@stkxp/cli 0.1.2

package/src/deploy.mjs

@@ -0,0 +1,145 @@
+// packages/cli/src/deploy.mjs
+//
+// `stkxp deploy` spawns the vendored server/entrypoints/cli-deploy.js under
+// tsx (its emitted imports are extensionless — see scripts/bundle-server.mjs
+// in the main repo — tsx's loader is what resolves them; a plain `node` run
+// would fail). A child process, not an in-process dynamic import, so this
+// package never needs its OWN module loader hacks: tsx owns its process
+// fully, and cli-deploy.js's own dynamic-import env-var-then-import ordering
+// (see server/entrypoints/cli-deploy.ts's file header) is self-contained
+// inside that child.
+//
+// tsx is located with require.resolve("tsx/cli") — its package.json exports
+// map declares "./cli" → "./dist/cli.mjs" — and run as
+// `process.execPath <tsx/dist/cli.mjs> <runner>`. Resolving the module (not a
+// node_modules/.bin/tsx shim path) is what makes this work both inside this
+// pnpm monorepo, where tsx is hoisted well above packages/cli/, and after a
+// bare `npm install @stkxp/cli`, where there is no packages/cli/node_modules
+// at all and the shim lands in the consumer's own node_modules/.bin.
+import { spawn } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const CLI_ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const require = createRequire(import.meta.url);
+
+/** Must stay byte-identical to RESULT_SENTINEL in server/entrypoints/cli-deploy-run.ts. */
+export const RESULT_SENTINEL = "__STKXP_DEPLOY_RESULT__";
+
+export function resolveTsxCli() {
+  return require.resolve("tsx/cli");
+}
+
+export async function runDeployCommand({
+  bundlePath,
+  secret,
+  esUrl,
+  esUser,
+  esPassword,
+  webhookPort,
+  webhookHost,
+  esCaPath,
+  esInsecure,
+}) {
+  const bundle = JSON.parse(await readFile(bundlePath, "utf8"));
+
+  const runnerScript = path.join(CLI_ROOT, "vendor", "dist-server", "entrypoints", "cli-deploy-run.js");
+
+  return spawnAndAwaitJsonResult(process.execPath, [resolveTsxCli(), runnerScript], {
+    input: JSON.stringify({
+      bundle,
+      secret,
+      esUrl,
+      esUser,
+      esPassword,
+      webhookPort,
+      webhookHost,
+      esCaPath,
+      esInsecure,
+    }),
+  });
+}
+
+// Spawns `command args` and resolves as soon as the child's stdout produces a
+// line prefixed with `sentinel` (defaults to this module's own
+// RESULT_SENTINEL; packages/cli/src/bootstrap.mjs passes its own) — NOT on
+// child exit. Extracted from runDeployCommand so it can be exercised in
+// tests against a tiny hermetic mock child process instead of the real
+// (tsx + cli-deploy-run.js) child.
+export function spawnAndAwaitJsonResult(command, args, { input, env, onSpawn } = {}, sentinel = RESULT_SENTINEL) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      env: { ...process.env, ...env },
+      stdio: ["pipe", "pipe", "inherit"],
+    });
+    // Test-only hook: lets tests grab the child handle (e.g. to kill a mock
+    // child left running after the "resolves without waiting for exit"
+    // case) without changing runDeployCommand's production call signature.
+    onSpawn?.(child);
+
+    let settled = false;
+    let stdout = "";
+
+    // The child boots a webhook server and, on success, keeps running in the
+    // foreground forever (same precedent as server/entrypoints/team-runner.ts)
+    // — it never exits on the success path. So we can't wait for `exit` to
+    // resolve: we resolve as soon as the child prints its sentinel-prefixed
+    // result line, and let the child keep running afterwards (no kill/unref
+    // here — the webhook must stay up).
+    const onData = (chunk) => {
+      if (settled) return; // Post-settle output is piped straight through (see below).
+      stdout += chunk.toString();
+
+      // The last element of split("\n") is either an incomplete,
+      // not-yet-newline-terminated line, or (if stdout ends with "\n") an
+      // empty string — either way it's not a candidate line yet.
+      const completeLines = stdout.split("\n").slice(0, -1);
+      for (const line of completeLines) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith(sentinel)) continue;
+        let parsed;
+        try {
+          parsed = JSON.parse(trimmed.slice(sentinel.length));
+        } catch (e) {
+          settled = true;
+          child.stdout.off("data", onData);
+          reject(new Error(`stkxp deploy child printed an unparseable result line: ${e.message}`));
+          return;
+        }
+        settled = true;
+        // Stop accumulating (the child runs forever — an unbounded buffer
+        // here would leak for the whole life of the deploy) and forward its
+        // ongoing logs to the operator's terminal instead.
+        stdout = "";
+        child.stdout.off("data", onData);
+        child.stdout.pipe(process.stdout);
+        resolve(parsed);
+        return;
+      }
+    };
+    child.stdout.on("data", onData);
+
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      reject(err);
+    });
+
+    child.on("exit", (code) => {
+      if (settled) return; // Already resolved from the sentinel line — no-op.
+      settled = true;
+      if (code !== 0) {
+        reject(new Error(`stkxp deploy child process exited with code ${code}`));
+        return;
+      }
+      reject(new Error(`stkxp deploy child process exited cleanly (code 0) without printing a deploy result: ${stdout}`));
+    });
+
+    if (input !== undefined) {
+      child.stdin.write(input);
+    }
+    child.stdin.end();
+  });
+}

