@noormdev/sdk 1.0.0-alpha.33 → 1.0.0-alpha.34

package/dist/index.js

@@ -2,7 +2,7 @@ import { createRequire } from 'module';
 import { processFile, DtReader, isTemplate, FORMAT_VERSION, DT_EXTENSIONS, encryptWithPassphrase, ENCODED_TYPES } from './chunk-5AYPF5D5.js';
 import './chunk-UOFJT5PY.js';
 import { initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey } from './chunk-DE3NJ22A.js';
-import { makeNestedConfig, gigabytes, observer, attempt, retry, clone, merge, attemptSync, ObserverRelay } from './chunk-DLQES4PM.js';
+import { makeNestedConfig, gigabytes, observer, attempt, retry, attemptSync, clone, merge, ObserverRelay } from './chunk-DLQES4PM.js';
 import { dist_default } from './chunk-TBRUDUBQ.js';
 import { require_dist } from './chunk-YJBKNUTP.js';
 import { __commonJS, __export, __toESM } from './chunk-D2XW2UOP.js';
@@ -10,7 +10,7 @@ import { constants, existsSync, readFileSync, mkdirSync, writeFileSync, createWr
 import path, { join, dirname, resolve } from 'path';
 import { homedir, availableParallelism, userInfo } from 'os';
 import { stat, mkdir, writeFile, unlink, rename, rm, readdir, readFile, access } from 'fs/promises';
-import { createHash, createDecipheriv, randomBytes, createCipheriv, randomUUID, hkdfSync } from 'crypto';
+import { createHash, createPrivateKey, createPublicKey, createDecipheriv, randomBytes, createCipheriv, randomUUID, hkdfSync } from 'crypto';
 import { execSync } from 'child_process';
 import { sql } from 'kysely';
 import { Worker, parentPort, workerData } from 'worker_threads';
@@ -304,6 +304,9 @@ var PRIVATE_KEY_PATH = join(NOORM_HOME, "identity.key");
 var PUBLIC_KEY_PATH = join(NOORM_HOME, "identity.pub");
 var IDENTITY_METADATA_PATH = join(NOORM_HOME, "identity.json");
 async function loadIdentityMetadata() {
+  if (identityOverride) {
+    return identityOverride;
+  }
   const [content, err] = await attempt(
     () => readFile(IDENTITY_METADATA_PATH, { encoding: "utf8" })
   );
@@ -320,6 +323,9 @@ async function loadIdentityMetadata() {
   return parsed;
 }
 async function loadPrivateKey() {
+  if (keyOverride) {
+    return keyOverride;
+  }
   const [content, err] = await attempt(() => readFile(PRIVATE_KEY_PATH, { encoding: "utf8" }));
   if (err) {
     if (err.code === "ENOENT") {
@@ -339,6 +345,34 @@ async function loadPublicKey() {
   }
   return content.trim();
 }
+function isValidKeyHex(hex4) {
+  if (!/^[0-9a-f]+$/i.test(hex4)) {
+    return false;
+  }
+  const validLengths = [88, 96];
+  return validLengths.includes(hex4.length);
+}
+var keyOverride = null;
+function setKeyOverride(key) {
+  keyOverride = key;
+}
+var identityOverride = null;
+function setIdentityOverride(identity) {
+  identityOverride = identity;
+}
+function derivePublicKeyFromPrivate(privateKeyHex) {
+  const privateKeyObj = createPrivateKey({
+    key: Buffer.from(privateKeyHex, "hex"),
+    format: "der",
+    type: "pkcs8"
+  });
+  const publicKeyObj = createPublicKey(privateKeyObj);
+  const publicKeyDer = publicKeyObj.export({
+    type: "spki",
+    format: "der"
+  });
+  return publicKeyDer.toString("hex");
+}
 function deriveStateKey(privateKey) {
   const privateKeyBuffer = Buffer.from(privateKey, "hex");
   return Buffer.from(
@@ -14866,199 +14900,26 @@ function getEffectiveBuildPaths(buildInclude, buildExclude, rules, config2) {
 
 // src/core/settings/manager.ts
 var import_yaml = __toESM(require_dist(), 1);
-
-// src/core/config/schema.ts
-var DialectSchema2 = external_exports.enum(["postgres", "mysql", "sqlite", "mssql"]);
-var ConfigNameSchema = external_exports.string().min(1, "Config name is required").regex(
