@vendure/cloud 0.2.0 → 0.3.0

package/dist/cli/commands/runtime-data/seeds.js

@@ -0,0 +1,213 @@
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { basename } from "node:path";
+import * as prompts from "@clack/prompts";
+import { cloudInvocation, createAuthenticatedClient, formatBytes, formatDateTime, formatTable, requiredArgument, resolveEnvironment, sleep, } from "../../index.js";
+import { SEED_CONTENT_TYPE, SEED_UPLOAD_PRECONDITION_HEADER, SEED_UPLOAD_PRECONDITION_VALUE, isValidSeedName, } from "../../lib/contract/seeds.js";
+const POLL_INTERVAL_MS = 3_000;
+// Long enough for a real dump. The apply runs as a task in the environment's Cell and the platform
+// stops it at its own, longer deadline, so a client giving up here abandons the wait rather than the
+// work: the operation goes on and its outcome is on the record the id names.
+const APPLY_TIMEOUT_MS = 60 * 60 * 1000;
+// Postgres restore does not repopulate the search index — that runs separately
+// (CLO-220 automates it). Until then, tell the operator search is empty.
+const SEARCH_WARNING = "The search index was not rebuilt. Products won't appear in search until a reindex runs (Admin UI → Products → reindex, or your app's reindex job).";
+export async function pushSeed({ args, globals }) {
+    const name = requiredArgument(args, 0, "name");
+    const file = requiredArgument(args, 1, "file");
+    assertValidSeedName(name);
+    if (!file.endsWith(".gz")) {
+        throw new Error(`Seed artifacts must be gzipped plain-SQL ('.gz'). "${basename(file)}" does not end with .gz.`);
+    }
+    const info = await stat(file).catch(() => {
+        throw new Error(`File not found: ${file}`);
+    });
+    if (!info.isFile()) {
+        throw new Error(`Not a file: ${file}`);
+    }
+    const client = createAuthenticatedClient(globals);
+    const spinner = globals.json ? null : prompts.spinner();
+    spinner?.start(`Uploading ${basename(file)} as seed "${name}"...`);
+    // Request a short-lived presigned upload URL, then PUT the bytes straight to
+    // storage — the CLI never holds bucket credentials. Two signed headers must be
+    // echoed exactly: the Content-Type the URL was signed with, and the create-only
+    // precondition, which is part of the signature rather than a header the client
+    // may choose. The file is streamed (not buffered) with a known Content-Length,
+    // so a multi-GB dump never has to fit in the CLI's memory.
+    const ticket = await client.post(`/seeds/${encodeURIComponent(name)}/upload-url`);
+    // `duplex: "half"` is required when the body is a stream but isn't in the DOM
+    // RequestInit type; the intersection lets us pass it without a cast.
+    const uploadInit = {
+        method: "PUT",
+        headers: {
+            "content-type": SEED_CONTENT_TYPE,
+            "content-length": String(info.size),
+            [SEED_UPLOAD_PRECONDITION_HEADER]: SEED_UPLOAD_PRECONDITION_VALUE,
+        },
+        body: fileToWebStream(file),
+        duplex: "half",
+    };
+    const response = await fetch(ticket.uploadUrl, uploadInit);
+    if (response.status === 412) {
+        spinner?.stop("Upload rejected");
+        throw new Error(`A seed named "${name}" already exists. Delete it first with \`${cloudInvocation()} seed rm ${name}\`, or use a different name.`);
+    }
+    if (!response.ok) {
+        spinner?.stop("Upload failed");
+        throw new Error(`Upload failed: HTTP ${response.status} ${response.statusText}`);
+    }
+    spinner?.stop("Upload complete.");
+    if (globals.json) {
+        writeCompactJson({ name, sizeBytes: info.size });
+        return;
+    }
+    prompts.log.success(`Seed "${name}" uploaded (${formatBytes(info.size)}).`);
+    prompts.log.info(`Apply it with \`${cloudInvocation()} seed apply ${name} -e <environment>\`.`);
+}
+export async function listSeeds({ globals }) {
+    const client = createAuthenticatedClient(globals);
+    // In JSON mode, keep stdout to the machine-readable payload only — no spinner
+    // or notes, which clack writes to stdout and would corrupt the output.
+    const spinner = globals.json ? null : prompts.spinner();
+    spinner?.start("Fetching seeds...");
+    const seeds = await client.get("/seeds");
+    spinner?.stop("Done.");
+    if (globals.json) {
+        writeCompactJson(seeds);
+        return;
+    }
+    if (seeds.length === 0) {
+        prompts.log.info(`No seeds yet. Upload one with \`${cloudInvocation()} seed push <name> <file.gz>\`.`);
+        return;
+    }
+    const rows = seeds
+        .slice()
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .map((s) => [s.name, formatBytes(s.sizeBytes), formatDateTime(s.updatedAt)]);
+    prompts.note(formatTable(["NAME", "SIZE", "UPDATED"], rows), "Seeds");
+    prompts.log.info(`Apply one with \`${cloudInvocation()} seed apply <name> -e <environment>\`.`);
+}
+export async function applySeed({ args, options, globals }) {
+    const name = requiredArgument(args, 0, "name");
+    assertValidSeedName(name);
+    // Applying a seed overwrites the environment's entire database, so confirm
+    // unless `--yes`. JSON / non-interactive callers must pass `--yes` — checked
+    // before resolving the environment so it fails fast without a network call.
+    const needsConfirmation = options.yes !== true;
+    if (needsConfirmation && (globals.json || !process.stdin.isTTY)) {
