create-m5kdev 0.34.0 → 0.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-m5kdev",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "license": "GPL-3.0-only",
   "engines": {
     "node": ">=24"

package/templates/minimal-app/.cursor/rules/frontend-data-guide.mdc

@@ -88,6 +88,7 @@ Mutation input shapes are enforced by the router's inferred types — no
 
 - Invalidate intentionally with the matching `queryFilter()` after mutations.
 - Never call `queryClient.clear()` or invalidate everything.
+- Background Workflow completions: invalidate from a `ServerEventProvider` handler. The trigger mutation only returns `jobId`. See `.cursor/rules/server-event-emit.mdc`.
 
 ## Pending state
 

package/templates/minimal-app/.cursor/rules/server-event-emit.mdc

@@ -0,0 +1,41 @@
+---
+description: Emit Server events from background jobs, not from mutations that already return the entity
+globs: **/*.service.ts,**/*.jobs.ts,**/App.tsx,**/*ServerEventProvider.tsx
+alwaysApply: false
+---
+
+# Server event emit
+
+Emit through Auth (`userEmit`, `batchUserEmit`, `organizationEmit`, `emitServerEvent`) when work finishes **off the request** that started it. Typical case: a Workflow job. The UI will not get a completion payload, so SSE tells it to refetch or patch cache.
+
+The acting User already receives the mutation result. They do not need an SSE for that write.
+
+## Emit from
+
+- Workflow job `.handle` after the job creates or updates a resource
+- Other background work the User did not wait on (cron, inbound callback that persisted something)
+
+```typescript
+.handle(async (payload) => {
+  // ... job work ...
+  this.service.auth.userEmit({
+    userId: payload.userId,
+    resource: "workflow",
+    id: jobName,
+    change: "updated",
+    organizationId: null,
+  });
+});
+```
+
+Call Auth directly. Do not wrap `userEmit` in a private helper that only forwards.
+
+## Organization fan-out
+
+`organizationEmit` (or `emitServerEvent` with an Organization id) notifies **other Members**. Use it when a background job (or similar off-request work) creates or changes an org-scoped entity those Members must see. Skip it for tRPC writes that already return the entity, including publish.
+
+## Client
+
+Mount `ServerEventProvider` in the app shell. Register a handler that invalidates the matching `queryFilter()`. Reconnect has no replay: `onReconnect` should invalidate the same queries. Keep polling only as a fallback for in-progress status (queued → running) if you emit only when the job finishes.
+
+Starter: `DemoWorkflowService` `demo.ping` + `trpc.workflow.list`.

package/templates/minimal-app/AGENTS.md.tpl

@@ -25,6 +25,7 @@
 - Do not add service methods that merely call another service. Call the owning service directly unless the method adds a business rule, authorization, validation, orchestration, a transaction boundary, or meaningful domain translation.
 - Renaming a dependency method, repackaging arguments, constructing a prompt, or forwarding actor/context data alone does not justify a service wrapper.
 - Do not create Drizzle migrations by hand. Use the scaffolded config and your project migration workflow later if you need generated migrations.
+- Server event: emit through Auth from Workflow job handlers (and similar background work) when the UI must refresh a change the triggering mutation did not return. See `.cursor/rules/server-event-emit.mdc`.
 
 ## Frontend Conventions
 

package/templates/minimal-app/CLAUDE.md.tpl

@@ -117,6 +117,7 @@ The framework's detailed conventions live in `.cursor/rules/*.mdc`. Cursor appli
 | `.cursor/rules/module-dto-guide.mdc` | `apps/server/src/modules/**/*.dto.ts` |
 | `.cursor/rules/module-repository-guide.mdc` | `apps/server/src/modules/**/*.repository.ts` |
 | `.cursor/rules/module-service-guide.mdc` | `apps/server/src/modules/**/*.service.ts` |
+| `.cursor/rules/server-event-emit.mdc` | `*.service.ts`, `*.jobs.ts`, webapp `App.tsx` / `*ServerEventProvider.tsx` |
 | `.cursor/rules/module-trpc-guide.mdc` | `apps/server/src/modules/**/*.trpc.ts` |
 | `.cursor/rules/module-grants-guide.mdc` | `apps/server/src/modules/**/*.grants.ts` |
 | `.cursor/rules/module-module-guide.mdc` | `apps/server/src/modules/**/*.module.ts` |

