bazis 0.98.28 → 0.98.29

package/cli/build.ts

@@ -10,6 +10,13 @@ export interface BuildOptions {
   readonly bin: boolean;
   /** Executable path relative to the project; default `bin/<package name>`. */
   readonly outfile?: string;
+  /** Let the executable read `.env` files from its working directory (off by default). */
+  readonly dotenv?: boolean;
+}
+
+export interface CompileOptions {
+  /** Let the executable read `.env`, `.env.local`, `.env.<NODE_ENV>` from its working directory. */
+  readonly dotenv?: boolean;
 }
 
 /**
@@ -103,7 +110,7 @@ export async function runBuild(cwd: string, options: BuildOptions, codegen: Code
   if (typecheck !== 0 || !options.bin) return typecheck;
   const outfile = path.resolve(cwd, options.outfile ?? path.join("bin", await binaryName(cwd)));
   log(`[bazis] compile ${path.relative(cwd, outfile)}...`);
-  return compileBinary(bun, await projectEntry(cwd), outfile);
+  return compileBinary(bun, await projectEntry(cwd), outfile, { dotenv: options.dotenv });
 }
 
 /**
@@ -111,11 +118,18 @@ export async function runBuild(cwd: string, options: BuildOptions, codegen: Code
  * `.<hash>.bun-build` file in its working directory and cannot remove it when
  * that executable is read-only or carries `uchg` (scripts/bazis-bun). Compile
  * from a private directory and remove it afterwards.
+ *
+ * By default a Bun executable reads `bunfig.toml` and `.env` files from the
+ * directory it is started in: a `preload` in such a bunfig runs foreign code
+ * inside the application, and a stray `.env` silently changes its settings.
+ * The executable gets its settings from the real environment instead;
+ * `dotenv: true` restores reading `.env`. A bunfig is never read.
  */
-export function compileBinary(bun: string, entry: string, outfile: string): number {
+export function compileBinary(bun: string, entry: string, outfile: string, options: CompileOptions = {}): number {
   const workDir = mkdtempSync(path.join(tmpdir(), "bazis-compile-"));
+  const autoload = ["--no-compile-autoload-bunfig", options.dotenv === true ? "--compile-autoload-dotenv" : "--no-compile-autoload-dotenv"];
   try {
-    const result = Bun.spawnSync([bun, "build", "--compile", path.resolve(entry), "--outfile", path.resolve(outfile)],
+    const result = Bun.spawnSync([bun, "build", "--compile", ...autoload, path.resolve(entry), "--outfile", path.resolve(outfile)],
       { cwd: workDir, stdout: "inherit", stderr: "inherit" });
     return result.exitCode ?? 1;
   } finally {

package/cli/generateProject.ts

@@ -164,7 +164,8 @@ function buildProjectFiles(name: string, dependency: string, frameworkMode: Fram
     ["package.json", `${JSON.stringify(manifest, null, 2)}\n`],
     ["tsconfig.json", `${JSON.stringify(tsconfig, null, 2)}\n`],
     ["bazis.config.json", `${JSON.stringify(codegen, null, 2)}\n`],
-    [".gitignore", "node_modules/\nbin/\nsrc/generated/\n.env\n"],
+    // Bun reads .env, .env.local and .env.<NODE_ENV>: none of them belongs in git.
+    [".gitignore", "node_modules/\nbin/\nsrc/generated/\n.env\n.env.*\n!.env.example\n"],
     [".env.example", "# Copy to .env (Bun loads it automatically).\nBAZIS_ENV=development\nHOST=127.0.0.1\nPORT=3000\n"],
     ["src/app/test/health.test.ts", HEALTH_TEST],
     ["AGENTS.md", "# Working on this bazis project\n\nBefore changing the application, read the [module architecture](docs/architecture/MODULE_ARCHITECTURE.md). Create new modules only with `bunx bazis g module` or `bunx bazis g pack`; fill in the generated `MODULE.md` afterwards. Only codegen updates `src/generated/`.\n"],

package/cli/main.ts

@@ -16,6 +16,7 @@ export const USAGE = `Usage:
   bazis test [<bun test args>]                Codegen, then bun test
   bazis build                                 Codegen and typecheck
   bazis build --bin [--outfile <path>]        Also compile a standalone executable (default bin/<name>)
+  bazis build --bin --dotenv                  The executable also reads .env files from its working directory
   bazis --help
   g can also be written as generate.
 