+        throw new Error("Applying a seed overwrites all data in the target environment. Re-run with --yes to proceed non-interactively.");
+    }
+    const { project, environment } = await resolveEnvironment(globals);
+    if (needsConfirmation) {
+        const confirmed = await prompts.confirm({
+            initialValue: false,
+            message: `Apply seed "${name}" to ${project.slug} / ${environment.slug}? All current data in the database will be overwritten.`,
+        });
+        if (prompts.isCancel(confirmed) || !confirmed) {
+            prompts.log.info("Apply cancelled.");
+            return;
+        }
+    }
+    const client = createAuthenticatedClient(globals);
+    const spinner = globals.json ? null : prompts.spinner();
+    spinner?.start(`Applying seed "${name}" to ${project.slug} / ${environment.slug}...`);
+    let started;
+    try {
+        started = await client.post(`/environments/${environment.id}/seed`, { name });
+    }
+    catch (error) {
+        spinner?.stop("Seed could not be started");
+        throw error;
+    }
+    const startTime = Date.now();
+    let current = { operationId: started.operationId, status: "pending" };
+    while (current.status === "pending") {
+        if (Date.now() - startTime > APPLY_TIMEOUT_MS) {
+            spinner?.stop("Seeding is taking longer than expected");
+            throw new Error(`Seed apply ${started.operationId} has not finished after an hour. It is still running, and Vendure Cloud will finish or stop it on its own — do not deploy this environment or apply another seed to it until then.`);
+        }
+        await sleep(POLL_INTERVAL_MS);
+        current = await client.get(`/environments/${environment.id}/seed/${encodeURIComponent(started.operationId)}`);
+    }
+    if (current.status !== "success") {
+        spinner?.stop("Seed apply failed");
+        // The control plane's own sentence when it has one — it is written for a customer and says what
+        // to do next. The status alone is the fallback, for a control plane that predates the field.
+        throw new Error(current.errorDetails ??
+            `Seed apply ${started.operationId} ended with status "${current.status}".`);
+    }
+    spinner?.stop("Seed applied.");
+    if (globals.json) {
+        writeCompactJson({
+            operationId: current.operationId,
+            status: current.status,
+            environmentId: environment.id,
+        });
+        return;
+    }
+    prompts.log.success(`Seed "${name}" applied to ${project.slug} / ${environment.slug}.`);
+    prompts.log.warn(SEARCH_WARNING);
+}
+export async function removeSeed({ args, options, globals }) {
+    const name = requiredArgument(args, 0, "name");
+    assertValidSeedName(name);
+    // A seed can be referenced by an environment's config, so confirm before
+    // deleting. `--yes` bypasses for scripts; JSON mode has no TTY to prompt on and
+    // therefore requires `--yes`.
+    if (options.yes !== true) {
+        if (globals.json || !process.stdin.isTTY) {
+            throw new Error(`Refusing to delete seed "${name}" without confirmation — pass --yes.`);
+        }
+        const confirmed = await prompts.confirm({
+            initialValue: false,
+            message: `Delete seed "${name}"? Environments configured to use it will fail to seed until it is replaced.`,
+        });
+        if (prompts.isCancel(confirmed) || !confirmed) {
+            prompts.log.info("Deletion cancelled.");
+            return;
+        }
+    }
+    const client = createAuthenticatedClient(globals);
+    const result = await client.delete(`/seeds/${encodeURIComponent(name)}`);
+    if (globals.json) {
+        writeCompactJson(result);
+        return;
+    }
+    prompts.log.success(`Seed "${result.name}" deleted.`);
+}
+// Client-side pre-validation for a fast, clear error; the control plane is the
+// authority. Delegates to the single seed-name rule the wire contract carries
+// (CLO-217) so the two never drift.
+function assertValidSeedName(name) {
+    if (!isValidSeedName(name)) {
+        throw new Error(`Invalid seed name "${name}". Use lowercase letters, numbers and hyphens (max 63 characters), e.g. "flowtech-preview-slim".`);
+    }
+}
+// One line, no indentation. `writeJson` pretty-prints, which is what `resource` has always written
+// and what these four have never written; a script reading a seed command's stdout line by line
+// would stop working on the change.
+function writeCompactJson(value) {
+    process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+// Bridges a file read stream to a web ReadableStream for a streaming upload body,
+// so a multi-GB dump is never held in memory. Driving the file's async iterator
+// from `pull` gives natural backpressure — a chunk is only read when the upload
+// consumer asks for one.
+function fileToWebStream(path) {
+    const iterator = createReadStream(path)[Symbol.asyncIterator]();
+    return new ReadableStream({
+        async pull(controller) {
+            const { done, value } = await iterator.next();
+            if (done) {
+                controller.close();
+            }
+            else {
+                controller.enqueue(value);
+            }
+        },
+        async cancel() {
+            await iterator.return?.();
+        },
+    });
+}
+//# sourceMappingURL=seeds.js.map

