@jango-blockchained/hoox-cli 0.5.0 → 0.5.2

package/src/services/schema/schema-service.ts

@@ -0,0 +1,99 @@
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import {
+  WORKER_MANIFESTS,
+  WORKER_NAMES,
+  validateWranglerJsonc,
+  validateRootSecrets,
+  validateDevVars,
+  type WorkerManifest,
+  type ValidationError,
+} from "@jango-blockchained/hoox-shared";
+
+export interface SchemaCheckResult {
+  worker: string;
+  passed: boolean;
+  errors: ValidationError[];
+}
+
+export class SchemaService {
+  constructor(private projectRoot: string = process.cwd()) {}
+
+  getWorkerNames(): string[] {
+    return WORKER_NAMES;
+  }
+
+  getManifest(name: string): WorkerManifest | undefined {
+    return WORKER_MANIFESTS[name];
+  }
+
+  validateWorker(name: string): SchemaCheckResult {
+    const manifest = WORKER_MANIFESTS[name];
+    if (!manifest) {
+      return {
+        worker: name,
+        passed: false,
+        errors: [
+          {
+            worker: name,
+            severity: "error",
+            message: `Unknown worker "${name}"`,
+          },
+        ],
+      };
+    }
+
+    const workersDir = resolve(this.projectRoot, "workers");
+    const rootWranglerPath = resolve(this.projectRoot, "wrangler.jsonc");
+    const workerWranglerPath = resolve(workersDir, name, "wrangler.jsonc");
+    const devVarsPath = resolve(workersDir, name, ".dev.vars");
+
+    const errors: ValidationError[] = [];
+
+    // Read and validate per-worker wrangler.jsonc
+    try {
+      const wranglerContent = readFileSync(workerWranglerPath, "utf-8");
+      errors.push(...validateWranglerJsonc(name, manifest, wranglerContent));
+    } catch (e: any) {
+      errors.push({
+        worker: name,
+        severity: "error",
+        message: `Cannot read ${workerWranglerPath}: ${e.message}`,
+      });
+    }
+
+    // Read and validate root wrangler.jsonc (if exists)
+    try {
+      const rootContent = readFileSync(rootWranglerPath, "utf-8");
+      errors.push(...validateRootSecrets(name, manifest, rootContent));
+    } catch (e: any) {
+      errors.push({
+        worker: name,
+        severity: "warning",
+        message: `Cannot read root wrangler.jsonc: ${e.message}`,
+      });
+    }
+
+    // Read and validate .dev.vars (if exists)
+    try {
+      const devVarsContent = readFileSync(devVarsPath, "utf-8");
+      errors.push(...validateDevVars(name, manifest, devVarsContent));
+    } catch (e: any) {
+      errors.push({
+        worker: name,
+        severity: "warning",
+        message: `Cannot read ${devVarsPath}: ${e.message}`,
+      });
+    }
+
+    return {
+      worker: name,
+      passed: errors.filter((e) => e.severity === "error").length === 0,
+      errors,
+    };
+  }
+
+  validateAll(): SchemaCheckResult[] {
+    return WORKER_NAMES.map((name) => this.validateWorker(name));
+  }
+}

package/src/services/secrets/secrets-service.test.ts

@@ -33,12 +33,16 @@ const WORKERS_JSONC = JSON.stringify({
     "telegram-worker": {
       enabled: true,
       path: "workers/telegram-worker",
-      secrets: ["TELEGRAM_BOT_TOKEN"],
+      secrets: ["TG_BOT_TOKEN_BINDING"],
     },
     "trade-worker": {
       enabled: true,
       path: "workers/trade-worker",
-      secrets: ["API_SERVICE_KEY", "BINANCE_API_KEY", "BINANCE_API_SECRET"],
+      secrets: [
+        "API_SERVICE_KEY_BINDING",
+        "BINANCE_KEY_BINDING",
+        "BINANCE_SECRET_BINDING",
+      ],
     },
     "d1-worker": {
       enabled: true,
@@ -106,16 +110,16 @@ describe("SecretsService", () => {
     it("returns correct secret names for a worker that has secrets", async () => {
       const svc = await createService();
       expect(svc.listSecrets("trade-worker")).toEqual([
-        "API_SERVICE_KEY",
-        "BINANCE_API_KEY",
-        "BINANCE_API_SECRET",
+        "API_SERVICE_KEY_BINDING",
+        "BINANCE_KEY_BINDING",
+        "BINANCE_SECRET_BINDING",
       ]);
     });
 
