@groundfloorcloud/cli 0.1.9 → 0.1.10

package/README.md

@@ -147,6 +147,25 @@ wrong identity for testing Coderunner Vault/Files as the workload.
 | `-m, --message <text>` | Version description. |
 | `--skip-deploy` | Upload a new version but do not deploy it. |
 
+### What is never uploaded
+
+`gf deploy` drops credential files from the package on **both** paths — the
+plain-directory walk and the git file list (which includes untracked files that
+no `.gitignore` rule covers). Excluded by name: `.env*`, `.npmrc`, `.yarnrc*`,
+`.netrc`/`_netrc`, `.pypirc`, `.git-credentials`, `.htpasswd`, `.pgpass`,
+`.s3cfg`, `id_rsa`/`id_dsa`/`id_ecdsa`/`id_ed25519` (but not their `.pub`
+halves), `*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.jks`, `*.keystore`, `*.ppk`,
+`*.kdbx`, `*.gpg`, `*.tfstate*`, and anything under `.ssh/`, `.aws/`, `.azure/`,
+`.gcloud/`, `.gnupg/`, `.docker/`, `.kube/`, `.terraform/` or `.chef/`.
+
+Every exclusion is printed, and so is every dot-file that survived the filter.
+There is no flag to turn it off: pass values with `gf secrets` or
+`-e KEY=VALUE` instead.
+
+This is a **denylist**, so it only knows names. A secret in a file called
+`config.json`, `settings.py` or `serviceAccount.json` is still uploaded —
+check what the packaged file list says before deploying.
+
 ## Publish a Shell app
 
 Product **Apps** are packaging (Shell Module Federation remotes, or a

package/dist/index.js

@@ -2,7 +2,7 @@
 
 // src/index.ts
 import { Command } from "commander";
-import path9 from "path";
+import path10 from "path";
 
 // src/auth/store.ts
 import { promises as fs } from "fs";
@@ -555,9 +555,9 @@ async function parseError(res) {
   }
   return `${res.status} ${detail}`;
 }
-async function cpGet(apiUrl, path10) {
+async function cpGet(apiUrl, path11) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: "application/json"
@@ -568,9 +568,9 @@ async function cpGet(apiUrl, path10) {
   }
   return await res.json();
 }
-async function cpPostJson(apiUrl, path10, body) {
+async function cpPostJson(apiUrl, path11, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -584,9 +584,9 @@ async function cpPostJson(apiUrl, path10, body) {
   }
   return await res.json();
 }
-async function cpDelete(apiUrl, path10) {
+async function cpDelete(apiUrl, path11) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "DELETE",
     headers: { Authorization: `Bearer ${token}`, Accept: "application/json" }
   });
@@ -594,9 +594,9 @@ async function cpDelete(apiUrl, path10) {
     throw new CpError(res.status, await parseError(res));
   }
 }
-async function cpPutJson(apiUrl, path10, body) {
+async function cpPutJson(apiUrl, path11, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "PUT",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -610,9 +610,9 @@ async function cpPutJson(apiUrl, path10, body) {
   }
   return await res.json();
 }
-async function cpPatchJson(apiUrl, path10, body) {
+async function cpPatchJson(apiUrl, path11, body) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "PATCH",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -626,9 +626,9 @@ async function cpPatchJson(apiUrl, path10, body) {
   }
   return await res.json();
 }
-async function cpPutBytes(apiUrl, path10, body, contentType) {
+async function cpPutBytes(apiUrl, path11, body, contentType) {
   const token = await getValidAccessToken();
-  const res = await fetch(`${apiUrl}${path10}`, {
+  const res = await fetch(`${apiUrl}${path11}`, {
     method: "PUT",
     headers: {
       Authorization: `Bearer ${token}`,
@@ -760,13 +760,13 @@ function getCoderunnerStatus(apiUrl, workspaceId, coderunnerId) {
     )}/coderunners/${encodeURIComponent(coderunnerId)}/status`
   );
 }
-function runCoderunner(apiUrl, workspaceId, coderunnerId, payload) {
+function runCoderunner(apiUrl, workspaceId, coderunnerId, event = {}) {
   return cpPostJson(
     apiUrl,
     `/v1/workspaces/${encodeURIComponent(
       workspaceId
     )}/coderunners/${encodeURIComponent(coderunnerId)}/run`,
-    payload
+    event
   );
 }
 function getProcessLogs(apiUrl, workspaceId, query = {}) {
@@ -962,13 +962,49 @@ async function mintM2mToken(apiUrl, workspaceId, clientId, clientSecret) {
   }
   return await res.json();
 }
-function mintCoderunnerVaultToken(apiUrl, workspaceId, coderunnerId) {
+function mintCoderunnerVaultToken(apiUrl, workspaceId, coderunnerId, body = {}) {
   return cpPostJson(
     apiUrl,
     `${wsPath(workspaceId, `/coderunners/${encodeURIComponent(coderunnerId)}/vault-token`)}`,
-    {}
+    body
+  );
+}
+async function listWorkloadIdentities(apiUrl, workspaceId) {
+  const data = await cpGet(
+    apiUrl,
+    wsPath(workspaceId, "/workload-identities")
+  );
+  return data.identities ?? [];
+}
+function mintWorkloadIdentityVaultToken(apiUrl, workspaceId, identityId, body = {}) {
+  return cpPostJson(
+    apiUrl,
+    wsPath(
+      workspaceId,
+      `/workload-identities/${encodeURIComponent(identityId)}/vault-token`
+    ),
+    body
   );
 }
+async function controlPlaneRequest(apiUrl, method, path11, body) {
+  const token = await getValidAccessToken();
+  const res = await fetch(`${apiUrl}${path11}`, {
+    method,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/json",
+      ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    body: body !== void 0 ? JSON.stringify(body) : void 0
+  });
+  if (res.status === 204) return void 0;
+  if (!res.ok) {
+    throw new CpError(res.status, await parseError(res));
+  }
+  const text = await res.text();
+  if (!text) return void 0;
+  return JSON.parse(text);
+}
 
