@localctl/cli 0.2.0 → 0.4.0

package/src/lib/clusterProvision.js

@@ -1,170 +1,171 @@
-const os = require('os');
-const fs = require('fs');
-const path = require('path');
-const yaml = require('js-yaml');
-const { run, capture, sleepSync, commandExists } = require('./exec');
-const { detectEngine } = require('./engine');
-const { installIfMissing } = require('./toolInstall');
-const { ensureInsecureRegistry } = require('./podman');
-const { DOMAIN } = require('./constants');
-const logger = require('./logger');
-
-// Cluster-level manifests: bundled under cli/assets/ in the npm package (copied there by
-// scripts/sync-assets.js at pack time), or read straight from the repo root in a git checkout.
-const BUNDLED_MANIFESTS_DIR = path.resolve(__dirname, '..', '..', 'assets', 'manifests');
-const MANIFESTS_DIR = fs.existsSync(BUNDLED_MANIFESTS_DIR)
-  ? BUNDLED_MANIFESTS_DIR
-  : path.resolve(__dirname, '..', '..', '..', 'cluster', 'manifests');
-
-function registryNameFor(clusterName) {
-  return `${clusterName}-registry`;
-}
-
-function clusterExists(clusterName) {
-  return capture('k3d', ['cluster', 'list']).stdout
-    .split('\n')
-    .map((line) => line.trim().split(/\s+/)[0])
-    .includes(clusterName);
-}
-
-// Brings up (idempotently) one Main project's cluster: container engine + tool checks, the k3d
-// cluster itself (own ports, since two clusters can't both bind host :80/:443), its own local
-// registry container, and the shared *.local.test TLS cert wired into its Traefik. Used by both
-// `localctl setup` (the "default" profile, unchanged ports/names from before multi-project
-// support) and `localctl profiles new`/`switch` (any other Main project).
-function provisionCluster({ clusterName, httpPort, httpsPort, registryPort }) {
-  logger.step('Detecting container engine...');
-  const detected = detectEngine();
-  if (!detected) {
-    throw new Error('No running container engine found. Start Docker Desktop, Podman, or Rancher Desktop and re-run.');
-  }
-  const { engine, bin: engineBin } = detected;
-  logger.success(`Using container engine: ${engine} (${engineBin} CLI)`);
-
-  // Podman-specific, and must happen before the cluster/registry exist - see lib/podman.js. The
-  // insecure-registry trust is VM-wide, so it only needs doing once no matter how many clusters
-  // exist, but re-running it per registry port is cheap and idempotent.
-  if (engine === 'podman') {
-    ensureInsecureRegistry(registryPort);
-  }
-
-  installIfMissing('k3d', 'k3d', 'k3d-io.k3d');
-  installIfMissing('kubectl', 'kubernetes-cli', 'Kubernetes.kubectl');
-  installIfMissing('tilt', 'tilt', 'Tilt.dev.tilt');
-  installIfMissing('mkcert', 'mkcert', 'FiloSottile.mkcert');
-  installIfMissing('helm', 'helm', 'Helm.Helm');
-
-  const registryName = registryNameFor(clusterName);
-
-  if (clusterExists(clusterName)) {
-    logger.success(`k3d cluster '${clusterName}' already exists`);
-  } else {
-    logger.step(`Creating k3d cluster '${clusterName}'...`);
-    // Generated fresh per call, not a static file: every Main project needs its own cluster
-    // name, ports, and registry mirror name baked in.
-    const k3dConfig = {
-      apiVersion: 'k3d.io/v1alpha5',
-      kind: 'Simple',
-      metadata: { name: clusterName },
-      servers: 1,
-      agents: 0,
-      ports: [
-        { port: `${httpPort}:80`, nodeFilters: ['loadbalancer'] },
-        { port: `${httpsPort}:443`, nodeFilters: ['loadbalancer'] },
-      ],
-      // Plain container + mirror config, not k3d's built-in `registries.create`: that hard-codes
-      // attaching to a network literally named "bridge", which Docker has by default but Podman
-      // does not, breaking cluster creation there.