package/src/deploy.test.mjs

@@ -0,0 +1,131 @@
+// packages/cli/src/deploy.test.mjs
+//
+// Covers spawnAndAwaitJsonResult's promise-resolution contract (used by
+// runDeployCommand): it must resolve as soon as the child prints its
+// RESULT_SENTINEL-prefixed JSON line to stdout — even if the child then keeps
+// running forever (the real cli-deploy-run.js child boots a webhook server
+// and never exits on success) — must ignore non-sentinel log lines even when
+// they happen to be valid JSON, and must reject if the child exits without
+// ever printing a sentinel line.
+//
+// We spawn tiny inline `node -e "..."` scripts rather than the real
+// tsx + cli-deploy-run.js child, to keep this hermetic and fast.
+import { describe, it, expect, afterEach } from "vitest";
+import { spawnAndAwaitJsonResult, resolveTsxCli, RESULT_SENTINEL } from "./deploy.mjs";
+
+describe("resolveTsxCli", () => {
+  it("resolves tsx's CLI entry point as a real file path (no node_modules/.bin shim)", () => {
+    const resolved = resolveTsxCli();
+    expect(resolved).toMatch(/tsx[\\/]dist[\\/]cli\.mjs$/);
+    expect(resolved).not.toMatch(/node_modules[\\/]\.bin/);
+  });
+});
+
+describe("spawnAndAwaitJsonResult", () => {
+  let spawnedChildren = [];
+
+  afterEach(() => {
+    // Clean up any mock children left running (the "keeps running" case is
+    // expected to leave its child alive — don't leak processes across tests).
+    for (const child of spawnedChildren) {
+      if (!child.killed) child.kill();
+    }
+    spawnedChildren = [];
+  });
+
+  it("resolves with parsed JSON as soon as the child prints the sentinel line, without waiting for exit", async () => {
+    // Prints the sentinel result line, then blocks forever (setInterval keeps
+    // the event loop alive) — simulates the real deploy child staying up to
+    // serve the webhook.
+    const script = `
+      console.log(${JSON.stringify(RESULT_SENTINEL)} + JSON.stringify({ webhookUrl: "http://localhost:8081/hook", webhookToken: "tok" }));
+      setInterval(() => {}, 1000);
+    `;
+    let childHandle;
+    const resultPromise = spawnAndAwaitJsonResult("node", ["-e", script], {
+      onSpawn: (child) => { childHandle = child; spawnedChildren.push(child); },
+    });
+
+    const result = await Promise.race([
+      resultPromise,
+      new Promise((_, reject) => setTimeout(() => reject(new Error("timed out waiting for resolve")), 5000)),
+    ]);
+
+    expect(result).toEqual({ webhookUrl: "http://localhost:8081/hook", webhookToken: "tok" });
+    // The mock child is still running at this point (it never exited) —
+    // proving resolution happened without waiting for exit. It's cleaned up
+    // in afterEach via spawnedChildren.
+    expect(childHandle.exitCode).toBeNull();
+  });
+
+  it("ignores JSON-parseable log lines that lack the sentinel prefix", async () => {