package/dist/cli/commands/runtime-data/seeds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeds.js","sourceRoot":"","sources":["../../../../src/cli/commands/runtime-data/seeds.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAEL,eAAe,EACf,yBAAyB,EACzB,WAAW,EACX,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,GACN,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,+BAA+B,EAC/B,8BAA8B,EAM9B,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAErC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,mGAAmG;AACnG,qGAAqG;AACrG,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,+EAA+E;AAC/E,yEAAyE;AACzE,MAAM,cAAc,GAClB,oJAAoJ,CAAC;AAEvJ,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAqB;IACjE,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,sDAAsD,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QACvC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,CAAC;IAEnE,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,+EAA+E;IAC/E,+EAA+E;IAC/E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,UAAU,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAChD,CAAC;IAEF,8EAA8E;IAC9E,qEAAqE;IACrE,MAAM,UAAU,GAAqC;QACnD,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,cAAc,EAAE,iBAAiB;YACjC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACnC,CAAC,+BAA+B,CAAC,EAAE,8BAA8B;SAClE;QACD,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC;QAC3B,MAAM,EAAE,MAAM;KACf,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,4CAA4C,eAAe,EAAE,YAAY,IAAI,8BAA8B,CACjI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,OAAO,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAElC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,gBAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,eAAe,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,eAAe,EAAE,eAAe,IAAI,sBAAsB,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,OAAO,EAAqB;IAC5D,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAElD,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAe,QAAQ,CAAC,CAAC;IACvD,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEvB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,mCAAmC,eAAe,EAAE,gCAAgC,CACrF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,KAAK;SACf,KAAK,EAAE;SACP,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAE/E,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,eAAe,EAAE,wCAAwC,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAqB;IAC3E,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;IAC/C,IAAI,iBAAiB,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEnE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACtC,YAAY,EAAE,KAAK;YACnB,OAAO,EAAE,eAAe,IAAI,QAAQ,OAAO,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI,yDAAyD;SAChI,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,EAAE,KAAK,CAAC,kBAAkB,IAAI,QAAQ,OAAO,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC;IAEtF,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAkB,iBAAiB,WAAW,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAoB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEvF,OAAO,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,gBAAgB,EAAE,CAAC;YAC9C,OAAO,EAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,cAAc,OAAO,CAAC,WAAW,oLAAoL,CACtN,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CACxB,iBAAiB,WAAW,CAAC,EAAE,SAAS,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACnC,gGAAgG;QAChG,6FAA6F;QAC7F,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,YAAY;YAClB,cAAc,OAAO,CAAC,WAAW,uBAAuB,OAAO,CAAC,MAAM,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,gBAAgB,CAAC;YACf,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,aAAa,EAAE,WAAW,CAAC,EAAE;SAC9B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,OAAO,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAqB;IAC5E,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,yEAAyE;IACzE,gFAAgF;IAChF,8BAA8B;IAC9B,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,sCAAsC,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACtC,YAAY,EAAE,KAAK;YACnB,OAAO,EAAE,gBAAgB,IAAI,8EAA8E;SAC5G,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAqB,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7F,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC;AACxD,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,oCAAoC;AACpC,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,kGAAkG,CAC7H,CAAC;IACJ,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,gGAAgG;AAChG,oCAAoC;AACpC,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,kFAAkF;AAClF,gFAAgF;AAChF,gFAAgF;AAChF,yBAAyB;AACzB,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAChE,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,IAAI,EAAE,CAAC;gBACT,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/runtime-data/tunnel.d.ts