package/templates/minimal-app/README.md.tpl

@@ -76,7 +76,8 @@ pnpm landing:deploy
 ```
 
 `app:deploy` / `landing:deploy` read that app’s `.env.production` and forward
-every key as `fly deploy --build-secret`. A missing env file errors with a
+every key as `fly deploy --build-secret` via Kernel bins
+(`m5kdev-fly-deploy` / `m5kdev-fly-secrets`). A missing env file errors with a
 copy-the-example message. Product data lives on the `libsql_data` volume at
 `/app/data` (`DATABASE_URL=file:/app/data/local.db`). Redis is a runtime secret,
 not an image layer.

package/templates/minimal-app/apps/server/AGENTS.md.tpl

@@ -45,6 +45,7 @@ apps/server/src/modules/<module>/
 
 // m5k:workflows:start
 - `WorkflowModule` is registered in `app.ts`. Start **Redis** locally (`REDIS_URL`) before `pnpm dev` on the server, or background jobs will not run.
+- Server event: emit through Auth from a job `.handle` when the UI must refresh a change the trigger mutation did not return. See `.cursor/rules/server-event-emit.mdc`.
 // m5k:workflows:end
 - `index.ts` calls `builtBackendApp.start()`, which listens and handles SIGINT/SIGTERM. Extra shutdown work (telemetry) is `onShutdown` on `createBackendApp`.
 - After changing Drizzle tables, run `pnpm --filter ./apps/server drizzle:generate` then `drizzle:migrate` — do not hand-edit SQL migrations in this repo.

package/templates/minimal-app/apps/server/src/modules/demo-workflow/demo-workflow.module.ts.tpl

@@ -1,4 +1,5 @@
 import { createBackendRouterMap } from "@m5kdev/backend/app";
+import type { AuthModule } from "@m5kdev/backend/modules/auth/auth.module";
 import {
   BaseModule,
   type ModuleServicesContext,
@@ -9,7 +10,7 @@ import type { WorkflowModule } from "@m5kdev/backend/modules/workflow/workflow.m
 import { DemoWorkflowService } from "./demo-workflow.service";
 import { createDemoWorkflowTRPC } from "./demo-workflow.trpc";
 
-type DemoWorkflowModuleDeps = { workflow: WorkflowModule };
+type DemoWorkflowModuleDeps = { workflow: WorkflowModule; auth: AuthModule };
 type DemoWorkflowModuleServices = {
   demoWorkflow: DemoWorkflowService;
 };
@@ -25,13 +26,16 @@ export class DemoWorkflowModule extends BaseModule<
   DemoWorkflowModuleRouters
 > {
   readonly id = "demo-workflow";
-  override readonly dependsOn = ["workflow"] as const;
+  override readonly dependsOn = ["workflow", "auth"] as const;
 
   override services({
     deps,
   }: ModuleServicesContext<DemoWorkflowModuleDeps, Record<string, never>>) {
     return {
-      demoWorkflow: new DemoWorkflowService({ workflow: deps.workflow.services.workflow }),
+      demoWorkflow: new DemoWorkflowService({
+        workflow: deps.workflow.services.workflow,
+        auth: deps.auth.services.auth,
+      }),
     };
   }
 

package/templates/minimal-app/apps/server/src/modules/demo-workflow/demo-workflow.service.ts.tpl

@@ -1,9 +1,11 @@
+import type { AuthService } from "@m5kdev/backend/modules/auth/auth.service";
 import type { ServerResultAsync } from "@m5kdev/backend/modules/base/base.dto";
 import { BaseService } from "@m5kdev/backend/modules/base/base.service";
 import type { WorkflowService } from "@m5kdev/backend/modules/workflow/workflow.service";
 import type { FireAndForgetJobDefinition } from "@m5kdev/backend/modules/workflow/workflow.types";
 import type { Context } from "@m5kdev/backend/utils/trpc";
 import { workflowTriggerOutputSchema } from "@m5kdev/commons/modules/workflow/workflow.schema";
+import { DEMO_WORKFLOW_SERVER_EVENT_RESOURCE } from "{{PACKAGE_SCOPE}}/shared/modules/demo-workflow/demo-workflow.constants";
 import { ok } from "neverthrow";
 
 const DEMO_PING_JOB_NAME = "demo.ping";
