgboss credentials when postgres is available
-	if (result.services.postgres && !result.services.pgboss) {
-		result = {
-			...result,
-			services: {
-				...result.services,
-				pgboss: {
-					host: result.services.postgres.host,
-					port: result.services.postgres.port,
-					username: 'pgboss',
-					password: generateSecurePassword(),
-					database: result.services.postgres.database ?? 'app',
-				},
-			},
-		};
-		result.urls = generateConnectionUrls(result.services, result.eventsBackend);
-		logger.log('   🔄 Adding missing service credentials: pgboss');
-		changed = true;
-	}
-
-	// Reconcile events backend
-	const eventsBackend = workspace.services.events;
-	if (eventsBackend && result.eventsBackend !== eventsBackend) {
-		result.eventsBackend = eventsBackend;
-
-		// Add localstack credentials if needed
-		if (eventsBackend === 'sns' && !result.services.localstack) {
-			result = {
-				...result,
-				services: {
-					...result.services,
-					localstack: generateLocalStackCredentials(),
-				},
-			};
-			logger.log('   🔄 Adding missing service credentials: localstack');
-			changed = true;
-		}
-
-		// Add rabbitmq credentials if needed (for rabbitmq events)
-		if (eventsBackend === 'rabbitmq' && !result.services.rabbitmq) {
-			result = {
-				...result,
-				services: {
-					...result.services,
-					rabbitmq: generateServiceCredentials('rabbitmq'),
-				},
-			};
-			logger.log('   🔄 Adding missing service credentials: rabbitmq');
-			changed = true;
-		}
-
-		// Regenerate URLs with new events backend
-		result.urls = generateConnectionUrls(result.services, eventsBackend);
-		changed = true;
-	}
-
-	// Reconcile custom secrets for multi-app workspaces
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (isMultiApp) {
-		const expected = generateFullstackCustomSecrets(workspace);
-		const missing: Record<string, string> = {};
-
-		for (const [key, value] of Object.entries(expected)) {
-			if (!(key in result.custom)) {
-				missing[key] = value;
-			}
-		}
-
-		if (Object.keys(missing).length > 0) {
-			logger.log(
-				`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,
-			);
-			result = {
-				...result,
-				custom: { ...result.custom, ...missing },
-			};
-			changed = true;
-		}
-	}
-
-	if (!changed) {
-		return null;
-	}
-
-	return {
-		...result,
-		updatedAt: new Date().toISOString(),
-	};
-}
-
-/**
- * Build a fresh StageSecrets object for a workspace: service credentials,
- * connection URLs, and custom secrets. Pure — does not write to disk or touch
- * SSM. Service passwords are freshly randomized, so the result must be the same
- * one used to start the matching Docker containers.
- * @internal Exported for reuse by `gkm test` auto-setup.
- */
-export function createFreshWorkspaceSecrets(
-	stage: string,
-	workspace: NormalizedWorkspace,
-): StageSecrets {
-	// Determine services from workspace config
-	const serviceNames: ComposeServiceName[] = [];
-	if (workspace.services.db) serviceNames.push('postgres');
-	if (workspace.services.cache) serviceNames.push('redis');
-	if (workspace.services.storage) serviceNames.push('minio');
-	if (workspace.services.mail) serviceNames.push('mailpit');
-	if (workspace.services.events === 'sns') serviceNames.push('localstack');
-	if (workspace.services.events === 'rabbitmq') serviceNames.push('rabbitmq');
-
-	// Create base secrets with service credentials
-	const secrets = createStageSecrets(stage, serviceNames, {
-		projectName: workspace.name,
-		eventsBackend: workspace.services.events,
-	});
-
-	// Generate fullstack-aware custom secrets
-	const isMultiApp = Object.keys(workspace.apps).length > 1;
-	if (isMultiApp) {
-		secrets.custom = generateFullstackCustomSecrets(workspace);
-	} else {
-		secrets.custom = {
-			NODE_ENV: 'development',
-			PORT: '3000',
-			LOG_LEVEL: 'debug',
-			JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-		};
-	}
-
-	return secrets;
-}
-
-/**
- * Ensure a usable secret set exists for a stage, generating a fresh one from the
- * workspace config when none is present. No-op if secrets already exist.