-  /^[a-z0-9_-]+$/i,
-  "Config name must contain only letters, numbers, hyphens, and underscores"
-);
-var PortSchema2 = external_exports.number().int().min(1, "Port must be at least 1").max(65535, "Port must be at most 65535");
-var PoolSchema = external_exports.object({
-  min: external_exports.number().int().min(0).optional(),
-  max: external_exports.number().int().min(1).optional()
-});
-var SSLSchema = external_exports.union([
-  external_exports.boolean(),
-  external_exports.object({
-    rejectUnauthorized: external_exports.boolean().optional(),
-    ca: external_exports.string().optional(),
-    cert: external_exports.string().optional(),
-    key: external_exports.string().optional()
-  })
-]);
-var ConnectionSchema = external_exports.object({
-  dialect: DialectSchema2,
-  host: external_exports.string().optional(),
-  port: PortSchema2.optional(),
-  database: external_exports.string().min(1, "Database name is required"),
-  filename: external_exports.string().optional(),
-  user: external_exports.string().optional(),
-  password: external_exports.string().optional(),
-  ssl: SSLSchema.optional(),
-  pool: PoolSchema.optional()
-}).refine((conn) => conn.dialect === "sqlite" || conn.host, {
-  message: "Host is required for non-SQLite databases",
-  path: ["host"]
-});
-var ConfigSchema = external_exports.object({
-  name: ConfigNameSchema,
-  type: external_exports.enum(["local", "remote"]).default("local"),
-  isTest: external_exports.boolean().default(false),
-  protected: external_exports.boolean().default(false),
-  connection: ConnectionSchema,
-  identity: external_exports.string().optional()
-});
-var PartialConnectionSchema = external_exports.object({
-  dialect: DialectSchema2.optional(),
-  host: external_exports.string().optional(),
-  port: PortSchema2.optional(),
-  database: external_exports.string().optional(),
-  filename: external_exports.string().optional(),
-  user: external_exports.string().optional(),
-  password: external_exports.string().optional(),
-  ssl: SSLSchema.optional(),
-  pool: PoolSchema.optional()
-});
-external_exports.object({
-  name: external_exports.string().regex(/^[a-z0-9_-]+$/i).optional(),
-  type: external_exports.enum(["local", "remote"]).optional(),
-  isTest: external_exports.boolean().optional(),
-  protected: external_exports.boolean().optional(),
-  connection: PartialConnectionSchema.optional(),
-  identity: external_exports.string().optional()
-});
-ConfigSchema.extend({
-  name: ConfigNameSchema.optional()
-});
-var ConfigValidationError = class extends Error {
-  constructor(message, field, issues) {
-    super(message);
-    this.field = field;
-    this.issues = issues;
-    this.name = "ConfigValidationError";
-  }
-};
-function parseConfig(config2) {
-  const result = ConfigSchema.safeParse(config2);
-  if (!result.success) {
-    const firstIssue = result.error.issues[0];
-    throw new ConfigValidationError(
-      firstIssue?.message ?? "Validation failed",
-      firstIssue?.path.join(".") || "unknown",
-      result.error.issues
-    );
-  }
-  return result.data;
-}
-
-// src/core/environment.ts
-function getEnvConfigName() {
-  return process.env["NOORM_CONFIG"];
-}
-
-// src/core/config/resolver.ts
-var SettingsProvider = class {
-  #manager;
-  constructor(manager) {
-    this.#manager = manager;
-  }
-  /** Get a stage by name */
-  getStage(name) {
-    return this.#manager.getStage(name) ?? null;
-  }
-  /** Get stage that matches a config name (for auto-linking) */
-  findStageForConfig(configName) {
-    return this.#manager.getStage(configName) ?? null;
-  }
-};
-var DEFAULTS = {