@@ -0,0 +1,16 @@
+import { type ApiClient, type CloudCommandInput } from "../../index.js";
+import type { TunnelTicket } from "../../lib/contract/database.js";
+export interface TunnelHandle {
+    port: number;
+    database: TunnelTicket["database"];
+    close: () => Promise<void>;
+}
+export declare function buildConnectionString(database: TunnelTicket["database"], port: number): string;
+export declare function openDatabaseTunnel({ options, globals }: CloudCommandInput): Promise<number>;
+export declare function startDbTunnel(options: {
+    client: ApiClient;
+    environmentId: string;
+    apiUrl: string;
+    requestedPort?: number;
+}): Promise<TunnelHandle>;
+//# sourceMappingURL=tunnel.d.ts.map

package/dist/cli/commands/runtime-data/tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/runtime-data/tunnel.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,SAAS,EACd,KAAK,iBAAiB,EAKvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAenE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAiBD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9F;AAED,wBAAsB,kBAAkB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CjG;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,YAAY,CAAC,CA6BxB"}

package/dist/cli/commands/runtime-data/tunnel.js

@@ -0,0 +1,249 @@
+import net from "node:net";
+import * as prompts from "@clack/prompts";
+import { createAuthenticatedClient, getApiUrl, logger, resolveEnvironment, } from "../../index.js";
+// Local tunnel to the environment database. Per accepted TCP connection the
+// CLI mints a single-use ticket over HTTPS and opens one WebSocket to the
+// control plane, which relays to the database. The ticket travels as the
+// FIRST WS message — never in the URL.
+//
+// Uses the runtime's built-in WebSocket, which Node has had since 22.
+const DEFAULT_PORT = 5432;
+// Gateway close codes (mirror apps/control-plane database-tunnel.gateway.ts).
+const CLOSE_IDLE_TIMEOUT = 4410;
+const CLOSE_MAX_DURATION = 4411;
+// Local connection string for the tunnel. The relay is a transparent pipe and
+// TLS is negotiated end-to-end with the database (ADR-0006), so the client must
+// request TLS — `sslmode=require` (not `verify-full`), because the client dials
+// 127.0.0.1 and the cert belongs to the remote DB: encrypt without hostname
+// verification.
+//
+// This is libpq semantics (psql and other libpq clients consume this string),
+// where `require` means "encrypt, do not verify the CA". The managed app runs
+// node-postgres, whose `PGSSLMODE` handling differs — there the equivalent value
+// is `no-verify`, injected as a managed env var (ADR-0011). Same intent, different
+// driver: don't unify the two values.
+//
+// Host is `127.0.0.1`, not `localhost`: the listener binds IPv4 loopback, and
+// `localhost` resolves to IPv6 (`::1`) first on many systems — a client using it
+// would miss the tunnel (and may hit a local Postgres bound on `::1:5432`).
+export function buildConnectionString(database, port) {
+    const sslSuffix = database.tlsEnabled ? "?sslmode=require" : "";
+    return `postgres://${encodeURIComponent(database.username)}:${encodeURIComponent(database.password)}@127.0.0.1:${port}/${encodeURIComponent(database.database)}${sslSuffix}`;
+}
+export async function openDatabaseTunnel({ options, globals }) {
+    const requestedPort = readPort(options.port);
+    const { project, environment } = await resolveEnvironment(globals);
+    const client = createAuthenticatedClient(globals);
+    const spinner = prompts.spinner();
+    spinner.start(`Opening tunnel to ${project.slug} / ${environment.slug} database...`);
+    let handle;
+    try {
+        handle = await startDbTunnel({
+            client,
+            environmentId: environment.id,
+            apiUrl: getApiUrl(),
+            requestedPort,
+        });
+    }
+    catch (error) {
+        spinner.stop("Could not open tunnel");
+        throw error;
+    }
+    const { database, port } = handle;
+    const connectionString = buildConnectionString(database, port);
+    // Printed as plain lines, not a boxed note: the connection string is long
+    // enough to overflow a clack note box and fragment its borders.
+    spinner.stop(`Tunnel open on 127.0.0.1:${port}`);
+    prompts.log.message(connectionString);
+    prompts.log.info("Press Ctrl-C to close the tunnel.");
+    // The command runs until Ctrl-C — the net server holds the event loop — and then answers with
+    // the code the host exits on. `vcloud` called `process.exit` from the signal handler itself;
+    // answering instead leaves the exiting where every other command in this family leaves it, and
+    // is what makes the teardown observable from a test.
+    return await new Promise((resolve) => {
+        process.once("SIGINT", () => {
+            void handle
+                .close()
+                .then(() => {
+                prompts.outro("Tunnel closed.");
+                resolve(0);
+            })
+                // Never hang on Ctrl-C: if teardown rejects, answer non-zero anyway.
+                .catch(() => resolve(1));
+        });
+    });
+}
+export async function startDbTunnel(options) {
+    const { client, environmentId, apiUrl, requestedPort } = options;
+    // The first ticket is minted purely to validate access and fetch the
+    // connection credentials — every TCP connection mints its own.
+    const initial = await client.post(`/environments/${environmentId}/database/tunnel-tickets`);
+    const wsUrl = `${apiUrl.replace(/^http/, "ws")}${initial.wsPath}`;
+    const activeSockets = new Set();
+    const server = net.createServer((socket) => {
+        activeSockets.add(socket);
+        socket.on("close", () => activeSockets.delete(socket));
+        void relayConnection(socket, client, environmentId, wsUrl);
+    });
+    const port = await listenWithFallback(server, requestedPort);
+    return {
+        port,
+        database: initial.database,