@@ -14,12 +16,12 @@ interface DemoPingJobPayload {
 
 export class DemoWorkflowService extends BaseService<
   Record<string, never>,
-  { workflow: WorkflowService },
+  { workflow: WorkflowService; auth: AuthService },
   Context
 > {
   readonly demoPingJob: FireAndForgetJobDefinition<DemoPingJobPayload>;
 
-  constructor(services: { workflow: WorkflowService }) {
+  constructor(services: { workflow: WorkflowService; auth: AuthService }) {
     super({}, services);
 
     this.demoPingJob = this.service.workflow
@@ -28,8 +30,14 @@ export class DemoWorkflowService extends BaseService<
         queue: "fast",
         meta: (payload) => ({ userId: payload.userId }),
       })
-      .handle(async () => {
-        // Completes immediately so the Starter webapp can observe a finished run.
+      .handle(async (payload) => {
+        this.service.auth.userEmit({
+          userId: payload.userId,
+          resource: DEMO_WORKFLOW_SERVER_EVENT_RESOURCE,
+          id: DEMO_PING_JOB_NAME,
+          change: "updated",
+          organizationId: null,
+        });
       });
   }
 

package/templates/minimal-app/apps/server/src/modules/posts/posts.module.ts.tpl

@@ -11,6 +11,7 @@ import { PostsRepository } from "./posts.repository";
 import { PostsService } from "./posts.service";
 import { createPostsTRPC } from "./posts.trpc";
 
+type PostsModuleDeps = Record<string, never>;
 type PostsModuleTables = typeof postsTables;
 type PostsModuleRepositories = {
   posts: PostsRepository;
@@ -23,7 +24,7 @@ type PostsModuleRouters = {
 };
 
 export class PostsModule extends BaseModule<
-  never,
+  PostsModuleDeps,
   PostsModuleTables,
   PostsModuleRepositories,
   PostsModuleServices,
@@ -32,7 +33,7 @@ export class PostsModule extends BaseModule<
   readonly id = "posts";
   override readonly dbDependsOn = ["auth"] as const;
 
-  override repositories({ db }: ModuleRepositoriesContext<never, PostsModuleTables>) {
+  override repositories({ db }: ModuleRepositoriesContext<PostsModuleDeps, PostsModuleTables>) {
     return {
       posts: new PostsRepository({
         orm: db.orm,
@@ -42,13 +43,15 @@ export class PostsModule extends BaseModule<
     };
   }
 
-  override services({ repositories }: ModuleServicesContext<never, PostsModuleRepositories>) {
+  override services({
+    repositories,
+  }: ModuleServicesContext<PostsModuleDeps, PostsModuleRepositories>) {
     return {
       posts: new PostsService({ posts: repositories.posts }, {}, postsGrants),
     };
   }
 
-  override trpc({ trpc, services }: ModuleTRPCContext<never, PostsModuleServices>) {
+  override trpc({ trpc, services }: ModuleTRPCContext<PostsModuleDeps, PostsModuleServices>) {
     return createBackendRouterMap("posts", createPostsTRPC(trpc, services.posts));
   }
 }

package/templates/minimal-app/apps/server/src/modules/posts/posts.service.ts.tpl

@@ -88,7 +88,7 @@ export class PostsService extends BasePermissionService<
       action: "publish",
       entityStep: "post",
     })
-    .handle(({ input, state }) => {
+    .handle(async ({ input, state }) => {
       return this.repository.posts.update({
         id: input.id,
         status: "published",

package/templates/minimal-app/apps/shared/package.json.tpl

@@ -20,6 +20,7 @@
   "exports": {
     "./modules/app/*": "./src/modules/app/*.ts",
     "./modules/conversation/*": "./src/modules/conversation/*.ts",
+    "./modules/demo-workflow/*": "./src/modules/demo-workflow/*.ts",
     "./modules/posts/*": "./src/modules/posts/*.ts"
   }
 }

package/templates/minimal-app/apps/shared/src/modules/demo-workflow/demo-workflow.constants.ts.tpl

@@ -0,0 +1 @@
