alepha 0.20.1 → 0.20.2

package/src/cli/core/services/ProjectScaffolder.ts

@@ -5,7 +5,6 @@ import { $logger, ConsoleColorProvider } from "alepha/logger";
 import { FileSystemProvider } from "alepha/system";
 import { type AgentMdOptions, agentMd } from "../templates/agentMd.ts";
 import { alephaConfigTs } from "../templates/alephaConfigTs.ts";
-import { apiAppSecurityTs } from "../templates/apiAppSecurityTs.ts";
 import { apiHelloControllerTs } from "../templates/apiHelloControllerTs.ts";
 import { apiHelloResponseSchemaTs } from "../templates/apiHelloResponseSchemaTs.ts";
 import { apiIndexTs } from "../templates/apiIndexTs.ts";
@@ -19,7 +18,7 @@ import { mainCss } from "../templates/mainCss.ts";
 import { mainServerTs } from "../templates/mainServerTs.ts";
 import { tsconfigJson } from "../templates/tsconfigJson.ts";
 import { viteConfigTs } from "../templates/viteConfigTs.ts";
-import { webAdminDashboardTsx } from "../templates/webAdminDashboardTsx.ts";
+import { vitestConfigTs } from "../templates/vitestConfigTs.ts";
 import { webAppRouterTs } from "../templates/webAppRouterTs.ts";
 import { webHomeComponentTsx } from "../templates/webHomeComponentTsx.ts";
 import { webIndexTs } from "../templates/webIndexTs.ts";
@@ -241,7 +240,7 @@ export class ProjectScaffolder {
    */
   public async ensureApiProject(
     root: string,
-    opts: { auth?: boolean; adminEmail?: string; force?: boolean } = {},
+    opts: { force?: boolean } = {},
   ): Promise<void> {
     const appName = this.getAppName(root);
 
@@ -257,7 +256,7 @@ export class ProjectScaffolder {
     await this.ensureFile(
       root,
       "src/api/index.ts",
-      apiIndexTs({ appName, auth: opts.auth }),
+      apiIndexTs({ appName }),
       opts.force,
     );
     await this.ensureFile(
@@ -272,16 +271,6 @@ export class ProjectScaffolder {
       apiHelloResponseSchemaTs(),
       opts.force,
     );
-
-    // Create AppSecurity if auth is enabled
-    if (opts.auth) {
-      await this.ensureFile(
-        root,
-        "src/api/AppSecurity.ts",
-        apiAppSecurityTs({ adminEmail: opts.adminEmail }),
-        opts.force,
-      );
-    }
   }
 
   // ===========================================
@@ -300,9 +289,6 @@ export class ProjectScaffolder {
     root: string,
     opts: {
       api?: boolean;
-      ui?: boolean;
-      auth?: boolean;
-      admin?: boolean;
       tailwind?: boolean;
       force?: boolean;
     } = {},
@@ -322,7 +308,7 @@ export class ProjectScaffolder {
     await this.ensureFile(
       root,
       "src/main.css",
-      mainCss({ ui: opts.ui, tailwind: opts.tailwind }),
+      mainCss({ tailwind: opts.tailwind }),
       opts.force,
     );
 
@@ -341,12 +327,7 @@ export class ProjectScaffolder {
     await this.ensureFile(
       root,
       "src/web/AppRouter.ts",
-      webAppRouterTs({
-        api: opts.api,
-        ui: opts.ui,
-        auth: opts.auth,
-        admin: opts.admin,
-      }),
+      webAppRouterTs({ api: opts.api }),
       opts.force,
     );
     await this.ensureFile(
@@ -355,14 +336,6 @@ export class ProjectScaffolder {
       webHomeComponentTsx({ api: opts.api }),
       opts.force,
     );
-    if (opts.admin) {
-      await this.ensureFile(
-        root,
-        "src/web/components/AdminDashboard.tsx",
-        webAdminDashboardTsx(),
-        opts.force,
-      );
-    }
     await this.ensureFile(
       root,
       "src/main.browser.ts",
@@ -376,11 +349,18 @@ export class ProjectScaffolder {
   // ===========================================
 