+        close: async () => {
+            for (const socket of activeSockets) {
+                socket.destroy();
+            }
+            await new Promise((resolve) => server.close(() => resolve()));
+        },
+    };
+}
+async function relayConnection(socket, client, environmentId, wsUrl) {
+    // Buffer client bytes (psql sends its startup packet immediately) until
+    // the relay is ready. The data listener is attached right away and the queue
+    // is kept here rather than left to pause()/resume(), so no byte can arrive
+    // while the socket is paused and be dropped by the runtime underneath.
+    let ready = false;
+    let wsSend = null;
+    const pending = [];
+    let closed = false;
+    let activeWs = null;
+    // Idempotent teardown, wired before the ticket-mint await below. The `error`
+    // listener must exist from the start: a net.Socket with no 'error' handler
+    // throws on a peer RST, and during the mint window there is no other handler —
+    // an early RST would otherwise crash the relay. `activeWs` is null until the
+    // mint resolves and the WS is created; teardown closes it once it exists. The
+    // `closed` flag also lets us skip opening a doomed WS if the client went away
+    // mid-mint.
+    const teardown = () => {
+        // Re-entrant: the `activeWs.close()` below can dispatch the WS `error` event
+        // synchronously, whose listener calls teardown again (CLO-550).
+        if (closed) {
+            return;
+        }
+        closed = true;
+        socket.destroy();
+        if (activeWs &&
+            (activeWs.readyState === WebSocket.OPEN || activeWs.readyState === WebSocket.CONNECTING)) {
+            activeWs.close();
+        }
+    };
+    socket.on("error", teardown);
+    socket.on("close", teardown);
+    socket.on("data", (chunk) => {
+        if (ready && wsSend) {
+            wsSend(chunk);
+        }
+        else {
+            pending.push(chunk);
+        }
+    });
+    let ticket;
+    try {
+        ticket = await client.post(`/environments/${environmentId}/database/tunnel-tickets`);
+    }
+    catch (error) {
+        logger.warn({ error: error instanceof Error ? error.message : error }, "Tunnel ticket mint failed");
+        prompts.log.warn("Connection rejected — could not authorize the tunnel.");
+        teardown();
+        return;
+    }
+    if (closed) {
+        return;
+    }
+    const ws = new WebSocket(wsUrl);
+    activeWs = ws;
+    ws.binaryType = "arraybuffer";
+    ws.addEventListener("open", () => {
+        ws.send(JSON.stringify({ ticket: ticket.ticket }));
+    });
+    ws.addEventListener("message", (event) => {
+        if (!ready) {
+            // First message is the relay handshake.
+            if (typeof event.data === "string") {
+                try {
+                    const message = JSON.parse(event.data);
+                    if (message &&
+                        typeof message === "object" &&
+                        message.type === "ready") {
+                        ready = true;
+                        wsSend = (chunk) => ws.send(chunk);
+                        for (const chunk of pending) {
+                            wsSend(chunk);
+                        }
+                        pending.length = 0;
+                        return;
+                    }
+                }
+                catch {
+                    // Fall through — unexpected handshake, tear down.
+                }
+            }
+            logger.warn({ data: String(event.data) }, "Unexpected tunnel handshake message");
+            teardown();
+            return;
+        }
+        if (typeof event.data === "string") {
+            return; // Control messages after handshake are ignored.
+        }
+        socket.write(Buffer.from(event.data));
+    });
+    ws.addEventListener("close", (event) => {
+        if (!ready && event.code !== 1000) {
+            prompts.log.warn("Connection rejected by the tunnel endpoint.");
+            logger.warn({ code: event.code, reason: event.reason }, "Tunnel WS closed before ready");
+        }
+        else if (event.code === CLOSE_IDLE_TIMEOUT) {
+            prompts.log.warn("Connection closed: idle timeout. Reconnect to continue.");
+        }
+        else if (event.code === CLOSE_MAX_DURATION) {
+            prompts.log.warn("Connection closed: maximum tunnel duration reached. Reconnect to continue.");
+        }
+        socket.destroy();
+    });
+    ws.addEventListener("error", () => {
+        logger.warn("Tunnel WS error");
+        teardown();
+    });
+}
+// `--port` is declared with a mandatory value, so the host hands over the string the customer
+// typed or nothing at all. Anything else is a shape this command did not declare.
+function readPort(value) {
+    if (value === undefined)
+        return undefined;
+    const port = typeof value === "string" ? Number.parseInt(value, 10) : Number.NaN;
+    if (Number.isNaN(port) || port < 0 || port > 65535) {
+        throw new Error(`Invalid port "${String(value)}".`);
+    }
+    return port;
+}
+async function listenWithFallback(server, requestedPort) {
+    const preferred = requestedPort ?? DEFAULT_PORT;
+    try {
+        await listen(server, preferred);
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? error.code : undefined;
+        if (requestedPort !== undefined || (code !== "EADDRINUSE" && code !== "EACCES")) {
+            throw error;
+        }
+        prompts.log.warn(`Port ${preferred} is in use — picking a free port.`);
+        await listen(server, 0);
+    }
+    return server.address().port;
+}
+function listen(server, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.removeListener("listening", onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.removeListener("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, "127.0.0.1");
+    });
+}
+//# sourceMappingURL=tunnel.js.map