+export const DEMO_WORKFLOW_SERVER_EVENT_RESOURCE = "workflow";

package/templates/minimal-app/apps/webapp/src/App.tsx.tpl

@@ -14,6 +14,7 @@ import { NuqsAdapter } from "nuqs/adapters/react-router/v7";
 import { BrowserRouter } from "react-router";
 import { Toaster } from "sonner";
 import { Router } from "./Router";
+import { StarterServerEventProvider } from "./StarterServerEventProvider";
 
 export function App() {
   return (
@@ -31,11 +32,13 @@ export function App() {
           <ThemeProvider defaultTheme="light" storageKey="m5kdev-theme">
             <AuthProvider loader={<AppLoader />}>
               <AppTrpcQueryProvider>
-                <DialogProvider>
-                  <Router />
-                </DialogProvider>
-                <Toaster richColors closeButton />
-                <Toast.Provider placement="bottom end" />
+                <StarterServerEventProvider>
+                  <DialogProvider>
+                    <Router />
+                  </DialogProvider>
+                  <Toaster richColors closeButton />
+                  <Toast.Provider placement="bottom end" />
+                </StarterServerEventProvider>
               </AppTrpcQueryProvider>
             </AuthProvider>
           </ThemeProvider>

package/templates/minimal-app/apps/webapp/src/StarterServerEventProvider.tsx.tpl

@@ -0,0 +1,38 @@
+// biome-ignore-all assist/source/organizeImports: feature-gated Server event imports stay in marker blocks
+import { ServerEventProvider } from "@m5kdev/frontend/modules/app/components/ServerEventProvider";
+// m5k:workflows:start
+import type { QueryClient } from "@tanstack/react-query";
+import { DEMO_WORKFLOW_SERVER_EVENT_RESOURCE } from "{{PACKAGE_SCOPE}}/shared/modules/demo-workflow/demo-workflow.constants";
+// m5k:workflows:end
+import type { ReactNode } from "react";
+// m5k:workflows:start
+import { useTRPC } from "./utils/trpc";
+// m5k:workflows:end
+
+type Props = {
+  children: ReactNode;
+};
+
+/** Kernel SSE for the authenticated session. Workflow handlers are feature-gated. */
+export function StarterServerEventProvider({ children }: Props): ReactNode {
+  // m5k:workflows:start
+  const trpc = useTRPC();
+  const invalidateWorkflowList = (queryClient: QueryClient): void => {
+    void queryClient.invalidateQueries(trpc.workflow.list.queryFilter());
+  };
+  // m5k:workflows:end
+  return (
+    <ServerEventProvider
+      // m5k:workflows:start
+      handlers={{
+        [DEMO_WORKFLOW_SERVER_EVENT_RESOURCE]: (_event, queryClient) => {
+          invalidateWorkflowList(queryClient);
+        },
+      }}
+      onReconnect={invalidateWorkflowList}
+      // m5k:workflows:end
+    >
+      {children}
+    </ServerEventProvider>
+  );
+}

package/templates/minimal-app/package.json.tpl

@@ -8,13 +8,14 @@
     "lint": "turbo run lint",
     "lint:fix": "turbo run lint:fix",
     "check-types": "turbo run check-types",
-    "app:deploy": "node apps/shared/scripts/fly-deploy.mjs --config apps/shared/fly.toml --dockerfile apps/shared/Dockerfile --env apps/shared/.env.production",
-    "app:secrets": "node apps/shared/scripts/fly-secrets.mjs --config apps/shared/fly.toml --env apps/shared/.env.production",
-    "landing:deploy": "node apps/landing/scripts/fly-deploy.mjs --config apps/landing/fly.toml --dockerfile apps/landing/Dockerfile --env apps/landing/.env.production",
-    "landing:secrets": "node apps/landing/scripts/fly-secrets.mjs --config apps/landing/fly.toml --env apps/landing/.env.production"
+    "app:deploy": "m5kdev-fly-deploy --config apps/shared/fly.toml --dockerfile apps/shared/Dockerfile --env apps/shared/.env.production",