 // src/commands/whoami.ts
 async function whoamiCommand() {
@@ -1082,7 +1118,8 @@ async function coderunnerListCommand(opts) {
   for (const cr of coderunners) {
     const name = cr.name ?? cr.slug ?? "";
     const status = cr.status ?? "";
-    process.stdout.write(`${cr.id}  ${name}  [${status}]
+    const type = cr.workload_type ?? "function";
+    process.stdout.write(`${cr.id}  ${name}  [${type}]  [${status}]
 `);
   }
 }
@@ -1123,6 +1160,13 @@ async function vaultTokenCommand(opts) {
 `);
     return;
   }
+  if (data.refresh_secret) {
+    process.stderr.write(
+      "Save refresh_secret now; it is not shown again unless you rotate.\n"
+    );
+    process.stderr.write(`refresh_secret=${data.refresh_secret}
+`);
+  }
   process.stderr.write(
     `expires_in=${data.expires_in}s identity=${data.workload_identity_id}
 `
@@ -1399,13 +1443,13 @@ portal: ${processLogPortalUrl(
 
 // src/commands/deploy.ts
 import { promises as fs4 } from "fs";
-import path4 from "path";
+import path5 from "path";
 
 // src/deploy/package.ts
 import { execFile } from "child_process";
 import { promises as fs2 } from "fs";
 import os2 from "os";
-import path2 from "path";
+import path3 from "path";
 import { promisify } from "util";
 import AdmZip from "adm-zip";
 
@@ -1414,6 +1458,109 @@ function isGitCommitSha(ref) {
   return /^[0-9a-f]{7,40}$/i.test(ref);
 }
 