-      registries: {
-        config: yaml.dump({ mirrors: { [`${registryName}:5000`]: { endpoint: [`http://${registryName}:5000`] } } }),
-      },
-    };
-    const tmpConfig = path.join(os.tmpdir(), `localctl-k3d-config-${clusterName}.yaml`);
-    fs.writeFileSync(tmpConfig, yaml.dump(k3dConfig));
-    run('k3d', ['cluster', 'create', '--config', tmpConfig, '--wait']);
-    fs.rmSync(tmpConfig, { force: true });
-    logger.success('Cluster created');
-  }
-  run('kubectl', ['config', 'use-context', `k3d-${clusterName}`], { stdio: 'ignore' });
-
-  const registryNetwork = `k3d-${clusterName}`;
-  const existingNames = capture(engineBin, ['ps', '-a', '--format', '{{.Names}}']).stdout.split('\n');
-  if (existingNames.includes(registryName)) {
-    logger.success('Registry container already exists');
-    run(engineBin, ['start', registryName], { stdio: 'ignore', allowFail: true });
-  } else {
-    logger.step('Starting local image registry...');
-    run(engineBin, [
-      'run', '-d',
-      '--name', registryName,
-      '--network', registryNetwork,
-      '-p', `0.0.0.0:${registryPort}:5000`,
-      '--restart=always',
-      'registry:2',
-    ]);
-    logger.success(`Registry running at localhost:${registryPort} (in-cluster name: ${registryName}:5000)`);
-  }
-
-  // TLS via mkcert - one *.local.test cert/key, shared across every cluster (it's the same
-  // domain everywhere; only the namespace/subdomain prefix or the cluster differs).
-  logger.step(`Setting up local TLS for *.${DOMAIN}...`);
-  run('mkcert', ['-install']);
-  const certDir = path.join(os.homedir(), '.localctl', 'certs');
-  fs.mkdirSync(certDir, { recursive: true });
-  const certFile = path.join(certDir, 'local-dev.pem');
-  const keyFile = path.join(certDir, 'local-dev-key.pem');
-  if (!fs.existsSync(certFile) || !fs.existsSync(keyFile)) {
-    run('mkcert', ['-cert-file', certFile, '-key-file', keyFile, `*.${DOMAIN}`, DOMAIN]);
-  }
-
-  const secretYaml = capture('kubectl', [
-    'create', 'secret', 'tls', 'local-dev-tls',
-    `--cert=${certFile}`, `--key=${keyFile}`,
-    '-n', 'kube-system', '--dry-run=client', '-o', 'yaml',
-  ]).stdout;
-  run('kubectl', ['apply', '-f', '-'], { stdio: ['pipe', 'inherit', 'inherit'], input: secretYaml });
-
-  // k3d's --wait only waits for node readiness, not for Traefik's helm-install job to finish
-  // registering its CRDs, so applying TLSStore any earlier races and fails intermittently.
-  logger.step('Waiting for Traefik CRDs...');
-  for (let i = 0; i < 60; i += 1) {
-    if (capture('kubectl', ['get', 'crd', 'tlsstores.traefik.io']).status === 0) break;
-    sleepSync(2000);
-  }
-  run('kubectl', ['wait', '--for=condition=Established', 'crd/tlsstores.traefik.io', '--timeout=60s'], { stdio: 'ignore' });
-
-  run('kubectl', ['apply', '-f', path.join(MANIFESTS_DIR, 'tls-store.yaml')]);
-  run('kubectl', ['apply', '-f', path.join(MANIFESTS_DIR, 'namespace-addons.yaml')]);
-  logger.success('TLS configured, default cert wired into Traefik');
-}
-
-// Reverses provisionCluster() for one Main project: deletes its cluster, registry container,
-// network, and image volume. Does NOT touch the Podman VM's insecure-registry trust (that's
-// VM-wide, torn down once by `localctl uninstall`, not per-cluster) or *.local.test hosts/certs
-// (shared across every cluster).
