@groundfloorcloud/cli 0.1.2 → 0.1.4

package/README.md

@@ -54,15 +54,28 @@ curl -H "Authorization: Bearer $(gf token)" \
 create if needed, upload a version, wait for the build, deploy, poll until
 complete, and print IDs and the URL.
 
-Do not create an App just to run a function, job, schedule, or service.
-Use `gf deploy`. Bind `--app-id` only when the coderunner should be a helper
-of an existing product App.
+Do not create an App just to run a function, job, schedule, or service
+(Deployment). Use `gf deploy`. Bind `--app-id` only when the coderunner should
+be a helper of an existing product App.
+
+**Before the first create:** enable workspace Authentication (Administer →
+Authentication, mode `groundfloor` or `external`) until the realm is active.
+
+### Workload types
+
+| `--workload-type` | Also called | Package notes |
+|-------------------|-------------|---------------|
+| `function` | Function | HTTP on `PORT`/8080. Node needs `scripts.start`. |
+| `job` | Background job | Run-to-completion. Then `gf coderunner run`. |
+| `schedule` | Scheduled job | Cron. No public URL. |
+| `service` | **Deployment** | Long-running HTTP. **Root `Dockerfile` is required.** |
 
 ```bash
 gf deploy
 gf deploy --git https://github.com/me/my-fn.git --ref main
 gf deploy --name my-fn --runtime python --cpu 250m --memory 256Mi \
   -e API_KEY=secret
+gf deploy --workload-type service
 gf deploy --app-id <app-uuid>
 ```
 
@@ -75,6 +88,19 @@ How the target is chosen:
 
 Runtime is auto-detected when omitted (`package.json` → node,
 `requirements.txt` / `pyproject.toml` → python), defaulting to python.
+Node images run `npm start` — add `"scripts": { "start": "node index.js" }`.
+
+### Local with live data
+
+```bash
+eval "$(gf env)"
+export PORT=8080
+npm start
+curl -sS -H "Authorization: Bearer $(gf token)" \
+  "$CONTROLPLANE_URL/v1/workspaces/$GROUNDFLOOR_WORKSPACE_ID/vault/collections"
+```
+
+Then `gf deploy` the same tree. Do not zip `.env` files.
 
 ### `groundfloor.json`
 
@@ -98,7 +124,7 @@ Runtime is auto-detected when omitted (`package.json` → node,
 | `--git <url>` / `--ref <ref>` | Clone and deploy a remote repo. |
 | `--subdir <dir>` | Package a subdirectory of the source. |
 | `--runtime <r>` | `python` \| `node` \| `dotnet-script`. |
-| `--workload-type <t>` | `function` \| `service` \| `job` \| `schedule`. |
+| `--workload-type <t>` | `function` \| `service` (Deployment) \| `job` \| `schedule`. Service requires a Dockerfile. |
 | `--cpu` / `--memory` | Resource requests, e.g. `250m` / `256Mi`. |
 | `-e, --env KEY=VALUE` | Deployment env var (repeatable). |
 | `-m, --message <text>` | Version description. |
@@ -126,11 +152,12 @@ gf apps publish --path release.zip
 (`/downloads/shell-starter-kit.zip` on the current cell) and stamps
 `APP_ID` / `groundfloor.manifest.json` `appId` to the slug.
 
-`gf apps publish` uploads `release.zip` (or `remoteEntry.js`), flattens a
-Vite `dist/assets/` layout so chunks sit next to `remoteEntry.js`, finalizes
-the release, and by default PATCHes the Portal manifest from
-`groundfloor.manifest.json` next to the bundle. Pass an app id/slug, or set
-`appId` in that manifest. Prefer `npm run release` over zipping `dist/` by hand.
+`gf apps publish` uploads **only** `release.zip` from `npm run release`.
+It flattens a Vite `dist/assets/` layout when needed, then **rejects** a zip
+that is only `remoteEntry.js` (missing `__federation_*.js` / CSS) or whose
+federation `name` does not match `federationRemoteName(slug)`. A lone
+`.js` file is also rejected. Pass an app id/slug, or set `appId` in
+`groundfloor.manifest.json` next to the zip.
 