- *
- * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a
- * committed secrets file or a shared encryption key — the stage is regenerated
- * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.
- *
- * @returns true if fresh secrets were generated, false if existing ones were kept
- */
-export async function ensureStageSecrets(
-	stage: string,
-	cwd: string = process.cwd(),
-): Promise<boolean> {
-	const { workspace } = await loadWorkspaceConfig(cwd);
-
-	if (secretsExist(stage, workspace.root)) {
-		return false;
-	}
-
-	const secrets = createFreshWorkspaceSecrets(stage, workspace);
-	await writeStageSecrets(secrets, workspace.root);
-	return true;
-}
-
-/**
- * Generate fresh secrets for the workspace.
- */
-async function generateFreshSecrets(
-	stage: string,
-	workspace: NormalizedWorkspace,
-	options: SetupOptions,
-) {
-	const secrets = createFreshWorkspaceSecrets(stage, workspace);
-
-	// Write secrets
-	await writeStageSecrets(secrets, workspace.root);
-	logger.log(`   Secrets written to .gkm/secrets/${stage}.json`);
-
-	// Offer to push to SSM if configured
-	if (isSSMConfigured(workspace) && !options.yes) {
-		const { shouldPush } = await prompts({
-			type: 'confirm',
-			name: 'shouldPush',
-			message: 'Push secrets to SSM for team sharing?',
-			initial: true,
-		});
-
-		if (shouldPush) {
-			try {
-				await pushSecrets(stage, workspace);
-				logger.log('☁️  Secrets pushed to SSM');
-			} catch (error) {
-				logger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);
-			}
-		}
-	}
-
-	return secrets;
-}
-
-/**
- * Print setup summary with next steps.
- */
-function printSummary(workspace: NormalizedWorkspace, stage: string): void {
-	logger.log(`\n${'─'.repeat(50)}`);
-	logger.log('\n✅ Development environment ready!\n');
-
-	logger.log('📋 Apps:');
-	for (const [name, app] of Object.entries(workspace.apps)) {
-		const icon =
-			app.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';
-		logger.log(`   ${icon} ${name} → http://localhost:${app.port}`);
-	}
-
-	logger.log('\n🚀 Next steps:');
-	logger.log('   gkm dev                    # Start all apps');
-	logger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);
-	logger.log('');
-}

package/src/test/__tests__/__fixtures__/workspace.ts

@@ -1,104 +0,0 @@
-import { normalizeWorkspace } from '../../../workspace/index';
-
-/**
- * Simulates the secrets that gkm init generates for a fullstack workspace.
- * In production these come from the encrypted store via toEmbeddableSecrets.
- */
-export function createFullstackSecrets(): Record<string, string> {
-	return {
-		NODE_ENV: 'development',
-		PORT: '3000',
-		LOG_LEVEL: 'debug',
-		JWT_SECRET: 'dev-jwt-secret',
-		// Per-app database URLs (fullstack workspace)
-		API_DATABASE_URL: 'postgresql://api:api-pass@localhost:5432/my-saas',
-		AUTH_DATABASE_URL: 'postgresql://auth:auth-pass@localhost:5432/my-saas',
-		API_DB_PASSWORD: 'api-pass',
-		AUTH_DB_PASSWORD: 'auth-pass',
-		// Auth service secrets
-		AUTH_PORT: '3002',
-		AUTH_URL: 'http://localhost:3002',
-		BETTER_AUTH_SECRET: 'better-auth-secret-123',
-		BETTER_AUTH_URL: 'http://localhost:3002',
-		BETTER_AUTH_TRUSTED_ORIGINS: 'http://localhost:3000,http://localhost:3001',
-		// Service credentials
-		POSTGRES_USER: 'api',
-		POSTGRES_PASSWORD: 'api-pass',
-		POSTGRES_DB: 'my-saas',
-		POSTGRES_HOST: 'localhost',
-		POSTGRES_PORT: '5432',
-		REDIS_PASSWORD: 'redis-pass',
-		REDIS_HOST: 'localhost',
-		REDIS_PORT: '6379',
-		// URLs
-		DATABASE_URL: 'postgresql://api:api-pass@localhost:5432/my-saas',
-		REDIS_URL: 'redis://:redis-pass@localhost:6379',
-	};
-}
-
-export function createFullstackWorkspace(): ReturnType<
-	typeof normalizeWorkspace
-> {
-	return normalizeWorkspace(
-		{
-			apps: {
-				api: {
-					type: 'backend',
-					path: 'apps/api',
-					port: 3000,
-					routes: './src/endpoints/**/*.ts',
-					dependencies: [],
-				},
-				auth: {
-					type: 'backend',
-					path: 'apps/auth',
-					port: 3002,
-					entry: './src/index.ts',
-					dependencies: [],
-				},
-				web: {
-					type: 'web',
-					path: 'apps/web',
-					port: 3001,
-					framework: 'nextjs',
-					dependencies: ['api', 'auth'],
-				},
-			},
-		},
-		'/project',
-	);
-}
-
-/**
- * Simulates what loadSecretsForApp does for a specific app:
- * maps {APP}_DATABASE_URL -> DATABASE_URL.