+    const script = `
+      console.log(JSON.stringify({ level: "info", msg: "not the result" }));
+      console.log("plain log line");
+      console.log(${JSON.stringify(RESULT_SENTINEL)} + JSON.stringify({ webhookToken: "real" }));
+      setInterval(() => {}, 1000);
+    `;
+    const result = await Promise.race([
+      spawnAndAwaitJsonResult("node", ["-e", script], { onSpawn: (c) => spawnedChildren.push(c) }),
+      new Promise((_, reject) => setTimeout(() => reject(new Error("timed out waiting for resolve")), 5000)),
+    ]);
+    expect(result).toEqual({ webhookToken: "real" });
+  });
+
+  it("forwards the child's post-settle stdout to the parent's terminal instead of buffering it", async () => {
+    const script = `
+      console.log(${JSON.stringify(RESULT_SENTINEL)} + JSON.stringify({ ok: true }));
+      let n = 0;
+      const t = setInterval(() => { console.log("ongoing webhook log " + (++n)); if (n > 2) clearInterval(t); }, 20);
+      setInterval(() => {}, 1000);
+    `;
+    let childHandle;
+    const forwarded = [];
+    const realWrite = process.stdout.write.bind(process.stdout);
+    process.stdout.write = (chunk, ...rest) => {
+      forwarded.push(chunk.toString());
+      return realWrite(chunk, ...rest);
+    };
+    try {
+      const result = await spawnAndAwaitJsonResult("node", ["-e", script], {
+        onSpawn: (child) => { childHandle = child; spawnedChildren.push(child); },
+      });
+      expect(result).toEqual({ ok: true });
+      await new Promise((r) => setTimeout(r, 300));
+    } finally {
+      process.stdout.write = realWrite;
+    }
+    expect(forwarded.join("")).toContain("ongoing webhook log 1");
+    expect(childHandle.exitCode).toBeNull();
+  });
+
+  it("rejects if the child exits with a non-zero code before printing a result", async () => {
+    const script = `
+      console.error("boom before printing anything");
+      process.exit(3);
+    `;
+    await expect(spawnAndAwaitJsonResult("node", ["-e", script])).rejects.toThrow(
+      /exited with code 3/
+    );
+  });
+
+  it("rejects if the child exits with code 0 but never printed a sentinel line", async () => {
+    const script = `
+      console.log("just some log output, not JSON");
+      console.log(JSON.stringify({ json: "but no sentinel" }));
+    `;
+    await expect(spawnAndAwaitJsonResult("node", ["-e", script])).rejects.toThrow(
+      /exited cleanly \(code 0\) without printing a deploy result/
+    );
+  });
+
+  it("rejects if the sentinel line's payload is not parseable JSON", async () => {
+    const script = `
+      console.log(${JSON.stringify(RESULT_SENTINEL)} + "{not json");
+      setInterval(() => {}, 1000);
+    `;
+    await expect(
+      spawnAndAwaitJsonResult("node", ["-e", script], { onSpawn: (c) => spawnedChildren.push(c) }),
+    ).rejects.toThrow(/unparseable result line/);
+  });
+});