package/dist/cli/commands/runtime-data/tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.js","sourceRoot":"","sources":["../../../../src/cli/commands/runtime-data/tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAGL,yBAAyB,EACzB,SAAS,EACT,MAAM,EACN,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,uCAAuC;AACvC,EAAE;AACF,sEAAsE;AAEtE,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAQhC,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,4EAA4E;AAC5E,gBAAgB;AAChB,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,mFAAmF;AACnF,sCAAsC;AACtC,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB,CAAC,QAAkC,EAAE,IAAY;IACpF,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO,cAAc,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,SAAS,EAAE,CAAC;AAC/K,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAqB;IAC9E,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,qBAAqB,OAAO,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI,cAAc,CAAC,CAAC;IAErF,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,CAAC;YAC3B,MAAM;YACN,aAAa,EAAE,WAAW,CAAC,EAAE;YAC7B,MAAM,EAAE,SAAS,EAAE;YACnB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC/D,0EAA0E;IAC1E,gEAAgE;IAChE,OAAO,CAAC,IAAI,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAEtD,8FAA8F;IAC9F,6FAA6F;IAC7F,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QAC3C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC1B,KAAK,MAAM;iBACR,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE;gBACT,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBAChC,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC,CAAC;gBACF,qEAAqE;iBACpE,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAKnC;IACC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAEjE,qEAAqE;IACrE,+DAA+D;IAC/D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAC/B,iBAAiB,aAAa,0BAA0B,CACzD,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAElE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,KAAK,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE7D,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;gBACnC,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAkB,EAClB,MAAiB,EACjB,aAAqB,EACrB,KAAa;IAEb,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,MAAM,GAAqC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,QAAQ,GAAqB,IAAI,CAAC;IAEtC,6EAA6E;IAC7E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,YAAY;IACZ,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,6EAA6E;QAC7E,gEAAgE;QAChE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,IACE,QAAQ;YACR,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,CAAC,EACxF,CAAC;YACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1B,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CACxB,iBAAiB,aAAa,0BAA0B,CACzD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,EACzD,2BAA2B,CAC5B,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAC1E,QAAQ,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;IAChC,QAAQ,GAAG,EAAE,CAAC;IACd,EAAE,CAAC,UAAU,GAAG,aAAa,CAAC;IAE9B,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,wCAAwC;YACxC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChD,IACE,OAAO;wBACP,OAAO,OAAO,KAAK,QAAQ;wBAC1B,OAA8B,CAAC,IAAI,KAAK,OAAO,EAChD,CAAC;wBACD,KAAK,GAAG,IAAI,CAAC;wBACb,MAAM,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;4BAC5B,MAAM,CAAC,KAAK,CAAC,CAAC;wBAChB,CAAC;wBACD,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;wBACnB,OAAO;oBACT,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kDAAkD;gBACpD,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qCAAqC,CAAC,CAAC;YACjF,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO,CAAC,gDAAgD;QAC1D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAmB,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC3F,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/B,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8FAA8F;AAC9F,kFAAkF;AAClF,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACjF,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,aAAsB;IAC1E,MAAM,SAAS,GAAG,aAAa,IAAI,YAAY,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;YAChF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,SAAS,mCAAmC,CAAC,CAAC;QACvE,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAQ,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,MAAM,CAAC,MAAkB,EAAE,IAAY;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;YACrC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/host-arguments.d.ts