-function teardownCluster(clusterName) {
-  if (commandExists('k3d')) {
-    logger.step(`Deleting k3d cluster '${clusterName}'...`);
-    run('k3d', ['cluster', 'delete', clusterName], { allowFail: true });
-  }
-  const detected = detectEngine();
-  if (detected) {
-    const { bin: engineBin } = detected;
-    run(engineBin, ['rm', '-f', '-v', registryNameFor(clusterName)], { stdio: 'ignore', allowFail: true });
-    run(engineBin, ['network', 'rm', `k3d-${clusterName}`], { stdio: 'ignore', allowFail: true });
-    run(engineBin, ['volume', 'rm', `k3d-${clusterName}-images`], { stdio: 'ignore', allowFail: true });
-  }
-}
-
-// Throws with the exact fix command if `clusterName` isn't up yet, otherwise points kubectl at
-// it. Called by every app-scoped command before it does anything else, so "cd in and run a
-// command" fails with a clear instruction instead of a confusing kubectl error further down.
-function ensureClusterUp(clusterName, profileName) {
-  if (!clusterExists(clusterName)) {
-    const fix = profileName === 'default' ? 'localctl setup' : `localctl profiles switch ${profileName}`;
-    throw new Error(`No cluster running for project "${profileName}". Run "${fix}" to start it.`);
-  }
-  run('kubectl', ['config', 'use-context', `k3d-${clusterName}`], { stdio: 'ignore' });
-}
-
-module.exports = { provisionCluster, teardownCluster, clusterExists, registryNameFor, ensureClusterUp };
+const os = require('os');
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+const { run, capture, sleepSync, commandExists } = require('./exec');
+const { detectEngine, warnIfExperimental } = require('./engine');
+const { installIfMissing } = require('./toolInstall');
+const { ensureInsecureRegistry } = require('./podman');
+const { DOMAIN } = require('./constants');
+const logger = require('./logger');
+
+// Cluster-level manifests: bundled under cli/assets/ in the npm package (copied there by
+// scripts/sync-assets.js at pack time), or read straight from the repo root in a git checkout.
+const BUNDLED_MANIFESTS_DIR = path.resolve(__dirname, '..', '..', 'assets', 'manifests');
+const MANIFESTS_DIR = fs.existsSync(BUNDLED_MANIFESTS_DIR)
+  ? BUNDLED_MANIFESTS_DIR
+  : path.resolve(__dirname, '..', '..', '..', 'cluster', 'manifests');
+
+function registryNameFor(clusterName) {
+  return `${clusterName}-registry`;
+}
+
+function clusterExists(clusterName) {
+  return capture('k3d', ['cluster', 'list']).stdout
+    .split('\n')
+    .map((line) => line.trim().split(/\s+/)[0])
+    .includes(clusterName);
+}
+
+// Brings up (idempotently) one Main project's cluster: container engine + tool checks, the k3d
+// cluster itself (own ports, since two clusters can't both bind host :80/:443), its own local
+// registry container, and the shared *.local.test TLS cert wired into its Traefik. Used by both
+// `localctl setup` (the "default" profile, unchanged ports/names from before multi-project
+// support) and `localctl profiles new`/`switch` (any other Main project).
+function provisionCluster({ clusterName, httpPort, httpsPort, registryPort }) {
+  logger.step('Detecting container engine...');
+  const detected = detectEngine();
+  if (!detected) {
+    throw new Error('No running container engine found. Start Docker Desktop, Podman, or Rancher Desktop and re-run.');
+  }
+  const { engine, bin: engineBin } = detected;
+  logger.success(`Using container engine: ${engine} (${engineBin} CLI)`);
+  warnIfExperimental(engine);
+
+  // Podman-specific, and must happen before the cluster/registry exist - see lib/podman.js. The
+  // insecure-registry trust is VM-wide, so it only needs doing once no matter how many clusters
+  // exist, but re-running it per registry port is cheap and idempotent.
+  if (engine === 'podman') {
+    ensureInsecureRegistry(registryPort);
+  }
+
+  installIfMissing('k3d', 'k3d', 'k3d-io.k3d');
+  installIfMissing('kubectl', 'kubernetes-cli', 'Kubernetes.kubectl');
+  installIfMissing('tilt', 'tilt', 'Tilt.dev.tilt');
+  installIfMissing('mkcert', 'mkcert', 'FiloSottile.mkcert');
+  installIfMissing('helm', 'helm', 'Helm.Helm');
+
+  const registryName = registryNameFor(clusterName);
+
+  if (clusterExists(clusterName)) {
+    logger.success(`k3d cluster '${clusterName}' already exists`);
+  } else {
+    logger.step(`Creating k3d cluster '${clusterName}'...`);
+    // Generated fresh per call, not a static file: every Main project needs its own cluster
+    // name, ports, and registry mirror name baked in.