package/src/export.mjs

@@ -0,0 +1,30 @@
+// packages/cli/src/export.mjs
+//
+// `stkxp export` is pure networking: it calls the SOURCE stkxp-app instance's
+// POST /api/teams/:id/export-encrypted (already running, reachable over
+// HTTPS) with a JWT bearer token and the chosen passphrase, then writes the
+// returned encrypted bundle to a local file. It never touches the vendored
+// dist-server payload used by `stkxp deploy` — that only runs on the TARGET.
+import { writeFile } from "node:fs/promises";
+
+export async function runExport({ sourceUrl, token, teamId, secret, outFile }) {
+  const url = new URL(`/api/teams/${teamId}/export-encrypted`, sourceUrl);
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({ secret }),
+  });
+
+  const body = await response.json();
+  if (!response.ok || !body.success) {
+    throw new Error(`Export failed (${response.status}): ${body.error ?? response.statusText}`);
+  }
+
+  // 0600: the bundle carries every one of the team's credentials, encrypted
+  // but offline-crackable against the passphrase — don't leave it world-readable.
+  await writeFile(outFile, JSON.stringify(body.bundle, null, 2), { encoding: "utf8", mode: 0o600 });
+  return { outFile, rootName: body.bundle.rootName, totalDocs: body.bundle.summary.totalDocs };
+}

package/src/export.test.mjs

@@ -0,0 +1,56 @@
+// packages/cli/src/export.test.mjs
+import { describe, it, expect, afterEach, vi } from "vitest";
+import { mkdtemp, rm, stat, readFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { runExport } from "./export.mjs";
+
+const tmpDirs = [];
+async function tmpOut(name) {
+  const dir = await mkdtemp(path.join(tmpdir(), "stkxp-export-test-"));
+  tmpDirs.push(dir);
+  return path.join(dir, name);
+}
+
+afterEach(async () => {
+  vi.unstubAllGlobals();
+  await Promise.all(tmpDirs.splice(0).map((d) => rm(d, { recursive: true, force: true })));
+});
+
+function stubFetchOk(bundle) {
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => ({ ok: true, status: 200, statusText: "OK", json: async () => ({ success: true, bundle }) })),
+  );
+}
+
+describe("runExport", () => {
+  it("writes the bundle file owner-readable only (mode 0600)", async () => {
+    stubFetchOk({ rootName: "Ops Team", summary: { totalDocs: 3 } });
+    const outFile = await tmpOut("bundle.json");
+
+    await runExport({ sourceUrl: "https://app.example.com", token: "jwt", teamId: "team-1", secret: "pw", outFile });
+
+    const mode = (await stat(outFile)).mode & 0o777;
+    expect(mode.toString(8)).toBe("600");
+    expect(JSON.parse(await readFile(outFile, "utf8")).rootName).toBe("Ops Team");
+  });
+
+  it("returns the bundle summary", async () => {
+    stubFetchOk({ rootName: "Ops Team", summary: { totalDocs: 3 } });
+    const outFile = await tmpOut("bundle.json");
+    const result = await runExport({ sourceUrl: "https://app.example.com", token: "jwt", teamId: "team-1", secret: "pw", outFile });
+    expect(result).toEqual({ outFile, rootName: "Ops Team", totalDocs: 3 });
+  });
+
+  it("throws (without echoing the passphrase) when the source rejects the export", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => ({ ok: false, status: 403, statusText: "Forbidden", json: async () => ({ success: false, error: "not the owner" }) })),
+    );
+    const outFile = await tmpOut("bundle.json");
+    const promise = runExport({ sourceUrl: "https://app.example.com", token: "jwt", teamId: "team-1", secret: "super-secret-pw", outFile });
+    await expect(promise).rejects.toThrow(/Export failed \(403\): not the owner/);
+    await expect(promise).rejects.not.toThrow(/super-secret-pw/);
+  });
+});