@@ -0,0 +1,7 @@
+export interface CommandContext {
+    inheritedOptions: Record<string, unknown>;
+    commandPath: string[];
+}
+export declare function readCommandContext(args: readonly unknown[]): CommandContext;
+export declare function readCommandOptions(args: readonly unknown[]): Record<string, unknown>;
+//# sourceMappingURL=host-arguments.d.ts.map

package/dist/cli/host-arguments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-arguments.d.ts","sourceRoot":"","sources":["../../src/cli/host-arguments.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAID,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,cAAc,CAe3E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQpF"}

package/dist/cli/host-arguments.js

@@ -0,0 +1,46 @@
+// Reading what a CLI host passed a command action.
+//
+// The Vendure CLI host appends three values after everything Commander supplies — the parsed
+// options, the Commander command, then its own context — and reads them back by counting from the
+// end. `@vendure/cli` exports `readCommandContext` and `readCommandOptions` for that, and this is a
+// restatement of them rather than a call to them.
+//
+// It is a restatement for the same reason `dev/cli-host.ts` is one, and for one more. The first:
+// `import("@vendure/cli")` answers with whichever copy sits nearest this package, which in a
+// workspace is not always the copy that is running, so reading the convention from it proves
+// nothing about the host that actually called. Reaching the running host needs a helper it does not
+// expose (CLO-646). The second: the same actions run under the transitional `vcloud` executable,
+// which is not the Vendure CLI and does not install it — resolving the host there would fail on a
+// customer's machine, and bundling it would pull the whole Vendure CLI, `vite` and `ts-morph`
+// included, into a standalone binary that never runs any of it.
+//
+// A restated convention is a cross-component claim, so it is held by a test rather than by this
+// comment: `test/cli-host-arguments.test.ts` reads the same argument list with these and with the
+// host's own exported readers and requires the same answer.
+const CONTEXT_FROM_END = 1;
+const OPTIONS_FROM_END = 3;
+// Throws rather than defaulting, because a tail that is not there is a calling convention that has
+// moved. A command run with the wrong context would resolve the wrong VC Environment.
+export function readCommandContext(args) {
+    const context = args[args.length - CONTEXT_FROM_END];
+    if (!isPlainObject(context) || !Array.isArray(context.commandPath)) {
+        throw new Error("No CliCommandContext found. Pass the full argument list a command action received.");
+    }
+    const commandPath = context.commandPath.filter((segment) => typeof segment === "string");
+    const inheritedOptions = context.inheritedOptions;
+    return {
+        inheritedOptions: isPlainObject(inheritedOptions) ? inheritedOptions : {},
+        commandPath,
+    };
+}
+export function readCommandOptions(args) {
+    const options = args[args.length - OPTIONS_FROM_END];
+    if (!isPlainObject(options)) {
+        throw new Error("No parsed options found. Pass the full argument list a command action received.");
+    }
+    return options;
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=host-arguments.js.map