+    const k3dConfig = {
+      apiVersion: 'k3d.io/v1alpha5',
+      kind: 'Simple',
+      metadata: { name: clusterName },
+      servers: 1,
+      agents: 0,
+      ports: [
+        { port: `${httpPort}:80`, nodeFilters: ['loadbalancer'] },
+        { port: `${httpsPort}:443`, nodeFilters: ['loadbalancer'] },
+      ],
+      // Plain container + mirror config, not k3d's built-in `registries.create`: that hard-codes
+      // attaching to a network literally named "bridge", which Docker has by default but Podman
+      // does not, breaking cluster creation there.
+      registries: {
+        config: yaml.dump({ mirrors: { [`${registryName}:5000`]: { endpoint: [`http://${registryName}:5000`] } } }),
+      },
+    };
+    const tmpConfig = path.join(os.tmpdir(), `localctl-k3d-config-${clusterName}.yaml`);
+    fs.writeFileSync(tmpConfig, yaml.dump(k3dConfig));
+    run('k3d', ['cluster', 'create', '--config', tmpConfig, '--wait']);
+    fs.rmSync(tmpConfig, { force: true });
+    logger.success('Cluster created');
+  }
+  run('kubectl', ['config', 'use-context', `k3d-${clusterName}`], { stdio: 'ignore' });
+
+  const registryNetwork = `k3d-${clusterName}`;
+  const existingNames = capture(engineBin, ['ps', '-a', '--format', '{{.Names}}']).stdout.split('\n');
+  if (existingNames.includes(registryName)) {
+    logger.success('Registry container already exists');
+    run(engineBin, ['start', registryName], { stdio: 'ignore', allowFail: true });
+  } else {
+    logger.step('Starting local image registry...');
+    run(engineBin, [
+      'run', '-d',
+      '--name', registryName,
+      '--network', registryNetwork,
+      '-p', `0.0.0.0:${registryPort}:5000`,
+      '--restart=always',
+      'registry:2',
+    ]);
+    logger.success(`Registry running at localhost:${registryPort} (in-cluster name: ${registryName}:5000)`);
+  }
+
+  // TLS via mkcert - one *.local.test cert/key, shared across every cluster (it's the same
+  // domain everywhere; only the namespace/subdomain prefix or the cluster differs).
+  logger.step(`Setting up local TLS for *.${DOMAIN}...`);
+  run('mkcert', ['-install']);
+  const certDir = path.join(os.homedir(), '.localctl', 'certs');
+  fs.mkdirSync(certDir, { recursive: true });
+  const certFile = path.join(certDir, 'local-dev.pem');
+  const keyFile = path.join(certDir, 'local-dev-key.pem');
+  if (!fs.existsSync(certFile) || !fs.existsSync(keyFile)) {
+    run('mkcert', ['-cert-file', certFile, '-key-file', keyFile, `*.${DOMAIN}`, DOMAIN]);
+  }
+
+  const secretYaml = capture('kubectl', [
+    'create', 'secret', 'tls', 'local-dev-tls',
+    `--cert=${certFile}`, `--key=${keyFile}`,
+    '-n', 'kube-system', '--dry-run=client', '-o', 'yaml',
+  ]).stdout;
+  run('kubectl', ['apply', '-f', '-'], { stdio: ['pipe', 'inherit', 'inherit'], input: secretYaml });
+
+  // k3d's --wait only waits for node readiness, not for Traefik's helm-install job to finish
+  // registering its CRDs, so applying TLSStore any earlier races and fails intermittently.