package/src/secret-input.mjs

@@ -0,0 +1,64 @@
+// packages/cli/src/secret-input.mjs
+//
+// Resolves a secret (the bundle passphrase, the target ES password) WITHOUT
+// requiring it on the command line. Passing a secret as an argv flag leaks it
+// to every process on the box via `ps` / /proc/<pid>/cmdline and writes it
+// into the operator's shell history, so the flags are now optional and fall
+// back, in order, to:
+//   1. the explicit CLI flag (unchanged behaviour when given),
+//   2. an environment variable,
+//   3. an interactive prompt, when stdin is a TTY.
+// Nothing here logs, echoes, or persists the resolved value.
+import readline from "node:readline";
+
+/**
+ * Prompt on the TTY without echoing what is typed. Uses readline's
+ * _writeToOutput hook — the standard zero-dependency way to mask input; if a
+ * future Node drops it, the prompt degrades to visible input rather than
+ * failing (and we never add a dependency just for masking).
+ */
+export function promptHidden(question, { input = process.stdin, output = process.stdout } = {}) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input, output, terminal: true });
+    let masking = false;
+    rl._writeToOutput = function (chunk) {
+      if (masking) return; // Swallow the echo of typed characters entirely.
+      rl.output.write(chunk);
+    };
+    rl.question(question, (answer) => {
+      masking = false;
+      output.write("\n");
+      rl.close();
+      resolve(answer);
+    });
+    masking = true;
+  });
+}
+
+/**
+ * @param {object} args
+ * @param {string|undefined} args.flagValue  Value from the CLI flag, if given.
+ * @param {string} args.envVar               Env var name to fall back to.
+ * @param {string} args.promptLabel          Prompt text (never includes a value).
+ * @param {string} args.flagName             Flag name, for the error message only.
+ */
+export async function resolveSecret({
+  flagValue,
+  envVar,
+  promptLabel,
+  flagName,
+  env = process.env,
+  isTTY = process.stdin.isTTY,
+  prompt = promptHidden,
+}) {
+  if (flagValue) return flagValue;
+  if (env[envVar]) return env[envVar];
+  if (isTTY) {
+    const answer = (await prompt(promptLabel)).trim();
+    if (answer) return answer;
+  }
+  throw new Error(
+    `Missing ${flagName}. Provide it with ${flagName}, set ${envVar} in the environment, ` +
+      `or run this command from an interactive terminal to be prompted for it.`,
+  );
+}

package/src/secret-input.test.mjs

@@ -0,0 +1,58 @@
+// packages/cli/src/secret-input.test.mjs
+import { describe, it, expect, vi } from "vitest";
+import { resolveSecret } from "./secret-input.mjs";
+
+const base = { envVar: "STKXP_SECRET", promptLabel: "Passphrase: ", flagName: "--secret" };
+
+describe("resolveSecret", () => {
+  it("returns the CLI flag value when given, without reading the env or prompting", async () => {
+    const prompt = vi.fn();
+    const value = await resolveSecret({
+      ...base,
+      flagValue: "from-flag",
+      env: { STKXP_SECRET: "from-env" },
+      isTTY: true,
+      prompt,
+    });
+    expect(value).toBe("from-flag");
+    expect(prompt).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the environment variable when no flag is given", async () => {
+    const prompt = vi.fn();
+    const value = await resolveSecret({ ...base, flagValue: undefined, env: { STKXP_SECRET: "from-env" }, isTTY: true, prompt });
+    expect(value).toBe("from-env");
+    expect(prompt).not.toHaveBeenCalled();
+  });
+
+  it("prompts interactively when neither flag nor env var is present and stdin is a TTY", async () => {
+    const prompt = vi.fn().mockResolvedValue("  typed-secret  ");
+    const value = await resolveSecret({ ...base, flagValue: undefined, env: {}, isTTY: true, prompt });
+    expect(value).toBe("typed-secret");
+    expect(prompt).toHaveBeenCalledWith("Passphrase: ");
+  });
+
+  it("errors clearly (naming the flag and env var, never a value) when nothing is available and stdin is not a TTY", async () => {
+    await expect(
+      resolveSecret({ ...base, flagValue: undefined, env: {}, isTTY: false, prompt: vi.fn() }),
+    ).rejects.toThrow(/Missing --secret.*STKXP_SECRET/s);
+  });
+
+  it("errors when the interactive prompt yields an empty answer", async () => {
+    await expect(
+      resolveSecret({ ...base, flagValue: undefined, env: {}, isTTY: true, prompt: vi.fn().mockResolvedValue("   ") }),
+    ).rejects.toThrow(/Missing --secret/);
+  });
+
+  it("supports a distinct env var per secret (e.g. the ES password)", async () => {
+    const value = await resolveSecret({
+      flagValue: undefined,
+      envVar: "STKXP_ES_PASSWORD",
+      promptLabel: "ES password: ",
+      flagName: "--es-password",
+      env: { STKXP_ES_PASSWORD: "es-pw" },
+      isTTY: false,
+    });
+    expect(value).toBe("es-pw");
+  });
+});