-  type: "local",
-  isTest: false,
-  protected: false,
-  connection: {
-    host: "localhost",
-    pool: { min: 0, max: 10 }
-  },
-  log: {
-    level: "info"
-  }
-};
-function resolveConfig(state, options = {}) {
-  const configName = options.name ?? getEnvConfigName() ?? state.getActiveConfigName();
-  if (!configName) {
-    const envConfig2 = getEnvConfig();
-    if (envConfig2.connection?.dialect && envConfig2.connection?.database) {
-      return resolveFromEnvOnly(envConfig2, options.flags, options.stage, options.settings);
-    }
-    return null;
-  }
-  const stored = state.getConfig(configName);
-  if (!stored) {
-    throw new Error(`Config "${configName}" not found`);
-  }
-  const stageDefaults = getStageDefaults(configName, options.stage, options.settings);
-  const envConfig = getEnvConfig();
-  let merged = clone(DEFAULTS);
-  if (stageDefaults) {
-    merged = merge(merged, stageDefaults);
-  }
-  merged = merge(merged, stored);
-  merged = merge(merged, envConfig);
-  merged = merge(merged, options.flags ?? {});
-  return parseConfig(merged);
-}
-function getStageDefaults(configName, stageName, settings) {
-  if (!settings) return null;
-  if (stageName) return settings.getStage(stageName)?.defaults ?? null;
-  return settings.findStageForConfig(configName)?.defaults ?? null;
-}
-function resolveFromEnvOnly(envConfig, flags, stageName, settings) {
-  const name = envConfig.name ?? flags?.name ?? "__env__";
-  const stageDefaults = getStageDefaults(name, stageName, settings);
-  let merged = clone(DEFAULTS);
-  if (stageDefaults) {
-    merged = merge(merged, stageDefaults);
-  }
-  merged = merge(merged, envConfig);
-  merged = merge(merged, flags ?? {});
-  if (!merged.name) {
-    merged.name = "__env__";
-  }
-  return parseConfig(merged);
-}
-
-// src/core/config/index.ts
-var META_ENV_VARS = /* @__PURE__ */ new Set([
+var META_SETTINGS_ENV_VARS = /* @__PURE__ */ new Set([
   "NOORM_CONFIG",
-  // Config selection
   "NOORM_YES",
-  // Skip confirmations
-  "NOORM_JSON"
-  // JSON output mode
+  "NOORM_JSON",
+  "NOORM_HEADLESS",
+  "NOORM_DEBUG",
+  "NOORM_DEV",
+  "NOORM_CI_CONFIG_NAME",
+  "NOORM_LOGGER_DEBUG",
+  "NOORM_IDENTITY"
 ]);
-var VALID_DIALECTS = ["postgres", "mysql", "sqlite", "mssql"];
-var { allConfigs, getConfig } = makeNestedConfig(process.env, {
-  filter: (key) => key.startsWith("NOORM_") && !META_ENV_VARS.has(key),
-  stripPrefix: "NOORM_",
-  forceAllCapToLower: true,
-  memoizeOpts: false,
-  skipConversion: (key) => key.toLowerCase().includes("password")
-});
-function getEnvConfig() {
-  const config2 = allConfigs();
-  if (config2.connection?.dialect) {
-    const result = DialectSchema2.safeParse(config2.connection.dialect);
-    if (!result.success) {
-      throw new Error(
-        `Invalid NOORM_CONNECTION_DIALECT: must be one of ${VALID_DIALECTS.join(", ")}`
-      );
-    }
-  }
-  return config2;
+function allSettingsEnv() {
+  const { allConfigs: allConfigs2 } = makeNestedConfig(process.env, {
+    filter: (key) => key.startsWith("NOORM_") && !META_SETTINGS_ENV_VARS.has(key) && !key.startsWith("NOORM_IDENTITY_") && !key.startsWith("NOORM_CONNECTION_"),
+    stripPrefix: "NOORM_",
+    forceAllCapToLower: true,
+    memoizeOpts: false
+  });
+  return allConfigs2();
 }
-
-// src/core/settings/manager.ts
 var SettingsManager = class {
   #projectRoot;
   #settingsDir;
@@ -15134,7 +14995,7 @@ var SettingsManager = class {
       }
       fromFile = true;
     }
-    this.#settings = merge(this.#settings, allConfigs());
+    this.#settings = merge(this.#settings, allSettingsEnv());
     this.#loaded = true;
