alepha 0.21.2 → 0.22.0

package/src/cli/core/templates/apiIndexTs.ts

@@ -1,30 +1,9 @@
 export interface ApiIndexTsOptions {
   appName?: string;
-  /**
-   * Include `AlephaApiUsers` (realms, sessions, registration, identities,
-   * password reset, email verification, admin endpoints) plus the local
-   * `RealmProvider` that declares `$realm({ ... })`.
-   */
-  saas?: boolean;
 }
 
 export const apiIndexTs = (options: ApiIndexTsOptions = {}) => {
-  const { appName = "app", saas = false } = options;
-
-  if (saas) {
-    return `
-import { $module } from "alepha";
-import { AlephaApiUsers } from "alepha/api/users";
-import { HelloController } from "./controllers/HelloController.ts";
-import { RealmProvider } from "./providers/RealmProvider.ts";
-
-export const ApiModule = $module({
-  name: "${appName}.api",
-  services: [HelloController, RealmProvider],
-  imports: [AlephaApiUsers],
-});
-`.trim();
-  }
+  const { appName = "app" } = options;
 
   return `
 import { $module } from "alepha";

package/src/cli/core/templates/mainCss.ts

@@ -11,7 +11,6 @@ export const mainCss = (opts: { tailwind?: boolean } = {}) => {
  *
  * Options:
  * - Tailwind CSS: Use \`alepha init --tailwind\` to add Tailwind CSS
- * - shadcn/ui: Use \`alepha init --shadcn\` to add shadcn/ui setup
  * - Raw CSS: Write your own styles below
  */
 

package/src/cli/core/templates/webAppRouterTs.ts

@@ -1,16 +1,8 @@
 export interface WebAppRouterOptions {
   api?: boolean;
-  saas?: boolean;
 }
 
 export const webAppRouterTs = (options: WebAppRouterOptions) => {
-  if (options.saas) {
-    return saasAppRouterTs();
-  }
-  return basicAppRouterTs(options);
-};
-
-const basicAppRouterTs = (options: WebAppRouterOptions) => {
   const imports: string[] = ['import { $page } from "alepha/react/router";'];
   const classMembers: string[] = [];
 
@@ -39,94 +31,3 @@ export class AppRouter {
 ${classMembers.join("\n\n")}
 }`;
 };
-
-/**
- * SaaS router wires three trees onto the app:
- *   /            → Home
- *   /auth/*      → AuthLayout + login / register / reset / verify
- *   /admin/*     → AdminLayout + users / sessions / api-keys / parameters / audits
- *
- * Each auth page resolves the realm config from its loader, so the registry
- * components render with everything they need on first paint.
- */
-const saasAppRouterTs =
-  () => `import type { RealmController } from "alepha/api/users";
-import { $page, NotFound } from "alepha/react/router";
-import { $secure } from "alepha/security";
-import { $client } from "alepha/server/links";
-import type { HelloController } from "../api/controllers/HelloController.ts";
-
-export class AppRouter {
-  protected readonly api = $client<HelloController>();
-  protected readonly realmApi = $client<RealmController>();
-
-  home = $page({
-    path: "/",
-    lazy: () => import("./components/Home.tsx"),
-    loader: () => this.api.hello(),
-  });
-
-  // ── /auth — login, register, reset, verify ─────────────────────────────
-  authLayout = $page({
-    path: "/auth",
-    lazy: () => import("./components/auth/AuthLayout.tsx"),
-  });
-
-  login = $page({
-    parent: this.authLayout,
-    path: "/login",
-    name: "login",
-    head: { title: "Sign in" },
-    lazy: () => import("./components/auth/Login.tsx"),
-    loader: async () => ({ realmConfig: await this.realmApi.getRealmConfig() }),
-  });
-
-  register = $page({
-    parent: this.authLayout,
-    path: "/register",
-    name: "register",
-    head: { title: "Sign up" },
-    lazy: () => import("./components/auth/Register.tsx"),
-    loader: async () => ({ realmConfig: await this.realmApi.getRealmConfig() }),
-  });
-
-  resetPassword = $page({
-    parent: this.authLayout,
-    path: "/reset-password",
-    head: { title: "Reset password" },
-    lazy: () => import("./components/auth/ResetPassword.tsx"),
-    loader: async () => ({ realmConfig: await this.realmApi.getRealmConfig() }),
-  });
-
-  verifyEmail = $page({
-    parent: this.authLayout,
-    path: "/verify-email",
-    head: { title: "Verify email" },
-    lazy: () => import("./components/auth/VerifyEmail.tsx"),
-  });
-
-  // ── /admin — gated by 'admin:ui' permission, declared in RealmProvider.
-  // Children inherit the gate via the parent chain.
-  adminLayout = $page({
-    path: "/admin",
-    use: [$secure({ permissions: ["admin:ui"] })],
-    lazy: () => import("./components/admin/AdminLayout.tsx"),
-  });
-
-  adminUsers = $page({
-    parent: this.adminLayout,
-    path: "/users",
-    head: { title: "Users" },
-    lazy: () => import("./components/admin/Users.tsx"),
-  });
-
-  adminSessions = $page({
-    parent: this.adminLayout,
-    path: "/sessions",
-    head: { title: "Sessions" },
-    lazy: () => import("./components/admin/Sessions.tsx"),
-  });
-
-  notFound = $page({ path: "/*", component: NotFound });
-}
-`;