package/dist/cli/host-arguments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-arguments.js","sourceRoot":"","sources":["../../src/cli/host-arguments.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,6FAA6F;AAC7F,kGAAkG;AAClG,oGAAoG;AACpG,kDAAkD;AAClD,EAAE;AACF,iGAAiG;AACjG,6FAA6F;AAC7F,6FAA6F;AAC7F,oGAAoG;AACpG,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,gEAAgE;AAChE,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,4DAA4D;AAE5D,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAO3B,mGAAmG;AACnG,sFAAsF;AACtF,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAC5C,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ,CAC5D,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAClD,OAAO;QACL,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;QACzE,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC;IACrD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/cli/host-nodes.d.ts

@@ -0,0 +1,30 @@
+export interface CloudCommandArgument {
+    name: string;
+    description: string;
+    required?: boolean;
+}
+export interface CloudCommandOption {
+    long: string;
+    short?: string;
+    description: string;
+    required?: boolean;
+    defaultValue?: string;
+    subOptions?: CloudCommandOption[];
+}
+export type CloudCommandAction = (...args: unknown[]) => Promise<void | number>;
+export interface CloudCommand {
+    name: string;
+    description: string;
+    arguments?: CloudCommandArgument[];
+    options?: CloudCommandOption[];
+    action: CloudCommandAction;
+    subcommands?: CloudCommandNode[];
+}
+export interface CloudCommandGroupNode {
+    name: string;
+    description: string;
+    options?: CloudCommandOption[];
+    subcommands: CloudCommandNode[];
+}
+export type CloudCommandNode = CloudCommand | CloudCommandGroupNode;
+//# sourceMappingURL=host-nodes.d.ts.map

package/dist/cli/host-nodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-nodes.d.ts","sourceRoot":"","sources":["../../src/cli/host-nodes.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACnC;AAMD,MAAM,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;AAKhF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAClC;AAGD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC/B,WAAW,EAAE,gBAAgB,EAAE,CAAC;CACjC;AAED,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAAG,qBAAqB,CAAC"}

package/dist/cli/host-nodes.js

@@ -0,0 +1,17 @@
+// The Vendure CLI host's command shape, restated rather than imported from `@vendure/cli`.
+//
+// Loading the CLI plugin must resolve no package, and that covers a type-only import. TypeScript
+// erases one, so it cannot fail a `vendure` run, but it still has to resolve the specifier to
+// compile. `@vendure/cli` is an optional peer dependency here, and `apps/vc-builder/Dockerfile`
+// compiles this package on its own — where an import that resolves only inside the workspace shows
+// up as TS2307. `test/cli-published-surface.test.ts` counts a type-only reach for that reason.
+//
+// Only as much of the host's shape as this package fills in. `replaces` is absent because it takes
+// over a built-in `vendure` command; the `dev` extension is the only thing here that does that, and
+// a hosted Cloud command that set it would displace a Core command silently.
+//
+// Nothing keeps these in step with the host by construction. The suites that hand the declared tree
+// to the host's own `defineCliPlugin` do: `test/cli-plugin.test.ts` for the whole inventory,
+// `test/cli-boundary.test.ts` and each family's tree suite for the parts.
+export {};
+//# sourceMappingURL=host-nodes.js.map

package/dist/cli/host-nodes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-nodes.js","sourceRoot":"","sources":["../../src/cli/host-nodes.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,EAAE;AACF,iGAAiG;AACjG,8FAA8F;AAC9F,gGAAgG;AAChG,mGAAmG;AACnG,+FAA+F;AAC/F,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,6EAA6E;AAC7E,EAAE;AACF,oGAAoG;AACpG,6FAA6F;AAC7F,0EAA0E"}