     it("returns single secret for telegram-worker", async () => {
       const svc = await createService();
       expect(svc.listSecrets("telegram-worker")).toEqual([
-        "TELEGRAM_BOT_TOKEN",
+        "TG_BOT_TOKEN_BINDING",
       ]);
     });
 
@@ -143,11 +147,11 @@ describe("SecretsService", () => {
       const all = svc.listAllSecrets();
 
       expect(Object.keys(all)).toHaveLength(2);
-      expect(all["telegram-worker"]).toEqual(["TELEGRAM_BOT_TOKEN"]);
+      expect(all["telegram-worker"]).toEqual(["TG_BOT_TOKEN_BINDING"]);
       expect(all["trade-worker"]).toEqual([
-        "API_SERVICE_KEY",
-        "BINANCE_API_KEY",
-        "BINANCE_API_SECRET",
+        "API_SERVICE_KEY_BINDING",
+        "BINANCE_KEY_BINDING",
+        "BINANCE_SECRET_BINDING",
       ]);
     });
 
@@ -175,9 +179,9 @@ describe("SecretsService", () => {
         expect(result.worker).toBe("trade-worker");
         expect(result.allSet).toBe(false);
         expect(result.missing).toEqual([
-          "API_SERVICE_KEY",
-          "BINANCE_API_KEY",
-          "BINANCE_API_SECRET",
+          "API_SERVICE_KEY_BINDING",
+          "BINANCE_KEY_BINDING",
+          "BINANCE_SECRET_BINDING",
         ]);
         expect(result.secrets).toHaveLength(3);
         for (const s of result.secrets) {
@@ -193,7 +197,7 @@ describe("SecretsService", () => {
       try {
         writeFileSync(
           join(dir, ".dev.vars"),
-          "API_SERVICE_KEY=abc123\nBINANCE_API_KEY=xyz789\nBINANCE_API_SECRET=sec456\n"
+          "API_SERVICE_KEY_BINDING=abc123\nBINANCE_KEY_BINDING=xyz789\nBINANCE_SECRET_BINDING=sec456\n"
         );
 
         const svc = await createService();
@@ -217,7 +221,7 @@ describe("SecretsService", () => {
       try {
         writeFileSync(
           join(dir, ".dev.vars"),
-          "API_SERVICE_KEY=placeholder_api_service_key\nBINANCE_API_KEY=binance-real-key\nBINANCE_API_SECRET=your_secret\n"
+          "API_SERVICE_KEY_BINDING=placeholder_api_service_key\nBINANCE_KEY_BINDING=binance-real-key\nBINANCE_SECRET_BINDING=your_secret\n"
         );
 
         const svc = await createService();
@@ -226,10 +230,10 @@ describe("SecretsService", () => {
 
         const result = await svc.checkLocalSecrets("trade-worker");
         expect(result.allSet).toBe(false);
-        // Only BINANCE_API_KEY should be set (not placeholder)
-        expect(result.missing).toContain("API_SERVICE_KEY");
-        expect(result.missing).toContain("BINANCE_API_SECRET");
-        expect(result.missing).not.toContain("BINANCE_API_KEY");
+        // Only BINANCE_KEY_BINDING should be set (not placeholder)
+        expect(result.missing).toContain("API_SERVICE_KEY_BINDING");
+        expect(result.missing).toContain("BINANCE_SECRET_BINDING");
+        expect(result.missing).not.toContain("BINANCE_KEY_BINDING");
       } finally {
         rmSync(dir, { recursive: true, force: true });
       }
@@ -240,7 +244,7 @@ describe("SecretsService", () => {
       try {
         writeFileSync(
           join(dir, ".dev.vars"),
-          "# This is a comment\nAPI_SERVICE_KEY=real-key\n\n# Another comment\nBINANCE_API_KEY=another-key\nBINANCE_API_SECRET=third-key\n"
+          "# This is a comment\nAPI_SERVICE_KEY_BINDING=real-key\n\n# Another comment\nBINANCE_KEY_BINDING=another-key\nBINANCE_SECRET_BINDING=third-key\n"
         );
 