+  logger.step('Waiting for Traefik CRDs...');
+  for (let i = 0; i < 60; i += 1) {
+    if (capture('kubectl', ['get', 'crd', 'tlsstores.traefik.io']).status === 0) break;
+    sleepSync(2000);
+  }
+  run('kubectl', ['wait', '--for=condition=Established', 'crd/tlsstores.traefik.io', '--timeout=60s'], { stdio: 'ignore' });
+
+  run('kubectl', ['apply', '-f', path.join(MANIFESTS_DIR, 'tls-store.yaml')]);
+  run('kubectl', ['apply', '-f', path.join(MANIFESTS_DIR, 'namespace-addons.yaml')]);
+  logger.success('TLS configured, default cert wired into Traefik');
+}
+
+// Reverses provisionCluster() for one Main project: deletes its cluster, registry container,
+// network, and image volume. Does NOT touch the Podman VM's insecure-registry trust (that's
+// VM-wide, torn down once by `localctl uninstall`, not per-cluster) or *.local.test hosts/certs
+// (shared across every cluster).
+function teardownCluster(clusterName) {
+  if (commandExists('k3d')) {
+    logger.step(`Deleting k3d cluster '${clusterName}'...`);
+    run('k3d', ['cluster', 'delete', clusterName], { allowFail: true });
+  }
+  const detected = detectEngine();
+  if (detected) {
+    const { bin: engineBin } = detected;
+    run(engineBin, ['rm', '-f', '-v', registryNameFor(clusterName)], { stdio: 'ignore', allowFail: true });
+    run(engineBin, ['network', 'rm', `k3d-${clusterName}`], { stdio: 'ignore', allowFail: true });
+    run(engineBin, ['volume', 'rm', `k3d-${clusterName}-images`], { stdio: 'ignore', allowFail: true });
+  }
+}
+
+// Throws with the exact fix command if `clusterName` isn't up yet, otherwise points kubectl at
+// it. Called by every app-scoped command before it does anything else, so "cd in and run a
+// command" fails with a clear instruction instead of a confusing kubectl error further down.
+function ensureClusterUp(clusterName, profileName) {
+  if (!clusterExists(clusterName)) {
+    const fix = profileName === 'default' ? 'localctl setup' : `localctl profiles switch ${profileName}`;
+    throw new Error(`No cluster running for project "${profileName}". Run "${fix}" to start it.`);
+  }
+  run('kubectl', ['config', 'use-context', `k3d-${clusterName}`], { stdio: 'ignore' });
+}
+
+module.exports = { provisionCluster, teardownCluster, clusterExists, registryNameFor, ensureClusterUp };

package/src/lib/configSchema.js

@@ -1,103 +1,103 @@
-const { z } = require('zod');
-const { knownAddonTypes } = require('./manifestGen');
-
-// Dependency types are discovered from cli/src/lib/addons/<type>/addon.yaml (see
-// docs/adding-tools.md) rather than hardcoded here - dropping in a new addon folder is enough to
-// make it usable, no code change needed.
-const dependencySchema = z.object({
-  type: z.enum(knownAddonTypes()),
-  version: z.string().optional(),
-  database: z.string().optional(),
-  storage: z.string().optional(),
-});
-
-const debugSchema = z
-  .object({
-    enabled: z.boolean().default(false),
-    port: z.number().int().optional(),
-    type: z.enum(['node', 'python', 'go', 'java', 'dotnet']).optional(),
-  })
-  .default({ enabled: false });
-
-const syncEntrySchema = z.object({
-  localPath: z.string(),
-  remotePath: z.string(),
-});
-
-// An extra container in the same pod as your app - the classic k8s sidecar pattern (a DB admin
-// UI next to a database, a log/metrics shipper, a background job runner next to a web app). It
-// shares the pod's network namespace with your app automatically - no Service needed for your app
-// to reach it, just `localhost:<port>`. See docs/config-schema.md for a worked example.
-const sidecarSchema = z.object({
-  name: z.string().regex(/^[a-z0-9-]+$/, 'must be lowercase alphanumeric + dashes only'),
-  image: z.string(),
-  port: z.number().int().optional(),
-  command: z.array(z.string()).optional(),
-  args: z.array(z.string()).optional(),
-  env: z.record(z.string()).default({}),
-});
-
-const resourceSpec = z
-  .object({
-    cpu: z.string().optional(),
-    memory: z.string().optional(),
-  })
-  .optional();
-
-// A single probe - defaults to a plain TCP check on the app's own `port` if `path` isn't given
-// (see buildProbe() in manifestGen.js). Applies to the main app container only.
