alepha 0.18.2 → 0.18.3

package/src/cli/platform/index.ts

@@ -1,17 +1,12 @@
 import { $module } from "alepha";
-import {
-  AlephaCli,
-  type AlephaCliConfig,
-  registerConfigProcessor,
-} from "alepha/cli";
+import { AlephaCli } from "alepha/cli";
 import { CloudflareAdapter } from "./adapters/CloudflareAdapter.ts";
 import { DockerAdapter } from "./adapters/DockerAdapter.ts";
 import { VercelAdapter } from "./adapters/VercelAdapter.ts";
-import {
-  type PlatformOptions,
-  platformOptions,
-} from "./atoms/platformOptions.ts";
 import { PlatformCommand } from "./commands/platform.ts";
+import { SecretsCommand } from "./commands/SecretsCommand.ts";
+import { GitHubSecretStore } from "./providers/GitHubSecretStore.ts";
+import { MemorySecretStore } from "./providers/MemorySecretStore.ts";
 import { PlatformCacheProvider } from "./providers/PlatformCacheProvider.ts";
 import { CloudflareApi } from "./services/CloudflareApi.ts";
 import { DockerComposeGenerator } from "./services/DockerComposeGenerator.ts";
@@ -19,29 +14,11 @@ import { DockerSshService } from "./services/DockerSshService.ts";
 import { NamingService } from "./services/NamingService.ts";
 import { PlatformInspector } from "./services/PlatformInspector.ts";
 import { PlatformOrchestrator } from "./services/PlatformOrchestrator.ts";
+import { SecretFilterService } from "./services/SecretFilterService.ts";
 import { VercelApi } from "./services/VercelApi.ts";
 import { VercelCli } from "./services/VercelCli.ts";
 import { WranglerApi } from "./services/WranglerApi.ts";
 
-// ---------------------------------------------------------------------------
-// Module augmentation — extends AlephaCliConfig with platform options
-// ---------------------------------------------------------------------------
-
-declare module "alepha/cli" {
-  interface AlephaCliConfig {
-    /**
-     * Platform deployment configuration.
-     */
-    platform?: PlatformOptions;
-  }
-}
-
-registerConfigProcessor((alepha: any, config: AlephaCliConfig) => {
-  if (config.platform) {
-    alepha.set(platformOptions, config.platform);
-  }
-});
-
 // ---------------------------------------------------------------------------
 
 export const AlephaCliPlatform = $module({
@@ -49,6 +26,7 @@ export const AlephaCliPlatform = $module({
   services: [
     AlephaCli,
     PlatformCommand,
+    SecretsCommand,
     CloudflareAdapter,
     CloudflareApi,
     DockerAdapter,
@@ -59,7 +37,10 @@ export const AlephaCliPlatform = $module({
     VercelCli,
     WranglerApi,
     PlatformCacheProvider,
+    GitHubSecretStore,
+    MemorySecretStore,
     NamingService,
+    SecretFilterService,
     PlatformInspector,
     PlatformOrchestrator,
   ],
@@ -73,7 +54,11 @@ export * from "./adapters/PlatformAdapter.ts";
 export * from "./adapters/VercelAdapter.ts";
 export * from "./atoms/platformOptions.ts";
 export * from "./commands/platform.ts";
+export * from "./commands/SecretsCommand.ts";
+export * from "./providers/GitHubSecretStore.ts";
+export * from "./providers/MemorySecretStore.ts";
 export * from "./providers/PlatformCacheProvider.ts";
+export * from "./providers/SecretStoreProvider.ts";
 export * from "./schemas/cloudflare.ts";
 export * from "./schemas/platform.ts";
 export * from "./schemas/vercel.ts";
@@ -83,6 +68,7 @@ export * from "./services/DockerSshService.ts";
 export * from "./services/NamingService.ts";
 export * from "./services/PlatformInspector.ts";
 export * from "./services/PlatformOrchestrator.ts";
+export * from "./services/SecretFilterService.ts";
 export * from "./services/VercelApi.ts";
 export * from "./services/VercelCli.ts";
 export * from "./services/WranglerApi.ts";