         const svc = await createService();
@@ -280,7 +284,7 @@ describe("SecretsService", () => {
         // Verify file content
         const content = await Bun.file(join(dir, ".dev.vars")).text();
         expect(content).toContain(
-          "TELEGRAM_BOT_TOKEN=placeholder_telegram_bot_token"
+          "TG_BOT_TOKEN_BINDING=placeholder_tg_bot_token_binding"
         );
       } finally {
         rmSync(dir, { recursive: true, force: true });
@@ -323,7 +327,7 @@ describe("SecretsService", () => {
 
         const content = await Bun.file(join(dir, ".dev.vars")).text();
         expect(content).toContain(
-          "TELEGRAM_BOT_TOKEN=placeholder_telegram_bot_token"
+          "TG_BOT_TOKEN_BINDING=placeholder_tg_bot_token_binding"
         );
         expect(content).not.toContain("OLD_KEY");
       } finally {
@@ -340,7 +344,7 @@ describe("SecretsService", () => {
       try {
         writeFileSync(
           join(dir, ".dev.vars"),
-          "TELEGRAM_BOT_TOKEN=my-real-token\n"
+          "TG_BOT_TOKEN_BINDING=my-real-token\n"
         );
 
         const svc = await createService();
@@ -357,8 +361,8 @@ describe("SecretsService", () => {
         );
 
         const result = await svc.syncToCloudflare("telegram-worker");
-        expect(expectOk(result)).toEqual(["TELEGRAM_BOT_TOKEN"]);
-        expect(called).toEqual([["TELEGRAM_BOT_TOKEN", "my-real-token"]]);
+        expect(expectOk(result)).toEqual(["TG_BOT_TOKEN_BINDING"]);
+        expect(called).toEqual([["TG_BOT_TOKEN_BINDING", "my-real-token"]]);
       } finally {
         rmSync(dir, { recursive: true, force: true });
       }
@@ -369,7 +373,7 @@ describe("SecretsService", () => {
       try {
         writeFileSync(
           join(dir, ".dev.vars"),
-          "API_SERVICE_KEY=placeholder_api_service_key\nBINANCE_API_KEY=real-binance-key\nBINANCE_API_SECRET=generate_something\n"
+          "API_SERVICE_KEY_BINDING=placeholder_api_service_key\nBINANCE_KEY_BINDING=real-binance-key\nBINANCE_SECRET_BINDING=generate_something\n"
         );
 
         const svc = await createService();
@@ -386,10 +390,10 @@ describe("SecretsService", () => {
 
         const result = await svc.syncToCloudflare("trade-worker");
         const errMsg = expectErr(result);
-        // Only BINANCE_API_KEY was synced — but errors exist, so overall result is error
-        expect(errMsg).toContain("API_SERVICE_KEY");
-        expect(errMsg).toContain("BINANCE_API_SECRET");
-        expect(called).toEqual([["BINANCE_API_KEY", "real-binance-key"]]);
+        // Only BINANCE_KEY_BINDING was synced — but errors exist, so overall result is error
+        expect(errMsg).toContain("API_SERVICE_KEY_BINDING");
+        expect(errMsg).toContain("BINANCE_SECRET_BINDING");
+        expect(called).toEqual([["BINANCE_KEY_BINDING", "real-binance-key"]]);
       } finally {
         rmSync(dir, { recursive: true, force: true });
       }
@@ -412,9 +416,9 @@ describe("SecretsService", () => {
 