package/src/cli/core/templates/webIndexTs.ts

@@ -1,30 +1,9 @@
 export interface WebIndexTsOptions {
   appName?: string;
-  /**
-   * SaaS bundle: auth pages need `useAuth()` (ReactAuth) which lives in the
-   * `alepha.react.auth` module. Importing it here registers ReactAuth in the
-   * container so the auth-* registry components can inject it.
-   */
-  saas?: boolean;
 }
 
 export const webIndexTs = (options: WebIndexTsOptions = {}) => {
-  const { appName = "app", saas = false } = options;
-
-  if (saas) {
-    return `
-import { $module } from "alepha";
-import { AlephaReactAuth } from "alepha/react/auth";
-import { AlephaReactI18n } from "alepha/react/i18n";
-import { AppRouter } from "./AppRouter.ts";
-
-export const WebModule = $module({
-  name: "${appName}.web",
-  services: [AppRouter],
-  imports: [AlephaReactAuth, AlephaReactI18n],
-});
-`.trim();
-  }
+  const { appName = "app" } = options;
 
   return `
 import { $module } from "alepha";

package/src/cli/platform/__tests__/SecretsCommand.spec.ts

@@ -1,11 +1,13 @@
 import { Alepha } from "alepha";
+import {
+  MemorySecretStore,
+  platformOptions,
+  type SecretStoreProvider,
+} from "alepha/cli/platform-lib";
 import { CliProvider } from "alepha/command";
 import { FileSystemProvider, MemoryFileSystemProvider } from "alepha/system";
 import { describe, test } from "vitest";
-import { platformOptions } from "../atoms/platformOptions.ts";
 import { SecretsCommand } from "../commands/SecretsCommand.ts";
-import { MemorySecretStore } from "../providers/MemorySecretStore.ts";
-import type { SecretStoreProvider } from "../providers/SecretStoreProvider.ts";
 
 class TestSecretsCommand extends SecretsCommand {
   public readonly testList = this.list;

package/src/cli/platform/commands/SecretsCommand.ts

@@ -1,12 +1,14 @@
 import { $inject, $state, AlephaError, t } from "alepha";
+import {
+  GitHubSecretStore,
+  NamingService,
+  PlatformInspector,
+  platformOptions,
+  SecretFilterService,
+  type SecretStoreProvider,
+} from "alepha/cli/platform-lib";
 import { $command, EnvUtils } from "alepha/command";
 import { $logger, ConsoleColorProvider } from "alepha/logger";
-import { platformOptions } from "../atoms/platformOptions.ts";
-import { GitHubSecretStore } from "../providers/GitHubSecretStore.ts";
-import type { SecretStoreProvider } from "../providers/SecretStoreProvider.ts";
-import { NamingService } from "../services/NamingService.ts";
-import { PlatformInspector } from "../services/PlatformInspector.ts";
-import { SecretFilterService } from "../services/SecretFilterService.ts";
 
