@hexclave/cli 1.0.61 → 1.0.63

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hexclave/cli",
-  "version": "1.0.61",
+  "version": "1.0.63",
   "repository": "https://github.com/hexclave/hexclave",
   "description": "The CLI for Hexclave. https://hexclave.com",
   "main": "dist/index.js",
@@ -25,9 +25,9 @@
     "commander": "^13.1.0",
     "extract-zip": "^2.0.1",
     "jiti": "^2.4.2",
-    "@hexclave/shared-backend": "1.0.61",
-    "@hexclave/shared": "1.0.61",
-    "@hexclave/js": "1.0.61"
+    "@hexclave/js": "1.0.63",
+    "@hexclave/shared-backend": "1.0.63",
+    "@hexclave/shared": "1.0.63"
   },
   "devDependencies": {
     "@types/node": "20.17.6",

package/src/commands/config-file.ts

@@ -10,6 +10,7 @@ import { getAdminProject } from "../lib/app.js";
 import { isProjectAuthWithRefreshToken, isProjectAuthWithSecretServerKey, resolveAuth, resolveProjectId, type ProjectAuthWithSecretServerKey } from "../lib/auth.js";
 import { resolveConfigFilePathOption } from "../lib/config-file-path.js";
 import { CliError } from "../lib/errors.js";
+import { startProgress, withProgress } from "../lib/progress.js";
 
 const SHOW_ONBOARDING_STACK_CONFIG_VALUE = "show-onboarding";
 
@@ -258,13 +259,14 @@ export function registerConfigCommand(program: Command) {
       }
       assertConfigPullTarget(filePath, opts);
 
-      const project = await getAdminProject(auth);
-
-      const configOverride = await project.getConfigOverride("branch");
-      if (!isValidConfig(configOverride)) {
-        throw new CliError("Pulled branch config is not a valid local config object.");
-      }
-      await replaceConfigObject(filePath, configOverride);
+      await withProgress("Pulling config", async () => {
+        const project = await getAdminProject(auth);
+        const configOverride = await project.getConfigOverride("branch");
+        if (!isValidConfig(configOverride)) {
+          throw new CliError("Pulled branch config is not a valid local config object.");
+        }
+        await replaceConfigObject(filePath, configOverride);
+      });
       console.log(`Config written to ${filePath}`);
     });
 
@@ -287,19 +289,6 @@ export function registerConfigCommand(program: Command) {
         throw new CliError("Config file must have a .js or .ts extension.");
       }
 
-      // The generated GitHub sync workflow installs the repo's dependencies
-      // before running the CLI, so jiti resolves the config's SDK import (e.g.
-      // `@hexclave/js`) from the project's own node_modules.
-      const { createJiti } = await import("jiti");
-      const jiti = createJiti(import.meta.url);
-      const configModule: { config?: unknown } = await jiti.import(filePath);
-
-      const config = parseConfigOverride(configModule.config);
-      if (config == null) {
-        const exampleImport = detectImportPackageFromDir(path.dirname(filePath)) ?? "@hexclave/js";
-        throw new CliError(`Config file must export a plain \`config\` object or "show-onboarding". Example: import type { HexclaveConfig } from "${exampleImport}"; export const config: HexclaveConfig = { ... };`);
-      }
-
       const source = buildConfigPushSource(opts.configFile, {
         source: opts.source,
         sourceRepo: opts.sourceRepo,
@@ -307,16 +296,35 @@ export function registerConfigCommand(program: Command) {
         sourceWorkflowPath: opts.sourceWorkflowPath,
       });
 
-      if (isProjectAuthWithSecretServerKey(auth)) {
-        await pushConfigWithSecretServerKey(auth, config, source);
-      } else {
-        if (!isProjectAuthWithRefreshToken(auth)) {
-          throw new CliError("`hexclave config push` requires either STACK_SECRET_SERVER_KEY or `hexclave login`.");
+      const progress = startProgress("Loading config");
+      try {
+        // The generated GitHub sync workflow installs the repo's dependencies
+        // before running the CLI, so jiti resolves the config's SDK import (e.g.
+        // `@hexclave/js`) from the project's own node_modules.
+        const { createJiti } = await import("jiti");
+        const jiti = createJiti(import.meta.url);
+        const configModule: { config?: unknown } = await jiti.import(filePath);
+
+        const config = parseConfigOverride(configModule.config);
+        if (config == null) {
+          const exampleImport = detectImportPackageFromDir(path.dirname(filePath)) ?? "@hexclave/js";
+          throw new CliError(`Config file must export a plain \`config\` object or "show-onboarding". Example: import type { HexclaveConfig } from "${exampleImport}"; export const config: HexclaveConfig = { ... };`);
         }
-        const project = await getAdminProject(auth);
-        await project.pushConfig(config, {
-          source: sourceToSdkSource(source),
-        });
+
+        progress.update("Pushing config");
+        if (isProjectAuthWithSecretServerKey(auth)) {
+          await pushConfigWithSecretServerKey(auth, config, source);
+        } else {
+          if (!isProjectAuthWithRefreshToken(auth)) {
+            throw new CliError("`hexclave config push` requires either STACK_SECRET_SERVER_KEY or `hexclave login`.");
+          }
+          const project = await getAdminProject(auth);
+          await project.pushConfig(config, {
+            source: sourceToSdkSource(source),
+          });
+        }
+      } finally {
+        progress.stop();
       }
 