+// src/deploy/secret-files.ts
+import path2 from "path";
+var DENIED_NAMES = /* @__PURE__ */ new Set([
+  ".netrc",
+  "_netrc",
+  ".npmrc",
+  ".yarnrc",
+  ".yarnrc.yml",
+  ".pypirc",
+  ".git-credentials",
+  ".htpasswd",
+  ".htdigest",
+  ".pgpass",
+  ".dockercfg",
+  ".s3cfg",
+  ".pdbrc",
+  ".envrc",
+  ".my.cnf",
+  "my.cnf",
+  ".boto",
+  ".databrickscfg",
+  "kubeconfig",
+  "kube.config",
+  "deploy_key",
+  "deploykey",
+  "credentials",
+  "credentials.json",
+  "credentials.yaml",
+  "credentials.yml",
+  "secrets.json",
+  "secrets.yaml",
+  "secrets.yml"
+]);
+var DENIED_SEGMENTS = /* @__PURE__ */ new Set([
+  ".ssh",
+  ".aws",
+  ".azure",
+  ".gcloud",
+  ".gnupg",
+  ".docker",
+  ".kube",
+  ".terraform",
+  ".chef",
+  ".pki"
+]);
+var DENIED_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".pem",
+  ".key",
+  ".p12",
+  ".pfx",
+  ".jks",
+  ".keystore",
+  ".ppk",
+  ".kdbx",
+  ".gpg",
+  ".tfstate",
+  ".tfvars"
+]);
+var SSH_PRIVATE_KEY_RE = /^id_(rsa|dsa|ecdsa|ed25519)(_[\w.-]+)?$/;
+var BACKUP_SUFFIX_RE = /(~|\.(bak|old|orig|save|backup|swp|swo|tmp|copy))$/;
+function normaliseName(name) {
+  let out = name.toLowerCase();
+  for (let i = 0; i < 8; i++) {
+    const next = out.replace(BACKUP_SUFFIX_RE, "");
+    if (next === out) break;
+    out = next;
+  }
+  return out;
+}
+function isCredentialFile(relPath) {
+  const parts = relPath.split("/").filter(Boolean);
+  const rawName = parts[parts.length - 1] ?? "";
+  const name = normaliseName(rawName);
+  for (const segment of parts.slice(0, -1)) {
+    if (DENIED_SEGMENTS.has(segment.toLowerCase())) return true;
+  }
+  if (DENIED_SEGMENTS.has(name)) return true;
+  if (name === ".env" || name.startsWith(".env.")) return true;
+  if (DENIED_NAMES.has(name)) return true;
+  if (SSH_PRIVATE_KEY_RE.test(name)) return true;
+  if (name.endsWith(".tfvars.json") || name.endsWith(".tfstate.json")) {
+    return true;
+  }
+  if (DENIED_EXTENSIONS.has(path2.extname(name))) return true;
+  return false;
+}
+function isDotPath(relPath) {
+  return relPath.split("/").some((part) => part.startsWith("."));
+}
+function filterCredentialFiles(files2) {
+  const kept = [];
+  const excluded = [];
+  for (const rel of files2) {
+    if (isCredentialFile(rel)) excluded.push(rel);
+    else kept.push(rel);
+  }
+  return {
+    kept,
+    excluded: excluded.sort(),
+    dotfilesIncluded: kept.filter(isDotPath).sort()
+  };
+}
+
 // src/deploy/package.ts
 var exec = promisify(execFile);
 var DEFAULT_IGNORES = /* @__PURE__ */ new Set([
@@ -1453,7 +1600,7 @@ async function walkFileList(dir) {
     const entries = await fs2.readdir(current, { withFileTypes: true });
     for (const entry of entries) {
       if (DEFAULT_IGNORES.has(entry.name)) continue;
-      const abs = path2.join(current, entry.name);
+      const abs = path3.join(current, entry.name);
       const relPath = rel ? `${rel}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         await walk(abs, relPath);
@@ -1468,17 +1615,17 @@ async function walkFileList(dir) {
 async function buildZip(sourceDir, files2) {
   const zip = new AdmZip();
   for (const rel of files2) {
-    const abs = path2.join(sourceDir, rel);
+    const abs = path3.join(sourceDir, rel);
     try {
       const data = await fs2.readFile(abs);
-      zip.addFile(rel.split(path2.sep).join("/"), data);
+      zip.addFile(rel.split(path3.sep).join("/"), data);
     } catch {
     }
   }
   return zip.toBuffer();
 }
 async function cloneRepo(url, ref) {
-  const tmp = await fs2.mkdtemp(path2.join(os2.tmpdir(), "gf-deploy-"));
+  const tmp = await fs2.mkdtemp(path3.join(os2.tmpdir(), "gf-deploy-"));
   try {
     if (ref && isGitCommitSha(ref)) {
       await exec("git", ["init"], { cwd: tmp });
@@ -1509,16 +1656,27 @@ async function packageSource(opts) {
     baseDir = await cloneRepo(opts.git, opts.ref);
     cleanup = baseDir;
   } else {
-    baseDir = path2.resolve(opts.path ?? process.cwd());
+    baseDir = path3.resolve(opts.path ?? process.cwd());
+  }
+  const sourceDir = opts.subdir ? path3.resolve(baseDir, opts.subdir) : baseDir;
+  if (sourceDir !== baseDir && !sourceDir.startsWith(baseDir + path3.sep)) {
+    if (cleanup) {
+      await fs2.rm(cleanup, { recursive: true, force: true }).catch(() => {
+      });
+    }
+    throw new Error(
+      `--subdir "${opts.subdir}" resolves to ${sourceDir}, outside ${baseDir}.`
+    );
   }
-  const sourceDir = opts.subdir ? path2.join(baseDir, opts.subdir) : baseDir;
   try {
     const stat = await fs2.stat(sourceDir);
     if (!stat.isDirectory()) {
       throw new Error(`Not a directory: ${sourceDir}`);
     }
     const useGit = await isGitRepo(sourceDir);
-    const files2 = useGit ? await gitFileList(sourceDir) : await walkFileList(sourceDir);
+    const listed = useGit ? await gitFileList(sourceDir) : await walkFileList(sourceDir);
+    const filtered = filterCredentialFiles(listed);
+    const files2 = filtered.kept;
     if (files2.length === 0) {
       throw new Error(
         `No files to package in ${sourceDir} (everything ignored or empty).`
@@ -1535,7 +1693,14 @@ async function packageSource(opts) {
         gitSha = null;
       }
     }
-    return { zip, fileCount: files2.length, sourceDir, cleanup, gitSha };
+    return {
+      zip,
+      fileCount: files2.length,
+      sourceDir,
+      cleanup,
+      gitSha,
+      filtered
+    };
   } catch (err) {
     if (cleanup) {
       await fs2.rm(cleanup, { recursive: true, force: true }).catch(() => {
@@ -1546,7 +1711,7 @@ async function packageSource(opts) {
 }
 async function readProjectManifest(dir) {
   try {
-    const raw = await fs2.readFile(path2.join(dir, "groundfloor.json"), "utf8");
+    const raw = await fs2.readFile(path3.join(dir, "groundfloor.json"), "utf8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -1555,7 +1720,7 @@ async function readProjectManifest(dir) {
 async function detectRuntime(dir) {
   const has = async (name) => {
     try {
-      await fs2.access(path2.join(dir, name));
+      await fs2.access(path3.join(dir, name));
       return true;
     } catch {
       return false;
@@ -1569,7 +1734,7 @@ async function detectRuntime(dir) {
 
 // src/deploy/preflight.ts
 import { promises as fs3 } from "fs";
-import path3 from "path";
+import path4 from "path";
 var NODE_BOOTSTRAP_MISSING_START = 'Node packages without a Dockerfile use the platform bootstrap image (CMD ["npm","start"], EXPOSE 8080). Add package.json "scripts": { "start": "node <entrypoint>" }. The process must listen on process.env.PORT || 8080 and bind 0.0.0.0 (not 127.0.0.1).';
 var NODE_BOOTSTRAP_MISSING_PACKAGE = 'Node packages without a Dockerfile need package.json with "scripts.start" (bootstrap image runs `npm start` and probes 0.0.0.0:8080).';
 var NODE_DOCKERFILE_NPM_START_MISSING = 'Dockerfile runs `npm start` but package.json has no "scripts.start". Add "scripts": { "start": "node <entrypoint>" }.';
@@ -1584,10 +1749,10 @@ async function readOptional(filePath) {
   }
 }
 async function preflightNodePackage(sourceDir) {
-  const dockerfile = await readOptional(path3.join(sourceDir, "Dockerfile"));
+  const dockerfile = await readOptional(path4.join(sourceDir, "Dockerfile"));
   const needsStartScript = dockerfile == null || dockerfileRunsNpmStart(dockerfile);
   if (!needsStartScript) return;
-  const raw = await readOptional(path3.join(sourceDir, "package.json"));
+  const raw = await readOptional(path4.join(sourceDir, "package.json"));
   if (raw == null) {
     throw new Error(
       dockerfile == null ? NODE_BOOTSTRAP_MISSING_PACKAGE : NODE_DOCKERFILE_NPM_START_MISSING
@@ -1630,6 +1795,45 @@ function formatDeployTarget(input) {
   return `Deploy target: workspace=${label} cell=${cell} api=${input.apiUrl}`;
 }
 