 export class SecretsCommand {
   protected readonly log = $logger();

package/src/cli/platform/commands/platform.ts

@@ -1,24 +1,20 @@
 import { $inject, $state, AlephaError, t } from "alepha";
-import { AppEntryProvider, ViteBuildProvider } from "alepha/cli";
-import { $command, EnvUtils } from "alepha/command";
-import { $logger, ConsoleColorProvider } from "alepha/logger";
-import { CloudflareAdapter } from "../adapters/CloudflareAdapter.ts";
-import type {
-  AppDefinition,
-  DetectedResources,
-} from "../adapters/PlatformAdapter.ts";
-import { VercelAdapter } from "../adapters/VercelAdapter.ts";
-import { platformOptions } from "../atoms/platformOptions.ts";
-import type {
-  PlatformPlanOutput,
-  PlatformStatusOutput,
-} from "../schemas/platform.ts";
-import { NamingService } from "../services/NamingService.ts";
+import { type AppEntry, AppEntryProvider, ViteBuildProvider } from "alepha/cli";
 import {
+  CloudflareAdapter,
+  type DetectedResources,
+  NamingService,
   PlatformInspector,
+  PlatformOrchestrator,
+  type PlatformPlanOutput,
+  type PlatformStatusOutput,
+  platformOptions,
   type ResolvedPlatformConfig,
-} from "../services/PlatformInspector.ts";
-import { PlatformOrchestrator } from "../services/PlatformOrchestrator.ts";
+  resolveTenant,
+  VercelAdapter,
+} from "alepha/cli/platform-lib";
+import { $command, EnvUtils } from "alepha/command";
+import { $logger, ConsoleColorProvider } from "alepha/logger";
 import { SecretsCommand } from "./SecretsCommand.ts";
 
 export class PlatformCommand {
@@ -43,6 +39,12 @@ export class PlatformCommand {
         description: "Target environment",
       }),
     ),
+    tenant: t.optional(
+      t.text({
+        description:
+          "Tenant slug (apps with tenancy: optional | required). Names resources <tenant>-<project>-<env> and serves <tenant>.<domain>.",
+      }),
+    ),
     verbose: t.optional(
       t.boolean({
         aliases: ["v"],
@@ -75,7 +77,8 @@ export class PlatformCommand {
         config,
         this.isServerless(adapterName),
       );
-      const namingCtx = this.naming.forContext(config.project, env);
+      const tenant = resolveTenant(config.tenancy, flags.tenant);
+      const namingCtx = this.naming.forContext(config.project, env, tenant);
 
       // --- Data collection ---
 
@@ -231,14 +234,18 @@ export class PlatformCommand {
         root,
         config,
         this.isServerless(adapter),
+        { prebuilt: flags.prebuilt },
       );
 
       const result = await this.orchestrator.up({
         root,
         env,
-        apps,
+        entry: apps[0].entry,
+        resources: apps[0].resources,
+
         run,
         prebuilt: flags.prebuilt,
+        tenant: flags.tenant,
       });
 
       if (flags.json) {
@@ -296,8 +303,11 @@ export class PlatformCommand {
       const completed = await this.orchestrator.down({
         root,
         env: flags.env,
-        apps,
+        entry: apps[0].entry,
+        resources: apps[0].resources,
+
         run,
+        tenant: flags.tenant,
         confirm: async (prompt) => {
           if (flags.yes) {
             return flags.env as string;
@@ -347,8 +357,11 @@ export class PlatformCommand {
       const { state } = await this.orchestrator.status({
         root,
         env,
-        apps,
+        entry: apps[0].entry,
+        resources: apps[0].resources,
+
         run,
+        tenant: flags.tenant,
       });
 