       console.log("Config pushed successfully.");

package/src/commands/deploy.test.ts

@@ -0,0 +1,221 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { assertSecretsMatchEnv, extractServiceDefinition, parseSecretOptions, resolveDeployConfigPath, type ServiceEnvVarConfig } from "./deploy.js";
+
+describe("parseSecretOptions", () => {
+  it("parses KEY=VALUE pairs", () => {
+    expect(parseSecretOptions(["a=1", "db_connection=two"])).toEqual(new Map([
+      ["a", "1"],
+      ["db_connection", "two"],
+    ]));
+  });
+
+  it("keeps everything after the first = as the value", () => {
+    expect(parseSecretOptions(["db_connection=postgres://user:pass@host/db?a=b"])).toEqual(new Map([
+      ["db_connection", "postgres://user:pass@host/db?a=b"],
+    ]));
+  });
+
+  it("allows empty values", () => {
+    expect(parseSecretOptions(["empty="])).toEqual(new Map([["empty", ""]]));
+  });
+
+  it("rejects entries without =", () => {
+    expect(() => parseSecretOptions(["novalue"])).toThrow("KEY=VALUE");
+  });
+
+  it("rejects entries with an empty key", () => {
+    expect(() => parseSecretOptions(["=value"])).toThrow("KEY=VALUE");
+  });
+
+  it("rejects invalid keys", () => {
+    expect(() => parseSecretOptions(["bad key=x"])).toThrow("Invalid --secret key");
+    expect(() => parseSecretOptions(["bad.key=x"])).toThrow("Invalid --secret key");
+  });
+
+  it("rejects duplicate keys", () => {
+    expect(() => parseSecretOptions(["a=1", "a=2"])).toThrow("Duplicate --secret key");
+  });
+});
+
+describe("extractServiceDefinition", () => {
+  const config = {
+    "deployments-alpha": {
+      services: {
+        api: {
+          type: "vercel",
+          framework: "nextjs",
+          installCommand: "pnpm install",
+          buildCommand: "pnpm build",
+          outputDirectory: ".next",
+          rootDirectory: "./api",
+          env: {
+            MY_ENV_VAR: { value: "true" },
+            DATABASE_CONNECTION_STRING: { type: "secret", key: "db_connection" },
+            NEXT_PUBLIC_HEXCLAVE_PROJECT_ID: { type: "connection", value: "hexclave.projectId" },
+          },
+        },
+        minimal: { type: "vercel" },
+      },
+    },
+  };
+
+  it("extracts a fully specified service", () => {
+    expect(extractServiceDefinition(config, "api")).toEqual({
+      framework: "nextjs",
+      installCommand: "pnpm install",
+      buildCommand: "pnpm build",
+      outputDirectory: ".next",
+      rootDirectory: "./api",
+      env: {
+        MY_ENV_VAR: { value: "true" },
+        DATABASE_CONNECTION_STRING: { type: "secret", key: "db_connection" },
+        NEXT_PUBLIC_HEXCLAVE_PROJECT_ID: { type: "connection", value: "hexclave.projectId" },
+      },
+    });
+  });
+
+  it("extracts a minimal service", () => {
+    expect(extractServiceDefinition(config, "minimal")).toEqual({
+      framework: undefined,
+      installCommand: undefined,
+      buildCommand: undefined,
+      outputDirectory: undefined,
+      rootDirectory: undefined,
+      env: {},
+    });
+  });
+
+  it("lists available services when the requested one is missing", () => {
+    expect(() => extractServiceDefinition(config, "web")).toThrow("Available services: api, minimal");
+  });
+
+  it("rejects configs without a deployments-alpha.services section", () => {
+    expect(() => extractServiceDefinition({}, "api")).toThrow("deployments-alpha.services");
+  });
+
+  it("rejects services without a type", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { framework: "nextjs" } } },
+    }, "api")).toThrow('Add `type: "vercel"`');
+  });
+
+  it("rejects services with an unknown type", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "netlify" } } },
+    }, "api")).toThrow('must be "vercel"');
+  });
+
+  it("rejects non-string build fields", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "vercel", buildCommand: 42 } } },
+    }, "api")).toThrow("must be a string");
+  });
+
+  it("rejects invalid env var keys", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "vercel", env: { "1BAD": { value: "x" } } } } },