- */
-export function mapSecretsForApp(
-	secrets: Record<string, string>,
-	appName: string,
-): Record<string, string> {
-	const prefix = appName.toUpperCase();
-	const mapped = { ...secrets };
-	const appDbUrl = secrets[`${prefix}_DATABASE_URL`];
-	if (appDbUrl) {
-		mapped.DATABASE_URL = appDbUrl;
-	}
-	return mapped;
-}
-
-export const COMPOSE_FULL = `
-services:
-  postgres:
-    image: postgres:17
-    ports:
-      - '\${POSTGRES_HOST_PORT:-5432}:5432'
-  redis:
-    image: redis:7
-    ports:
-      - '\${REDIS_HOST_PORT:-6379}:6379'
-  mailpit:
-    image: axllent/mailpit
-    ports:
-      - '\${SMTP_PORT:-1025}:1025'
-      - '\${MAILPIT_PORT:-8025}:8025'
-`;

package/src/test/__tests__/api.spec.ts

@@ -1,199 +0,0 @@
-import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import {
-	afterAll,
-	afterEach,
-	beforeAll,
-	beforeEach,
-	describe,
-	expect,
-	it,
-	vi,
-} from 'vitest';
-import {
-	loadPortState,
-	parseComposePortMappings,
-	rewriteUrlsWithPorts,
-	savePortState,
-} from '../../dev/index';
-import { getDependencyEnvVars } from '../../workspace/index';
-import { rewriteDatabaseUrlForTests } from '../index';
-import {
-	COMPOSE_FULL,
-	createFullstackSecrets,
-	createFullstackWorkspace,
-	mapSecretsForApp,
-} from './__fixtures__/workspace';
-
-beforeAll(() => {
-	vi.spyOn(console, 'log').mockImplementation(() => {});
-});
-
-afterAll(() => {
-	vi.restoreAllMocks();
-});
-
-describe('api app context', () => {
-	let testDir: string;
-
-	beforeEach(() => {
-		testDir = join(tmpdir(), `gkm-api-test-${Date.now()}`);
-		mkdirSync(testDir, { recursive: true });
-		writeFileSync(join(testDir, 'docker-compose.yml'), COMPOSE_FULL);
-	});
-
-	afterEach(() => {
-		rmSync(testDir, { recursive: true, force: true });
-	});
-
-	it('should resolve DATABASE_URL from API_DATABASE_URL', () => {
-		const apiSecrets = mapSecretsForApp(createFullstackSecrets(), 'api');
-
-		expect(apiSecrets.DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5432/my-saas',
-		);
-		expect(apiSecrets.API_DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5432/my-saas',
-		);
-	});
-
-	it('should rewrite DATABASE_URL and REDIS_URL when ports are remapped', async () => {
-		await savePortState(testDir, {
-			POSTGRES_HOST_PORT: 5433,
-			REDIS_HOST_PORT: 6380,
-		});
-
-		let secrets = mapSecretsForApp(createFullstackSecrets(), 'api');
-
-		const mappings = parseComposePortMappings(
-			join(testDir, 'docker-compose.yml'),
-		);
-		const ports = await loadPortState(testDir);
-		secrets = rewriteUrlsWithPorts(secrets, {
-			dockerEnv: {},
-			ports,
-			mappings,
-		});
-
-		expect(secrets.DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5433/my-saas',
-		);
-		expect(secrets.API_DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5433/my-saas',
-		);
-		expect(secrets.REDIS_URL).toBe('redis://:redis-pass@localhost:6380');
-		// AUTH_URL is an app URL, not a docker service
-		expect(secrets.AUTH_URL).toBe('http://localhost:3002');
-	});
-
-	it('should rewrite only postgres when redis port unchanged', async () => {
-		await savePortState(testDir, {
-			POSTGRES_HOST_PORT: 5433,
-			REDIS_HOST_PORT: 6379,
-		});
-
