affect-cli 0.0.3 → 0.0.4

package/README.md

@@ -10,12 +10,27 @@ bunx --no-install affect --help
 Run commands from the application repository root:
 
 - `affect env` prints shell exports from `env/{development,preview,production,ci}/.env`. It requires the matching `DOTENV_PRIVATE_KEY` when that file exists. Treat its output as secrets.
+- `affect env sync-dev [--force]` reads only `env/development/.env` with its matching `DOTENV_PRIVATE_KEY` and synchronizes declared server settings to its verified hosted development backend. It never deploys code or builds the frontend. It ignores inherited CI, production, account-token and provider-host selection. Missing required settings fail; absent optional settings preserve remote values; explicit empty strings remain values. Existing differing values refuse the entire batch unless `--force` is supplied. Omission never deletes a remote setting. Output contains only the verified target and setting counts.
 - `affect run -- <command> [args...]` loads that environment and runs a command. Existing environment values take precedence; arguments, standard I/O, and exit codes are preserved.
 - `affect dotenvx -- …` forwards arguments to the bundled native dotenvx CLI, for example `affect dotenvx -- encrypt -f env/development/.env --no-armor --no-native`.
 - `affect setup` initializes an anonymous local Convex backend only for a fresh project, or retries its environment import. It preserves existing linked deployments and credentials.
 - `affect deploy` uses Convex's native deploy/build sequence, imports the selected backend environment, and builds the frontend. Vercel supplies `VERCEL_ENV=preview|production` and the preview branch name automatically; put the matching deploy key in the encrypted file. `--build` is its internal Convex callback.
 
-Selection uses `VERCEL_ENV`, then `ci` for GitHub Actions/CI, otherwise `development`. Files stay in the application; cryptography stays in dotenvx. Deployment follows Affect's `apps/web` layout.
+Except for the explicitly development-only `env sync-dev`, selection uses `VERCEL_ENV`, then `ci` for GitHub Actions/CI, otherwise `development`. Files stay in the application; cryptography stays in dotenvx. Deployment follows Affect's `apps/web` layout.
+
+`env sync-dev` requires a declaration-only `convex/env.config.ts` with a default Convex `EnvDefinition` export. Share that same object with `defineApp({ env })`; keep it independent of generated files, app/component initialization and runtime environment reads. The Bun-only CLI loads this trusted module directly. It does not execute `convex.config.ts` or generate an allowlist from source text. For example:
+
+```ts
+import type { EnvDefinition } from "convex/server";
+import { v } from "convex/values";
+
+export default {
+  API_TOKEN: v.string(),
+  OPTIONAL_SETTING: v.optional(v.string()),
+} satisfies EnvDefinition;
+```
+
+Use the profile's development-scoped deploy key and canonical public Convex cloud/site origins. Before any update the command verifies the provider's cloud/development identity, owning team/project and both canonical URLs. Reserved credential/control/client-public names are rejected even if declared. Only present declared server settings are sent, using the native Convex JSON environment API without temporary plaintext files; native Convex remains responsible for provider limits and application value validation. The command needs metadata and environment read/write permissions; it does not create credentials or fall back to a broader login. Profile values use the same dotenvx decryption and interpolation as `affect env`.
 
 For example, an application's package scripts can load their environment automatically:
 

