hereya-cli 0.89.0 → 0.90.1

package/dist/lib/env/test.setup.js

@@ -0,0 +1,18 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import * as sinon from 'sinon';
+import { EnvManager } from './index.js';
+export async function setupEnvManagerTest() {
+    const tempDir = path.join(os.tmpdir(), 'hereya-test-env', randomUUID());
+    await fs.mkdir(path.join(tempDir, '.hereya'), { recursive: true });
+    process.env.HEREYA_PROJECT_ROOT_DIR = tempDir;
+    const envManager = new EnvManager();
+    return { envManager, tempDir };
+}
+export async function teardownEnvManagerTest(context) {
+    sinon.restore();
+    await fs.rm(context.tempDir, { force: true, recursive: true });
+    delete process.env.HEREYA_PROJECT_ROOT_DIR;
+}

package/dist/lib/executor-start/auth.d.ts

@@ -0,0 +1,2 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+export declare function createAuthenticatedBackend(hereyaToken: string, cloudUrl: string): Promise<CloudBackend>;

package/dist/lib/executor-start/auth.js

@@ -0,0 +1,21 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { loginWithToken } from '../../backend/cloud/login.js';
+import { saveCloudCredentials } from '../../backend/config.js';
+export async function createAuthenticatedBackend(hereyaToken, cloudUrl) {
+    const loginResult = await loginWithToken(cloudUrl, hereyaToken);
+    if (!loginResult.success) {
+        throw new Error(`Failed to authenticate: ${loginResult.error}`);
+    }
+    await saveCloudCredentials({
+        accessToken: loginResult.accessToken,
+        clientId: loginResult.clientId,
+        refreshToken: loginResult.refreshToken,
+        url: cloudUrl,
+    });
+    return new CloudBackend({
+        accessToken: loginResult.accessToken,
+        clientId: loginResult.clientId,
+        refreshToken: loginResult.refreshToken,
+        url: cloudUrl,
+    });
+}

package/dist/lib/executor-start/execute-app-job.d.ts

@@ -0,0 +1,13 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { Logger } from '../../lib/log.js';
+export type AppJobResult = {
+    reason: string;
+    success: false;
+} | {
+    success: true;
+};
+export declare function executeAppJob(job: {
+    id: string;
+    payload: any;
+    type: string;
+}, cloudBackend: CloudBackend, logger: Logger): Promise<AppJobResult>;