       // --- JSON output ---
@@ -521,20 +534,22 @@ export class PlatformCommand {
         config,
         this.isServerless(envConfig.adapter),
       );
-      const namingCtx = this.naming.forContext(config.project, env);
+      const tenant = resolveTenant(config.tenancy, flags.tenant);
+      const namingCtx = this.naming.forContext(config.project, env, tenant);
 
       const ctx = {
         project: config.project,
         env,
         envConfig,
-        apps,
+        entry: apps[0].entry,
+        resources: apps[0].resources,
+
         root,
         naming: namingCtx,
+        tenant,
       };
 
-      for (const app of apps) {
-        await adapter.build({ ...ctx, app }, run);
-      }
+      await adapter.build(ctx, run);
     },
   });
 
@@ -552,22 +567,23 @@ export class PlatformCommand {
         config,
         this.isServerless(envConfig.adapter),
       );
-      const namingCtx = this.naming.forContext(config.project, env);
+      const tenant = resolveTenant(config.tenancy, flags.tenant);
+      const namingCtx = this.naming.forContext(config.project, env, tenant);
 
       const ctx = {
         project: config.project,
         env,
         envConfig,
-        apps,
+        entry: apps[0].entry,
+        resources: apps[0].resources,
+
         root,
         naming: namingCtx,
+        tenant,
       };
 
       await adapter.authenticate(ctx, run);
-
-      for (const app of apps) {
-        await adapter.deploy({ ...ctx, app }, run);
-      }
+      await adapter.deploy(ctx, run);
     },
   });
 
@@ -585,15 +601,19 @@ export class PlatformCommand {
         config,
         this.isServerless(envConfig.adapter),
       );
-      const namingCtx = this.naming.forContext(config.project, env);
+      const tenant = resolveTenant(config.tenancy, flags.tenant);
+      const namingCtx = this.naming.forContext(config.project, env, tenant);
 
       const ctx = {
         project: config.project,
         env,
         envConfig,
-        apps,
+        entry: apps[0].entry,
+        resources: apps[0].resources,
+
         root,
         naming: namingCtx,
+        tenant,
       };
 
       await adapter.authenticate(ctx, run);
@@ -611,6 +631,72 @@ export class PlatformCommand {
     },
   });
 
+  protected readonly dbExport = $command({
+    name: "export",
+    description:
+      "Export the deployed database to a local snapshot (remote → local dev DB).",
+    flags: t.object({
+      ...this.envFlags.properties,
+      output: t.optional(
+        t.text({
+          description:
+            "Destination SQLite file. Defaults to the dev DB path (node_modules/.alepha/sqlite.db).",
+        }),
+      ),
+      keepSql: t.optional(
+        t.boolean({
+          description: "Keep the intermediate .sql dump file.",
+        }),
+      ),
+    }),
+    handler: async ({ flags, root, run }) => {
+      const config = await this.inspector.resolveConfig(root);
+      const env = flags.env ?? config.defaultEnv;
+      const envConfig = config.environments[env];
+      const adapter = this.orchestrator.resolveAdapter(envConfig.adapter);
+      const app = await this.resolveApp(
+        root,
+        config,
+        this.isServerless(envConfig.adapter),
+      );
+      const tenant = resolveTenant(config.tenancy, flags.tenant);
+      const namingCtx = this.naming.forContext(config.project, env, tenant);
+
+      const ctx = {
+        project: config.project,
+        env,
+        envConfig,
+        entry: app.entry,
+        resources: app.resources,
+
+        root,
+        naming: namingCtx,
+        tenant,
+      };
+
+      await adapter.authenticate(ctx, run);
+      await adapter.exportDb(ctx, run, {
+        output: flags.output,
+        keepSql: flags.keepSql,
+      });
+    },
+  });
+
+  /**
+   * `db` subgroup — operations against the *deployed* database (export,
+   * migrate). They live under `platform` (not core `alepha db`) because
+   * they need the env config, tenancy, adapter, and resource naming.
+   */
+  protected readonly db = $command({
+    name: "db",
+    description: "Deployed-database operations (export, migrate).",
+    children: [this.dbExport, this.migrate],
+    handler: async ({ help, root }) => {
+      await this.inspector.resolveConfig(root);
+      help();
+    },
+  });
+
   // -----------------------------------------------------------------------
   // Parent command
   // -----------------------------------------------------------------------
@@ -626,7 +712,7 @@ export class PlatformCommand {
       this.status,
       this.build,
       this.deploy,
-      this.migrate,
+      this.db,
       this.secretsCommand.secrets,
     ],
     handler: async ({ help, root }) => {
@@ -649,11 +735,29 @@ export class PlatformCommand {
    * ViteBuildProvider.init() per app. This is expensive -- only done
    * for up/down/status, not for plan.
    */
-  protected async resolveApps(
+  protected async resolveApp(
     root: string,
-    config: ResolvedPlatformConfig,
+    _config: ResolvedPlatformConfig,
     isServerless: boolean,
-  ): Promise<AppDefinition[]> {
+    options: { prebuilt?: boolean } = {},
+  ): Promise<{ entry: AppEntry; resources: DetectedResources }> {
+    // Prebuilt + manifest fast-path: read `dist/manifest.json` produced
+    // by the original `alepha build` instead of re-booting the workspace
+    // via Vite. Lets external orchestrators (Alepha Rocket) avoid the
+    // workspace's runtime `npm install` — the app source is never
+    // imported here, so missing deps (react-dom, etc.) don't matter.
+    if (options.prebuilt) {
+      const manifest = await this.readManifest(root);
+      if (manifest) {
+        return {
+          entry: { root, server: "" },
+          resources: manifest.resources,
+        };
+      }
+      // No manifest — fall through to introspection. Useful for older
+      // artifacts that pre-date the manifest emission.
+    }
+
     const entry = await this.boot.getAppEntry(root);
     if (isServerless) {
       process.env.ALEPHA_SERVERLESS = "true";
@@ -662,20 +766,62 @@ export class PlatformCommand {
     delete process.env.ALEPHA_SERVERLESS;
     const resources = this.detectResources(appAlepha);
 