         const result = await svc.syncToCloudflare("trade-worker");
         const errMsg = expectErr(result);
-        expect(errMsg).toContain("API_SERVICE_KEY");
-        expect(errMsg).toContain("BINANCE_API_KEY");
-        expect(errMsg).toContain("BINANCE_API_SECRET");
+        expect(errMsg).toContain("API_SERVICE_KEY_BINDING");
+        expect(errMsg).toContain("BINANCE_KEY_BINDING");
+        expect(errMsg).toContain("BINANCE_SECRET_BINDING");
         expect(called).toHaveLength(0);
       } finally {
         rmSync(dir, { recursive: true, force: true });
@@ -430,7 +434,10 @@ describe("SecretsService", () => {
     it("handles wrangler failures gracefully", async () => {
       const dir = tmpDir();
       try {
-        writeFileSync(join(dir, ".dev.vars"), "TELEGRAM_BOT_TOKEN=my-token\n");
+        writeFileSync(
+          join(dir, ".dev.vars"),
+          "TG_BOT_TOKEN_BINDING=my-token\n"
+        );
 
         const svc = await createService();
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -478,7 +485,7 @@ describe("SecretsService", () => {
       try {
         writeFileSync(
           join(dir, ".dev.vars"),
-          "   TELEGRAM_BOT_TOKEN   =   my-token   \n"
+          "   TG_BOT_TOKEN_BINDING   =   my-token   \n"
         );
 
         const svc = await createService();

package/src/services/secrets/types.ts

@@ -16,7 +16,7 @@ export type { Result };
 // ---------------------------------------------------------------------------
 
 export interface SecretStatus {
-  /** Name of the secret (e.g. "TELEGRAM_BOT_TOKEN"). */
+  /** Name of the secret (e.g. "TG_BOT_TOKEN_BINDING"). */
   name: string;
   /** Whether the secret has a real (non-placeholder) value set. */
   set: boolean;

package/src/ui/menu.ts

@@ -17,7 +17,7 @@ import {
   isCancel,
   cancel,
 } from "@clack/prompts";
-import { renderBanner, renderCompactBanner, DISCLAIMER } from "./banner.js";
+import { renderBanner, DISCLAIMER } from "./banner.js";
 import { CLIError } from "../utils/errors.js";
 import { theme } from "../utils/theme.js";
 

package/src/utils/error-handler.ts

@@ -0,0 +1,62 @@
+/**
+ * Shared CLI error-handling wrapper.
+ *
+ * Provides a `withErrorHandling()` higher-order function that wraps command
+ * handlers with standardized error formatting and exit-code management,
+ * eliminating ~23 duplicated try/catch blocks across command files.
+ *
+ * Inner/recoverable try/catch blocks (e.g. JSON parse, per-key KV errors,
+ * API network errors) are left in place — only the outermost handler-level
+ * catch-all is replaced.
+ */
+
+import { formatError } from "./formatters.js";
+import { CLIError, ExitCode } from "./errors.js";
+import type { FormatOptions } from "./formatters.js";
+
+export type CommandResult = Promise<void>;
+
+/**
+ * Wraps a command handler with standardized error handling.
+ *
+ * @param handler - The command action function to wrap
+ * @param options.service - Service name for error prefix (e.g. "db", "kv")
+ * @param options.opts   - Optional FormatOptions for JSON/quiet-aware output
+ *
+ * @returns A wrapped function that catches errors, formats them, and exits
+ *
+ * @example
+ * ```ts
+ * .action(withErrorHandling(async (cmd) => {
+ *   const opts = getFormatOptions(cmd);
+ *   // …command logic…
+ * }, { service: "db" }))
+ * ```
+ */
+export function withErrorHandling<T extends unknown[]>(
+  handler: (...args: T) => Promise<void>,
+  options?: { service?: string; opts?: FormatOptions }
+): (...args: T) => CommandResult {
+  return async (...args: T) => {
+    try {
+      await handler(...args);
+    } catch (error) {
+      const service = options?.service ?? "cli";
+
+      if (error instanceof CLIError) {
+        // CLIError is already structured — pass through for proper formatting
+        formatError(error, options?.opts);
+        process.exit(error.code);
+      } else if (error instanceof Error) {
+        formatError(`[${service}] ${error.message}`, options?.opts);
+        process.exit(ExitCode.ERROR);
+      } else {
+        formatError(
+          `[${service}] Unknown error: ${String(error)}`,
+          options?.opts
+        );
+        process.exit(ExitCode.CommandFailed);
+      }
+    }
+  };
+}