package/dist/index.js

@@ -1684,6 +1684,7 @@ var normalize = (n) => n > 0 ? Math.floor(n) : 0;
 // node_modules/effect/dist/Result.js
 var succeed2 = succeed;
 var fail2 = fail;
+var failVoid = /* @__PURE__ */ fail2(undefined);
 var try_ = (evaluate) => {
   if (isFunction(evaluate)) {
     try {
@@ -1841,6 +1842,17 @@ var contains = /* @__PURE__ */ containsWith(/* @__PURE__ */ asEquivalence());
 var empty2 = () => [];
 var of = (a) => [a];
 var map3 = /* @__PURE__ */ dual(2, (self, f) => self.map(f));
+var filterMap = /* @__PURE__ */ dual(2, (self, f) => {
+  const as = fromIterable(self);
+  const out = [];
+  for (let i = 0;i < as.length; i++) {
+    const result = f(as[i], i);
+    if (isSuccess2(result)) {
+      out.push(result.success);
+    }
+  }
+  return out;
+});
 var filter = /* @__PURE__ */ dual(2, (self, predicate) => {
   const as = fromIterable(self);
   const out = [];
@@ -3475,6 +3487,7 @@ var flatMapEager = /* @__PURE__ */ dual(2, (self, f) => {
   }
   return flatMap2(self, f);
 });
+var flatten2 = (self) => flatMap2(self, identity);
 var map4 = /* @__PURE__ */ dual(2, (self, f) => new ContImpl(self, mapCont, f));
 var mapEager = /* @__PURE__ */ dual(2, (self, f) => effectIsExit(self) ? exitMap(self, f) : map4(self, f));
 var mapErrorEager = /* @__PURE__ */ dual(2, (self, f) => effectIsExit(self) ? exitMapError(self, f) : mapError(self, f));
@@ -5059,6 +5072,7 @@ var try_3 = try_2;
 var withFiber2 = withFiber;
 var fromResult2 = fromResult;
 var flatMap3 = flatMap2;
+var flatten3 = flatten2;
 var andThen2 = andThen;
 var tap2 = tap;
 var exit2 = exit;
@@ -12485,6 +12499,45 @@ function isBase64(annotations) {
     ...annotations
   });
 }
+function makeIsGreaterThan(options) {
+  const gt = isGreaterThan(options.order);
+  const formatter = options.formatter ?? format;
+  return (exclusiveMinimum, annotations) => {
+    return makeFilter2((input) => gt(input, exclusiveMinimum), {
+      expected: `a value greater than ${formatter(exclusiveMinimum)}`,
+      arbitraryConstraint: {
+        order: options.order,
+        minimum: exclusiveMinimum,
+        exclusiveMinimum: true
+      },
+      ...options.annotate?.(exclusiveMinimum),
+      ...annotations
+    });
+  };
+}
+function encodeNumberPayload(number) {
+  if (!globalThis.Number.isFinite(number)) {
+    throw new globalThis.RangeError(`Expected a finite number, got ${format(number)}`);
+  }
+  return number;
+}
+var isGreaterThan2 = /* @__PURE__ */ makeIsGreaterThan({
+  order: Number2,
+  annotate: (exclusiveMinimum) => ({
+    representation: {
+      id: "effect/schema/isGreaterThan",
+      payload: {
+        exclusiveMinimum: encodeNumberPayload(exclusiveMinimum)
+      }
+    },
+    toJsonSchema: () => ({
+      exclusiveMinimum
+    }),
+    toCode: () => ({
+      runtime: `Schema.isGreaterThan(${format(exclusiveMinimum)})`
+    })
+  })
+});
 function isInt(annotations) {
   return makeFilter2((n) => globalThis.Number.isSafeInteger(n), {
     expected: "an integer",
@@ -12614,6 +12667,7 @@ var URL2 = /* @__PURE__ */ instanceOf(globalThis.URL, {
   expected: "URL",
   toCodecJson: () => link3()(URLString, urlFromString)
 });
+var URLFromString = /* @__PURE__ */ URLString.pipe(/* @__PURE__ */ decodeTo2(URL2, urlFromString));
 var File = /* @__PURE__ */ instanceOf(globalThis.File, {
   representation: {
     id: "effect/schema/File",
@@ -13649,7 +13703,7 @@ var Custom = (initialState, ...args) => {
   op.events = events;
   return op;
 };
-var Date4 = (options) => {
+var Date5 = (options) => {
   const opts = {
     initial: new globalThis.Date,
     dateMask: "YYYY-MM-DD HH:mm:ss",
@@ -18141,7 +18195,7 @@ var promptSingle = (single) => {
       })), commandLineArg);
     }
     case "Date":
-      return map6(run3(Date4({
+      return map6(run3(Date5({
         message
       })), (date) => commandLineArg(date.toISOString()));
     case "Finite":
@@ -18519,7 +18573,7 @@ var runWith2 = (command, config) => {
   }) => andThen2(showUserError(error, userMessage), fail7(error))), catchFilter2((e) => isQuitError(e) ? succeed2(e) : fail2(e), (_) => interrupt2));
 };
 // package.json
-var version = "0.0.3";
+var version = "0.0.4";
 // node_modules/effect/dist/http/HttpBody.js
 var TypeId35 = "~effect/http/HttpBody";
 var HttpBodyErrorTypeId = "~effect/http/HttpBody/HttpBodyError";
@@ -18804,6 +18858,7 @@ var make32 = (method) => (url, options) => modify(empty8, {
   url,
   ...options ?? undefined
 });
+var get4 = /* @__PURE__ */ make32("GET");
 var post = /* @__PURE__ */ make32("POST");
 var modify = /* @__PURE__ */ dual(2, (self, options) => {
   let result = self;
@@ -19645,9 +19700,111 @@ var setup = fn2("Setup.run")(function* setup() {
   return yield* log("Local Convex setup complete.");
 });
 