@@ -85,7 +86,7 @@ export async function runCli(argv: readonly string[], runtime: CliRuntime = defa
     if (parsed.kind === "codegen") return await runtime.codegen(process.cwd(), parsed.target);
     if (parsed.kind === "dev") return await runDev(process.cwd(), runtime.codegen, runtime.log, { watch: parsed.watch });
     if (parsed.kind === "test") return await runTest(process.cwd(), parsed.args, runtime.codegen);
-    if (parsed.kind === "build") return await runBuild(process.cwd(), { bin: parsed.bin, outfile: parsed.outfile }, runtime.codegen, runtime.log);
+    if (parsed.kind === "build") return await runBuild(process.cwd(), { bin: parsed.bin, outfile: parsed.outfile, dotenv: parsed.dotenv }, runtime.codegen, runtime.log);
     if (parsed.kind === "new") {
       const result = await generateProject({ name: parsed.name, outputPath: parsed.outputPath, frameworkPath: parsed.frameworkPath, linkFramework: parsed.linkFramework, vendor: parsed.vendor, dryRun: parsed.dryRun });
       runtime.log(`[bazis] ${result.dryRun ? "planned" : "created"} project: ${result.projectDir}`);

package/cli/parseCli.ts

@@ -25,7 +25,7 @@ export type ParseCliResult =
   | { readonly kind: "codegen"; readonly target?: string }
   | { readonly kind: "dev"; readonly watch: boolean }
   | { readonly kind: "test"; readonly args: readonly string[] }
-  | { readonly kind: "build"; readonly bin: boolean; readonly outfile?: string }
+  | { readonly kind: "build"; readonly bin: boolean; readonly outfile?: string; readonly dotenv: boolean }
   | { readonly kind: "error"; readonly message: string };
 
 const GENERATOR_ALIASES = new Map<string, "module" | "pack">([
@@ -33,7 +33,7 @@ const GENERATOR_ALIASES = new Map<string, "module" | "pack">([
   ["pack", "pack"], ["p", "pack"], ["module-pack", "pack"],
 ]);
 const VALUE_OPTIONS = new Set(["--modules-root", "--app-module", "--pack", "--parts", "--target", "--path", "--framework", "--outfile"]);
-const FLAG_OPTIONS = new Set(["--no-register", "--force", "--full", "--enterprise", "--minimal", "--empty", "--dry-run", "--no-codegen", "--link-framework", "--vendor", "--bin", "--watch"]);
+const FLAG_OPTIONS = new Set(["--no-register", "--force", "--full", "--enterprise", "--minimal", "--empty", "--dry-run", "--no-codegen", "--link-framework", "--vendor", "--bin", "--watch", "--dotenv"]);
 
 /** Parsing is pure: help and invalid input can never start generation. */
 export function parseCliArgs(argv: readonly string[]): ParseCliResult {
@@ -89,14 +89,15 @@ export function parseCliArgs(argv: readonly string[]): ParseCliResult {
   }
   if (options.has("--watch")) return error("--watch is only supported by dev.");
   if (command === "build") {
-    if (positional.length !== 1) return error("Use: bazis build [--bin [--outfile <path>]]");
+    if (positional.length !== 1) return error("Use: bazis build [--bin [--outfile <path>] [--dotenv]]");
     for (const option of options.keys()) {
-      if (option !== "--bin" && option !== "--outfile") return error(`Option ${option} is not supported by build.`);
+      if (option !== "--bin" && option !== "--outfile" && option !== "--dotenv") return error(`Option ${option} is not supported by build.`);
     }
     if (options.has("--outfile") && !options.has("--bin")) return error("--outfile requires --bin.");
-    return { kind: "build", bin: options.has("--bin"), outfile: options.get("--outfile") };
+    if (options.has("--dotenv") && !options.has("--bin")) return error("--dotenv requires --bin.");
+    return { kind: "build", bin: options.has("--bin"), outfile: options.get("--outfile"), dotenv: options.has("--dotenv") };
   }
-  if (options.has("--bin") || options.has("--outfile")) return error("--bin and --outfile are only supported by build.");
+  if (options.has("--bin") || options.has("--outfile") || options.has("--dotenv")) return error("--bin, --outfile and --dotenv are only supported by build.");
   if (command === "codegen") {
     if (positional.length !== 1) return error("Use: bazis codegen [--target <name|all>]");
     for (const option of options.keys()) {