package/src/utils/errors.ts

@@ -8,6 +8,7 @@ export const enum ExitCode {
   ERROR = 1,
   INVALID_USAGE = 2,
   INFRA_UNAVAILABLE = 3,
+  CommandFailed = -1,
 }
 
 export class CLIError extends Error {

package/src/utils/git.ts

@@ -0,0 +1,134 @@
+/**
+ * Shared git utilities for Hoox CLI.
+ *
+ * All functions use Bun.spawn for asynchronous git operations.
+ * Bun is a global in the Bun runtime — no import needed.
+ */
+
+// ---------------------------------------------------------------------------
+// Repository and working tree checks
+// ---------------------------------------------------------------------------
+
+/**
+ * Check if `cwd` is inside a git work-tree.
+ */
+export async function isGitRepo(cwd: string): Promise<boolean> {
+  const proc = Bun.spawn(["git", "rev-parse", "--is-inside-work-tree"], {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const exitCode = await proc.exited;
+  return exitCode === 0;
+}
+
+/**
+ * Check whether a path inside `cwd` is a registered git submodule.
+ */
+export async function isSubmodule(
+  cwd: string,
+  submodulePath: string
+): Promise<boolean> {
+  const proc = Bun.spawn(["git", "submodule", "status", "--", submodulePath], {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const exitCode = await proc.exited;
+  if (exitCode !== 0) return false;
+  const out = (await new Response(proc.stdout).text()).trim();
+  return out.length > 0;
+}
+
+/**
+ * Check if a specific file inside `dir` is tracked by git.
+ */
+export async function isGitTracked(
+  dir: string,
+  filename: string
+): Promise<boolean> {
+  try {
+    const proc = Bun.spawn(["git", "ls-files", "--error-unmatch", filename], {
+      cwd: dir,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const exitCode = await proc.exited;
+    return exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Git operations
+// ---------------------------------------------------------------------------
+
+/**
+ * Run `git pull --ff-only` inside `cwd`.
+ */
+export async function gitPull(cwd: string): Promise<string> {
+  const proc = Bun.spawn(["git", "pull", "--ff-only"], {
+    cwd,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const exitCode = await proc.exited;
+  const stdout = await new Response(proc.stdout).text();
+  const stderr = await new Response(proc.stderr).text();
+
+  if (exitCode !== 0) {
+    throw new Error(stderr.trim() || `git pull failed (exit ${exitCode})`);
+  }
+  return stdout.trim();
+}
+
+/**
+ * Run `git submodule update --remote --init` for a specific submodule path.
+ */
+export async function gitSubmoduleUpdate(
+  cwd: string,
+  submodulePath: string
+): Promise<string> {
+  const proc = Bun.spawn(
+    ["git", "submodule", "update", "--remote", "--init", "--", submodulePath],
+    {
+      cwd,
+      stdout: "pipe",
+      stderr: "pipe",
+    }
+  );
+  const exitCode = await proc.exited;
+  const stdout = await new Response(proc.stdout).text();
+  const stderr = await new Response(proc.stderr).text();
+
+  if (exitCode !== 0) {
+    throw new Error(
+      stderr.trim() || `git submodule update failed (exit ${exitCode})`
+    );
+  }
+  return stdout.trim();
+}
+
+/**
+ * Run `git rm --cached` to remove a file from git tracking while keeping it
+ * on disk.
+ */
+export async function gitUntrackFile(
+  dir: string,
+  filename: string
+): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    const proc = Bun.spawn(["git", "rm", "--cached", filename], {
+      cwd: dir,
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    proc.exited
+      .then((code: number) => {
+        if (code === 0) resolve();
+        else reject(new Error(`git rm --cached failed with code ${code}`));
+      })
+      .catch(reject);
+  });
+}

package/src/utils/theme.ts

@@ -67,8 +67,6 @@ export const icons = {
   arrow: "->",
   spinner: ["-", "\\", "|", "/"],
   dot: "●",
-  check: "v",
-  cross: "x",
 };
 
 // ── Display helpers ───────────────────────────────────────────────