+    }, "api")).toThrow("invalid key");
+  });
+
+  it("rejects secret env vars with an inline value", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "vercel", env: { A: { type: "secret", key: "a", value: "leaked" } } } } },
+    }, "api")).toThrow("must not have a `value`");
+  });
+
+  it("rejects secret env vars without a key", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "vercel", env: { A: { type: "secret" } } } } },
+    }, "api")).toThrow("must have a `key`");
+  });
+
+  it("rejects plain env vars with a secret key", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "vercel", env: { A: { value: "x", key: "a" } } } } },
+    }, "api")).toThrow("must not have a `key`");
+  });
+
+  it("rejects the legacy {service.output} interpolation syntax in connections", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "vercel", env: { A: { type: "connection", value: "{hexclave.projectId}" } } } } },
+    }, "api")).toThrow("service output");
+  });
+
+  it("rejects unknown env var types", () => {
+    expect(() => extractServiceDefinition({
+      "deployments-alpha": { services: { api: { type: "vercel", env: { A: { type: "literal", value: "x" } } } } },
+    }, "api")).toThrow("unknown `type`");
+  });
+});
+
+describe("assertSecretsMatchEnv", () => {
+  const env: Record<string, ServiceEnvVarConfig> = {
+    PLAIN: { value: "x" },
+    DB: { type: "secret", key: "db_connection" },
+    API: { type: "secret", key: "api-key" },
+    PROJECT: { type: "connection", value: "hexclave.projectId" },
+  };
+
+  it("accepts exactly matching secrets", () => {
+    expect(() => assertSecretsMatchEnv(env, new Map([["db_connection", "a"], ["api-key", "b"]]))).not.toThrow();
+  });
+
+  it("rejects missing secrets", () => {
+    expect(() => assertSecretsMatchEnv(env, new Map([["db_connection", "a"]]))).toThrow("Missing secret values for: api-key");
+  });
+
+  it("rejects unknown secrets", () => {
+    expect(() => assertSecretsMatchEnv(env, new Map([["db_connection", "a"], ["api-key", "b"], ["typo", "c"]]))).toThrow("Unknown --secret key(s): typo");
+  });
+
+  it("accepts no secrets when none are referenced", () => {
+    expect(() => assertSecretsMatchEnv({ PLAIN: { value: "x" } }, new Map())).not.toThrow();
+  });
+});
+
+describe("resolveDeployConfigPath", () => {
+  const tempDirs: string[] = [];
+  const makeTempDir = () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "hexclave-deploy-test-"));
+    tempDirs.push(dir);
+    return dir;
+  };
+  afterEach(() => {
+    for (const dir of tempDirs.splice(0)) {
+      fs.rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("prefers an explicit --config path", () => {
+    const dir = makeTempDir();
+    const configPath = path.join(dir, "custom.config.ts");
+    fs.writeFileSync(configPath, "export const config = {};");
+    expect(resolveDeployConfigPath("custom.config.ts", dir)).toBe(configPath);
+  });
+
+  it("errors when the explicit path doesn't exist", () => {
+    const dir = makeTempDir();
+    expect(() => resolveDeployConfigPath("missing.config.ts", dir)).toThrow("Config file not found");
+  });
+
+  it("auto-discovers hexclave.config.ts before stack.config.ts", () => {
+    const dir = makeTempDir();
+    fs.writeFileSync(path.join(dir, "stack.config.ts"), "export const config = {};");
+    fs.writeFileSync(path.join(dir, "hexclave.config.ts"), "export const config = {};");
+    expect(resolveDeployConfigPath(undefined, dir)).toBe(path.join(dir, "hexclave.config.ts"));
+  });
+
+  it("falls back to stack.config.ts", () => {
+    const dir = makeTempDir();
+    fs.writeFileSync(path.join(dir, "stack.config.ts"), "export const config = {};");
+    expect(resolveDeployConfigPath(undefined, dir)).toBe(path.join(dir, "stack.config.ts"));
+  });
+
+  it("returns undefined when nothing is found (dashboard mode)", () => {
+    const dir = makeTempDir();
+    expect(resolveDeployConfigPath(undefined, dir)).toBeUndefined();
+  });
+});