     observer.emit("settings:loaded", {
       path: this.settingsFilePath,
@@ -15718,6 +15579,13 @@ function formatIdentity(identity) {
   }
   return identity.name;
 }
+function computeIdentityHash(input) {
+  if (!input.email || !input.name || !input.machine || false) {
+    throw new Error("All fields required for identity hash: email, name, machine, os");
+  }
+  const hashInput = [input.email, input.name, input.machine, input.os].join("\0");
+  return createHash("sha256").update(hashInput, "utf8").digest("hex");
+}
 
 // src/core/identity/factory.ts
 async function loadExistingIdentity() {
@@ -16638,6 +16506,11 @@ function createDialectQuoting(opts) {
   return { quote: quote5, qualifiedName: qualifiedName4 };
 }
 
+// src/core/environment.ts
+function getEnvConfigName() {
+  return process.env["NOORM_CONFIG"];
+}
+
 // src/core/logger/logger.ts
 __toESM(require_dayjs_min(), 1);
 
@@ -16765,6 +16638,50 @@ async function registerIdentity(db, identity, dialect) {
   return { ok: true, registered: true };
 }
 
+// src/core/identity/env.ts
+var CI_ENV_VARS = {
+  privateKey: "NOORM_IDENTITY_PRIVATE_KEY",
+  name: "NOORM_IDENTITY_NAME",
+  email: "NOORM_IDENTITY_EMAIL"
+};
+function loadIdentityFromEnv() {
+  const rawKey = process.env[CI_ENV_VARS.privateKey];
+  const rawName = process.env[CI_ENV_VARS.name];
+  const rawEmail = process.env[CI_ENV_VARS.email];
+  if (!rawKey || !rawName || !rawEmail) {
+    return null;
+  }
+  const privateKey = rawKey.trim();
+  const name = rawName.trim();
+  const email3 = rawEmail.trim();
+  if (!name || !email3) {
+    return null;
+  }
+  if (!isValidKeyHex(privateKey)) {
+    return null;
+  }
+  const [publicKey, deriveErr] = attemptSync(() => derivePublicKeyFromPrivate(privateKey));
+  if (deriveErr || !publicKey) {
+    return null;
+  }
+  const identityHash = computeIdentityHash({
+    email: email3,
+    name,
+    machine: publicKey,
+    os: "env"
+  });
+  const identity = {
+    identityHash,
+    name,
+    email: email3,
+    publicKey,
+    machine: "ci",
+    os: "env",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  return { identity, privateKey, source: "env" };
+}
+
 // src/core/identity/index.ts
 var cachedIdentity = null;
 function resolveIdentity2(options = {}) {
@@ -16791,6 +16708,205 @@ async function waitForIdentityToLoad(db, dialect) {
   });
 }
 
+// src/core/config/schema.ts
+var DialectSchema2 = external_exports.enum(["postgres", "mysql", "sqlite", "mssql"]);
+var ConfigNameSchema = external_exports.string().min(1, "Config name is required").regex(
+  /^[a-z0-9_-]+$/i,
+  "Config name must contain only letters, numbers, hyphens, and underscores"
+);
+var PortSchema2 = external_exports.number().int().min(1, "Port must be at least 1").max(65535, "Port must be at most 65535");
+var PoolSchema = external_exports.object({
+  min: external_exports.number().int().min(0).optional(),
+  max: external_exports.number().int().min(1).optional()
+});
+var SSLSchema = external_exports.union([
+  external_exports.boolean(),
+  external_exports.object({
+    rejectUnauthorized: external_exports.boolean().optional(),
+    ca: external_exports.string().optional(),
+    cert: external_exports.string().optional(),
+    key: external_exports.string().optional()
+  })
+]);
+var ConnectionSchema = external_exports.object({
+  dialect: DialectSchema2,
+  host: external_exports.string().optional(),
+  port: PortSchema2.optional(),
+  database: external_exports.string().min(1, "Database name is required"),
+  filename: external_exports.string().optional(),
+  user: external_exports.string().optional(),
+  password: external_exports.string().optional(),