-const probeSchema = z.object({
-  path: z.string().optional(),
-  initialDelaySeconds: z.number().int().optional(),
-  periodSeconds: z.number().int().optional(),
-});
-
-const probesSchema = z
-  .object({
-    readiness: probeSchema.optional(),
-    liveness: probeSchema.optional(),
-  })
-  .default({});
-
-const appConfigSchema = z
-  .object({
-    name: z
-      .string()
-      .regex(/^[a-z0-9-]+$/, 'must be lowercase alphanumeric + dashes only'),
-    subdomain: z.string().regex(/^[a-z0-9-]+$/).optional(),
-    namespace: z.string().optional(),
-    port: z.number().int(),
-    build: z.object({
-      context: z.string().default('.'),
-      dockerfile: z.string().default('Dockerfile'),
-    }),
-    env: z.record(z.string()).default({}),
-    // Names only - values never live here. Set with `localctl app secrets set <KEY>`, which
-    // stores the value once as a real k8s Secret and injects it via secretKeyRef, the same
-    // never-plaintext principle addon-provided credentials already follow.
-    secrets: z
-      .array(z.string().regex(/^[A-Z][A-Z0-9_]*$/, 'must be UPPER_SNAKE_CASE'))
-      .default([]),
-    replicas: z.number().int().min(1).default(1),
-    resources: z
-      .object({ requests: resourceSpec, limits: resourceSpec })
-      .optional(),
-    debug: debugSchema,
-    probes: probesSchema,
-    dependencies: z.array(dependencySchema).default([]),
-    sidecars: z.array(sidecarSchema).default([]),
-    sync: z.array(syncEntrySchema).default([]),
-    tls: z.boolean().default(true),
-  })
-  .superRefine((cfg, ctx) => {
-    const overlap = cfg.secrets.filter((key) => key in cfg.env);
-    if (overlap.length > 0) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        path: ['secrets'],
-        message: `${overlap.join(', ')} can't be in both "env" and "secrets" - pick one.`,
-      });
-    }
-  });
-
-module.exports = { appConfigSchema };
+const { z } = require('zod');
+const { knownAddonTypes } = require('./manifestGen');
+
+// Dependency types are discovered from cli/src/lib/addons/<type>/addon.yaml (see
+// docs/adding-tools.md) rather than hardcoded here - dropping in a new addon folder is enough to
+// make it usable, no code change needed.
+const dependencySchema = z.object({
+  type: z.enum(knownAddonTypes()),
+  version: z.string().optional(),
+  database: z.string().optional(),
+  storage: z.string().optional(),
+});
+
+const debugSchema = z
+  .object({
+    enabled: z.boolean().default(false),
+    port: z.number().int().optional(),
+    type: z.enum(['node', 'python', 'go', 'java', 'dotnet']).optional(),
+  })
+  .default({ enabled: false });
+
+const syncEntrySchema = z.object({
+  localPath: z.string(),
+  remotePath: z.string(),
+});
+
+// An extra container in the same pod as your app - the classic k8s sidecar pattern (a DB admin
+// UI next to a database, a log/metrics shipper, a background job runner next to a web app). It
+// shares the pod's network namespace with your app automatically - no Service needed for your app
+// to reach it, just `localhost:<port>`. See docs/config-schema.md for a worked example.
+const sidecarSchema = z.object({
+  name: z.string().regex(/^[a-z0-9-]+$/, 'must be lowercase alphanumeric + dashes only'),
+  image: z.string(),
+  port: z.number().int().optional(),
+  command: z.array(z.string()).optional(),
+  args: z.array(z.string()).optional(),
+  env: z.record(z.string()).default({}),
+});
+
+const resourceSpec = z
+  .object({
+    cpu: z.string().optional(),
+    memory: z.string().optional(),
+  })
+  .optional();
+
+// A single probe - defaults to a plain TCP check on the app's own `port` if `path` isn't given
+// (see buildProbe() in manifestGen.js). Applies to the main app container only.