+// src/credential-env.ts
+var CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DATABASE_URI",
+  "DATABASE_PASSWORD",
+  "DATABASE_USER",
+  "DATABASE_USERNAME",
+  "DB_URL",
+  "DB_URI",
+  "POSTGRES_URL",
+  "POSTGRES_URI",
+  "POSTGRES_PASSWORD",
+  "POSTGRES_USER",
+  "MYSQL_URL",
+  "MYSQL_PASSWORD",
+  "MONGO_URI",
+  "MONGODB_URI",
+  "MONGODB_URL"
+]);
+var CREDENTIAL_SUFFIXES = [
+  "_PASSWORD",
+  "_SECRET",
+  "_PRIVATE_KEY",
+  "_API_KEY",
+  "_ACCESS_KEY",
+  "_SECRET_KEY"
+];
+function isCredentialEnvKey(key) {
+  const cleaned = key.trim();
+  if (!cleaned) return false;
+  const upper = cleaned.toUpperCase();
+  if (CREDENTIAL_KEYS.has(upper)) return true;
+  if (upper.startsWith("MANAGED_DB_")) return true;
+  return CREDENTIAL_SUFFIXES.some((suffix) => upper.endsWith(suffix));
+}
+function credentialEnvKeys(env) {
+  return Object.keys(env).filter((key) => isCredentialEnvKey(key)).sort();
+}
+
 // src/commands/deploy.ts
 var FALLBACK_RUNTIMES = /* @__PURE__ */ new Set([
   "python",
@@ -1665,6 +1869,22 @@ function parseEnvPairs(pairs) {
 }
 var log = (msg) => process.stderr.write(`${msg}
 `);
+function names(list, max = 10) {
+  return list.length > max ? `${list.slice(0, max).join(", ")} \u2026 and ${list.length - max} more` : list.join(", ");
+}
+function reportFiltering(filtered) {
+  if (filtered.excluded.length) {
+    log(
+      `Excluded ${filtered.excluded.length} credential file(s): ${names(filtered.excluded)}`
+    );
+    log("  (use `gf secrets` or `--env KEY=VALUE` to pass values to the app)");
+  }
+  if (filtered.dotfilesIncluded.length) {
+    log(
+      `Including ${filtered.dotfilesIncluded.length} dot-file(s): ${names(filtered.dotfilesIncluded)}`
+    );
+  }
+}
 async function failDeploy(opts) {
   throw new Error(await diagnoseDeployFailure(opts));
 }
@@ -1694,7 +1914,7 @@ async function deployCommand(opts) {
     })
   );
   log(
-    opts.git ? `Cloning ${opts.git}${opts.ref ? ` (${opts.ref})` : ""}...` : `Packaging ${path4.resolve(opts.path ?? process.cwd())}...`
+    opts.git ? `Cloning ${opts.git}${opts.ref ? ` (${opts.ref})` : ""}...` : `Packaging ${path5.resolve(opts.path ?? process.cwd())}...`
   );
   const pkg = await packageSource({
     path: opts.path,
@@ -1706,6 +1926,7 @@ async function deployCommand(opts) {
     const manifest = await readProjectManifest(pkg.sourceDir) ?? {};
     const sizeKb = (pkg.zip.byteLength / 1024).toFixed(1);
     log(`Packaged ${pkg.fileCount} file(s), ${sizeKb} KB`);
+    reportFiltering(pkg.filtered);
     const detected = await detectRuntime(pkg.sourceDir);
     const runtime = opts.runtime ?? manifest.runtime ?? detected ?? "python";
     let allowedRuntimes = FALLBACK_RUNTIMES;
@@ -1729,7 +1950,7 @@ async function deployCommand(opts) {
     }
     if (workloadType === "service") {
       try {
-        await fs4.access(path4.join(pkg.sourceDir, "Dockerfile"));
+        await fs4.access(path5.join(pkg.sourceDir, "Dockerfile"));
       } catch {
         throw new Error(
           'workload type "service" (also called Deployment) requires a Dockerfile at the project root.'
@@ -1746,7 +1967,7 @@ async function deployCommand(opts) {
     });
     let coderunnerId = opts.coderunner;
     if (!coderunnerId) {
-      const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path4.basename(path4.resolve(opts.path ?? process.cwd())));
+      const name = opts.name ?? manifest.name ?? (opts.git ? nameFromGitUrl(opts.git) : path5.basename(path5.resolve(opts.path ?? process.cwd())));
       const slug = manifest.slug ?? slugify(name);
       const existing = await listCoderunners(cfg.apiUrl, ws);
       const match = existing.find((c) => c.slug === slug || c.name === name);
@@ -1760,7 +1981,8 @@ async function deployCommand(opts) {
           slug,
           runtime,
           workload_type: workloadType,
-          ...opts.appId ? { app_id: opts.appId } : {}
+          ...opts.appId ? { app_id: opts.appId } : {},
+          ...schedule ? { schedule } : {}
         });
         coderunnerId = created.id;
         log(`Created coderunner ${created.id}`);
@@ -1840,13 +2062,21 @@ async function deployCommand(opts) {
       ...manifest.env ?? {},
       ...parseEnvPairs(opts.env)
     };
+    const plaintextSecrets = credentialEnvKeys(envVariable);
+    if (plaintextSecrets.length) {
+      throw new Error(
+        `Do not pass secrets as --env: ${plaintextSecrets.join(", ")}. Store them with \`gf secrets set KEY\` and deploy with \`--secret KEY\`.`
+      );
+    }
+    const injectSecretKeys = (opts.secret ?? []).map((key) => key.trim()).filter(Boolean);
     log("Deploying...");
     const result = await deployCoderunner(cfg.apiUrl, ws, coderunnerId, {
       version_id: uploaded.version_id,
       cpu: opts.cpu ?? manifest.cpu,
       memory: opts.memory ?? manifest.memory,
       envVariable: Object.keys(envVariable).length ? envVariable : void 0,
-      schedule
+      schedule,
+      inject_secret_keys: injectSecretKeys.length ? injectSecretKeys : void 0
     });
     log("Waiting for deployment...");
     const deployDeadline = Date.now() + DEPLOY_POLL_TIMEOUT_MS;
@@ -1938,9 +2168,12 @@ async function runCommand(opts) {
     cfg.workspaceId,
     opts.coderunner
   );
-  const result = await runCoderunner(cfg.apiUrl, cfg.workspaceId, coderunnerId, {
+  const result = await runCoderunner(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    coderunnerId,
     payload
-  });
+  );
   if (opts.json) {
     process.stdout.write(`${JSON.stringify(result, null, 2)}
 `);
@@ -1968,7 +2201,29 @@ async function statusCommand(opts) {
     getDeployment(cfg.apiUrl, cfg.workspaceId, coderunnerId)
   ]);
   const out = { coderunner_id: coderunnerId, status, deployment };
-  process.stdout.write(`${JSON.stringify(out, null, 2)}
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(out, null, 2)}
+`);
+    return;
+  }
+  const state = status && typeof status === "object" ? status.state : void 0;
+  const type = String(state?.workload_type ?? "function");
+  const schedule = state?.schedule ? String(state.schedule) : "\u2014";
+  const lastJob = state?.last_job_name ? `${state.last_job_name} (${state.last_job_status ?? "?"})` : "\u2014";
+  process.stdout.write(`coderunner:  ${coderunnerId}
+`);
+  process.stdout.write(`type:        ${type}
+`);
+  process.stdout.write(`schedule:    ${schedule}
+`);
+  process.stdout.write(`last_job:    ${lastJob}
+`);
+  if (deployment?.status != null) {
+    process.stdout.write(`deployment:  ${deployment.id ?? "\u2014"} [${deployment.status}]
+`);
+  }
+  process.stdout.write(`
+${JSON.stringify(out, null, 2)}
 `);
 }
 
