@getmonoceros/workbench 1.38.4 → 1.38.6

package/bundled-components/services/keycloak/component.yml

@@ -50,4 +50,7 @@ usageNotes:
   - 'Paths are relative to the container root (`projects/<app>/...`); Monoceros resolves the bind source for you. Do not turn off the deferred start while mounting a repo file - the file would not exist at boot.'
   - 'Import is one-way: admin-UI changes live in the Keycloak database, not the file. To keep them, export the realm and overwrite the committed JSON.'
 briefing:
-  - text: 'Keycloak (identity & access management) runs as service `keycloak`. Reach it at `$KEYCLOAK_URL` (admin user `$KEYCLOAK_USER` / `$KEYCLOAK_PASSWORD`). Realms come from JSON files the project mounts into `/opt/keycloak/data/import`; the database is ephemeral and re-seeds from them on each apply.'
+  - text: 'Identity & access management, reached in-container as host `keycloak`. Admin console + API at `$KEYCLOAK_URL` (admin `$KEYCLOAK_USER` / `$KEYCLOAK_PASSWORD`).'
+  - text: 'Keycloak auto-imports realms at startup (`--import-realm`) from `/opt/keycloak/data/import`, and its database is ephemeral - it re-seeds from those files on every apply. So keep the realm as a file in the repo at `projects/<app>/keycloak/realm.json`; do NOT configure it by hand in the admin UI, that is lost on the next apply.'
+  - text: 'You can create/edit that realm.json, but the bind-mount that feeds it to Keycloak lives in the container yml on the host, which you cannot edit from inside. Tell the user to add this volume to the keycloak service and re-apply: `projects/<app>/keycloak/realm.json:/opt/keycloak/data/import/<app>.json:ro`, then run `monoceros apply <name>` on the host.'
+  - text: "In the realm, define a public client (e.g. `<app>-web`) with your app's redirect URIs, and have the frontend reach Keycloak same-origin under `/realms/<realm>` so the issuer follows the request host (works on `.localhost` and over `monoceros share`)."

package/dist/bin.js

@@ -2313,6 +2313,9 @@ function serviceDefersStart(name) {
 function curatedServiceExampleVolumes(name) {
   return SERVICE_CATALOG[name]?.exampleVolumes ?? [];
 }
+function curatedServiceBriefing(name) {
+  return (SERVICE_CATALOG[name]?.briefing ?? []).map((line) => line.text);
+}
 function resolveService(entry2) {
   return {
     name: entry2.name,
@@ -2474,7 +2477,8 @@ var init_catalog = __esm({
           ...svc.client ? { client: svc.client } : {},
           ...svc.command ? { command: svc.command } : {},
           ...svc.exampleVolumes ? { exampleVolumes: svc.exampleVolumes } : {},
-          ...svc.deferStart ? { deferStart: true } : {}
+          ...svc.deferStart ? { deferStart: true } : {},
+          ...c.descriptor.briefing && c.descriptor.briefing.length > 0 ? { briefing: c.descriptor.briefing } : {}
         };
         return [key, entry2];
       })
@@ -4416,6 +4420,11 @@ function generateAgentsMd(input) {
     lines.push("");
     for (const svc of input.services) {
       lines.push(formatServiceLine(svc));
+      for (const brief of curatedServiceBriefing(svc.name)) {
+        for (const sub of brief.split("\n")) {
+          lines.push(sub ? `  ${sub}` : "");
+        }
+      }
     }
     lines.push("");
     const connEnv = serviceConnectionEnv(input.services);
@@ -8996,7 +9005,7 @@ var CLI_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    CLI_VERSION = true ? "1.38.4" : "dev";
+    CLI_VERSION = true ? "1.38.6" : "dev";
   }
 });
 
@@ -12767,7 +12776,7 @@ var init_share = __esm({
       meta: {
         name: "share",
         group: "discovery",
-        description: "Expose an app's ports to the local network (phone, tablet, other devices) over HTTPS so any device can open it - reached via the host's LAN IP (or `.local` name). TLS is served with a machine-local CA; trust the printed rootCA.pem once per device for warning-free HTTPS (and a working PWA secure context). Every target in the app's launch.json that declares a port is shared. Foreground: Ctrl+C stops sharing. See ADR 0030 and 0033."
+        description: "Expose an app's ports to the local network (phone, tablet, other devices) over HTTPS so any device can open it - reached via the host's LAN IP (or `.local` name). TLS is served with a machine-local CA; trust the printed rootCA.pem once per device for warning-free HTTPS (and a working PWA secure context). Every target in the app's launch.json that declares a port is shared. Foreground: Ctrl+C stops sharing."
       },
       args: {
         name: {
@@ -13448,7 +13457,7 @@ var init_tunnel = __esm({
       meta: {
         name: "tunnel",
         group: "discovery",
-        description: "Open a TCP tunnel from the host to a service or port inside the container. Foreground process \u2014 Ctrl+C closes the tunnel. Pass a service name (e.g. `postgres`, `mysql`, `redis`) from the container yml or a bare in-container port number. See ADR 0009."
+        description: "Open a TCP tunnel from the host to a service or port inside the container. Foreground process \u2014 Ctrl+C closes the tunnel. Pass a service name (e.g. `postgres`, `mysql`, `redis`) from the container yml or a bare in-container port number."
       },
       args: {
         name: {