   /**
-   * Ensure test directory exists with a dummy test file.
+   * Ensure test directory exists with a dummy test file + a self-contained
+   * `vitest.config.ts`. Pinning `test.root` prevents Vitest from walking up
+   * to a parent monorepo config (e.g. one that boots a Postgres container).
    */
   public async ensureTestDir(root: string): Promise<void> {
     const testDir = this.fs.join(root, "test");
     const dummyPath = this.fs.join(testDir, "dummy.spec.ts");
+    const vitestConfigPath = this.fs.join(root, "vitest.config.ts");
+
+    if (!(await this.fs.exists(vitestConfigPath))) {
+      await this.fs.writeFile(vitestConfigPath, vitestConfigTs());
+    }
 
     if (!(await this.fs.exists(testDir))) {
       await this.fs.mkdir(testDir, { recursive: true });
@@ -413,8 +393,6 @@ export class ProjectScaffolder {
       pm?: "yarn" | "npm" | "pnpm" | "bun";
       api?: boolean;
       react?: boolean;
-      ui?: boolean;
-      saas?: boolean;
       tailwind?: boolean;
       test?: boolean;
       force?: boolean;
@@ -426,21 +404,13 @@ export class ProjectScaffolder {
       await this.fs.mkdir(root, { force: true });
     }
 
-    // Flag cascading: --saas → --api + --ui → --react
-    if (flags.saas) {
-      flags.api = true;
-      flags.ui = true;
-    }
-    if (flags.ui) {
-      flags.react = true;
-    }
+    // Flag cascading: --tailwind → --react
     if (flags.tailwind) {
       flags.react = true;
     }
 
     // When codegen flags are set, target directory must be empty (unless --force)
-    const hasCodegenFlags =
-      flags.saas || flags.api || flags.ui || flags.react || flags.tailwind;
+    const hasCodegenFlags = flags.api || flags.react || flags.tailwind;
     if (hasCodegenFlags && !flags.force) {
       const files = await this.fs.ls(root);
       // Allow a directory that only has package.json (common for monorepo packages)
@@ -464,9 +434,6 @@ export class ProjectScaffolder {
 
     const isExpo = await this.pm.hasExpo(root);
 
-    // Get git email for admin auto-promotion (if saas enabled)
-    const adminEmail = flags.saas ? await this.utils.getGitEmail() : undefined;
-
     const force = !!flags.force;
 
     await run({
@@ -479,7 +446,7 @@ export class ProjectScaffolder {
           tsconfigJson: !workspace.config.tsconfigJson,
           biomeJson: true,
           editorconfig: !workspace.config.editorconfig,
-          agentMd: agentType ? { type: agentType, ui: !!flags.ui } : false,
+          agentMd: agentType ? { type: agentType } : false,
         });
 
         // Create alepha.config.ts with documented options
@@ -492,18 +459,11 @@ export class ProjectScaffolder {
           force,
         });
         if (flags.api) {
-          await this.ensureApiProject(root, {
-            auth: !!flags.saas,
-            adminEmail,
-            force,
-          });
+          await this.ensureApiProject(root, { force });
         }
         if (flags.react && !isExpo) {
           await this.ensureWebProject(root, {
             api: !!flags.api,
-            ui: !!flags.ui,
-            auth: !!flags.saas,
-            admin: !!flags.saas,
             tailwind: !!flags.tailwind,
             force,
           });
@@ -584,14 +544,6 @@ export class ProjectScaffolder {
       `  ${c.set("GREY_DARK", "$")} ${c.set("CYAN", `${pmRun} dev`)}`,
     );
 
-    if (adminEmail) {
-      this.log.info("");
-      this.log.info(`  Admin email: ${c.set("GREEN", adminEmail)}`);
-      this.log.info(
-        `  ${c.set("GREY_DARK", "(from git config, change in src/api/AppSecurity.ts)")}`,
-      );
-    }
-
     this.log.info("");
   }
 

package/src/cli/core/templates/agentMd.ts

@@ -2,18 +2,11 @@ export type AgentMdType = "claude" | "agents";
 
 export interface AgentMdOptions {
   type: AgentMdType;
-  ui?: boolean;
 }
 
 export const agentMd = (options: AgentMdOptions): string => {
   const header = options.type === "claude" ? `# CLAUDE.md` : `# AGENTS.md`;
 