@@ -2142,9 +2397,9 @@ async function secretsRmCommand(key, opts) {
 
 // src/commands/files.ts
 import { promises as fs5 } from "fs";
-import path5 from "path";
+import path6 from "path";
 function guessContentType(filename) {
-  const ext = path5.extname(filename).toLowerCase();
+  const ext = path6.extname(filename).toLowerCase();
   const types = {
     ".json": "application/json",
     ".txt": "text/plain",
@@ -2179,9 +2434,9 @@ async function filesListCommand(opts) {
 }
 async function filesUploadCommand(filePath, opts) {
   const cfg = await requireWorkspace(opts.workspace);
-  const resolved = path5.resolve(filePath);
+  const resolved = path6.resolve(filePath);
   const buf = await fs5.readFile(resolved);
-  const name = opts.name ?? path5.basename(resolved);
+  const name = opts.name ?? path6.basename(resolved);
   const contentType = guessContentType(name);
   const init = await initFileUpload(cfg.apiUrl, cfg.workspaceId, {
     name,
@@ -2218,7 +2473,7 @@ async function filesDownloadCommand(fileId, opts) {
     throw new Error(`Download failed: ${res.status} ${res.statusText}`);
   }
   const buf = Buffer.from(await res.arrayBuffer());
-  const dest = path5.resolve(opts.out ?? fileId);
+  const dest = path6.resolve(opts.out ?? fileId);
   await fs5.writeFile(dest, buf);
   process.stdout.write(`Wrote ${dest}
 `);
@@ -2232,7 +2487,7 @@ async function filesRmCommand(fileId, opts) {
 
 // src/commands/apps.ts
 import { promises as fs6 } from "fs";
-import path6 from "path";
+import path7 from "path";
 