package/src/serve.mjs

@@ -0,0 +1,83 @@
+// packages/cli/src/serve.mjs
+//
+// `stkxp serve` — starts the standalone webhook façade (the same
+// server/entrypoints/team-runner.ts façade already deployed in-fleet as PM2
+// process stkxp-team-runner) against an already-bootstrapped target
+// Elasticsearch cluster. Does NOT bootstrap — run `stkxp bootstrap` first.
+// Long-running and restart-safe: unlike `stkxp deploy`, this never mints a
+// token or writes to ES itself, so a crash/restart under
+// `docker restart: unless-stopped` is harmless — it just reconnects and
+// keeps serving whatever team(s) the target ES already has webhookEnabled.
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const CLI_ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const require = createRequire(import.meta.url);
+
+export function resolveTsxCli() {
+  return require.resolve("tsx/cli");
+}
+
+/** Pure: target-ES + bind env vars for the spawned team-runner.js child. Same TLS convention as cli-deploy.ts's bootstrapTeam(). */
+export function buildServeEnv({ esUrl, esUser, esPassword, esCaPath, esInsecure, port, host }) {
+  return {
+    ELASTICSEARCH_HOST: esUrl,
+    ELASTICSEARCH_USER: esUser,
+    ELASTICSEARCH_PASSWORD: esPassword,
+    ...(esCaPath ? { ELASTICSEARCH_CA_PATH: esCaPath } : {}),
+    ELASTICSEARCH_TLS_REJECT_UNAUTHORIZED: esInsecure === true ? "false" : "true",
+    TEAM_RUNNER_PORT: String(port),
+    TEAM_RUNNER_HOST: host,
+  };
+}
+
+/**
+ * Spawns `command args` with stdio inherited straight through (team-runner
+ * logs its own "listening on ..." line — there's no single JSON result to
+ * capture the way deploy/bootstrap have) and forwards SIGINT/SIGTERM to the
+ * child so its graceful-shutdown handler runs instead of the child being
+ * killed abruptly by `docker stop`. Resolves on a clean (code 0) exit,
+ * rejects otherwise — extracted from runServeCommand so it can be exercised
+ * in tests against a tiny hermetic mock child instead of the real
+ * (tsx + team-runner.js) child.
+ */
+export function spawnForeground(command, args, { env, onSpawn } = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      env: { ...process.env, ...env },
+      stdio: "inherit",
+    });
+    onSpawn?.(child);
+
+    const forwardSignal = (signal) => () => child.kill(signal);
+    const onSigint = forwardSignal("SIGINT");
+    const onSigterm = forwardSignal("SIGTERM");
+    process.on("SIGINT", onSigint);
+    process.on("SIGTERM", onSigterm);
+    const cleanupSignalForwarding = () => {
+      process.off("SIGINT", onSigint);
+      process.off("SIGTERM", onSigterm);
+    };
+
+    child.on("error", (err) => {
+      cleanupSignalForwarding();
+      reject(err);
+    });
+    child.on("exit", (code) => {
+      cleanupSignalForwarding();
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(`stkxp serve child process exited with code ${code}`));
+      }
+    });
+  });
+}
+
+export function runServeCommand({ esUrl, esUser, esPassword, esCaPath, esInsecure, port, host }) {
+  const runnerScript = path.join(CLI_ROOT, "vendor", "dist-server", "entrypoints", "team-runner.js");
+  const env = buildServeEnv({ esUrl, esUser, esPassword, esCaPath, esInsecure, port, host });
+  return spawnForeground(process.execPath, [resolveTsxCli(), runnerScript], { env });
+}

