@lunora/cli 1.0.0-alpha.7 → 1.0.0-alpha.70

package/dist/packem_chunks/runCodegenCommand.mjs

@@ -1,7 +1,8 @@
 import { runCodegen } from '@lunora/codegen';
-import { p as parseApiSpec } from '../packem_shared/api-spec-CtA6ilu4.mjs';
-import { d as defineHandler } from '../packem_shared/command-BDXcJCCJ.mjs';
-import { v as validateOutputFormat, p as printJson, l as loggerForFormat, i as isJsonFormat } from '../packem_shared/output-format-7gyGR3h8.mjs';
+import { collectWranglerSecretVariables } from '@lunora/config';
+import { p as parseApiSpec } from '../packem_shared/api-spec-Bx0iKbxA.mjs';
+import { d as defineHandler } from '../packem_shared/command-lYnl4QyF.mjs';
+import { v as validateOutputFormat, p as printJson, l as loggerForFormat, i as isJsonFormat } from '../packem_shared/output-format-B4642rjE.mjs';
 
 const CRON_TRIGGER_LIMIT = 3;
 const runCodegenCommand = (options) => {
@@ -13,7 +14,7 @@ const runCodegenCommand = (options) => {
     options.logger.error(formatError);
     return { advisories: [], cronTriggers: [], error: formatError, outputDirectory: "" };
   }
-  const result = runCodegen({ apiSpec: options.apiSpec, projectRoot });
+  const result = runCodegen({ apiSpec: options.apiSpec, projectRoot, wranglerVariables: collectWranglerSecretVariables(projectRoot) });
   const commandResult = {
     advisories: result.advisories.map((advisory) => {
       return {

package/dist/packem_chunks/runDeployCommand.mjs

@@ -1,18 +1,21 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { runCodegen, discoverMigrations } from '@lunora/codegen';
-import { readLinkedProject, writeLinkedProject, validateWranglerProject, inferLunoraBindings, reconcileWranglerBindings, DEV_VARS_FILE, parseDevVariableEntries, findWranglerFile, readWranglerJsonc, discoverContainerInfo } from '@lunora/config';
+import { readLinkedProject, writeLinkedProject, validateWranglerProject, inferLunoraBindings, reconcileWranglerBindings, DEV_VARS_FILE, parseDevVariableEntries, isMintableSecretKey, findWranglerFile, readWranglerJsonc, discoverContainerInfo, packageNamesFromBindings, requiredSecrets, generateSecretValue } from '@lunora/config';
 import { join } from '@visulima/path';
 import { Spinner } from '@visulima/spinner';
 import { Project } from 'ts-morph';
-import { p as parseApiSpec } from '../packem_shared/api-spec-CtA6ilu4.mjs';
+import { p as parseApiSpec } from '../packem_shared/api-spec-Bx0iKbxA.mjs';
 import { r as readWranglerName } from '../packem_shared/wrangler-name-cy4yhm9j.mjs';
-import { d as defineHandler } from '../packem_shared/command-BDXcJCCJ.mjs';
+import { d as defineHandler } from '../packem_shared/command-lYnl4QyF.mjs';
+import { e as execArgsFor, d as detectPackageManager } from '../packem_shared/detect-package-manager-DvEthdCw.mjs';
 import { a as isRailpackAvailable, i as isDockerAvailable } from '../packem_shared/docker-hMQ97KSQ.mjs';
-import { v as validateOutputFormat, i as isJsonFormat, p as printJson, l as loggerForFormat } from '../packem_shared/output-format-7gyGR3h8.mjs';
+import { v as validateOutputFormat, i as isJsonFormat, p as printJson, l as loggerForFormat } from '../packem_shared/output-format-B4642rjE.mjs';
 import { containerBuildTag } from '@lunora/container';
-import { defaultSpawner } from '../packem_shared/createRecordingSpawner-DxI3mebw.mjs';
+import { defaultSpawner } from '../packem_shared/createRecordingSpawner-Cw5Iu73G.mjs';
 import { r as resolveWorkerUrl } from '../packem_shared/resolve-target-qbsJ_5sF.mjs';
 import { r as runSchemaDriftGate } from '../packem_shared/schema-drift-gate-BtBt0as0.mjs';
+import { c as createTuiConfirm } from '../packem_shared/tui-prompts-BjEN8XgP.mjs';
+import { l as listRemoteSecrets } from '../packem_shared/wrangler-secrets-Dq_Fkbm-.mjs';
 import { runMigrateDataCommand } from './runMigrateGenerateCommand.mjs';
 