+  ssl: SSLSchema.optional(),
+  pool: PoolSchema.optional()
+}).refine((conn) => conn.dialect === "sqlite" || conn.host, {
+  message: "Host is required for non-SQLite databases",
+  path: ["host"]
+});
+var ConfigSchema = external_exports.object({
+  name: ConfigNameSchema,
+  type: external_exports.enum(["local", "remote"]).default("local"),
+  isTest: external_exports.boolean().default(false),
+  protected: external_exports.boolean().default(false),
+  connection: ConnectionSchema,
+  identity: external_exports.string().optional()
+});
+var PartialConnectionSchema = external_exports.object({
+  dialect: DialectSchema2.optional(),
+  host: external_exports.string().optional(),
+  port: PortSchema2.optional(),
+  database: external_exports.string().optional(),
+  filename: external_exports.string().optional(),
+  user: external_exports.string().optional(),
+  password: external_exports.string().optional(),
+  ssl: SSLSchema.optional(),
+  pool: PoolSchema.optional()
+});
+external_exports.object({
+  name: external_exports.string().regex(/^[a-z0-9_-]+$/i).optional(),
+  type: external_exports.enum(["local", "remote"]).optional(),
+  isTest: external_exports.boolean().optional(),
+  protected: external_exports.boolean().optional(),
+  connection: PartialConnectionSchema.optional(),
+  identity: external_exports.string().optional()
+});
+ConfigSchema.extend({
+  name: ConfigNameSchema.optional()
+});
+var ConfigValidationError = class extends Error {
+  constructor(message, field, issues) {
+    super(message);
+    this.field = field;
+    this.issues = issues;
+    this.name = "ConfigValidationError";
+  }
+};
+function parseConfig(config2) {
+  const result = ConfigSchema.safeParse(config2);
+  if (!result.success) {
+    const firstIssue = result.error.issues[0];
+    throw new ConfigValidationError(
+      firstIssue?.message ?? "Validation failed",
+      firstIssue?.path.join(".") || "unknown",
+      result.error.issues
+    );
+  }
+  return result.data;
+}
+
+// src/core/config/index.ts
+var META_ENV_VARS = /* @__PURE__ */ new Set([
+  "NOORM_CONFIG",
+  // Config selection
+  "NOORM_YES",
+  // Skip confirmations
+  "NOORM_JSON",
+  // JSON output mode
+  "NOORM_HEADLESS",
+  // Headless mode detection
+  "NOORM_DEBUG",
+  // Debug logging
+  "NOORM_DEV",
+  // Dev mode detection
+  "NOORM_CI_CONFIG_NAME",
+  // ci init config name override
+  "NOORM_LOGGER_DEBUG"
+  // Logger-internal debug
+]);
+var NON_CONFIG_ENV_PREFIXES = [
+  "NOORM_IDENTITY_"
+];
+var VALID_DIALECTS = ["postgres", "mysql", "sqlite", "mssql"];
+var { allConfigs, getConfig } = makeNestedConfig(process.env, {
+  filter: (key) => key.startsWith("NOORM_") && !META_ENV_VARS.has(key) && !NON_CONFIG_ENV_PREFIXES.some((prefix) => key.startsWith(prefix)),
+  stripPrefix: "NOORM_",
+  forceAllCapToLower: true,
+  memoizeOpts: false,
+  skipConversion: (key) => key.toLowerCase().includes("password")
+});
+function getEnvConfig() {
+  const config2 = allConfigs();
+  if (config2.connection?.dialect) {
+    const result = DialectSchema2.safeParse(config2.connection.dialect);
+    if (!result.success) {
+      throw new Error(
+        `Invalid NOORM_CONNECTION_DIALECT: must be one of ${VALID_DIALECTS.join(", ")}`
+      );
+    }
+  }
+  return config2;
+}
+
+// src/core/config/resolver.ts
+var SettingsProvider = class {
+  #manager;
+  constructor(manager) {
+    this.#manager = manager;
+  }
+  /** Get a stage by name */
+  getStage(name) {
+    return this.#manager.getStage(name) ?? null;
+  }
+  /** Get stage that matches a config name (for auto-linking) */