-  const docs = [`- Framework source: \`node_modules/alepha/src/\``];
-  if (options.ui) {
-    docs.push(`- UI components: \`node_modules/@alepha/ui/src/\``);
-  }
-  docs.push(`- Docs: https://alepha.dev/llms.txt`);
-
   return `${header}
 
 This is an **Alepha** project.
@@ -36,6 +29,7 @@ alepha build     # Build
 
 ## Documentation
 
-${docs.join("\n")}
+- Framework source: \`node_modules/alepha/src/\`
+- Docs: https://alepha.dev/llms.txt
 `.trim();
 };

package/src/cli/core/templates/apiIndexTs.ts

@@ -1,30 +1,16 @@
 export interface ApiIndexTsOptions {
   appName?: string;
-  auth?: boolean;
 }
 
 export const apiIndexTs = (options: ApiIndexTsOptions = {}) => {
-  const { appName = "app", auth = false } = options;
-
-  const imports: string[] = ['import { $module } from "alepha";'];
-  const services: string[] = [];
-
-  if (auth) {
-    imports.push('import { AppSecurity } from "./AppSecurity.ts";');
-    services.push("AppSecurity");
-  }
-
-  imports.push(
-    'import { HelloController } from "./controllers/HelloController.ts";',
-  );
-  services.push("HelloController");
-
+  const { appName = "app" } = options;
   return `
-${imports.join("\n")}
+import { $module } from "alepha";
+import { HelloController } from "./controllers/HelloController.ts";
 
 export const ApiModule = $module({
   name: "${appName}.api",
-  services: [${services.join(", ")}],
+  services: [HelloController],
 });
 `.trim();
 };

package/src/cli/core/templates/mainCss.ts

@@ -1,38 +1,4 @@
-export const mainCss = (opts: { ui?: boolean; tailwind?: boolean } = {}) => {
-  if (opts.ui) {
-    return `/**
- * Alepha UI - Based on Mantine component library
- * Mantine Docs: https://mantine.dev
- * Mantine LLM context: https://mantine.dev/llms.txt
- *
- * Switch theme index: alepha.set(alephaThemeAtom, { index: 1 })
- *
- * Custom themes (in src/web/index.ts):
- *
- *   import { alephaThemeListAtom } from "@alepha/ui";
- *
- *   export const WebModule = $module({
- *     name: "app.web",
- *     services: [AppRouter],
- *     register(alepha) {
- *       alepha.register(AppRouter);
- *       alepha.set(alephaThemeListAtom, [{
- *         name: "My Theme",
- *         description: "Custom theme",
- *         primaryColor: "blue",
- *         defaultColorScheme: "dark",
- *         // ...MantineThemeOverride options
- *       }]);
- *     },
- *   });
- *
- * Alternatives (remove the import below):
- * - Tailwind CSS: https://tailwindcss.com/docs/installation/using-vite
- * - Raw CSS: Write your own styles
- */
-@import "@alepha/ui/styles";`;
-  }
-
+export const mainCss = (opts: { tailwind?: boolean } = {}) => {
   if (opts.tailwind) {
     return `@import "tailwindcss";
 