 const WORKERS_DEV_URL = /https?:\/\/[^\s"'<>]+\.workers\.dev[^\s"'<>]*/u;
@@ -78,7 +81,8 @@ const buildRailpackImages = async (options) => {
   for (const target of options.targets) {
     const tag = containerBuildTag(target.exportName);
     const build = { args: ["build", target.buildDir, "--name", tag], command: "railpack", cwd: options.cwd };
-    const push = { args: ["exec", "wrangler", "containers", "push", tag], command: "pnpm", cwd: options.cwd };
+    const pushExec = execArgsFor(detectPackageManager(options.cwd), "wrangler", ["containers", "push", tag]);
+    const push = { args: pushExec.args, command: pushExec.command, cwd: options.cwd };
     options.logger.info(`railpack: building "${target.exportName}" → ${tag} from ${target.buildDir}`);
     const buildResult = await spawner(build);
     if (buildResult.code !== 0) {
@@ -210,6 +214,90 @@ const warnDevVariablesNotPushed = (cwd, logger) => {
     `Note: \`lunora deploy\` does not push secrets. ${DEV_VARS_FILE} has ${String(keyCount)} key(s); if you changed them, run \`lunora env push --yes\` to update the deployed secrets.`
   );
 };
+const SECRET_LIKE_KEY = /(?:KEY|PASSWORD|SECRET|TOKEN)$/u;
+const resolveRequiredSecretKeys = async (cwd) => {
+  let packages = [];
+  try {
+    packages = packageNamesFromBindings(await inferLunoraBindings({ projectRoot: cwd }));
+  } catch {
+  }
+  const fromPackages = requiredSecrets(packages).map((entry) => entry.key);
+  let fromLocal = [];
+  try {
+    const devVariablesPath = join(cwd, DEV_VARS_FILE);
+    if (existsSync(devVariablesPath)) {
+      fromLocal = parseDevVariableEntries(readFileSync(devVariablesPath, "utf8")).map((entry) => entry.key).filter((key) => SECRET_LIKE_KEY.test(key));
+    }
+  } catch {
+  }
+  return [.../* @__PURE__ */ new Set([...fromPackages, ...fromLocal])];
+};
+const pushMintableSecrets = async (cwd, options, keys) => {
+  const { logger } = options;
+  const spawner = options.spawner ?? defaultSpawner;
+  const manager = detectPackageManager(cwd);
+  const environmentFlag = options.env === void 0 ? "" : ` --env ${options.env}`;
+  for (const key of keys) {
+    const args = ["secret", "put", key];
+    if (options.env !== void 0) {
+      args.push("--env", options.env);
+    }
+    if (options.temporary === true) {
+      args.push("--temporary");
+    }
+    const exec = execArgsFor(manager, "wrangler", args);
+    const pushResult = await spawner({ args: exec.args, command: exec.command, cwd, input: generateSecretValue() });
+    if (pushResult.code !== 0) {
+      logger.error(
+        `failed to push secret ${key} (exit ${String(pushResult.code)}); set it manually with \`wrangler secret put ${key}${environmentFlag}\`.`
+      );
+      return false;
+    }
+    logger.success(`generated + pushed ${key}`);
+  }
+  return true;
+};
+const offerMissingSecrets = async (cwd, options, interactive) => {
+  if (options.dryRun === true || options.preview === true) {
+    return void 0;
+  }
+  const { logger } = options;
+  const environmentFlag = options.env === void 0 ? "" : ` --env ${options.env}`;
+  let remote;
+  try {
+    remote = await (options.secretLister ?? listRemoteSecrets)({ cwd, env: options.env, temporary: options.temporary });
+  } catch {
+    return void 0;
+  }
+  if (!remote.ok) {
+    return void 0;
+  }
+  const remoteNames = new Set(remote.names);
+  const required = await resolveRequiredSecretKeys(cwd);
+  const missing = required.filter((key) => !remoteNames.has(key));
+  if (missing.length === 0) {
+    return void 0;
+  }
+  if (!interactive) {
+    return `missing required secret(s) on the deploy target: ${missing.join(", ")}. Set them with \`wrangler secret put <KEY>${environmentFlag}\` (or \`lunora env generate --set\` then \`lunora env push --yes${options.env === void 0 ? "" : " --prod"}\`), then re-deploy.`;