+    "app:secrets": "m5kdev-fly-secrets --config apps/shared/fly.toml --env apps/shared/.env.production",
+    "landing:deploy": "m5kdev-fly-deploy --config apps/landing/fly.toml --dockerfile apps/landing/Dockerfile --env apps/landing/.env.production",
+    "landing:secrets": "m5kdev-fly-secrets --config apps/landing/fly.toml --env apps/landing/.env.production"
   },
   "devDependencies": {
     "@biomejs/biome": "catalog:m5kdev",
+    "@m5kdev/backend": "catalog:m5kdev",
     "turbo": "catalog:m5kdev",
     "typescript": "catalog:m5kdev"
   },

package/templates/minimal-app/pnpm-workspace.yaml.tpl

@@ -7,17 +7,17 @@ catalogs:
     "@heroui/react": 3.0.3
     "@heroui/styles": 3.0.3
     "@libsql/client": 0.17.4
-    "@m5kdev/backend": 0.34.0
-    "@m5kdev/commons": 0.34.0
-    "@m5kdev/config": 0.34.0
-    "@m5kdev/email": 0.34.0
-    "@m5kdev/frontend": 0.34.0
-    "@m5kdev/module-clay": 0.34.0
-    "@m5kdev/module-docx": 0.34.0
-    "@m5kdev/module-pdf": 0.34.0
-    "@m5kdev/module-social": 0.34.0
-    "@m5kdev/module-video": 0.34.0
-    "@m5kdev/web-ui": 0.34.0
+    "@m5kdev/backend": 0.35.0
+    "@m5kdev/commons": 0.35.0
+    "@m5kdev/config": 0.35.0
+    "@m5kdev/email": 0.35.0
+    "@m5kdev/frontend": 0.35.0
+    "@m5kdev/module-clay": 0.35.0
+    "@m5kdev/module-docx": 0.35.0
+    "@m5kdev/module-pdf": 0.35.0
+    "@m5kdev/module-social": 0.35.0
+    "@m5kdev/module-video": 0.35.0
+    "@m5kdev/web-ui": 0.35.0
     "@mastra/core": 1.51.0
     "@openrouter/ai-sdk-provider": 3.0.0
     "@opentelemetry/api": 1.9.0

package/templates/minimal-app/template.manifest.json

@@ -40,6 +40,7 @@
       "paths": [
         "apps/webapp/src/modules/workflows/",
         "apps/server/src/modules/demo-workflow/",
+        "apps/shared/src/modules/demo-workflow/",
         "apps/e2e/tests/workflow.spec.ts"
       ]
     },

package/templates/minimal-app/apps/landing/scripts/fly-deploy.mjs.tpl

@@ -1,75 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { parseArgs } from "node:util";
-
-function missingEnvMessage(envPath) {
-  return `Missing ${envPath}. Copy the .env.production.example next to it, fill in values, then retry.`;
-}
-
-function parseDotenv(source) {
-  const vars = {};
-  for (const rawLine of source.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq === -1) continue;
-    const key = line.slice(0, eq).trim();
-    let value = line.slice(eq + 1);
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    vars[key] = value;
-  }
-  return vars;
-}
-
-function shellSingleQuote(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-
-function toExportScript(vars) {
-  return Object.entries(vars)
-    .map(([key, value]) => `export ${key}=${shellSingleQuote(value)}`)
-    .join("\n");
-}
-
-const { values } = parseArgs({
-  options: {
-    config: { type: "string" },
-    dockerfile: { type: "string" },
-    env: { type: "string" },
-  },
-});
-
-if (!values.config || !values.dockerfile || !values.env) {
-  console.error(
-    "Usage: fly-deploy.mjs --config <fly.toml> --dockerfile <Dockerfile> --env <.env.production>"
-  );
-  process.exit(1);
-}
-
-if (!existsSync(values.env)) {
-  console.error(missingEnvMessage(values.env));
-  process.exit(1);
-}
-
-const vars = parseDotenv(readFileSync(values.env, "utf8"));
-const args = [
-  "deploy",
-  "-c",
-  values.config,
-  "--dockerfile",
-  values.dockerfile,
-  "--build-secret",
-  `ALL_SECRETS=${toExportScript(vars)}`,
-];
-for (const [key, value] of Object.entries(vars)) {
-  args.push("--build-secret", `${key}=${value}`);
-}
-
-const result = spawnSync("fly", args, { stdio: "inherit" });
-process.exit(result.status ?? 1);