 Wrap an existing **service** coderunner as a product:
 

package/dist/index.js

@@ -1239,6 +1239,33 @@ async function deployCommand(opts) {
         `Invalid workload type "${workloadType}" (expected: ${[...WORKLOAD_TYPES].join(", ")}).`
       );
     }
+    if (workloadType === "service") {
+      try {
+        await fs3.access(path3.join(pkg.sourceDir, "Dockerfile"));
+      } catch {
+        throw new Error(
+          'workload type "service" (also called Deployment) requires a Dockerfile at the project root.'
+        );
+      }
+    }
+    if (runtime === "node") {
+      try {
+        const raw = await fs3.readFile(
+          path3.join(pkg.sourceDir, "package.json"),
+          "utf8"
+        );
+        const npm = JSON.parse(raw);
+        if (!npm.scripts?.start?.trim()) {
+          throw new Error(
+            'Node Coderunner packages require package.json "scripts.start" (runtime CMD is npm start).'
+          );
+        }
+      } catch (err) {
+        if (err instanceof Error && err.message.includes("scripts.start")) {
+          throw err;
+        }
+      }
+    }
     let coderunnerId = opts.coderunner;
     if (!coderunnerId) {
       const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path3.basename(path3.resolve(opts.path ?? process.cwd())));
@@ -1783,8 +1810,80 @@ function flattenFederatedReleaseZip(bytes) {
   }
   return zip.toBuffer();
 }
-function federatedReleaseZipHint() {
-  return "Run `npm run release` in a kit from `gf apps init --slug <portal-slug>` (do not zip Vite dist/ or dist/assets/ by hand).";
+function federatedReleaseZipHint(slug) {
+  return `Run \`npm run release\` in a kit from \`gf apps init\`, then publish that zip (do not zip Vite dist/ or upload only remoteEntry.js). ${initThenPublishHint(slug)}`;
+}
+function federationRemoteName(appId) {
+  const sanitized = appId.replace(/[^a-zA-Z0-9_$]/g, "_");
+  return sanitized.length > 0 ? sanitized : "federatedApp";
+}
+function initThenPublishHint(slug) {
+  const s = (slug ?? "").trim() || "<portal-slug>";
+  return `gf apps init --slug ${s} && cd ${s} && npm install && npm run release && gf apps publish --path release.zip`;
+}
+function extractReferencedSiblings(remoteEntrySource) {
+  const names = /* @__PURE__ */ new Set();
+  for (const match of remoteEntrySource.matchAll(
+    /["']\.\/([^"'/]+\.(?:js|mjs|cjs|css))["']/g
+  )) {
+    if (match[1] !== REMOTE_ENTRY) names.add(match[1]);
+  }
+  for (const match of remoteEntrySource.matchAll(
+    /["']([A-Za-z0-9._-]+\.css)["']/g
+  )) {
+    names.add(match[1]);
+  }
+  return [...names];
+}
+function extractFederationScope(remoteEntrySource) {
+  return remoteEntrySource.match(/css__([A-Za-z0-9_-]+)__/)?.[1];
+}
+function zipRootNames(bytes) {
+  const zip = new AdmZip2(bytes);
+  return zip.getEntries().filter((entry) => !entry.isDirectory).map((entry) => normalizeZipEntryName(entry.entryName));
+}
+function readZipFile(bytes, rel) {
+  const zip = new AdmZip2(bytes);
+  const entry = zip.getEntries().find((item) => {
+    if (item.isDirectory) return false;
+    return normalizeZipEntryName(item.entryName) === rel;
+  });
+  return entry ? entry.getData().toString("utf8") : void 0;
+}
+function assertFederatedReleaseZip(bytes, slug) {
+  const hint = initThenPublishHint(slug);
+  const names = zipRootNames(bytes);
+  const present = new Set(names.map((name) => basename(name)));
+  const entryRel = chooseRemoteEntry(names);
+  if (!entryRel) {
+    throw new Error(`Zip has no remoteEntry.js. ${hint}`);
+  }
+  const source = readZipFile(bytes, entryRel);
+  if (!source) {
+    throw new Error(`Zip has no remoteEntry.js. ${hint}`);
+  }
+  const siblings = extractReferencedSiblings(source);
+  const missing = siblings.filter((name) => !present.has(name));
+  const jsOrCssAtRoot = names.filter((name) => {
+    if (name.includes("/")) return false;
+    const lower = name.toLowerCase();
+    return lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".css");
+  });
+  if (missing.length > 0 || siblings.length === 0 && jsOrCssAtRoot.length < 2) {
+    const detail = missing.length > 0 ? `Missing next to remoteEntry.js: ${missing.join(", ")}.` : "Zip is only remoteEntry.js (Vite chunks were never packed).";
+    throw new Error(
+      `${detail} Do not zip dist/ or upload a lone remoteEntry.js. ${hint}`
+    );
+  }
+  const scope = extractFederationScope(source);
+  if (slug && scope) {
+    const expected = federationRemoteName(slug);
+    if (scope !== expected) {
+      throw new Error(
+        `Federation name is "${scope}" but Shell looks up "${expected}" (from slug ${slug}). Use the starter-kit vite.config (federationRemoteName). ${hint}`
+      );
+    }
+  }
 }
 