package/src/cli/platform/providers/GitHubSecretStore.spec.ts

@@ -0,0 +1,153 @@
+import { Alepha } from "alepha";
+import {
+  FileSystemProvider,
+  MemoryFileSystemProvider,
+  MemoryShellProvider,
+  ShellProvider,
+} from "alepha/system";
+import { describe, test } from "vitest";
+import { GitHubSecretStore } from "./GitHubSecretStore.ts";
+
+describe("GitHubSecretStore", () => {
+  const createTestEnv = () => {
+    const alepha = Alepha.create()
+      .with({
+        provide: ShellProvider,
+        use: MemoryShellProvider,
+      })
+      .with({
+        provide: FileSystemProvider,
+        use: MemoryFileSystemProvider,
+      });
+
+    const shell = alepha.inject(MemoryShellProvider);
+    const fs = alepha.inject(MemoryFileSystemProvider);
+    const store = alepha.inject(GitHubSecretStore);
+
+    return { alepha, shell, fs, store };
+  };
+
+  describe("ensureAvailable", () => {
+    test("succeeds when gh is installed and authenticated", async ({
+      expect,
+    }) => {
+      const { shell, store } = createTestEnv();
+      shell.installedCommands.add("gh");
+      shell.outputs.set("gh auth status", "Logged in");
+
+      await expect(store.ensureAvailable()).resolves.not.toThrow();
+    });
+
+    test("throws when gh is not installed", async ({ expect }) => {
+      const { store } = createTestEnv();
+
+      await expect(store.ensureAvailable()).rejects.toThrow(
+        "GitHub CLI (gh) is not installed",
+      );
+    });
+
+    test("throws when gh is not authenticated", async ({ expect }) => {
+      const { shell, store } = createTestEnv();
+      shell.installedCommands.add("gh");
+      shell.errors.set("gh auth status", "Not logged in");
+
+      await expect(store.ensureAvailable()).rejects.toThrow(
+        "GitHub CLI is not authenticated",
+      );
+    });
+  });
+
+  describe("list", () => {
+    test("parses JSON output from gh", async ({ expect }) => {
+      const { shell, store } = createTestEnv();
+      shell.outputs.set(
+        "gh secret list --env app-production --json name,updatedAt",
+        JSON.stringify([
+          { name: "API_KEY", updatedAt: "2026-01-01T00:00:00Z" },
+          { name: "DATABASE_URL", updatedAt: "2026-01-02T00:00:00Z" },
+        ]),
+      );
+
+      const result = await store.list("app-production");
+
+      expect(result).toEqual([
+        { name: "API_KEY", updatedAt: "2026-01-01T00:00:00Z" },
+        { name: "DATABASE_URL", updatedAt: "2026-01-02T00:00:00Z" },
+      ]);
+    });
+
+    test("returns empty array when no secrets", async ({ expect }) => {
+      const { shell, store } = createTestEnv();
+      shell.outputs.set(
+        "gh secret list --env app-staging --json name,updatedAt",
+        "[]",
+      );
+
+      const result = await store.list("app-staging");
+      expect(result).toEqual([]);
+    });
+
+    test("returns empty array on error", async ({ expect }) => {
+      const { shell, store } = createTestEnv();
+      shell.errors.set(
+        "gh secret list --env bad-env --json name,updatedAt",
+        "Environment not found",
+      );
+
+      const result = await store.list("bad-env");
+      expect(result).toEqual([]);
+    });
+  });
+
+  describe("set", () => {
+    test("writes dotenv file and calls gh secret set --env-file", async ({
+      expect,
+    }) => {
+      const { shell, fs, store } = createTestEnv();
+
+      await store.set("app-production", "API_KEY", "abc123");
+
+      // Should write dotenv format
+      const written = fs.writeFileCalls.find((c) =>
+        /\/tmp\/alepha-secret-API_KEY-/.test(c.path),
+      );
+      expect(written).toBeDefined();
+      expect(written!.data).toBe('API_KEY="abc123"\n');
+
+      // Should call gh with --env-file (no positional secret name)
+      expect(
+        shell.wasCalledMatching(
+          /gh secret set -f \/tmp\/alepha-secret-API_KEY-\d+ --env app-production/,
+        ),
+      ).toBe(true);
+
+      // Temp file should be cleaned up
+      expect(
+        fs.rmCalls.some((c) => /\/tmp\/alepha-secret-API_KEY-/.test(c.path)),
+      ).toBe(true);
+    });
+
+    test("escapes special characters in value", async ({ expect }) => {
+      const { fs, store } = createTestEnv();
+
+      await store.set("app-production", "KEY", 'val"ue\nwith\\special');
+
+      const written = fs.writeFileCalls.find((c) =>
+        /\/tmp\/alepha-secret-KEY-/.test(c.path),
+      );
+      expect(written!.data).toBe('KEY="val\\"ue\\nwith\\\\special"\n');
+    });
+  });
+
+  describe("delete", () => {
+    test("calls gh secret delete with correct args", async ({ expect }) => {
+      const { shell, store } = createTestEnv();
+
+      await store.delete("app-production", "OLD_KEY");
+
+      expect(
+        shell.wasCalled("gh secret delete OLD_KEY --env app-production"),
+      ).toBe(true);
+    });
+  });
+});