 // src/release-zip.ts
 import AdmZip2 from "adm-zip";
@@ -2276,8 +2531,8 @@ function flattenFederatedBundlePlan(relpaths) {
   const promoteDirs = /* @__PURE__ */ new Set();
   const entryDir = parentDir(entry);
   if (entryDir) promoteDirs.add(entryDir);
-  for (const path10 of pathset) {
-    const parent = parentDir(path10);
+  for (const path11 of pathset) {
+    const parent = parentDir(path11);
     if (parent === "assets" || parent.endsWith("/assets") && parent.split("/").length - 1 < 2) {
       promoteDirs.add(parent);
     }
@@ -2324,8 +2579,8 @@ function flattenFederatedReleaseZip(bytes) {
   return zip.toBuffer();
 }
 function rewriteRemoteEntryInZip(zip) {
-  const names = zip.getEntries().filter((entry) => !entry.isDirectory).map((entry) => normalizeZipEntryName(entry.entryName));
-  const entryRel = chooseRemoteEntry(names);
+  const names2 = zip.getEntries().filter((entry) => !entry.isDirectory).map((entry) => normalizeZipEntryName(entry.entryName));
+  const entryRel = chooseRemoteEntry(names2);
   if (!entryRel) return;
   const zipEntry = zip.getEntries().find((item) => {
     if (item.isDirectory) return false;
@@ -2349,18 +2604,18 @@ function initThenPublishHint(slug) {
   return `gf apps init --slug ${s} && cd ${s} && npm install && npm run release && gf apps publish --path release.zip`;
 }
 function extractReferencedSiblings(remoteEntrySource) {
-  const names = /* @__PURE__ */ new Set();
+  const names2 = /* @__PURE__ */ new Set();
   for (const match of remoteEntrySource.matchAll(
     /["']\.\/(?:assets\/)?([^"'/]+\.(?:js|mjs|cjs|css))["']/g
   )) {
-    if (match[1] !== REMOTE_ENTRY) names.add(match[1]);
+    if (match[1] !== REMOTE_ENTRY) names2.add(match[1]);
   }
   for (const match of remoteEntrySource.matchAll(
     /["']([A-Za-z0-9._-]+\.css)["']/g
   )) {
-    names.add(match[1]);
+    names2.add(match[1]);
   }
-  return [...names];
+  return [...names2];
 }
 function extractFederationScope(remoteEntrySource) {
   return remoteEntrySource.match(/css__([A-Za-z0-9_-]+)__/)?.[1];
@@ -2379,9 +2634,9 @@ function readZipFile(bytes, rel) {
 }
 function assertFederatedReleaseZip(bytes, slug) {
   const hint = initThenPublishHint(slug);
-  const names = zipRootNames(bytes);
-  const present = new Set(names.map((name) => basename(name)));
-  const entryRel = chooseRemoteEntry(names);
+  const names2 = zipRootNames(bytes);
+  const present = new Set(names2.map((name) => basename(name)));
+  const entryRel = chooseRemoteEntry(names2);
   if (!entryRel) {
     throw new Error(`Zip has no remoteEntry.js. ${hint}`);
   }
@@ -2391,7 +2646,7 @@ function assertFederatedReleaseZip(bytes, slug) {
   }
   const siblings = extractReferencedSiblings(source);
   const missing = siblings.filter((name) => !present.has(name));
-  const jsOrCssAtRoot = names.filter((name) => {
+  const jsOrCssAtRoot = names2.filter((name) => {
     if (name.includes("/")) return false;
     const lower = name.toLowerCase();
     return lower.endsWith(".js") || lower.endsWith(".mjs") || lower.endsWith(".css");
@@ -2433,11 +2688,11 @@ async function readJsonObject(filePath) {
 }
 async function maybeReadManifest(filePath) {
   if (!filePath) return void 0;
-  return readJsonObject(path6.resolve(filePath));
+  return readJsonObject(path7.resolve(filePath));
 }
 async function findSiblingManifest(bundlePath) {
-  const dir = await isDirectory(bundlePath) ? bundlePath : path6.dirname(bundlePath);
-  const candidate = path6.join(dir, "groundfloor.manifest.json");
+  const dir = await isDirectory(bundlePath) ? bundlePath : path7.dirname(bundlePath);
+  const candidate = path7.join(dir, "groundfloor.manifest.json");
   try {
     await fs6.access(candidate);
   } catch {
@@ -2595,8 +2850,8 @@ Do not scaffold src/App.tsx from scratch \u2014 BrowserRouter in App.tsx crashes
 }
 async function appsPublishCommand(appRef, opts) {
   const cfg = await requireWorkspace(opts.workspace);
-  const inputPath = path6.resolve(opts.path ?? "release.zip");
-  const bundlePath = await isDirectory(inputPath) ? path6.join(inputPath, "release.zip") : inputPath;
+  const inputPath = path7.resolve(opts.path ?? "release.zip");
+  const bundlePath = await isDirectory(inputPath) ? path7.join(inputPath, "release.zip") : inputPath;
   let bytes;
   try {
     bytes = await fs6.readFile(bundlePath);
@@ -2626,11 +2881,11 @@ async function appsPublishCommand(appRef, opts) {
       `Releases are only for shell_federated apps (this app is ${app.app_kind}). Use \`gf deploy\` for coderunner workloads.`
     );
   }
-  const ext = path6.extname(bundlePath).toLowerCase();
+  const ext = path7.extname(bundlePath).toLowerCase();
   const isZip = ext === ".zip";
   if (!isZip) {
     throw new Error(
-      `Publish release.zip from \`npm run release\`, not a lone ${path6.basename(bundlePath)}. ` + initThenPublishHint(app.slug)
+      `Publish release.zip from \`npm run release\`, not a lone ${path7.basename(bundlePath)}. ` + initThenPublishHint(app.slug)
     );
   }
   bytes = prepareReleaseZip(bytes, app.slug);
@@ -2643,7 +2898,10 @@ async function appsPublishCommand(appRef, opts) {
   }
   const init = await initAppReleaseUpload(cfg.apiUrl, cfg.workspaceId, app.id, {
     bundle,
-    label: opts.label
+    label: opts.label,
+    // Required since wave 5: the server pins this into the presigned PUT and
+    // checks it against the quota before minting a URL. Omitting it is a 422.
+    size_bytes: bytes.byteLength
   });
   await uploadAppReleaseContent(
     cfg.apiUrl,
@@ -2672,11 +2930,20 @@ async function appsPublishCommand(appRef, opts) {
 // src/commands/apps-init.ts
 import { promises as fs7 } from "fs";
 import os3 from "os";
-import path7 from "path";
+import path8 from "path";
 import AdmZip4 from "adm-zip";
 