package/src/serve.test.mjs

@@ -0,0 +1,93 @@
+// packages/cli/src/serve.test.mjs
+import { describe, it, expect, afterEach } from "vitest";
+import { spawnForeground, buildServeEnv, resolveTsxCli } from "./serve.mjs";
+
+describe("resolveTsxCli", () => {
+  it("resolves tsx's CLI entry point as a real file path (no node_modules/.bin shim)", () => {
+    const resolved = resolveTsxCli();
+    expect(resolved).toMatch(/tsx[\\/]dist[\\/]cli\.mjs$/);
+    expect(resolved).not.toMatch(/node_modules[\\/]\.bin/);
+  });
+});
+
+describe("buildServeEnv", () => {
+  it("maps target-ES options to the ELASTICSEARCH_*/TEAM_RUNNER_* env vars team-runner.ts reads", () => {
+    expect(
+      buildServeEnv({ esUrl: "https://es:9200", esUser: "elastic", esPassword: "pw", port: 8081, host: "0.0.0.0" }),
+    ).toEqual({
+      ELASTICSEARCH_HOST: "https://es:9200",
+      ELASTICSEARCH_USER: "elastic",
+      ELASTICSEARCH_PASSWORD: "pw",
+      ELASTICSEARCH_TLS_REJECT_UNAUTHORIZED: "true",
+      TEAM_RUNNER_PORT: "8081",
+      TEAM_RUNNER_HOST: "0.0.0.0",
+    });
+  });
+
+  it("only disables TLS verification when esInsecure is explicitly true", () => {
+    const env = buildServeEnv({ esUrl: "x", esUser: "e", esPassword: "p", esInsecure: true, port: 1, host: "h" });
+    expect(env.ELASTICSEARCH_TLS_REJECT_UNAUTHORIZED).toBe("false");
+  });
+
+  it("includes ELASTICSEARCH_CA_PATH only when esCaPath is given", () => {
+    expect(buildServeEnv({ esUrl: "x", esUser: "e", esPassword: "p", port: 1, host: "h" })).not.toHaveProperty(
+      "ELASTICSEARCH_CA_PATH",
+    );
+    expect(
+      buildServeEnv({ esUrl: "x", esUser: "e", esPassword: "p", esCaPath: "/ca.pem", port: 1, host: "h" }),
+    ).toHaveProperty("ELASTICSEARCH_CA_PATH", "/ca.pem");
+  });
+});
+
+describe("spawnForeground", () => {
+  let spawnedChildren = [];
+
+  afterEach(() => {
+    for (const child of spawnedChildren) {
+      if (!child.killed) child.kill();
+    }
+    spawnedChildren = [];
+  });
+
+  it("resolves once the child exits cleanly (code 0)", async () => {
+    const result = await spawnForeground("node", ["-e", "process.exit(0)"], {
+      onSpawn: (c) => spawnedChildren.push(c),
+    });
+    expect(result).toBeUndefined();
+  });
+
+  it("rejects when the child exits with a non-zero code", async () => {
+    await expect(
+      spawnForeground("node", ["-e", "process.exit(3)"], { onSpawn: (c) => spawnedChildren.push(c) }),
+    ).rejects.toThrow(/exited with code 3/);
+  });
+
+  it("passes the given env through to the child", async () => {
+    const script = `process.exit(process.env.STKXP_TEST_VAR === "marker" ? 0 : 7)`;
+    await expect(
+      spawnForeground("node", ["-e", script], {
+        env: { STKXP_TEST_VAR: "marker" },
+        onSpawn: (c) => spawnedChildren.push(c),
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("forwards SIGTERM sent to this process to the child", async () => {
+    const script = `
+      process.on("SIGTERM", () => process.exit(0));
+      setInterval(() => {}, 1000);
+    `;
+    let childHandle;
+    const resultPromise = spawnForeground("node", ["-e", script], {
+      onSpawn: (c) => { childHandle = c; spawnedChildren.push(c); },
+    });
+    // Give the child a moment to install its SIGTERM handler before we send one.
+    await new Promise((r) => setTimeout(r, 150));
+    process.emit("SIGTERM");
+    await Promise.race([
+      resultPromise,
+      new Promise((_, reject) => setTimeout(() => reject(new Error("timed out waiting for forwarded SIGTERM")), 3000)),
+    ]);
+    expect(childHandle.exitCode).toBe(0);
+  });
+});