package/src/cli/platform/providers/GitHubSecretStore.ts

@@ -0,0 +1,112 @@
+import { $inject, AlephaError } from "alepha";
+import { $logger } from "alepha/logger";
+import { FileSystemProvider, ShellProvider } from "alepha/system";
+import type {
+  RemoteSecret,
+  SecretStoreProvider,
+} from "./SecretStoreProvider.ts";
+
+/**
+ * GitHub Actions secret store backed by the `gh` CLI.
+ *
+ * Requires the GitHub CLI (`gh`) to be installed and authenticated.
+ * Pushes secrets into GitHub Actions environments.
+ */
+export class GitHubSecretStore implements SecretStoreProvider {
+  protected readonly log = $logger();
+  protected readonly shell = $inject(ShellProvider);
+  protected readonly fs = $inject(FileSystemProvider);
+
+  /**
+   * Verify that `gh` is installed and authenticated.
+   */
+  public async ensureAvailable(): Promise<void> {
+    const installed = await this.shell.isInstalled("gh");
+    if (!installed) {
+      throw new AlephaError(
+        "GitHub CLI (gh) is not installed. Install it from https://cli.github.com",
+      );
+    }
+
+    try {
+      await this.shell.run("gh auth status", { capture: true });
+    } catch {
+      throw new AlephaError(
+        "GitHub CLI is not authenticated. Run `gh auth login` first.",
+      );
+    }
+  }
+
+  /**
+   * Create the GitHub Actions environment if it doesn't exist.
+   */
+  public async ensureEnvironment(environment: string): Promise<void> {
+    await this.shell.run(
+      `gh api --method PUT /repos/{owner}/{repo}/environments/${environment} --silent`,
+      { capture: true },
+    );
+    this.log.debug(`Ensured environment "${environment}" exists`);
+  }
+
+  /**
+   * List all secrets in a GitHub Actions environment.
+   */
+  public async list(environment: string): Promise<RemoteSecret[]> {
+    try {
+      const output = await this.shell.run(
+        `gh secret list --env ${environment} --json name,updatedAt`,
+        { capture: true },
+      );
+
+      const parsed = JSON.parse(output || "[]") as Array<{
+        name: string;
+        updatedAt?: string;
+      }>;
+
+      return parsed.map((s) => ({
+        name: s.name,
+        updatedAt: s.updatedAt,
+      }));
+    } catch (error) {
+      this.log.debug("Failed to list secrets", { environment, error });
+      return [];
+    }
+  }
+
+  /**
+   * Set a secret in a GitHub Actions environment.
+   *
+   * Writes a dotenv-formatted file and uses `gh secret set --env-file` to
+   * avoid shell pipe issues with NodeShellProvider escaping the `|` character.
+   */
+  public async set(
+    environment: string,
+    key: string,
+    value: string,
+  ): Promise<void> {
+    const tmpFile = `/tmp/alepha-secret-${key}-${Date.now()}`;
+    const escaped = value
+      .replace(/\\/g, "\\\\")
+      .replace(/"/g, '\\"')
+      .replace(/\n/g, "\\n");
+    await this.fs.writeFile(tmpFile, `${key}="${escaped}"\n`);
+    try {
+      const output = await this.shell.run(
+        `gh secret set -f ${tmpFile} --env ${environment}`,
+        { capture: true },
+      );
+      this.log.debug(`Secret set: ${key}`, { output });
+    } finally {
+      await this.fs.rm(tmpFile);
+    }
+  }
+
+  /**
+   * Delete a secret from a GitHub Actions environment.
+   */
+  public async delete(environment: string, key: string): Promise<void> {
+    await this.shell.run(`gh secret delete ${key} --env ${environment}`, {
+      capture: true,
+    });
+  }
+}

