@hyperdrive.bot/cli 1.0.13 → 1.0.16

package/dist/commands/network/register.js

@@ -0,0 +1,144 @@
+import { Command, Flags } from '@oclif/core';
+import chalk from 'chalk';
+import ora from 'ora';
+import { HyperdriveSigV4Service } from '../../services/hyperdrive-sigv4.js';
+const SLUG_REGEX = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+export default class NetworkRegister extends Command {
+    static description = 'Register a network manually';
+    static examples = [
+        '<%= config.bin %> network register',
+        '<%= config.bin %> network register --slug prod-us-east-1 --account-id 084309335408 --region us-east-1 --vpc-id vpc-abc123',
+    ];
+    static flags = {
+        'account-id': Flags.string({ description: 'AWS Account ID' }),
+        domain: Flags.string({ char: 'd', description: 'Tenant domain (for multi-domain setups)' }),
+        'private-subnets': Flags.string({ description: 'Comma-separated private subnet IDs' }),
+        'public-subnets': Flags.string({ description: 'Comma-separated public subnet IDs' }),
+        region: Flags.string({ char: 'r', description: 'AWS region' }),
+        'security-groups': Flags.string({ description: 'Security groups as JSON (e.g. {"database":"sg-123","lambda":"sg-456"})' }),
+        slug: Flags.string({ char: 's', description: 'Network slug' }),
+        'vpc-id': Flags.string({ description: 'VPC ID' }),
+    };
+    async run() {
+        const { flags } = await this.parse(NetworkRegister);
+        const service = new HyperdriveSigV4Service(flags.domain);
+        let slug = flags.slug;
+        let accountId = flags['account-id'];
+        let region = flags.region;
+        let vpcId = flags['vpc-id'];
+        let privateSubnetIds = flags['private-subnets']?.split(',').map(s => s.trim()).filter(Boolean);
+        let publicSubnetIds = flags['public-subnets']?.split(',').map(s => s.trim()).filter(Boolean);
+        let securityGroups;
+        if (flags['security-groups']) {
+            try {
+                securityGroups = JSON.parse(flags['security-groups']);
+            }
+            catch {
+                this.log(chalk.red('❌ Invalid JSON for --security-groups'));
+                this.exit(1);
+                return;
+            }
+        }
+        // Interactive mode if missing required fields
+        if (!slug || !accountId || !region || !vpcId) {
+            const inquirer = (await import('inquirer')).default;
+            if (!accountId) {
+                const { inputAccountId } = await inquirer.prompt([{
+                        message: chalk.yellow('AWS Account ID (12 digits):'),
+                        name: 'inputAccountId',
+                        validate: (input) => /^\d{12}$/.test(input) || 'Must be exactly 12 digits',
+                    }]);
+                accountId = inputAccountId;
+            }
+            if (!region) {
+                const { inputRegion } = await inquirer.prompt([{
+                        choices: [
+                            'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2',
+                            'sa-east-1', 'eu-west-1', 'eu-west-2', 'eu-central-1',
+                            'ap-southeast-1', 'ap-southeast-2', 'ap-northeast-1',
+                        ],
+                        default: 'us-east-1',
+                        message: chalk.yellow('AWS Region:'),
+                        name: 'inputRegion',
+                        type: 'list',
+                    }]);
+                region = inputRegion;
+            }
+            if (!vpcId) {
+                const { inputVpcId } = await inquirer.prompt([{
+                        message: chalk.yellow('VPC ID:'),
+                        name: 'inputVpcId',
+                        validate: (input) => input.startsWith('vpc-') || 'VPC ID must start with "vpc-"',
+                    }]);
+                vpcId = inputVpcId;
+            }
+            if (!slug) {
+                const { inputSlug } = await inquirer.prompt([{
+                        default: `vpc-${region}`,
+                        message: chalk.yellow('Network slug:'),
+                        name: 'inputSlug',
+                        validate: (input) => SLUG_REGEX.test(input) || 'Must be lowercase alphanumeric with hyphens (1-63 chars)',
+                    }]);
+                slug = inputSlug;
+            }
+            if (!privateSubnetIds) {
+                const { inputPrivateSubnets } = await inquirer.prompt([{
+                        message: chalk.yellow('Private subnet IDs (comma-separated, or leave empty):'),
+                        name: 'inputPrivateSubnets',
+                    }]);
+                if (inputPrivateSubnets) {
+                    privateSubnetIds = inputPrivateSubnets.split(',').map((s) => s.trim()).filter(Boolean);
+                }
+            }
+            if (!publicSubnetIds) {
+                const { inputPublicSubnets } = await inquirer.prompt([{
+                        message: chalk.yellow('Public subnet IDs (comma-separated, or leave empty):'),
+                        name: 'inputPublicSubnets',
+                    }]);
+                if (inputPublicSubnets) {
+                    publicSubnetIds = inputPublicSubnets.split(',').map((s) => s.trim()).filter(Boolean);
+                }
+            }
+            if (!securityGroups) {
+                const { inputSGs } = await inquirer.prompt([{
+                        message: chalk.yellow('Security groups JSON (e.g. {"database":"sg-123"}, or leave empty):'),
+                        name: 'inputSGs',
+                    }]);
+                if (inputSGs) {
+                    try {
+                        securityGroups = JSON.parse(inputSGs);
+                    }
+                    catch {
+                        this.log(chalk.yellow('Invalid JSON — skipping security groups.'));
+                    }
+                }
+            }
+        }
+        // Validate slug format
+        if (!SLUG_REGEX.test(slug)) {
+            this.log(chalk.red(`❌ Invalid slug format: "${slug}". Must match: ${SLUG_REGEX}`));
+            this.exit(1);
+            return;
+        }
+        const spinner = ora(`Registering network "${slug}"...`).start();
+        try {
+            await service.networkRegister({
+                slug: slug,
+                accountId: accountId,
+                region: region,
+                vpcId: vpcId,
+                privateSubnetIds,
+                publicSubnetIds,
+                securityGroups,
+                source: 'manual',
+            });
+            spinner.succeed(chalk.green(`Network registered: ${slug}`));
+        }
+        catch (error) {
+            spinner.fail('Registration failed');
+            const axiosError = error;
+            this.log(chalk.red(`\n❌ ${axiosError.response?.data?.message ?? axiosError.message}`));
+            this.exit(1);
+        }
+    }
+}