+const probeSchema = z.object({
+  path: z.string().optional(),
+  initialDelaySeconds: z.number().int().optional(),
+  periodSeconds: z.number().int().optional(),
+});
+
+const probesSchema = z
+  .object({
+    readiness: probeSchema.optional(),
+    liveness: probeSchema.optional(),
+  })
+  .default({});
+
+const appConfigSchema = z
+  .object({
+    name: z
+      .string()
+      .regex(/^[a-z0-9-]+$/, 'must be lowercase alphanumeric + dashes only'),
+    subdomain: z.string().regex(/^[a-z0-9-]+$/).optional(),
+    namespace: z.string().optional(),
+    port: z.number().int(),
+    build: z.object({
+      context: z.string().default('.'),
+      dockerfile: z.string().default('Dockerfile'),
+    }),
+    env: z.record(z.string()).default({}),
+    // Names only - values never live here. Set with `localctl app secrets set <KEY>`, which
+    // stores the value once as a real k8s Secret and injects it via secretKeyRef, the same
+    // never-plaintext principle addon-provided credentials already follow.
+    secrets: z
+      .array(z.string().regex(/^[A-Z][A-Z0-9_]*$/, 'must be UPPER_SNAKE_CASE'))
+      .default([]),
+    replicas: z.number().int().min(1).default(1),
+    resources: z
+      .object({ requests: resourceSpec, limits: resourceSpec })
+      .optional(),
+    debug: debugSchema,
+    probes: probesSchema,
+    dependencies: z.array(dependencySchema).default([]),
+    sidecars: z.array(sidecarSchema).default([]),
+    sync: z.array(syncEntrySchema).default([]),
+    tls: z.boolean().default(true),
+  })
+  .superRefine((cfg, ctx) => {
+    const overlap = cfg.secrets.filter((key) => key in cfg.env);
+    if (overlap.length > 0) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['secrets'],
+        message: `${overlap.join(', ')} can't be in both "env" and "secrets" - pick one.`,
+      });
+    }
+  });
+
+module.exports = { appConfigSchema };

package/src/lib/constants.js

@@ -1,16 +1,16 @@
-module.exports = {
-  // The "default" profile's cluster name - the single cluster this whole tool managed before
-  // multi-project support existed. Other Main-level projects get their own `local-dev-<name>`
-  // cluster (see profileStore.js).
-  DEFAULT_CLUSTER_NAME: 'local-dev',
-  DEFAULT_HTTP_PORT: 80,
-  DEFAULT_HTTPS_PORT: 443,
-  // .test (RFC 2606) is reserved for testing and guaranteed to never resolve publicly or be
-  // HSTS-preloaded. Not .dev: it's a real, live gTLD (Google-operated) that's HSTS-preloaded at
-  // the TLD level - every browser force-HTTPS's *any* .dev domain, including made-up ones, with
-  // no way to click through a self-signed cert warning, and "local.dev" itself is registered by
-  // an unrelated third party.
-  DOMAIN: 'local.test',
-  REGISTRY_HOST_PORT: '5050',
-  OBSERVABILITY_NAMESPACE: 'observability',
-};
+module.exports = {
+  // The "default" profile's cluster name - the single cluster this whole tool managed before
+  // multi-project support existed. Other Main-level projects get their own `local-dev-<name>`
+  // cluster (see profileStore.js).
+  DEFAULT_CLUSTER_NAME: 'local-dev',
+  DEFAULT_HTTP_PORT: 80,
+  DEFAULT_HTTPS_PORT: 443,
+  // .test (RFC 2606) is reserved for testing and guaranteed to never resolve publicly or be
+  // HSTS-preloaded. Not .dev: it's a real, live gTLD (Google-operated) that's HSTS-preloaded at
+  // the TLD level - every browser force-HTTPS's *any* .dev domain, including made-up ones, with
+  // no way to click through a self-signed cert warning, and "local.dev" itself is registered by
+  // an unrelated third party.
+  DOMAIN: 'local.test',
+  REGISTRY_HOST_PORT: '5050',
+  OBSERVABILITY_NAMESPACE: 'observability',
+};