 // src/commands/apps.ts
@@ -1827,10 +1926,10 @@ function zipHasRemoteEntry(bytes) {
     return name === REMOTE_ENTRY || name.endsWith(`/${REMOTE_ENTRY}`);
   });
 }
-function prepareReleaseZip(bytes) {
+function prepareReleaseZip(bytes, slug) {
   if (!zipHasRemoteEntry(bytes)) {
     throw new Error(
-      `Zip has no remoteEntry.js. ${federatedReleaseZipHint()}`
+      `Zip has no remoteEntry.js. ${initThenPublishHint(slug)}`
     );
   }
   const flattened = flattenFederatedReleaseZip(bytes);
@@ -1840,10 +1939,11 @@ function prepareReleaseZip(bytes) {
   if (Object.keys(plan).length > 0) {
     process.stderr.write(
       `Note: flattened Vite dist/assets layout so chunks sit next to remoteEntry.js.
-Prefer: ${federatedReleaseZipHint()}
+Prefer: ${federatedReleaseZipHint(slug)}
 `
     );
   }
+  assertFederatedReleaseZip(flattened, slug);
   return flattened;
 }
 async function isDirectory(filePath) {
@@ -1942,7 +2042,8 @@ async function appsCreateCommand(opts) {
   } catch (err) {
     if (err instanceof CpError && err.status === 409) {
       throw new Error(
-        `App slug ${slug} already exists. Use \`gf apps publish ${slug}\` to ship a build.`
+        `App slug ${slug} already exists. Init the kit if you do not have it, then publish:
+  ${initThenPublishHint(slug)}`
       );
     }
     throw err;
@@ -1974,7 +2075,7 @@ async function appsPublishCommand(appRef, opts) {
     bytes = await fs5.readFile(bundlePath);
   } catch {
     throw new Error(
-      `No bundle at ${bundlePath}. Run \`npm run release\` in the starter-kit, then pass --path release.zip.`
+      `No bundle at ${bundlePath}. ${initThenPublishHint()}`
     );
   }
   if (bytes.byteLength === 0) {
@@ -2000,11 +2101,14 @@ async function appsPublishCommand(appRef, opts) {
   }
   const ext = path5.extname(bundlePath).toLowerCase();
   const isZip = ext === ".zip";
-  if (isZip) {
-    bytes = prepareReleaseZip(bytes);
+  if (!isZip) {
+    throw new Error(
+      `Publish release.zip from \`npm run release\`, not a lone ${path5.basename(bundlePath)}. ` + initThenPublishHint(app.slug)
+    );
   }
-  const bundle = isZip ? "zip" : "remote_entry";
-  const contentType = isZip ? "application/zip" : "application/javascript";
+  bytes = prepareReleaseZip(bytes, app.slug);
+  const bundle = "zip";
+  const contentType = "application/zip";
   if (opts.syncManifest !== false && sibling) {
     await patchApp(cfg.apiUrl, cfg.workspaceId, app.id, {
       manifest: sibling.manifest
@@ -2274,7 +2378,7 @@ function run(fn) {
 var program = new Command();
 program.name("gf").description(
   "Groundfloor CLI \u2014 sign in, deploy coderunners, publish Shell apps, and manage workspace resources."
-).version("0.1.1");
+).version("0.1.4");
 program.command("login").description(
   "Log in via the browser (production by default; --dev / --stage for other cells)"
 ).option("--dev", "Sign in to Groundfloor dev").option("--stage", "Sign in to Groundfloor stage").option(
@@ -2371,10 +2475,10 @@ apps.command("create").description("Register a Shell federated or standalone pro
   "Path to groundfloor.manifest.json (Shell apps)"
 ).option("--json", "Output raw JSON").action((opts) => run(() => appsCreateCommand(opts)));
 apps.command("publish [appId]").description(
-  "Upload release.zip (or remoteEntry.js) and publish a Shell app"
+  "Upload release.zip from npm run release (not a lone remoteEntry.js)"
 ).option("-w, --workspace <id>", "Workspace id override").option("--app <id|slug>", "App id or slug (else manifest appId)").option(
   "-p, --path <file>",
-  "release.zip, remoteEntry.js, or a folder containing release.zip",
+  "release.zip from npm run release (or a folder containing it)",
   "release.zip"
 ).option("-m, --label <text>", "Optional release label").option(
   "--no-sync-manifest",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Groundfloor gf CLI — sign in, deploy coderunners, publish Shell apps, and manage secrets, files, and Dataplane.",
   "type": "module",
   "bin": {