 // src/version.ts
-var GF_VERSION = "0.1.8";
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var moduleDir = dirname(fileURLToPath(import.meta.url));
+function readPackageVersion() {
+  const pkgPath = join(moduleDir, "..", "package.json");
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+  return pkg.version;
+}
+var GF_VERSION = readPackageVersion();
 var GF_NPM_PACKAGE = "@groundfloorcloud/cli";
 
 // src/commands/apps-init.ts
@@ -2707,17 +2974,17 @@ async function isEmptyDir(dir) {
 }
 async function findKitRoot(extracted) {
   const candidates = [
-    path7.join(extracted, "shell-starter-kit"),
+    path8.join(extracted, "shell-starter-kit"),
     extracted
   ];
   const entries = await fs7.readdir(extracted, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isDirectory()) {
-      candidates.push(path7.join(extracted, entry.name));
+      candidates.push(path8.join(extracted, entry.name));
     }
   }
   for (const candidate of candidates) {
-    if (await pathExists(path7.join(candidate, "groundfloor.manifest.json"))) {
+    if (await pathExists(path8.join(candidate, "groundfloor.manifest.json"))) {
       return candidate;
     }
   }
@@ -2799,7 +3066,7 @@ async function appsInitCommand(opts) {
 `);
   }
   const name = opts.name?.trim() || titleFromSlug(slug);
-  const dest = path7.resolve(opts.dir?.trim() || path7.join(process.cwd(), slug));
+  const dest = path8.resolve(opts.dir?.trim() || path8.join(process.cwd(), slug));
   const cfg = await resolveConfig();
   const cell = cfg.environment ?? "production";
   const kitUrl = opts.kitUrl?.trim() || starterKitZipUrl(cell);
@@ -2814,7 +3081,7 @@ async function appsInitCommand(opts) {
   const bytes = await downloadKit(kitUrl);
   const zip = new AdmZip4(bytes);
   assertSafeZipEntries(zip);
-  const tmp = await fs7.mkdtemp(path7.join(os3.tmpdir(), "gf-starter-kit-"));
+  const tmp = await fs7.mkdtemp(path8.join(os3.tmpdir(), "gf-starter-kit-"));
   try {
     zip.extractAllTo(tmp, true);
     const kitRoot = await findKitRoot(tmp);
@@ -2823,8 +3090,8 @@ async function appsInitCommand(opts) {
   } finally {
     await fs7.rm(tmp, { recursive: true, force: true });
   }
-  const identityPath = path7.join(dest, "src", "appIdentity.ts");
-  const manifestPath = path7.join(dest, "groundfloor.manifest.json");
+  const identityPath = path8.join(dest, "src", "appIdentity.ts");
+  const manifestPath = path8.join(dest, "groundfloor.manifest.json");
   const identity = await fs7.readFile(identityPath, "utf8");
   await fs7.writeFile(identityPath, stampAppIdentity(identity, slug), "utf8");
   const manifest = await fs7.readFile(manifestPath, "utf8");
@@ -2901,7 +3168,7 @@ async function dataplaneProvisionCommand(opts) {
 
 // src/update-check.ts
 import { promises as fs8 } from "fs";
-import path8 from "path";
+import path9 from "path";
 var UPDATE_TTL_MS = 24 * 60 * 60 * 1e3;
 function isNewer(latest, current) {
   const a = latest.split(".").map((n) => Number.parseInt(n, 10) || 0);
@@ -2954,7 +3221,7 @@ async function readUpdateCache(file) {
   }
 }
 async function writeUpdateCache(file, cache) {
-  await fs8.mkdir(path8.dirname(file), { recursive: true, mode: 448 });
+  await fs8.mkdir(path9.dirname(file), { recursive: true, mode: 448 });
   await fs8.writeFile(file, `${JSON.stringify(cache)}
 `, { mode: 384 });
 }
@@ -2992,6 +3259,90 @@ function commanderExitCode(err) {
   return 0;
 }
 