+// src/sync-dev.ts
+var failure = (cause) => new UserError({ cause });
+var reserved = /^(?:CONVEX_|DOTENV_|NEXT_PUBLIC_|PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|VERCEL_|GITHUB_|NODE_|BUN_|AFFECT_|CI$|PATH$|HOME$|PWD$|SHELL$|ENV$|TMPDIR$|(?:HTTPS?|ALL|NO)_PROXY$)/u;
+var SettingName = String5.check(makeFilter2((name) => !reserved.test(name)));
+var Declaration2 = Record(String5, Struct({
+  isConvexValidator: Literal2(true),
+  isOptional: Literals(["required", "optional"])
+}));
+var Origin = URLFromString.check(makeFilter2((url) => url.protocol === "https:" && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === ""));
+var Profile = Struct({
+  CONVEX_DEPLOY_KEY: String5.check(isPattern2(/^dev:[a-z0-9-]+\|.+$/u)),
+  NEXT_PUBLIC_CONVEX_SITE_URL: Origin,
+  NEXT_PUBLIC_CONVEX_URL: Origin
+});
+var Slug = String5.check(isPattern2(/^[a-z0-9][a-z0-9_-]*$/u));
+var Id = Int.check(isGreaterThan2(0));
+var Identity = Struct({ project: Slug, projectId: Id, team: Slug, teamId: Id });
+var Deployment = Struct({
+  deploymentType: Literal2("dev"),
+  id: Id,
+  kind: Literal2("cloud"),
+  projectId: Id,
+  teamId: Id
+});
+var CanonicalUrls = Struct({ convexCloudUrl: Origin, convexSiteUrl: Origin });
+var Existing = Struct({
+  environmentVariables: Record(String5, String5)
+});
+var request = fn2("DevelopmentEnv.request")(function* request(url, authorization, body) {
+  const client = yield* HttpClient;
+  const base = setHeader(body === undefined ? get4(url) : post(url), "Authorization", authorization);
+  const outgoing = body === undefined ? base : yield* bodyJson(base, body);
+  const response = yield* client.execute(outgoing);
+  if (response.status !== 200) {
+    return yield* failure("Development environment request failed.");
+  }
+  return response;
+}, mapError2(() => failure("Development environment request failed.")));
+var json2 = (schema, response) => response.json.pipe(flatMap3(decodeUnknownEffect2(schema)), mapError2(() => failure("Invalid development deployment metadata.")));
+var syncDev = fn2("DevelopmentEnv.sync")(function* syncDev(force) {
+  const path = yield* Path;
+  const fs = yield* FileSystem;
+  const file = path.resolve("env", "development", ".env");
+  if (!(yield* fs.exists(file))) {
+    return yield* failure("Missing env/development/.env.");
+  }
+  yield* NonEmptyString2("DOTENV_PRIVATE_KEY").pipe(mapError2(() => failure("Set the matching development DOTENV_PRIVATE_KEY.")));
+  const values = yield* read2(file);
+  const profile = yield* decodeUnknownEffect2(Profile)(values).pipe(mapError2(() => failure("Development profile requires a dev-scoped key and HTTPS Convex origins.")));
+  const name = profile.CONVEX_DEPLOY_KEY.split("|")[0]?.slice(4);
+  if ((values["CONVEX_DEPLOYMENT"] ?? "") !== "" && values["CONVEX_DEPLOYMENT"] !== `dev:${name}`) {
+    return yield* failure("CONVEX_DEPLOYMENT does not match the development key.");
+  }
+  const declarationModule = yield* try_3({
+    catch: () => failure("Cannot load the declaration-only convex/env.config.ts."),
+    try: () => decodeUnknownEffect2(Struct({ default: Declaration2 }))(import.meta.require(path.resolve("convex", "env.config.ts")))
+  }).pipe(flatten3, mapError2(() => failure("Cannot load a valid declaration-only convex/env.config.ts with Convex validators.")));
+  const declaration = declarationModule.default;
+  yield* decodeEffect2(ArraySchema(SettingName))(keys(declaration)).pipe(mapError2(() => failure("Server declaration contains a credential, control or client-public name.")));
+  const entries = toEntries(declaration);
+  const missing = filter(entries, ([key, validator]) => validator.isOptional === "required" && !has(values, key));