-    return [
-      {
-        name: config.project,
-        path: "",
-        entry,
-        resources,
-      },
-    ];
+    return { entry, resources };
+  }
+
+  /**
+   * @deprecated single-app projects; use `resolveApp` directly.
+   * Kept temporarily so existing commands can be migrated one at a time.
+   */
+  protected async resolveApps(
+    root: string,
+    config: ResolvedPlatformConfig,
+    isServerless: boolean,
+    options: { prebuilt?: boolean } = {},
+  ): Promise<
+    Array<{
+      name: string;
+      path: string;
+      entry: AppEntry;
+      resources: DetectedResources;
+    }>
+  > {
+    const { entry, resources } = await this.resolveApp(
+      root,
+      config,
+      isServerless,
+      options,
+    );
+    return [{ name: config.project, path: "", entry, resources }];
   }
 
   protected isServerless(adapter: string): boolean {
     return adapter === "vercel" || adapter === "cloudflare";
   }
 
+  /**
+   * Read `dist/manifest.json` if present. Returns `null` when the file
+   * doesn't exist or isn't parseable — caller falls back to the
+   * Vite-introspection path.
+   */
+  protected async readManifest(root: string): Promise<{
+    version: number;
+    project: string;
+    resources: DetectedResources;
+  } | null> {
+    try {
+      const fs = await import("node:fs/promises");
+      const path = await import("node:path");
+      const raw = await fs.readFile(
+        path.join(root, "dist", "manifest.json"),
+        "utf-8",
+      );
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+
   protected detectResources(alepha: any): DetectedResources {
     let hasDatabase = false;
     let hasBucket = false;