package/dist/lib/executor-start/execute-app-job.js

@@ -0,0 +1,146 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import * as appSourceLib from '../../lib/app-source.js';
+import { shellUtils } from '../../lib/shell.js';
+import { sanitizeWorkspaceForFilename } from './format.js';
+export async function executeAppJob(job, cloudBackend, logger) {
+    const isDeploy = job.type === 'app-deploy';
+    const subcommand = isDeploy ? 'deploy' : 'destroy';
+    const payload = job.payload;
+    const { appName, commit, parameters: providedParameters, repository, sha256, version, workspace } = payload;
+    if (!appName || !workspace || !repository) {
+        return {
+            reason: `Missing appName, workspace, or repository in ${job.type} job payload`,
+            success: false,
+        };
+    }
+    let cleanup;
+    try {
+        logger.info(`Downloading app source ${repository}${commit ? `@${commit}` : ''}...`);
+        const downloadResult = await appSourceLib.appSource.download({ commit, logger, repository, sha256 });
+        cleanup = downloadResult.cleanup;
+        const { rootDir } = downloadResult;
+        await cloudBackend.updateAppDeployment({
+            lastJobId: job.id,
+            name: appName,
+            status: isDeploy ? 'deploying' : 'destroying',
+            workspace,
+        });
+        const parameters = providedParameters ?? {};
+        const paramFlags = [];
+        for (const [key, value] of Object.entries(parameters)) {
+            paramFlags.push('-p', `${key}=${value}`);
+        }
+        const versionFlags = isDeploy && version ? ['--version', version] : [];
+        logger.info(`Running hereya app ${subcommand} ${appName} -w ${workspace} --local...`);
+        const runOutcome = await runAppSubcommand({
+            appName,
+            logger,
+            paramFlags,
+            rootDir,
+            subcommand,
+            versionFlags,
+            workspace,
+        });
+        if (!runOutcome.success) {
+            await markAppDeploymentFailed({ appName, jobId: job.id, reason: runOutcome.reason, workspace }, cloudBackend);
+            return { reason: runOutcome.reason, success: false };
+        }
+        const patchResult = await patchAppFinalState({
+            appName,
+            cloudBackend,
+            isDeploy,
+            jobId: job.id,
+            rootDir,
+            workspace,
+        });
+        if (!patchResult.success) {
+            return patchResult;
+        }
+        return { success: true };
+    }
+    catch (error) {
+        try {
+            await markAppDeploymentFailed({ appName, jobId: job.id, reason: error.message, workspace }, cloudBackend);
+        }
+        catch {
+            // best-effort
+        }
+        return { reason: `app-${subcommand} failed: ${error.message}`, success: false };
+    }
+    finally {
+        if (cleanup) {
+            await cleanup();
+        }
+    }
+}
+async function runAppSubcommand(input) {
+    const { appName, logger, paramFlags, rootDir, subcommand, versionFlags, workspace } = input;
+    let runResult;
+    try {
+        runResult = await shellUtils.runShell('hereya', ['app', subcommand, appName, '-w', workspace, ...paramFlags, ...versionFlags, '--local'], {
+            directory: rootDir,
+            env: { ...process.env, HEREYA_LOCAL_EXECUTION: 'true', HEREYA_PROJECT_ROOT_DIR: rootDir },
+            logger,
+        });
+    }
+    catch (error) {
+        return { reason: `hereya app ${subcommand} failed: ${error.message}`, success: false };
+    }
+    if (runResult && runResult.status !== 0) {
+        return { reason: `hereya app ${subcommand} exited with code ${runResult.status}`, success: false };
+    }
+    return { success: true };
+}
+async function markAppDeploymentFailed(input, cloudBackend) {
+    try {
+        await cloudBackend.updateAppDeployment({
+            lastJobId: input.jobId,
+            name: input.appName,
+            status: 'failed',
+            workspace: input.workspace,
+        });
+    }
+    catch {
+        // best-effort; failure of the PATCH must not bubble out
+    }
+}
+async function patchAppFinalState(input) {
+    const { appName, cloudBackend, isDeploy, jobId, rootDir, workspace } = input;
+    if (!isDeploy) {
+        const updateResult = await cloudBackend.updateAppDeployment({
+            env: {},
+            lastJobId: jobId,
+            name: appName,
+            status: 'destroyed',
+            workspace,
+        });
+        if (!updateResult.success) {
+            return { reason: `Destroy succeeded but PATCH to deployment failed: ${updateResult.reason}`, success: false };
+        }
+        return { success: true };
+    }
+    const deployEnvFile = path.join(rootDir, '.hereya', `deploy-env.${sanitizeWorkspaceForFilename(workspace)}.json`);
+    let parsed;
+    try {
+        const content = await fs.readFile(deployEnvFile, 'utf8');
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        const reason = `Failed to read deploy env file at ${deployEnvFile}: ${error.message}`;
+        await markAppDeploymentFailed({ appName, jobId, reason, workspace }, cloudBackend);
+        return { reason, success: false };
+    }
+    const updateResult = await cloudBackend.updateAppDeployment({
+        env: parsed.env ?? {},
+        lastJobId: jobId,
+        name: appName,
+        state: parsed.state,
+        status: 'deployed',
+        workspace,
+    });
+    if (!updateResult.success) {
+        return { reason: `Provisioning succeeded but PATCH to deployment failed: ${updateResult.reason}`, success: false };
+    }
+    return { success: true };
+}

package/dist/lib/executor-start/execute-deploy-job.d.ts

@@ -0,0 +1,14 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { LocalExecutor } from '../../executor/local.js';
+import { Logger } from '../../lib/log.js';
+export type DeployJobResult = {
+    reason: string;
+    success: false;
+} | {
+    success: true;
+};
+export declare function executeDeployJob(job: {
+    id: string;
+    payload: any;
+    type: string;
+}, executor: LocalExecutor, cloudBackend: CloudBackend, logger: Logger): Promise<DeployJobResult>;