package/vendor/dist-server/asyncapi/generator.js

@@ -0,0 +1 @@
+import{OpenAPIRegistry as p,OpenApiGeneratorV3 as d,extendZodWithOpenApi as g}from"@asteasolutions/zod-to-openapi";import{z as l}from"zod";import{messages as i}from"./messages";import{BRAND_NAME as h}from"../core/app-config/branding";g(l);const c=(process.env.STKXP_APP_PUBLIC_URL||"https://localhost:3003").replace(/^https?:\/\//,"").replace(/\/$/,"");function y(){const s=new p;for(const n of i)s.register(n.name,n.schema);return new d(s.definitions).generateComponents()?.components?.schemas??{}}function f(s){return`${s.direction==="serverToClient"?"publish":"receive"}${s.name}`}function P(){const s=y(),t={},n={},o={};let r=0;for(const e of i){t[e.name]={name:e.name,title:e.summary,summary:e.summary,description:e.description,contentType:"application/json",payload:{schemaFormat:"application/vnd.oai.openapi+json;version=3.0.0",schema:s[e.name]??{type:"object"}},tags:e.tags?.map(a=>({name:a}))},n[e.name]={$ref:`#/components/messages/${e.name}`};const m=e.direction==="serverToClient"?"send":"receive";o[f(e)]={action:m,channel:{$ref:"#/channels/stream"},summary:e.summary,description:e.description,messages:[{$ref:`#/channels/stream/messages/${e.name}`}],tags:e.tags?.map(a=>({name:a}))},r++}return{doc:{asyncapi:"3.0.0",info:{title:`${h} App \u2014 WebSocket API`,version:"1.0.0",description:"Real-time streaming protocol used by the chat interface. Connect a WebSocket to `wss://"+c+"/?token=<JWT>` after logging in via `POST /api/auth/login`. Messages are JSON envelopes discriminated by a `type` field \u2014 only the message types declared in `server/asyncapi/messages.ts` appear in this spec."},servers:{main:{host:c,protocol:"wss",pathname:"/",description:"WebSocket chat handler. Authenticate with a `?token=<JWT>` query param."}},channels:{stream:{address:"/",title:"Chat stream",description:"Single WebSocket carrying both client\u2192server commands and server\u2192client streaming events. Messages are discriminated by the `type` field.",messages:n}},operations:o,components:{messages:t}},stats:{registered:r}}}export{P as buildAsyncApiDocument};