package/src/cli/platform/providers/MemorySecretStore.ts

@@ -0,0 +1,114 @@
+import type {
+  RemoteSecret,
+  SecretStoreProvider,
+} from "./SecretStoreProvider.ts";
+
+export interface MemorySecretStoreCall {
+  method: "ensureAvailable" | "ensureEnvironment" | "list" | "set" | "delete";
+  environment?: string;
+  key?: string;
+  value?: string;
+}
+
+/**
+ * In-memory implementation of SecretStoreProvider for testing.
+ * Records all operations and stores secrets in a nested Map.
+ */
+export class MemorySecretStore implements SecretStoreProvider {
+  /**
+   * Secrets keyed by environment, then by key.
+   */
+  public secrets = new Map<string, Map<string, string>>();
+
+  /**
+   * All recorded operations.
+   */
+  public calls: MemorySecretStoreCall[] = [];
+
+  /**
+   * When set, ensureAvailable() will throw with this message.
+   */
+  public availableError: string | null = null;
+
+  public async ensureAvailable(): Promise<void> {
+    this.calls.push({ method: "ensureAvailable" });
+    if (this.availableError) {
+      throw new Error(this.availableError);
+    }
+  }
+
+  public async ensureEnvironment(environment: string): Promise<void> {
+    this.calls.push({ method: "ensureEnvironment", environment });
+    if (!this.secrets.has(environment)) {
+      this.secrets.set(environment, new Map());
+    }
+  }
+
+  public async list(environment: string): Promise<RemoteSecret[]> {
+    this.calls.push({ method: "list", environment });
+    const envSecrets = this.secrets.get(environment);
+    if (!envSecrets) return [];
+
+    return Array.from(envSecrets.keys()).map((name) => ({ name }));
+  }
+
+  public async set(
+    environment: string,
+    key: string,
+    value: string,
+  ): Promise<void> {
+    this.calls.push({ method: "set", environment, key, value });
+
+    let envSecrets = this.secrets.get(environment);
+    if (!envSecrets) {
+      envSecrets = new Map();
+      this.secrets.set(environment, envSecrets);
+    }
+    envSecrets.set(key, value);
+  }
+
+  public async delete(environment: string, key: string): Promise<void> {
+    this.calls.push({ method: "delete", environment, key });
+    this.secrets.get(environment)?.delete(key);
+  }
+
+  /**
+   * Check if set() was called for a given environment and key.
+   */
+  public wasSet(environment: string, key: string): boolean {
+    return this.calls.some(
+      (c) =>
+        c.method === "set" && c.environment === environment && c.key === key,
+    );
+  }
+
+  /**
+   * Check if delete() was called for a given environment and key.
+   */
+  public wasDeleted(environment: string, key: string): boolean {
+    return this.calls.some(
+      (c) =>
+        c.method === "delete" && c.environment === environment && c.key === key,
+    );
+  }
+
+  /**
+   * Get all set() calls for a given environment.
+   */
+  public getSetCalls(
+    environment: string,
+  ): Array<{ key: string; value: string }> {
+    return this.calls
+      .filter((c) => c.method === "set" && c.environment === environment)
+      .map((c) => ({ key: c.key!, value: c.value! }));
+  }
+
+  /**
+   * Reset all state.
+   */
+  public reset(): void {
+    this.secrets.clear();
+    this.calls = [];
+    this.availableError = null;
+  }
+}

package/src/cli/platform/providers/SecretStoreProvider.ts

@@ -0,0 +1,39 @@
+/**
+ * A secret stored in a remote secret store.
+ */
+export interface RemoteSecret {
+  name: string;
+  updatedAt?: string;
+}
+
+/**
+ * Abstract provider for managing secrets in an external store.
+ *
+ * Implementations: GitHubSecretStore, MemorySecretStore
+ */
+export abstract class SecretStoreProvider {
+  /**
+   * Verify the backing store is reachable and authenticated.
+   */
+  abstract ensureAvailable(): Promise<void>;
+
+  /**
+   * Ensure the target environment exists in the store, creating it if needed.
+   */
+  abstract ensureEnvironment(environment: string): Promise<void>;
+
+  /**
+   * List all secrets in a given environment.
+   */
+  abstract list(environment: string): Promise<RemoteSecret[]>;
+
+  /**
+   * Set (create or update) a secret in a given environment.
+   */
+  abstract set(environment: string, key: string, value: string): Promise<void>;
+
+  /**
+   * Delete a secret from a given environment.
+   */
+  abstract delete(environment: string, key: string): Promise<void>;
+}

package/src/cli/platform/schemas/cloudflare.ts

@@ -153,6 +153,8 @@ export type CloudflareSecret = Static<typeof cloudflareSecretSchema>;
 
 export const createD1BodySchema = t.object({
   name: t.string(),
+  primary_location_hint: t.optional(t.string()),
+  jurisdiction: t.optional(t.string()),
 });
 
 export const createKVBodySchema = t.object({

package/src/cli/platform/services/CloudflareApi.ts

@@ -118,13 +118,16 @@ export class CloudflareApi {
     );
   }
 
-  public async createD1(name: string): Promise<CloudflareD1> {
+  public async createD1(
+    name: string,
+    location = "weur", // TODO: move to config (or auto-resolve based on account info, or ask ?)
+  ): Promise<CloudflareD1> {
     const accountId = await this.resolveAccountId();
     return await this.fetch<CloudflareD1>(
       `/accounts/${accountId}/d1/database`,
       {
         method: "POST",
-        body: { name },
+        body: { name, primary_location_hint: location },
         bodySchema: createD1BodySchema,
         schema: cloudflareD1Schema,
       },

package/src/cli/platform/services/DockerComposeGenerator.spec.ts

@@ -154,6 +154,62 @@ describe("DockerComposeGenerator", () => {
       expect(result).toBeNull();
     });
 