package/dist/lib/executor-start/execute-deploy-job.js

@@ -0,0 +1,64 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { cloneWithCredentialHelper } from '../../lib/git-utils.js';
+import { runShell } from '../../lib/shell.js';
+export async function executeDeployJob(job, executor, cloudBackend, logger) {
+    const { gitBranch, project, workspace } = job.payload;
+    if (!project || !workspace) {
+        return { reason: 'Missing project or workspace in job payload', success: false };
+    }
+    const metadata$ = await cloudBackend.getProjectMetadata({ project });
+    if (!metadata$.found) {
+        return { reason: `No metadata found for project ${project}`, success: false };
+    }
+    const { metadata } = metadata$;
+    if (!metadata.env?.hereyaGitRemoteUrl) {
+        return { reason: 'Project metadata missing hereyaGitRemoteUrl', success: false };
+    }
+    const gitEnvToResolve = {};
+    for (const [key, value] of Object.entries(metadata.env)) {
+        if (key.startsWith('hereyaGit'))
+            gitEnvToResolve[key] = value;
+    }
+    const resolvedGitEnv = await executor.resolveEnvValues({ env: gitEnvToResolve, project, workspace });
+    const tempDir = path.join(os.tmpdir(), `hereya-deploy-${randomUUID()}`);
+    try {
+        const branch = gitBranch || 'main';
+        logger.info(`Cloning ${resolvedGitEnv.hereyaGitRemoteUrl} (branch: ${branch})...`);
+        const cloneResult = await cloneWithCredentialHelper({
+            gitUrl: resolvedGitEnv.hereyaGitRemoteUrl,
+            hereyaBinPath: process.argv[1],
+            password: resolvedGitEnv.hereyaGitPassword,
+            targetDir: tempDir,
+            username: resolvedGitEnv.hereyaGitUsername,
+        });
+        if (!cloneResult.success) {
+            return { reason: `Git clone failed: ${cloneResult.reason}`, success: false };
+        }
+        if (branch !== 'main' && branch !== 'master') {
+            await runShell('git', ['checkout', branch], { directory: tempDir, logger });
+        }
+        const command = job.type === 'deploy' ? 'deploy' : 'undeploy';
+        logger.info(`Running hereya ${command} -w ${workspace} --local...`);
+        const result = await runShell('hereya', [command, '-w', workspace, '--local'], {
+            directory: tempDir,
+            env: { ...process.env, HEREYA_LOCAL_EXECUTION: 'true', HEREYA_PROJECT_ROOT_DIR: tempDir },
+            logger,
+        });
+        logger.info(`hereya ${command} exited with code ${result.status}`);
+        if (result.status !== 0) {
+            return { reason: `hereya ${command} failed (exit code ${result.status})`, success: false };
+        }
+        return { success: true };
+    }
+    finally {
+        try {
+            await fs.rm(tempDir, { force: true, recursive: true });
+        }
+        catch {
+            // ignore cleanup errors
+        }
+    }
+}

package/dist/lib/executor-start/execute-init-job.d.ts

@@ -0,0 +1,14 @@
+import { LocalExecutor } from '../../executor/local.js';
+import { Logger } from '../../lib/log.js';
+export type InitJobResult = {
+    hereyaGitRemoteUrl: string;
+    success: true;
+} | {
+    reason: string;
+    success: false;
+};
+export declare function executeInitJob(job: {
+    id: string;
+    payload: any;
+    type: string;
+}, executor: LocalExecutor, logger: Logger): Promise<InitJobResult>;