@@ -44,7 +10,6 @@ export const mainCss = (opts: { ui?: boolean; tailwind?: boolean } = {}) => {
  * Global styles for your application.
  *
  * Options:
- * - @alepha/ui: Use \`alepha init --ui\` to add Mantine-based components
  * - Tailwind CSS: Use \`alepha init --tailwind\` to add Tailwind CSS
  * - Raw CSS: Write your own styles below
  */

package/src/cli/core/templates/vitestConfigTs.ts

@@ -0,0 +1,17 @@
+/**
+ * Minimal Vitest config for a freshly scaffolded Alepha project.
+ *
+ * Defines `test.root` explicitly so Vitest doesn't walk up the directory
+ * tree and inherit a parent monorepo config (which can pull in unrelated
+ * setup files, database connections, etc.).
+ */
+export const vitestConfigTs = () =>
+  `import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    root: ".",
+    globals: true,
+  },
+});
+`;

package/src/cli/core/templates/webAppRouterTs.ts

@@ -1,97 +1,14 @@
-export const webAppRouterTs = (options: {
-  api?: boolean;
-  ui?: boolean;
-  auth?: boolean;
-  admin?: boolean;
-}) => {
-  const imports: string[] = [];
+export const webAppRouterTs = (options: { api?: boolean }) => {
+  const imports: string[] = ['import { $page } from "alepha/react/router";'];
   const classMembers: string[] = [];
 
-  // UI import and setup
-  if (options.ui) {
-    imports.push('import { $ui } from "@alepha/ui";');
-  }
-
-  // Auth import
-  if (options.auth) {
-    imports.push('import { $uiAuth } from "@alepha/ui/auth";');
-  }
-
-  // Admin imports
-  if (options.admin) {
-    imports.push('import { $uiAdmin } from "@alepha/ui/admin";');
-    imports.push('import { AdminUserRouter } from "@alepha/ui/admin-users";');
-    imports.push(
-      'import { AdminSessionRouter } from "@alepha/ui/admin-sessions";',
-    );
-    imports.push('import { $inject } from "alepha";');
-    imports.push(
-      'import { IconLayoutDashboard, IconUsers } from "@tabler/icons-react";',
-    );
-  }
-
-  // Page import
-  imports.push('import { $page } from "alepha/react/router";');
-
-  // API imports (only if api flag is set)
   if (options.api) {
     imports.push('import { $client } from "alepha/server/links";');
     imports.push(
       'import type { HelloController } from "../api/controllers/HelloController.ts";',
     );
     classMembers.push("  api = $client<HelloController>();");
-  }
-
-  // UI layout setup
-  if (options.ui) {
-    classMembers.push("  ui = $ui();");
-
-    if (options.auth) {
-      classMembers.push("  uiAuth = $uiAuth();");
-    }
-
-    if (options.admin) {
-      classMembers.push(`  // ── Admin Dashboard ─────────────────────────────
-  // Defined first so it can be referenced by the admin panel below.
-  // \`$uiAdmin\` auto-parents listed pages under the admin layout.
-  adminDashboard = $page({
-    path: "/",
-    label: "Dashboard",
-    icon: IconLayoutDashboard,
-    lazy: () => import("./components/AdminDashboard.tsx"),
-  });
-
-  // ── Admin Domain Routers ──────────────────────────
-  protected users = $inject(AdminUserRouter);
-  protected sessions = $inject(AdminSessionRouter);
 
-  // ── Admin Panel ─────────────────────────────────
-  admin = $uiAdmin({
-    pages: [
-      this.adminDashboard,
-      this.users.adminUsers,
-      this.users.adminUserLayout,
-      this.sessions.adminSessions,
-    ],
-    sidebarItems: [
-      this.adminDashboard,
-      {
-        label: "Identity",
-        icon: IconUsers,
-        children: [this.users.adminUsers, this.sessions.adminSessions],
-      },
-    ],
-  });`);
-    }
-
-    classMembers.push(`  layout = $page({
-      parent: this.ui.root,
-      children: () => [this.home],
-    });`);
-  }
-
-  // Home page - with or without loader
-  if (options.api) {
     classMembers.push(`  home = $page({
     path: "/",
     lazy: () => import("./components/Home.tsx"),

package/src/cli/platform/__tests__/CloudflareAdapter.spec.ts

@@ -119,6 +119,18 @@ class MemoryCloudflareApi extends CloudflareApi {
     return this.secrets.get(scriptName) ?? [];
   }
 