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.28" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.98.29" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/core/kernel/config/README.md

@@ -26,6 +26,16 @@ Flat Configuration key names are case-insensitive. A later source also wins
 between the canonical name and an explicit env alias.
 Numbers are finite; an empty string never becomes zero; a Secret does not allow an
 empty or whitespace value. TypeScript forbids unsupported object types.
+In `production` a Secret whose value would come from the `default` section (no source
+supplied it and the `production` section does not declare it) is an error: a secret
+default in the code is a development value. `production: { key: secret("…") }`
+declares a production value explicitly.
+
+`secretFilesSource(directory, { optional })` reads secret files as Docker and Kubernetes
+mount them (`/run/secrets`): one file per value, the file name is the key (`db.password`)
+or its variable (`BAZIS_DB__PASSWORD`), trailing line breaks are removed, hidden entries
+(Kubernetes `..data`) and directories are skipped, a file over 64 KiB is an error.
+Errors name the file, never its content. A missing directory is an error unless `optional`.
 
 A declaration stores no chosen environment, values or cache. `get/has/ensureValid`
 stay for standalone reading of the process env, but `ensureValid` no longer

package/core/kernel/config/defineConfig.ts

@@ -156,7 +156,8 @@ export function defineConfig(prefixOrSchema: string | ConfigSchema<Defaults>, ma
     const issues: string[] = [];
     // A wrong value names what came and where to change it: the variable that
     // supplied it, or the variables that can override the value from the code.
-    const got = (raw: unknown) => raw === undefined ? "" : `, got ${JSON.stringify(String(raw)).slice(0, 80)}`;
+    // A key with a sensitive name never shows its value.
+    const got = (key: string, raw: unknown) => raw === undefined || isSensitiveKey(fullKey(key)) ? "" : `, got ${JSON.stringify(String(raw)).slice(0, 80)}`;
     const source = (key: string, selected: { readonly name: string } | undefined) => ` (${selected ? selected.name : names.get(key)!.join(", ")})`;
     for (const key of keys) {
       const base = schema.default[key]!;
@@ -179,23 +180,31 @@ export function defineConfig(prefixOrSchema: string | ConfigSchema<Defaults>, ma
       let value: ConfigValueType | undefined;
       if (type === "secret") {
         if (typeof raw !== "string" || !raw.trim()) issues.push(`${fullKey(key)} — required non-empty secret is not set (${names.get(key)!.join(", ")})`);
+        // A secret default in the code is a development value; production must
+        // get the secret from a source or declare its own value explicitly.
+        // No "apiKey: …" in the hint: the console redaction would hide it.
+        else if (environment === "production" && selected === undefined && override === undefined) issues.push(`${fullKey(key)} — production would use the development default secret from the code; set ${names.get(key)!.join(" or ")}, or declare ${key} in the production section`);
         else value = new Secret(raw);
       } else if (type === "number") {
         const parsed = Number(raw);
-        if (raw === undefined || (typeof raw === "string" && !raw.trim()) || !Number.isFinite(parsed)) issues.push(`${fullKey(key)} — expected a finite number${got(raw)}${source(key, selected)}`);
+        if (raw === undefined || (typeof raw === "string" && !raw.trim()) || !Number.isFinite(parsed)) issues.push(`${fullKey(key)} — expected a finite number${got(key, raw)}${source(key, selected)}`);
         else value = parsed;
       } else if (type === "boolean") {
         const normalized = String(raw).toLowerCase();
         if (normalized === "true" || normalized === "1") value = true;
         else if (normalized === "false" || normalized === "0") value = false;
-        else issues.push(`${fullKey(key)} — expected a boolean (true, false, 1, 0)${got(raw)}${source(key, selected)}`);
+        else issues.push(`${fullKey(key)} — expected a boolean (true, false, 1, 0)${got(key, raw)}${source(key, selected)}`);
       } else if (typeof raw === "string") value = raw;
       else issues.push(`${fullKey(key)} — expected a string`);
       if (value === undefined) continue;
-      if (isEnum(base) && !base.values.includes(value as string | number)) issues.push(`${fullKey(key)} — ${JSON.stringify(value)} is not allowed, use one of: ${base.values.join(", ")}${source(key, selected)}`);
+      if (isEnum(base) && !base.values.includes(value as string | number)) issues.push(`${fullKey(key)} — ${isSensitiveKey(fullKey(key)) ? "the value" : JSON.stringify(value)} is not allowed, use one of: ${base.values.join(", ")}${source(key, selected)}`);
       try {
         const issue = validators[key]?.(value);
-        if (issue) issues.push(`${fullKey(key)} — ${issue}`);
+        // A validator may quote its own value; hide it in that message only.
+        // Replacing secrets across the whole text turned a one-letter secret
+        // into "m***il.***piKey".
+        const sensitive = value instanceof Secret ? value.reveal() : typeof value === "string" && isSensitiveKey(fullKey(key)) ? value : "";
+        if (issue) issues.push(`${fullKey(key)} — ${sensitive.trim() ? issue.replaceAll(sensitive, "***") : issue}`);
       } catch { issues.push(`${fullKey(key)} — validator failed`); }
       values.set(key, value);
       inspection.push(Object.freeze({ key: fullKey(key), type: type as ConfigInspection["type"], env: names.get(key)!, source: selected?.source ?? (override === undefined ? "default" : environment), value: safeValue(fullKey(key), value) }));
@@ -203,11 +212,7 @@ export function defineConfig(prefixOrSchema: string | ConfigSchema<Defaults>, ma
     if (issues.length) {
       // "key — text", not "key: text": the console redaction would read
       // "db.password: required" as a secret value and hide the word "required".
-      let message = issues.join("; ");
-      for (const [key, value] of values) {
-        const sensitive = value instanceof Secret ? value.reveal() : typeof value === "string" && isSensitiveKey(key) ? value : undefined;
-        if (sensitive) message = message.replaceAll(sensitive, "***");
-      }
+      const message = issues.join("; ");
       throw new KernelError(`Invalid configuration (environment "${environment}"): ${message}.`);
     }
     const rows = Object.freeze(inspection);