+    test("generates rustfs service when app has bucket and no S3_ENDPOINT", ({
+      expect,
+    }) => {
+      const { generator, naming } = createTestEnv();
+      const namingCtx = naming.forContext("myapp", "local");
+
+      const result = generator.generateLocal({
+        project: "myapp",
+        env: "local",
+        naming: namingCtx,
+        apps: [
+          makeApp({
+            resources: {
+              hasDatabase: false,
+              hasBucket: true,
+              hasKV: false,
+              hasQueue: false,
+              hasCron: false,
+            },
+          }),
+        ],
+        envVars: {},
+      });
+
+      expect(result).toContain("rustfs:");
+      expect(result).toContain("image: rustfs/rustfs:latest");
+      expect(result).toContain("9000:9000");
+      expect(result).toContain("RUSTFS_ROOT_USER: alepha");
+      expect(result).toContain("rustfs_data:");
+    });
+
+    test("skips rustfs when S3_ENDPOINT is present", ({ expect }) => {
+      const { generator, naming } = createTestEnv();
+      const namingCtx = naming.forContext("myapp", "local");
+
+      const result = generator.generateLocal({
+        project: "myapp",
+        env: "local",
+        naming: namingCtx,
+        apps: [
+          makeApp({
+            resources: {
+              hasDatabase: false,
+              hasBucket: true,
+              hasKV: false,
+              hasQueue: false,
+              hasCron: false,
+            },
+          }),
+        ],
+        envVars: { S3_ENDPOINT: "https://xxx.r2.cloudflarestorage.com" },
+      });
+
+      expect(result).toBeNull();
+    });
+
     test("returns null when no services needed", ({ expect }) => {
       const { generator, naming } = createTestEnv();
       const namingCtx = naming.forContext("myapp", "local");
@@ -312,6 +368,65 @@ describe("DockerComposeGenerator", () => {
       expect(result).toContain("Host(`myshop.com`)");
     });
 
+    test("generates rustfs service when app has bucket", ({ expect }) => {
+      const { generator, naming } = createTestEnv();
+      const namingCtx = naming.forContext("myapp", "production");
+
+      const result = generator.generateRemote({
+        project: "myapp",
+        env: "production",
+        naming: namingCtx,
+        domain: "myapp.com",
+        apps: [
+          makeApp({
+            resources: {
+              hasDatabase: false,
+              hasBucket: true,
+              hasKV: false,
+              hasQueue: false,
+              hasCron: false,
+            },
+          }),
+        ],
+        envVars: {},
+      });
+
+      expect(result).toContain("rustfs:");
+      expect(result).toContain("image: rustfs/rustfs:latest");
+      expect(result).toContain("RUSTFS_ROOT_PASSWORD: ${S3_SECRET_KEY}");
+      expect(result).toContain("rustfs_data:");
+      expect(result).toContain("depends_on:");
+      expect(result).toContain("- rustfs");
+      // RustFS on internal network when domain is set
+      expect(result).toContain("internal");
+    });
+
+    test("skips rustfs when S3_ENDPOINT present", ({ expect }) => {
+      const { generator, naming } = createTestEnv();
+      const namingCtx = naming.forContext("myapp", "production");
+
+      const result = generator.generateRemote({
+        project: "myapp",
+        env: "production",
+        naming: namingCtx,
+        domain: "myapp.com",
+        apps: [
+          makeApp({
+            resources: {
+              hasDatabase: false,
+              hasBucket: true,
+              hasKV: false,
+              hasQueue: false,
+              hasCron: false,
+            },
+          }),
+        ],
+        envVars: { S3_ENDPOINT: "https://xxx.r2.cloudflarestorage.com" },
+      });
+
+      expect(result).not.toContain("rustfs:");
+    });
+
     test("multi-app without domain exposes incremental ports", ({ expect }) => {
       const { generator, naming } = createTestEnv();
       const namingCtx = naming.forContext("myproject", "staging");