+  public override async putSecret(
+    scriptName: string,
+    name: string,
+    _value: string,
+  ) {
+    const existing = this.secrets.get(scriptName) ?? [];
+    if (!existing.some((s) => s.name === name)) {
+      existing.push({ name, type: "secret_text" });
+    }
+    this.secrets.set(scriptName, existing);
+  }
+
   public override async listDeployments() {
     return [];
   }
@@ -379,10 +391,10 @@ describe("CloudflareAdapter", () => {
   });
 
   describe("secrets", () => {
-    test("pushes non-binding env vars via wrangler secret bulk", async ({
+    test("pushes non-binding env vars via REST putSecret", async ({
       expect,
     }) => {
-      const { adapter, fs, shell, naming } = createTestEnv();
+      const { adapter, fs, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
         apps: [
           {
@@ -400,7 +412,6 @@ describe("CloudflareAdapter", () => {
         ],
       });
 
-      // Write .env.production with a mix of secrets and excluded vars
       await fs.writeFile(
         "/project/.env.production",
         [
@@ -418,62 +429,13 @@ describe("CloudflareAdapter", () => {
       const run = createMockRun();
       await adapter.secrets(ctx, run);
 
-      // Should call wrangler secret bulk with the worker name
-      expect(
-        shell.wasCalledMatching(
-          /wrangler secret bulk.*--name=acme-portal-production/,
-        ),
-      ).toBe(true);
-
-      // Verify the secrets JSON was written (only non-excluded vars)
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /GOOGLE_API_KEY/,
-        ),
-      ).toBe(true);
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /APP_SECRET/,
-        ),
-      ).toBe(true);
-
-      // Excluded vars should NOT be in the secrets file
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /DATABASE_URL/,
-        ),
-      ).toBe(false);
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /R2_BUCKET_NAME/,
-        ),
-      ).toBe(false);
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /CLOUDFLARE_DOMAIN/,
-        ),
-      ).toBe(false);
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /VITE_PUBLIC_KEY/,
-        ),
-      ).toBe(false);
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /NODE_ENV/,
-        ),
-      ).toBe(false);
+      const pushed = api.secrets.get("acme-portal-production") ?? [];
+      const names = pushed.map((s) => s.name).sort();
+      expect(names).toEqual(["APP_SECRET", "GOOGLE_API_KEY"]);
     });
 
     test("skips when no env file exists", async ({ expect }) => {
-      const { adapter, shell, naming } = createTestEnv();
+      const { adapter, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
         apps: [
           {
@@ -494,11 +456,11 @@ describe("CloudflareAdapter", () => {
       const run = createMockRun();
       await adapter.secrets(ctx, run);
 
-      expect(shell.wasCalledMatching(/wrangler secret/)).toBe(false);
+      expect(api.secrets.size).toBe(0);
     });
 
     test("skips comments and empty lines", async ({ expect }) => {
-      const { adapter, fs, shell, naming } = createTestEnv();
+      const { adapter, fs, naming, api } = createTestEnv();
       const ctx = makeCtx(naming, {
         apps: [
           {
@@ -524,19 +486,8 @@ describe("CloudflareAdapter", () => {
       const run = createMockRun();
       await adapter.secrets(ctx, run);
 
-      expect(shell.wasCalledMatching(/wrangler secret bulk/)).toBe(true);
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /ONLY_SECRET/,
-        ),
-      ).toBe(true);
-      expect(
-        fs.wasWrittenMatching(
-          "/project/node_modules/.alepha/secrets.json",
-          /comment/,
-        ),
-      ).toBe(false);
+      const pushed = api.secrets.get("acme-portal-production") ?? [];
+      expect(pushed.map((s) => s.name)).toEqual(["ONLY_SECRET"]);
     });
   });
 