+  if (missing.length > 0) {
+    return yield* failure(`Missing required server settings: ${join(map3(missing, ([key]) => key), ", ")}.`);
+  }
+  const selected = filterMap(entries, ([key]) => {
+    const value = has(values, key) ? values[key] : undefined;
+    return value === undefined ? failVoid : succeed2({ name: key, value });
+  });
+  const key = profile.CONVEX_DEPLOY_KEY;
+  const bearer = `Bearer ${key}`;
+  const lookup = { deployKey: key };
+  const cloud = yield* json2(Origin, yield* request("https://api.convex.dev/api/deployment/url_for_key", bearer, lookup));
+  if (cloud.origin !== profile.NEXT_PUBLIC_CONVEX_URL.origin) {
+    return yield* failure("Development key and public Convex URL do not match.");
+  }
+  const identity = yield* json2(Identity, yield* request("https://api.convex.dev/api/deployment/team_and_project_for_key", bearer, lookup));
+  const authorization = `Convex ${key}`;
+  const deployment = yield* json2(Deployment, yield* request(`${cloud.origin}/api/v1/deployment_info`, authorization));
+  if (deployment.teamId !== identity.teamId || deployment.projectId !== identity.projectId) {
+    return yield* failure("Development deployment identity does not match the key.");
+  }
+  const urls = yield* json2(CanonicalUrls, yield* request(`${cloud.origin}/api/v1/get_canonical_urls`, authorization));
+  if (urls.convexCloudUrl.origin !== cloud.origin || urls.convexSiteUrl.origin !== profile.NEXT_PUBLIC_CONVEX_SITE_URL.origin) {
+    return yield* failure("Development canonical Convex URLs do not match the profile.");
+  }
+  yield* error(`Convex target: ${identity.team}/${identity.project}; development ${name} (ID ${deployment.id}).`);
+  const existing = yield* json2(Existing, yield* request(`${cloud.origin}/api/v1/list_environment_variables`, authorization));
+  const changed = filter(selected, (entry) => !has(existing.environmentVariables, entry.name) || existing.environmentVariables[entry.name] !== entry.value);
+  const conflicts = filter(changed, (entry) => has(existing.environmentVariables, entry.name));
+  if (!force && conflicts.length > 0) {
+    return yield* failure(`Existing settings differ: ${join(map3(conflicts, (entry) => entry.name), ", ")}. Use --force to overwrite them.`);
+  }
+  if (changed.length > 0) {
+    yield* request(`${cloud.origin}/api/v1/update_environment_variables`, authorization, {
+      changes: changed
+    });
+  }
+  return yield* log(`Development settings: ${changed.length - conflicts.length} added, ${conflicts.length} updated, ${selected.length - changed.length} unchanged.`);
+}, provide3(layer11), provideService2(RequestInit, { redirect: "error" }));
+
 // src/index.ts
 var program = make30("affect").pipe(withDescription3("Environment and deployment commands for Affect applications."), withSubcommands([
-  make30("env", {}, () => exports().pipe(flatMap3(log))).pipe(withDescription3("Print shell exports for the selected encrypted environment.")),
+  make30("env", {}, () => exports().pipe(flatMap3(log))).pipe(withDescription3("Print shell exports for the selected encrypted environment."), withSubcommands([
+    make30("sync-dev", { force: Boolean6("force").pipe(withDefault5(false)) }, ({ force }) => syncDev(force)).pipe(withDescription3("Sync declared server settings to the verified hosted development backend; --force overwrites conflicts. No deployment."))
+  ])),
   make30("run", {
     command: String10("command"),
     params: String10("args").pipe(variadic2())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "affect-cli",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "description": "Affect command-line interface",
   "homepage": "https://github.com/ludicroushq/affect-cli#readme",
   "bugs": {