package/dist/commands/parameter/sync.d.ts

@@ -4,11 +4,24 @@ export default class ParameterSync extends Command {
     static examples: string[];
     static flags: {
         accountId: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'apply-to-lambda': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         file: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         moduleSlug: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         specific: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         stage: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    /**
+     * Render the Lambda env update report returned by the backend.
+     *
+     * Contract (API-111 AC5 / API-106 AC6):
+     *  - When `applyToLambda` was requested, every targeted Lambda appears here
+     *    even if no keys changed (so the user sees idempotent runs explicitly).
+     *  - `updatedKeys` is the testable contract — what actually got written
+     *    (or would be written under --dry-run).
+     *  - `applied: false` indicates a no-op (dry-run or already-in-sync).
+     */
+    private renderLambdaUpdates;
 }

package/dist/commands/parameter/sync.js

@@ -11,6 +11,8 @@ export default class ParameterSync extends Command {
         '<%= config.bin %> <%= command.id %> --stage="dev"',
         '<%= config.bin %> <%= command.id %> --file=".env.production" --stage="prod"',
         '<%= config.bin %> <%= command.id %> --no-specific --stage="all"',
+        '<%= config.bin %> <%= command.id %> --apply-to-lambda --stage="dev"',
+        '<%= config.bin %> <%= command.id %> --apply-to-lambda --dry-run --stage="dev"',
     ];
     static flags = {
         accountId: Flags.string({
@@ -18,10 +20,18 @@ export default class ParameterSync extends Command {
             env: 'AWS_ACCOUNT_ID',
             required: true,
         }),
+        'apply-to-lambda': Flags.boolean({
+            default: false,
+            description: 'After writing to DDB, also update each bound Lambda function\'s env vars (preserves existing vars; see API-111 AC5)',
+        }),
         domain: Flags.string({
             char: 'd',
             description: 'Tenant domain (for multi-domain setups)',
         }),
+        'dry-run': Flags.boolean({
+            default: false,
+            description: 'Preview env key changes without writing to DDB or Lambda. Best paired with --apply-to-lambda to see Lambda diffs.',
+        }),
         file: Flags.string({
             char: 'f',
             default: '.env',
@@ -54,6 +64,8 @@ export default class ParameterSync extends Command {
     async run() {
         const { flags } = await this.parse(ParameterSync);
         const { accountId, domain, file, moduleSlug, specific, stage } = flags;
+        const applyToLambda = flags['apply-to-lambda'];
+        const dryRun = flags['dry-run'];
         const envPath = path.resolve(process.cwd(), file);
         if (!existsSync(envPath)) {
             this.error(`The file "${file}" does not exist.`);
@@ -81,9 +93,17 @@ export default class ParameterSync extends Command {
             this.log(chalk.gray(`   Module: ${moduleSlug}`));
             this.log(chalk.gray(`   Stage: ${stage}`));
             this.log(chalk.gray(`   Scope: ${specific ? 'Project-specific' : 'Global'}`));
+            if (applyToLambda) {
+                this.log(chalk.gray(`   Apply to Lambda: yes${dryRun ? ' (dry-run)' : ''}`));
+            }
+            else if (dryRun) {
+                this.log(chalk.gray('   Dry run: yes (DDB-only preview)'));
+            }
             // Initiate async sync
             const initResult = await service.parameterSync({
                 accountId,
+                applyToLambda,
+                dryRun,
                 encodedContent,
                 projectSlug: moduleSlug,
                 specific,
@@ -111,7 +131,7 @@ export default class ParameterSync extends Command {
                     lastProgress = status.progress.percentage;
                 }
                 if (status.status === 'completed') {
-                    spinner.succeed('Parameters synchronized successfully!');
+                    spinner.succeed(dryRun ? 'Parameter sync preview complete (dry-run, nothing written).' : 'Parameters synchronized successfully!');
                     if (status.errors && status.errors.length > 0) {