package/src/cli/platform/adapters/CloudflareAdapter.ts

@@ -1,5 +1,4 @@
 import { $inject, Alepha } from "alepha";
-import { AlephaCliUtils } from "alepha/cli";
 import { EnvUtils, Runner, type RunnerMethod } from "alepha/command";
 import { $logger } from "alepha/logger";
 import { FileSystemProvider, ShellProvider } from "alepha/system";
@@ -24,7 +23,6 @@ export class CloudflareAdapter extends PlatformAdapter {
   protected readonly log = $logger();
   protected readonly fs = $inject(FileSystemProvider);
   protected readonly shell = $inject(ShellProvider);
-  protected readonly utils = $inject(AlephaCliUtils);
   protected readonly cache = $inject(PlatformCacheProvider);
   protected readonly alepha = $inject(Alepha);
   protected readonly envUtils = $inject(EnvUtils);
@@ -57,6 +55,7 @@ export class CloudflareAdapter extends PlatformAdapter {
    */
   protected configureApi(ctx: PlatformContext): void {
     this.api.setJurisdiction(ctx.envConfig.jurisdiction);
+    this.api.setAccountId(ctx.envConfig.accountId);
   }
 
   protected async runShell(
@@ -256,7 +255,9 @@ export class CloudflareAdapter extends PlatformAdapter {
       return;
     }
 
-    // Push secrets to each worker
+    // Push secrets to each worker via the REST API (one PUT per secret).
+    // Historically we shelled out to `wrangler secret bulk`, but it has an
+    // open hang issue (workers-sdk#10555) and is redundant given putSecret.
     for (const app of ctx.apps) {
       const workerName = ctx.naming.worker(
         ctx.apps.length > 1 ? app.name : undefined,
@@ -265,13 +266,9 @@ export class CloudflareAdapter extends PlatformAdapter {
       await run({
         name: `push secrets to ${workerName}`,
         handler: async () => {
-          const secretsPath = await this.utils.writeConfigFile(
-            "secrets.json",
-            JSON.stringify(secrets),
-            ctx.root,
-          );
-
-          await this.wrangler.secretBulk(secretsPath, workerName);
+          for (const [name, value] of Object.entries(secrets)) {
+            await this.api.putSecret(workerName, name, value);
+          }
         },
       });
     }
@@ -882,7 +879,11 @@ export class CloudflareAdapter extends PlatformAdapter {
   > {
     const deployments = await this.api.listDeployments(workerName);
 
-    const latest = deployments.at(-1);
+    // API ordering is not guaranteed across releases — sort explicitly.
+    const sorted = [...deployments].sort((a, b) =>
+      b.created_on.localeCompare(a.created_on),
+    );
+    const latest = sorted[0];
     if (!latest?.versions?.[0]) {
       return undefined;
     }

package/src/cli/platform/atoms/platformOptions.ts

@@ -74,6 +74,14 @@ export const platformOptions = $atom({
            * Omit for the default (global) jurisdiction.
            */
           jurisdiction: t.optional(t.enum(["eu", "fedramp"])),
+          /**
+           * Cloudflare account ID to deploy into.
+           *
+           * Falls back to `CLOUDFLARE_ACCOUNT_ID` env var, then to the
+           * token's account when the token is scoped to exactly one.
+           * Required when the token has access to multiple accounts.
+           */
+          accountId: t.optional(t.text()),
         }),
       ),
     }),
@@ -93,4 +101,5 @@ export interface EnvironmentConfig {
   domain?: string;
   vars?: Record<string, string>;
   jurisdiction?: "eu" | "fedramp";
+  accountId?: string;
 }

package/src/cli/platform/schemas/cloudflare.ts

@@ -40,7 +40,7 @@ export type CloudflareKV = Static<typeof cloudflareKVSchema>;
 
 export const cloudflareR2Schema = t.object({
   name: t.string(),
-  creation_date: t.string(),
+  creation_date: t.optional(t.string()),
 });
 
 export type CloudflareR2 = Static<typeof cloudflareR2Schema>;
@@ -61,8 +61,9 @@ export const cloudflareQueueSchema = t.object({
 export type CloudflareQueue = Static<typeof cloudflareQueueSchema>;
 
 export const cloudflareQueueConsumerSchema = t.object({
+  consumer_id: t.string(),
   service: t.string(),
-  environment: t.string(),
+  environment: t.optional(t.string()),
 });
 
 export type CloudflareQueueConsumer = Static<