package/templates/minimal-app/apps/landing/scripts/fly-secrets.mjs.tpl

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { parseArgs } from "node:util";
-
-function missingEnvMessage(envPath) {
-  return `Missing ${envPath}. Copy the .env.production.example next to it, fill in values, then retry.`;
-}
-
-const { values } = parseArgs({
-  options: {
-    config: { type: "string" },
-    env: { type: "string" },
-  },
-});
-
-if (!values.config || !values.env) {
-  console.error("Usage: fly-secrets.mjs --config <fly.toml> --env <.env.production>");
-  process.exit(1);
-}
-
-if (!existsSync(values.env)) {
-  console.error(missingEnvMessage(values.env));
-  process.exit(1);
-}
-
-const result = spawnSync("fly", ["secrets", "import", "-c", values.config], {
-  input: readFileSync(values.env),
-  stdio: ["pipe", "inherit", "inherit"],
-});
-process.exit(result.status ?? 1);

package/templates/minimal-app/apps/shared/scripts/fly-deploy.mjs.tpl

@@ -1,75 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { parseArgs } from "node:util";
-
-function missingEnvMessage(envPath) {
-  return `Missing ${envPath}. Copy the .env.production.example next to it, fill in values, then retry.`;
-}
-
-function parseDotenv(source) {
-  const vars = {};
-  for (const rawLine of source.split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq === -1) continue;
-    const key = line.slice(0, eq).trim();
-    let value = line.slice(eq + 1);
-    if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
-    ) {
-      value = value.slice(1, -1);
-    }
-    vars[key] = value;
-  }
-  return vars;
-}
-
-function shellSingleQuote(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-
-function toExportScript(vars) {
-  return Object.entries(vars)
-    .map(([key, value]) => `export ${key}=${shellSingleQuote(value)}`)
-    .join("\n");
-}
-
-const { values } = parseArgs({
-  options: {
-    config: { type: "string" },
-    dockerfile: { type: "string" },
-    env: { type: "string" },
-  },
-});
-
-if (!values.config || !values.dockerfile || !values.env) {
-  console.error(
-    "Usage: fly-deploy.mjs --config <fly.toml> --dockerfile <Dockerfile> --env <.env.production>"
-  );
-  process.exit(1);
-}
-
-if (!existsSync(values.env)) {
-  console.error(missingEnvMessage(values.env));
-  process.exit(1);
-}
-
-const vars = parseDotenv(readFileSync(values.env, "utf8"));
-const args = [
-  "deploy",
-  "-c",
-  values.config,
-  "--dockerfile",
-  values.dockerfile,
-  "--build-secret",
-  `ALL_SECRETS=${toExportScript(vars)}`,
-];
-for (const [key, value] of Object.entries(vars)) {
-  args.push("--build-secret", `${key}=${value}`);
-}
-
-const result = spawnSync("fly", args, { stdio: "inherit" });
-process.exit(result.status ?? 1);

package/templates/minimal-app/apps/shared/scripts/fly-secrets.mjs.tpl

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { parseArgs } from "node:util";
-
-function missingEnvMessage(envPath) {
-  return `Missing ${envPath}. Copy the .env.production.example next to it, fill in values, then retry.`;
-}
-
-const { values } = parseArgs({
-  options: {
-    config: { type: "string" },
-    env: { type: "string" },
-  },
-});
-
-if (!values.config || !values.env) {
-  console.error("Usage: fly-secrets.mjs --config <fly.toml> --env <.env.production>");
-  process.exit(1);
-}
-
-if (!existsSync(values.env)) {
-  console.error(missingEnvMessage(values.env));
-  process.exit(1);
-}
-
-const result = spawnSync("fly", ["secrets", "import", "-c", values.config], {
-  input: readFileSync(values.env),
-  stdio: ["pipe", "inherit", "inherit"],
-});
-process.exit(result.status ?? 1);