                         // Filter out non-fatal errors (commented/empty keys)
                         const fatalErrors = status.errors.filter(e => !e.error.includes('was ignored'));
@@ -129,6 +149,7 @@ export default class ParameterSync extends Command {
                             }
                         }
                     }
+                    this.renderLambdaUpdates(status.lambdaUpdates, { applyToLambda, dryRun });
                     break;
                 }
                 if (status.status === 'failed') {
@@ -139,6 +160,7 @@ export default class ParameterSync extends Command {
                             this.log(chalk.red(`   - ${error.key}: ${error.error}`));
                         }
                     }
+                    this.renderLambdaUpdates(status.lambdaUpdates, { applyToLambda, dryRun });
                     this.exit(1);
                 }
                 // Wait before next poll
@@ -150,4 +172,50 @@ export default class ParameterSync extends Command {
             this.error('An error occurred while synchronizing parameters');
         }
     }
+    /**
+     * Render the Lambda env update report returned by the backend.
+     *
+     * Contract (API-111 AC5 / API-106 AC6):
+     *  - When `applyToLambda` was requested, every targeted Lambda appears here
+     *    even if no keys changed (so the user sees idempotent runs explicitly).
+     *  - `updatedKeys` is the testable contract — what actually got written
+     *    (or would be written under --dry-run).
+     *  - `applied: false` indicates a no-op (dry-run or already-in-sync).
+     */
+    renderLambdaUpdates(reports, opts) {
+        if (!opts.applyToLambda) {
+            return;
+        }
+        if (!reports || reports.length === 0) {
+            this.log(chalk.gray('\n• No Lambda functions found bound to this module/stage — nothing to update.'));
+            return;
+        }
+        const header = opts.dryRun ? 'Lambda env updates (dry-run preview):' : 'Lambda env updates:';
+        this.log(chalk.blue(`\n${header}`));
+        for (const report of reports) {
+            if (report.skipped) {
+                this.log(chalk.gray(`   ⊘ ${report.functionName} — skipped: ${report.skipped}`));
+                continue;
+            }
+            if (report.error) {
+                this.log(chalk.red(`   ✗ ${report.functionName} — error: ${report.error}`));
+                continue;
+            }
+            const updated = report.updatedKeys ?? [];
+            const removed = report.removedKeys ?? [];
+            const totalChanged = updated.length + removed.length;
+            if (totalChanged === 0) {
+                this.log(chalk.gray(`   = ${report.functionName} — no changes (idempotent)`));
+                continue;
+            }
+            const verb = opts.dryRun || report.applied === false ? 'would update' : 'updated';
+            this.log(chalk.green(`   ✓ ${report.functionName} — ${verb} ${totalChanged} key${totalChanged === 1 ? '' : 's'}`));
+            if (updated.length > 0) {
+                this.log(chalk.gray(`     + ${updated.join(', ')}`));
+            }
+            if (removed.length > 0) {
+                this.log(chalk.gray(`     - removed: ${removed.join(', ')}`));
+            }
+        }
+    }
 }

package/dist/commands/project/sync.d.ts

@@ -1,26 +1,20 @@
 /**
- * Project Sync Command
+ * Project Sync Command (DEPRECATED)
  *
- * Generates structured architecture summaries for repos in a project.
- * For each repo: clone/pull → detect _bmad or invoke Claude → validate YAML → upload S3 → update DynamoDB.
+ * This command has been replaced by `hd module sync`.
+ * Kept in place to show deprecation warning to users of the old workflow.
  */
 import { Command } from '@oclif/core';
 export default class ProjectSync extends Command {
     static args: {
-        project: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        project: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
     };
     static description: string;
-    static examples: string[];
+    static hidden: boolean;
     static flags: {
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         repo: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    private syncRepo;
-    private detectBmadDocs;
-    private runClaude;
-    private validateYaml;
-    private readGutEntities;
-    private mergeEntityRegistries;
 }