+  findStageForConfig(configName) {
+    return this.#manager.getStage(configName) ?? null;
+  }
+};
+var DEFAULTS = {
+  type: "local",
+  isTest: false,
+  protected: false,
+  connection: {
+    host: "localhost",
+    pool: { min: 0, max: 10 }
+  },
+  log: {
+    level: "info"
+  }
+};
+function resolveConfig(state, options = {}) {
+  const configName = options.name ?? getEnvConfigName() ?? state.getActiveConfigName();
+  if (!configName) {
+    const envConfig2 = getEnvConfig();
+    if (envConfig2.connection?.dialect && envConfig2.connection?.database) {
+      return resolveFromEnvOnly(envConfig2, options.flags, options.stage, options.settings);
+    }
+    return null;
+  }
+  const stored = state.getConfig(configName);
+  if (!stored) {
+    throw new Error(`Config "${configName}" not found`);
+  }
+  const stageDefaults = getStageDefaults(configName, options.stage, options.settings);
+  const envConfig = getEnvConfig();
+  let merged = clone(DEFAULTS);
+  if (stageDefaults) {
+    merged = merge(merged, stageDefaults);
+  }
+  merged = merge(merged, stored);
+  merged = merge(merged, envConfig);
+  merged = merge(merged, options.flags ?? {});
+  return parseConfig(merged);
+}
+function getStageDefaults(configName, stageName, settings) {
+  if (!settings) return null;
+  if (stageName) return settings.getStage(stageName)?.defaults ?? null;
+  return settings.findStageForConfig(configName)?.defaults ?? null;
+}
+function resolveFromEnvOnly(envConfig, flags, stageName, settings) {
+  const name = envConfig.name ?? flags?.name ?? "__env__";
+  const stageDefaults = getStageDefaults(name, stageName, settings);
+  let merged = clone(DEFAULTS);
+  if (stageDefaults) {
+    merged = merge(merged, stageDefaults);
+  }
+  merged = merge(merged, envConfig);
+  merged = merge(merged, flags ?? {});
+  if (!merged.name) {
+    merged.name = "__env__";
+  }
+  return parseConfig(merged);
+}
+
 // src/sdk/tvp.ts
 var MSSQL_PARAM_LIMIT = 2100;
 function tvp(typeName, rows) {
@@ -19119,7 +19235,7 @@ async function executeChange(context, change, options = {}) {
   const [, lockErr] = await attempt(
     () => lockManager.acquire(context.db, context.configName, identity, {
       reason: `Change: ${change.name}`,
-      dialect: context.dialect
+      dialect: context.dialect ?? "postgres"
     })
   );
   if (lockErr) {
@@ -19191,7 +19307,7 @@ async function revertChange(context, change, options = {}) {
   const [, lockErr] = await attempt(
     () => lockManager.acquire(context.db, context.configName, identity, {
       reason: `Revert: ${change.name}`,
-      dialect: context.dialect
+      dialect: context.dialect ?? "postgres"
     })
   );
   if (lockErr) {
@@ -20266,8 +20382,12 @@ var ChangesNamespace = class {
   }
   #createChangeContext() {
     const state = getStateManager(this.#state.projectRoot);
+    if (!this.#state.connection) {
+      throw new Error("Not connected. Call connect() first.");
+    }
     return {
       db: this.#kysely,
+      dialect: this.#state.connection.dialect,
       configName: this.#state.config.name,
       identity: this.#state.identity,
       projectRoot: this.#state.projectRoot,
@@ -27874,6 +27994,11 @@ function toSettingsProvider(manager) {
 }
 async function createContext(options = {}) {
   const projectRoot = options.projectRoot ?? process.cwd();
+  const envIdentity = loadIdentityFromEnv();
+  if (envIdentity) {
+    setKeyOverride(envIdentity.privateKey);
+    setIdentityOverride(envIdentity.identity);
+  }
   await initState(projectRoot);
   const state = getStateManager(projectRoot);
   const settingsManager = getSettingsManager(projectRoot);