+// src/commands/api.ts
+var METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE"]);
+async function apiCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  const method = (opts.method ?? "GET").toUpperCase();
+  if (!METHODS.has(method)) {
+    throw new Error(`Unsupported method ${method}`);
+  }
+  let path11 = opts.path.trim();
+  if (!path11.startsWith("/")) path11 = `/${path11}`;
+  path11 = path11.replaceAll("{workspace_id}", cfg.workspaceId ?? "");
+  path11 = path11.replaceAll("{workspaceId}", cfg.workspaceId ?? "");
+  let body;
+  if (opts.body !== void 0) {
+    body = JSON.parse(opts.body);
+  }
+  const data = await controlPlaneRequest(cfg.apiUrl, method, path11, body);
+  if (data === void 0) {
+    process.stdout.write("\n");
+    return;
+  }
+  process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+}
+
+// src/commands/identities.ts
+async function identitiesListCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const identities2 = await listWorkloadIdentities(cfg.apiUrl, cfg.workspaceId);
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(identities2, null, 2)}
+`);
+    return;
+  }
+  if (identities2.length === 0) {
+    process.stdout.write("No workload identities in this workspace.\n");
+    return;
+  }
+  for (const identity of identities2) {
+    const refresh = identity.has_refresh_secret ? "refresh" : "no-refresh";
+    process.stdout.write(
+      `${identity.id}  ${identity.slug ?? identity.name}  [${refresh}]
+`
+    );
+  }
+}
+async function identitiesMintCommand(opts) {
+  const cfg = await resolveConfig({ workspaceId: opts.workspace });
+  if (!cfg.workspaceId) {
+    throw new Error(
+      "No workspace selected. Run `gf workspaces use <id>` or pass --workspace <id>."
+    );
+  }
+  const data = await mintWorkloadIdentityVaultToken(
+    cfg.apiUrl,
+    cfg.workspaceId,
+    opts.identity,
+    { rotate_refresh: Boolean(opts.rotateRefresh) }
+  );
+  if (opts.json) {
+    process.stdout.write(`${JSON.stringify(data, null, 2)}
+`);
+    return;
+  }
+  if (data.refresh_secret) {
+    process.stderr.write(
+      "Save refresh_secret now; it is not shown again unless you --rotate-refresh.\n"
+    );
+    process.stderr.write(`refresh_secret=${data.refresh_secret}
+`);
+  }
+  process.stderr.write(
+    `expires_in=${data.expires_in}s identity=${data.workload_identity_id}
+`
+  );
+  process.stdout.write(`${data.token}
+`);
+}
+
 // src/index.ts
 function collect(value, previous) {
   return previous.concat([value]);
@@ -3071,7 +3422,7 @@ coderunner.command("logs").description("Show Process Log lines for a coderunner
     })
   )
 );
-coderunner.command("run").description("Invoke a deployed function/job (smoke run)").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--payload <json>", "JSON payload object", "{}").option("--json", "Output raw JSON").action(
+coderunner.command("run").description("Invoke a deployed function/job (smoke run)").requiredOption("-c, --coderunner <id|slug>", "Coderunner id or slug").option("-w, --workspace <id>", "Workspace id override").option("--payload <json>", "Event JSON object posted as the /run body", "{}").option("--json", "Output raw JSON").action(
   (opts) => run(
     () => runCommand({
       workspace: opts.workspace,
@@ -3182,7 +3533,34 @@ program.command("deploy").description(
 ).option(
   "--app-id <id>",
   "Bind newly created coderunner as a helper of this App (optional)"
-).option("--cpu <cpu>", "CPU request, e.g. 250m").option("--memory <memory>", "Memory request, e.g. 256Mi").option("-e, --env <KEY=VALUE>", "Environment variable (repeatable)", collect, []).option("-m, --message <text>", "Version description").option("--skip-deploy", "Upload a new version but do not deploy it").action((opts) => run(() => deployCommand(opts)));
+).option("--cpu <cpu>", "CPU request, e.g. 250m").option("--memory <memory>", "Memory request, e.g. 256Mi").option("-e, --env <KEY=VALUE>", "Environment variable (repeatable)", collect, []).option(
+  "--secret <KEY>",
+  "Inject this workspace secret by reference (repeatable). Use for *_SECRET keys.",
+  collect,
+  []
+).option("-m, --message <text>", "Version description").option("--skip-deploy", "Upload a new version but do not deploy it").action((opts) => run(() => deployCommand(opts)));
+program.command("api").description("Call a Control Plane path (passthrough for gaps in gf commands)").argument("<path>", "Path beginning with /v1/\u2026  Use {workspace_id} for the current workspace").option("-X, --method <method>", "HTTP method", "GET").option("--body <json>", "JSON body for POST/PUT/PATCH").option("-w, --workspace <id>", "Workspace id override").action(
+  (path11, opts) => run(
+    () => apiCommand({
+      path: path11,
+      method: opts.method,
+      body: opts.body,
+      workspace: opts.workspace
+    })
+  )
+);
+var identities = program.command("identities").description("Workload identities (Vault principals)");
+identities.command("ls").alias("list").description("List workload identities").option("-w, --workspace <id>", "Workspace id override").option("--json", "Output raw JSON").action((opts) => run(() => identitiesListCommand(opts)));
+identities.command("mint").description("Mint a Vault JWT; first mint returns refresh_secret once").requiredOption("--identity <id>", "Workload identity id").option("-w, --workspace <id>", "Workspace id override").option("--rotate-refresh", "Rotate and return a new refresh_secret").option("--json", "Output raw JSON").action(
+  (opts) => run(
+    () => identitiesMintCommand({
+      workspace: opts.workspace,
+      identity: opts.identity,
+      rotateRefresh: opts.rotateRefresh,
+      json: opts.json
+    })
+  )
+);
 function wireUnknownCommands(root, current, latest) {
   const walk = (cmd) => {
     if (cmd.commands.length === 0) return;
@@ -3206,7 +3584,7 @@ function wireUnknownCommands(root, current, latest) {
 async function notifyUpgrade() {
   if (process.env.GF_SKIP_UPDATE_CHECK === "1") return null;
   const latest = await resolveLatest({
-    cacheFile: path9.join(paths.CONFIG_DIR, "update-check.json")
+    cacheFile: path10.join(paths.CONFIG_DIR, "update-check.json")
   });
   if (latest && isNewer(latest, GF_VERSION)) {
     process.stderr.write(`${upgradeNotice(GF_VERSION, latest)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groundfloorcloud/cli",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Groundfloor gf CLI — sign in, deploy coderunners, publish Shell apps, and manage secrets, files, and Dataplane.",
   "type": "module",
   "bin": {
@@ -28,17 +28,20 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "clean": "rm -rf dist *.tsbuildinfo .turbo",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "adm-zip": "^0.5.16",
+    "adm-zip": "^0.6.0",
     "commander": "^12.1.0",
     "open": "^10.1.0"
   },
   "devDependencies": {
     "@types/adm-zip": "^0.5.7",
     "@types/node": "^20",
+    "esbuild": "^0.27.7",
     "tsup": "^8.3.0",
     "typescript": "^5"
   },