-		let secrets = mapSecretsForApp(createFullstackSecrets(), 'api');
-
-		const mappings = parseComposePortMappings(
-			join(testDir, 'docker-compose.yml'),
-		);
-		const ports = await loadPortState(testDir);
-		secrets = rewriteUrlsWithPorts(secrets, {
-			dockerEnv: {},
-			ports,
-			mappings,
-		});
-
-		expect(secrets.DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5433/my-saas',
-		);
-		// Redis port unchanged — URL stays the same
-		expect(secrets.REDIS_URL).toBe('redis://:redis-pass@localhost:6379');
-	});
-
-	it('should apply full pipeline for gkm test in api context', async () => {
-		await savePortState(testDir, {
-			POSTGRES_HOST_PORT: 5433,
-			REDIS_HOST_PORT: 6380,
-		});
-
-		let secrets = mapSecretsForApp(createFullstackSecrets(), 'api');
-
-		const mappings = parseComposePortMappings(
-			join(testDir, 'docker-compose.yml'),
-		);
-		const ports = await loadPortState(testDir);
-		secrets = rewriteUrlsWithPorts(secrets, {
-			dockerEnv: {},
-			ports,
-			mappings,
-		});
-		secrets = rewriteDatabaseUrlForTests(secrets);
-
-		// Port rewrite + _test suffix
-		expect(secrets.DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5433/my-saas_test',
-		);
-		expect(secrets.API_DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5433/my-saas_test',
-		);
-		// AUTH_DATABASE_URL also gets both rewrites
-		expect(secrets.AUTH_DATABASE_URL).toBe(
-			'postgresql://auth:auth-pass@localhost:5433/my-saas_test',
-		);
-		// Non-database URLs unaffected
-		expect(secrets.REDIS_URL).toBe('redis://:redis-pass@localhost:6380');
-		expect(secrets.AUTH_URL).toBe('http://localhost:3002');
-	});
-
-	it('should use default ports when no port state saved', async () => {
-		let secrets = mapSecretsForApp(createFullstackSecrets(), 'api');
-
-		const mappings = parseComposePortMappings(
-			join(testDir, 'docker-compose.yml'),
-		);
-		const ports = await loadPortState(testDir);
-
-		if (Object.keys(ports).length > 0) {
-			secrets = rewriteUrlsWithPorts(secrets, {
-				dockerEnv: {},
-				ports,
-				mappings,
-			});
-		}
-		secrets = rewriteDatabaseUrlForTests(secrets);
-
-		expect(secrets.DATABASE_URL).toBe(
-			'postgresql://api:api-pass@localhost:5432/my-saas_test',
-		);
-		expect(secrets.REDIS_URL).toBe('redis://:redis-pass@localhost:6379');
-	});
-
-	it('should not inject dependency URLs for api app (no dependencies)', () => {
-		const workspace = createFullstackWorkspace();
-		const depEnv = getDependencyEnvVars(workspace, 'api');
-
-		expect(depEnv).toEqual({});
-	});
-
-	it('should keep BETTER_AUTH vars available for api to call auth service', async () => {
-		await savePortState(testDir, { POSTGRES_HOST_PORT: 5433 });
-
-		let secrets = mapSecretsForApp(createFullstackSecrets(), 'api');
-
-		const mappings = parseComposePortMappings(
-			join(testDir, 'docker-compose.yml'),
-		);
-		const ports = await loadPortState(testDir);
-		secrets = rewriteUrlsWithPorts(secrets, {
-			dockerEnv: {},
-			ports,
-			mappings,
-		});
-
-		// API app may need AUTH_URL to call auth service internally
-		expect(secrets.AUTH_URL).toBe('http://localhost:3002');
-		expect(secrets.BETTER_AUTH_URL).toBe('http://localhost:3002');
-	});
-});