package/core/kernel/config/sources.ts

@@ -1,3 +1,5 @@
+import { readdir, stat } from "node:fs/promises";
+import path from "node:path";
 import { KernelError } from "../errors";
 import type { ConfigSource } from "../types";
 
@@ -96,6 +98,62 @@ export function jsonFileSource(path: string, options?: { readonly optional?: boo
   };
 }
 
+/** Largest secret file read by {@link secretFilesSource}: keys and certificates are a few KiB. */
+const SECRET_FILE_MAX_BYTES = 64 * 1024;
+
+/**
+ * Secret files of a directory, as Docker and Kubernetes mount them
+ * (`/run/secrets`). Each file is one value; its name is the key, written as
+ * the key (`db.password`) or as its variable (`BAZIS_DB__PASSWORD`). Trailing
+ * line breaks are removed. Hidden entries (Kubernetes `..data`) and
+ * directories are skipped. Errors name the file, never its content.
+ */
+export function secretFilesSource(directory: string, options?: { readonly optional?: boolean }): ConfigSource {
+  return {
+    description: `files(${directory})`,
+    load: async () => {
+      let names: string[];
+      try {
+        names = await readdir(directory);
+      } catch (error) {
+        if (options?.optional === true && (error as NodeJS.ErrnoException).code === "ENOENT") {
+          return {};
+        }
+        throw new KernelError(`Secret directory "${directory}" cannot be read (${(error as NodeJS.ErrnoException).code ?? "error"}).`);
+      }
+      const result: Record<string, string> = {};
+      for (const name of names.sort()) {
+        if (name.startsWith(".")) {
+          continue;
+        }
+        const file = path.join(directory, name);
+        let text: string;
+        try {
+          // stat follows the symlinks Kubernetes uses for each key.
+          const info = await stat(file);
+          if (!info.isFile()) {
+            continue;
+          }
+          if (info.size > SECRET_FILE_MAX_BYTES) {
+            throw new KernelError(`Secret file "${file}" is larger than ${SECRET_FILE_MAX_BYTES} bytes.`);
+          }
+          text = await Bun.file(file).text();
+        } catch (error) {
+          if (error instanceof KernelError) throw error;
+          throw new KernelError(`Secret file "${file}" cannot be read (${(error as NodeJS.ErrnoException).code ?? "error"}).`);
+        }
+        const key = name.toUpperCase().startsWith(ENV_PREFIX)
+          ? name.slice(ENV_PREFIX.length).toLowerCase().replaceAll("__", ".")
+          : name.toLowerCase();
+        if (key.length > 0) {
+          result[key] = text.replace(/[\r\n]+$/, "");
+        }
+      }
+      return result;
+    },
+  };
+}
+
 function flatten(tree: ConfigTree, prefix = "", into: Record<string, string> = {}): Record<string, string> {
   for (const [key, value] of Object.entries(tree)) {
     const fullKey = prefix.length > 0 ? `${prefix}.${key}` : key;

