@oneteam-app/apps-cli 0.1.0-alpha.5 → 0.1.0-alpha.7

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @oneteam-app/apps-cli
 
+## 0.1.0-alpha.7
+
+- **`init --hosted`** starts a hosted app from a template: a Hono Worker with a D1 database and a
+  React front end built on `@oneteam-app/ui`.
+- **`login`, `deploy`, `status` and `logs`** for hosted apps. `deploy` builds, checks and uploads
+  a version; it goes live once an organisation admin approves it.
+- **`secret list`, `secret set` and `secret remove`.** `secret set NAME --env live|preview` asks
+  for the value at a hidden prompt; it is never an argument, never printed and never written to
+  disk.
+- **`job list` and `job run`** for scheduled jobs. `status` shows the schedules, and `deploy`
+  says what an admin has to approve.
+- `deploy` and `doctor` refuse env files that are not git-ignored, credentials written into the
+  code, a schedule without a handler, and sending something the manifest does not list. `doctor`
+  also warns about hard-coded colours and raw `<button>` / `<input>` in a hosted app's front end.
+- Depends on `@oneteam-app/apps@0.1.0-alpha.7`.
+
+Oneteam's hosting is not open yet: until it is, `deploy` and the commands after it only work
+against the local stand-in.
+
+## 0.1.0-alpha.6
+
+- Depends on `@oneteam-app/apps@0.1.0-alpha.6`.
+
 ## 0.1.0-alpha.5
 
 - Depends on `@oneteam-app/apps@0.1.0-alpha.5`.

package/README.md

@@ -1,9 +1,53 @@
 # @oneteam-app/apps-cli
 
-Adds Oneteam login to a Next.js App Router project and checks the setup.
+Starts, checks and deploys apps for Oneteam.
 
 > **Alpha.** Expect changes before 1.0.
 
+## Hosted apps (the platform runs the app and signs people in)
+
+```bash
+npx @oneteam-app/apps-cli init --hosted "Lost and found"
+cd lost-and-found && npm install && npm run dev
+npx oneteam-apps login                       # or set ONETEAM_TOKEN
+npx oneteam-apps deploy --organisation <id>
+npx oneteam-apps status
+npx oneteam-apps logs --env preview --hours 2
+npx oneteam-apps secret set SUPABASE_SERVICE_KEY --env preview   # asks at a hidden prompt
+```
+
+| Command | Does |
+|---|---|
+| `init --hosted <name>` | Copies the template (Vite + React, a Hono API, D1, permission tests) into a new folder, writes `oneteam.app.json` and the rules coding agents read (`AGENTS.md`, a Cursor rule) |
+| `login` | Signs in through your browser (OAuth with PKCE, as a client it registers itself; the code comes back to `127.0.0.1`). Credentials go to `~/.config/oneteam-apps/credentials.json` (mode 600). `--organisation <id>` remembers the organisation. Not needed with `ONETEAM_TOKEN` (a personal access token) |
+| `deploy` | Runs the project's `build` script, bundles `src/worker/index.ts` into one ES module, packs `worker.js`, `assets/`, `migrations/` and `source/` (what `.gitignore` allows; never `node_modules`, env files or tests), registers the app on the first run and uploads the version. Prints the review: checks, each finding as `SEVERITY  file:line` with what is wrong and how to fix it, then "Deploy stopped" (exit code 1) or the preview address and whether it waits for approval (exit code 0). `--json`, `--summary`, `--skip-build`, `--worker`, `--assets` |
+| `status` | Status, addresses, live and preview version, and which secrets still need a value. `--json` |
+| `logs` | Recent errors (with message and stack) and requests. `--env live\|preview`, `--hours`, `--json` |
+| `job list` | The scheduled jobs per environment: what runs when (times in the platform's zone), the next run, how the last one went. `--env`, `--json` |
+| `job run <NAME> --env live\|preview` | Asks for one run now; it starts within a minute. A job run by hand does what it does on its schedule, sending included |
+| `secret list` | Every secret the app declares, per environment: `saved`, `missing` or `unused`, who entered it and when. Never a value. `--env`, `--json` |
+| `secret set <NAME> --env live\|preview` | Asks for the value at a hidden prompt (nothing is echoed), or reads stdin when piped (`op read … \| oneteam-apps secret set NAME --env live`), and saves it for that one environment. There is no `--value` flag and a value given as an argument is refused: it would end up in shell history. The value is not written to disk or printed, and cannot be read back. The name must be listed under `secrets` in `oneteam.app.json` |
+| `secret remove <NAME> --env live\|preview` | Removes the value for that environment |
+| `doctor` | For a hosted app: the Worker uses the hosted adapter, `.gitignore` covers `.dev.vars`, no env file would be committed, no key is written into the code, no secret has a `VITE_` name |
+
+`deploy` stops before uploading ("Not uploaded: the app would carry secrets
+with it") when an env file (`.env*`, `.dev.vars*`) is not git-ignored or sits
+in the built front end, when a value from a local env file turns up in the
+Worker, the front end or the source, or when the code contains something
+shaped like a credential. It names the file and line, never the value.
+
+`deploy` and `doctor` also hold the Worker against the manifest: a job under
+`schedules` without a handler in `defineJobs()`, a handler without a schedule,
+jobs that nothing puts in front of the Worker (`withJobs`), and `notify()` or
+`sendChatMessage()` without the matching entry under `sends` stop the deploy.
+After a deploy the output lists what an admin has to approve again: a new job,
+one that runs more often or on more days, something new under `sends`.
+
+Environment: `ONETEAM_TOKEN`, `ONETEAM_ORGANISATION_ID`, `ONETEAM_API_URL`
+(default `https://api.oneteam.io`; only https, or http on localhost).
+
+## Apps you host yourself
+
 ```bash
 npx @oneteam-app/apps-cli init --url https://your-app.example.com
 npx @oneteam-app/apps-cli validate
@@ -13,7 +57,7 @@ npx @oneteam-app/apps-cli doctor
 | Command | Does |
 |---|---|
 | `init` | Writes `lib/oneteam.ts`, the auth route handler, a deny-by-default `proxy.ts`, `oneteam.app.json`, `.env.example` entries, and the rules coding agents read (`AGENTS.md`, a Cursor rule). Never overwrites existing files without `--force`, and never replaces an existing middleware |
-| `validate` | Checks `oneteam.app.json` against the manifest schema |
+| `validate` | Checks `oneteam.app.json` against the manifest schema (both kinds) |
 | `doctor` | Checks the manifest, environment variables, route protection and that the Oneteam issuer is reachable. Use `--offline` to skip the network check |
 
 Non-interactive by design, so AI coding tools can run it.