+  }
+  for (const key of missing.filter((name) => !isMintableSecretKey(name))) {
+    logger.warn(`required secret ${key} is not set on the target — set it with: wrangler secret put ${key}${environmentFlag}`);
+  }
+  const mintable = missing.filter((key) => isMintableSecretKey(key));
+  if (mintable.length === 0) {
+    return void 0;
+  }
+  const confirm = options.secretConfirm ?? createTuiConfirm();
+  if (await confirm(`${String(mintable.length)} required secret(s) not set on the target (${mintable.join(", ")}). Generate strong values and push them now?`)) {
+    await pushMintableSecrets(cwd, options, mintable);
+    return void 0;
+  }
+  logger.warn(
+    `${String(mintable.length)} required secret(s) not set on the target: ${mintable.join(", ")}. Generate + push with \`lunora env generate --set\` then \`lunora env push --yes${options.env === void 0 ? "" : " --prod"}\`.`
+  );
+  return void 0;
+};
 const runPostDeployMigrations = async (options, cwd) => {
   const project = new Project({ skipAddingFilesFromTsConfig: true });
   const lunoraDirectory = join(cwd, "lunora");
@@ -352,7 +440,7 @@ const runPreDeployGates = async (cwd, options) => {
   return buildContainerImages(cwd, options);
 };
 const buildWranglerDeployArgs = (cwd, options) => {
-  const args = options.preview ? ["exec", "wrangler", "versions", "upload"] : ["exec", "wrangler", "deploy"];
+  const args = options.preview ? ["versions", "upload"] : ["deploy"];
   const composedEntry = resolveComposedWorkerEntry(cwd);
   if (composedEntry !== void 0) {
     args.push(composedEntry);
@@ -375,6 +463,16 @@ const buildWranglerDeployArgs = (cwd, options) => {
   }
   return args;
 };
+const reportWranglerProblems = (validation, logger) => {
+  if (validation.problems.length === 0) {
+    return false;
+  }
+  logger.error("wrangler.jsonc validation failed:");
+  for (const problem of validation.problems) {
+    logger.error(`  - ${problem}`);
+  }
+  return true;
+};
 const executeDeploy = async (options) => {
   const cwd = options.cwd ?? process.cwd();
   const interactive = isInteractive(options);
@@ -420,24 +518,21 @@ const executeDeploy = async (options) => {
     return { code: 1, descriptor: void 0, error: preflightError, validation: { problems: [], wranglerPath: void 0 } };
   }
   const validation = validateWranglerProject({ projectRoot: cwd });
-  if (validation.problems.length > 0) {
-    options.logger.error("wrangler.jsonc validation failed:");
-    for (const problem of validation.problems) {
-      options.logger.error(`  - ${problem}`);
-    }
-    return {
-      code: 1,
-      descriptor: void 0,
-      error: "wrangler validation failed",
-      validation
-    };
+  if (reportWranglerProblems(validation, options.logger)) {
+    return { code: 1, descriptor: void 0, error: "wrangler validation failed", validation };
   }
   warnDevVariablesNotPushed(cwd, options.logger);
+  const secretAbort = await offerMissingSecrets(cwd, options, interactive);
+  if (secretAbort !== void 0) {
+    options.logger.error(secretAbort);
+    return { code: 1, descriptor: void 0, error: secretAbort, validation };
+  }
   const shouldAutoLink = !isJsonFormat(options.format) && options.dryRun !== true && options.preview !== true && readLinkedProject(cwd) === void 0;
+  const exec = execArgsFor(detectPackageManager(cwd), "wrangler", buildWranglerDeployArgs(cwd, options));
   const descriptor = {
-    args: buildWranglerDeployArgs(cwd, options),
+    args: exec.args,
     captureStdout: shouldAutoLink,
-    command: "pnpm",
+    command: exec.command,
     cwd,
     // In `--format json` mode stdout is reserved for the single JSON document,
     // so route wrangler's progress + deployed-URL output to stderr instead.