package/core/kernel/index.ts

@@ -29,7 +29,7 @@ export {
   type ValidatableConfig,
 } from "./config/defineConfig";
 export { addConfigOptions, configOptions, type ConfigOptionsBinding } from "./config/addConfigOptions";
-export { argsSource, envSource, jsonFileSource, memorySource } from "./config/sources";
+export { argsSource, envSource, jsonFileSource, memorySource, secretFilesSource } from "./config/sources";
 
 export {
   EVENT_HANDLER,

package/core/kernel/logging/ConsoleLogger.ts

@@ -1,4 +1,4 @@
-import { redactSensitive, type SensitiveRedactionOptions } from "../../../library/redaction";
+import { redactSensitive, redactSensitiveText, type SensitiveRedactionOptions } from "../../../library/redaction";
 import type { LogFields, LogLevel, Logger } from "./Logger";
 import { getRequestId, getTraceparent } from "../correlation/requestContext";
 
@@ -16,7 +16,10 @@ export interface ConsoleLoggerOptions {
   readonly minLevel?: LogLevel;
   /** Prefix tag, e.g. the app name. */
   readonly name?: string;
-  /** Structured fields are redacted by default; pass false only for trusted local debugging. */
+  /**
+   * The message and structured fields are redacted by default (secret keys, `password=…`,
+   * bearer tokens, URL credentials); pass false only for trusted local debugging.
+   */
   readonly redaction?: SensitiveRedactionOptions | false;
   /**
    * Inside a request, add `requestId` (and `traceparent`, when the request
@@ -83,6 +86,7 @@ export class ConsoleLogger implements Logger {
       return;
     }
     const line = this.requestContext ? withRequestContext(fields) : fields;
-    LEVEL_SINK[level](`${this.prefix}${level}: ${message}${formatFields(line, this.redaction)}`);
+    const text = this.redaction === false ? message : redactSensitiveText(message, this.redaction);
+    LEVEL_SINK[level](`${this.prefix}${level}: ${text}${formatFields(line, this.redaction)}`);
   }
 }

package/library/redaction/index.ts

@@ -19,6 +19,8 @@ const DEFAULT_SENSITIVE_FRAGMENTS = [
 const SECRET_TEXT_PATTERN =
   /\b(password|passwd|passphrase|secret|token|api[-_]?key|cookie|set-cookie|private[-_]?key|client[-_]?secret)\b(\s*[:=]\s*)("[^"]*"|'[^']*'|[^,\s}]+)/gi;
 const BEARER_TEXT_PATTERN = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+// Credentials in a URL: postgres://user:password@host, https://token@host.
+const URL_USERINFO_PATTERN = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/?#@]+)@/gi;
 
 export interface SensitiveRedactionOptions {
   readonly replacement?: string;
@@ -162,5 +164,7 @@ function normalizeKey(key: string): string {
 function redactText(value: string, replacement: string): string {
   return value
     .replace(SECRET_TEXT_PATTERN, (_match, name: string, separator: string) => `${name}${separator}${replacement}`)
-    .replace(BEARER_TEXT_PATTERN, (_match, scheme: string) => `${scheme} ${replacement}`);
+    .replace(BEARER_TEXT_PATTERN, (_match, scheme: string) => `${scheme} ${replacement}`)
+    .replace(URL_USERINFO_PATTERN, (_match, scheme: string, userinfo: string) =>
+      `${scheme}${userinfo.includes(":") ? `${replacement}:${replacement}` : replacement}@`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.98.28",
+  "version": "0.98.29",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",