package/src/cli/platform/index.ts

@@ -1,33 +1,23 @@
 import { $context, $module } from "alepha";
 import { AlephaCli } from "alepha/cli";
-import { CloudflareAdapter } from "./adapters/CloudflareAdapter.ts";
-import { VercelAdapter } from "./adapters/VercelAdapter.ts";
 import {
+  AlephaPlatformLibPlugin,
   type PlatformOptions,
   platformOptions,
-} from "./atoms/platformOptions.ts";
+} from "alepha/cli/platform-lib";
 import { PlatformCommand } from "./commands/platform.ts";
 import { SecretsCommand } from "./commands/SecretsCommand.ts";
-import { GitHubSecretStore } from "./providers/GitHubSecretStore.ts";
-import { MemorySecretStore } from "./providers/MemorySecretStore.ts";
-import { PlatformCacheProvider } from "./providers/PlatformCacheProvider.ts";
-import { CloudflareApi } from "./services/CloudflareApi.ts";
-import { NamingService } from "./services/NamingService.ts";
-import { PlatformInspector } from "./services/PlatformInspector.ts";
-import { PlatformOrchestrator } from "./services/PlatformOrchestrator.ts";
-import { SecretFilterService } from "./services/SecretFilterService.ts";
-import { VercelApi } from "./services/VercelApi.ts";
-import { VercelCli } from "./services/VercelCli.ts";
-import { WranglerApi } from "./services/WranglerApi.ts";
 
 // ---------------------------------------------------------------------------
 
 /**
  * CLI plugin for multi-cloud deployment orchestration.
  *
- * Manages the full lifecycle of deploying Alepha apps: provision
- * resources, build, migrate databases, deploy, and sync secrets.
- * Supports Cloudflare Workers and Vercel.
+ * Wraps `AlephaPlatformLibPlugin` (the framework-agnostic deploy
+ * services) with `$command` instances so the orchestration is
+ * reachable from `alepha platform …`. Non-CLI consumers (e.g. Alepha
+ * Rocket) should depend on `alepha/cli/platform-lib` directly instead
+ * of pulling in this command surface.
  *
  * Commands:
  * - `alepha platform plan`    — show project topology and resource names
@@ -35,9 +25,10 @@ import { WranglerApi } from "./services/WranglerApi.ts";
  * - `alepha platform down`    — teardown an environment
  * - `alepha platform status`  — inspect deployed resources
  * - `alepha platform build`   — build apps locally
- * - `alepha platform deploy`  — deploy to cloud
- * - `alepha platform migrate` — run database migrations
- * - `alepha platform secrets` — manage external secret stores
+ * - `alepha platform deploy`     — deploy to cloud
+ * - `alepha platform db migrate` — run database migrations
+ * - `alepha platform db export`  — pull the deployed DB into a local snapshot
+ * - `alepha platform secrets`    — manage external secret stores
  *
  * Configuration in `alepha.config.ts`:
  *
@@ -59,21 +50,9 @@ export const AlephaCliPlatformPlugin = $module({
   name: "alepha.cli.plugins.platform",
   services: [
     AlephaCli,
+    AlephaPlatformLibPlugin,
     PlatformCommand,
     SecretsCommand,
-    CloudflareAdapter,
-    CloudflareApi,
-    VercelAdapter,
-    VercelApi,
-    VercelCli,
-    WranglerApi,
-    PlatformCacheProvider,
-    GitHubSecretStore,
-    MemorySecretStore,
-    NamingService,
-    SecretFilterService,
-    PlatformInspector,
-    PlatformOrchestrator,
   ],
 });
 
@@ -99,24 +78,5 @@ export const platform = (options: PlatformOptions) => {
 
 // ---------------------------------------------------------------------------
 
-export * from "./adapters/CloudflareAdapter.ts";
-export * from "./adapters/PlatformAdapter.ts";
-export * from "./adapters/VercelAdapter.ts";
-export * from "./atoms/platformOptions.ts";
 export * from "./commands/platform.ts";
 export * from "./commands/SecretsCommand.ts";
-export * from "./providers/GitHubSecretStore.ts";
-export * from "./providers/MemorySecretStore.ts";
-export * from "./providers/PlatformCacheProvider.ts";
-export * from "./providers/SecretStoreProvider.ts";
-export * from "./schemas/cloudflare.ts";
-export * from "./schemas/platform.ts";
-export * from "./schemas/vercel.ts";
-export * from "./services/CloudflareApi.ts";
-export * from "./services/NamingService.ts";
-export * from "./services/PlatformInspector.ts";
-export * from "./services/PlatformOrchestrator.ts";
-export * from "./services/SecretFilterService.ts";
-export * from "./services/VercelApi.ts";
-export * from "./services/VercelCli.ts";
-export * from "./services/WranglerApi.ts";