package/dist/lib/executor-start/execute-init-job.js

@@ -0,0 +1,135 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { SimpleConfigManager } from '../../lib/config/simple.js';
+import { gitUtils } from '../../lib/git-utils.js';
+import { shellUtils } from '../../lib/shell.js';
+import { redactCredentials } from './format.js';
+export async function executeInitJob(job, executor, logger) {
+    const payload = job.payload;
+    const { deployWorkspace, parameters, projectName, template, workspace } = payload;
+    if (!projectName || !workspace || !template || !deployWorkspace) {
+        return {
+            reason: 'Missing projectName, workspace, template, or deployWorkspace in job payload',
+            success: false,
+        };
+    }
+    let password;
+    const redactingLogger = {
+        debug(msg) {
+            logger.debug(redactCredentials(msg, password));
+        },
+        error(msg) {
+            logger.error(redactCredentials(msg, password));
+        },
+        info(msg) {
+            logger.info(redactCredentials(msg, password));
+        },
+    };
+    const scratchDir = await fs.mkdtemp(path.join(os.tmpdir(), 'hereya-init-'));
+    try {
+        redactingLogger.info(`Provisioning template ${template}...`);
+        const provisionResult = await executor.provision({
+            logger: redactingLogger,
+            package: template,
+            parameters: {
+                ...parameters,
+                deployWorkspace,
+                projectName,
+                workspace,
+            },
+            project: projectName,
+            workspace,
+        });
+        if (!provisionResult.success) {
+            return { reason: `Template provisioning failed: ${provisionResult.reason}`, success: false };
+        }
+        const cloneResult = await provisionAndClone(provisionResult, scratchDir, redactingLogger, (pwd) => {
+            password = pwd;
+        });
+        if (!cloneResult.success) {
+            return cloneResult;
+        }
+        const { hereyaGitPassword, hereyaGitRemoteUrl, hereyaGitUsername, repoDir } = cloneResult;
+        redactingLogger.info('Writing hereya.yaml...');
+        const config = {
+            project: projectName,
+            workspace,
+        };
+        await new SimpleConfigManager().saveConfig({ config, projectRootDir: repoDir });
+        redactingLogger.info('Committing and pushing initial project config...');
+        const commitResult = await commitAndPush(repoDir, hereyaGitUsername, hereyaGitPassword, redactingLogger);
+        if (!commitResult.success) {
+            return {
+                reason: `Git commit/push failed: ${redactCredentials(commitResult.reason, password)}`,
+                success: false,
+            };
+        }
+        return { hereyaGitRemoteUrl, success: true };
+    }
+    catch (error) {
+        return {
+            reason: `Init failed: ${redactCredentials(error.message ?? String(error), password)}`,
+            success: false,
+        };
+    }
+    finally {
+        try {
+            await fs.rm(scratchDir, { force: true, recursive: true });
+        }
+        catch {
+            // ignore cleanup errors
+        }
+    }
+}
+async function provisionAndClone(provisionResult, scratchDir, logger, setPassword) {
+    const { env } = provisionResult;
+    const { hereyaGitPassword, hereyaGitRemoteUrl, hereyaGitUsername } = env;
+    setPassword(hereyaGitPassword);
+    if (!hereyaGitRemoteUrl) {
+        return { reason: 'Template did not export hereyaGitRemoteUrl', success: false };
+    }
+    logger.info(`Cloning ${hereyaGitRemoteUrl}...`);
+    const repoDir = path.join(scratchDir, 'repo');
+    const cloneResult = await gitUtils.cloneWithCredentialHelper({
+        gitUrl: hereyaGitRemoteUrl,
+        hereyaBinPath: process.argv[1],
+        password: hereyaGitPassword,
+        targetDir: repoDir,
+        username: hereyaGitUsername,
+    });
+    if (!cloneResult.success) {
+        return { reason: `Git clone failed: ${cloneResult.reason}`, success: false };
+    }
+    return { hereyaGitPassword, hereyaGitRemoteUrl, hereyaGitUsername, repoDir, success: true };
+}
+async function commitAndPush(repoDir, hereyaGitUsername, hereyaGitPassword, logger) {
+    const gitEnv = {
+        ...process.env,
+        GIT_AUTHOR_EMAIL: 'executor@hereya.dev',
+        GIT_AUTHOR_NAME: 'hereya-executor',
+        GIT_COMMITTER_EMAIL: 'executor@hereya.dev',
+        GIT_COMMITTER_NAME: 'hereya-executor',
+    };
+    if (hereyaGitUsername)
+        gitEnv.hereyaGitUsername = hereyaGitUsername;
+    if (hereyaGitPassword)
+        gitEnv.hereyaGitPassword = hereyaGitPassword;
+    try {
+        await shellUtils.runShell('git', ['add', '.'], { directory: repoDir, env: gitEnv, logger });
+        await shellUtils.runShell('git', ['commit', '-m', '"chore: hereya init"'], {
+            directory: repoDir,
+            env: gitEnv,
+            logger,
+        });
+        await shellUtils.runShell('git', ['push', 'origin', 'HEAD'], {
+            directory: repoDir,
+            env: gitEnv,
+            logger,
+        });
+        return { success: true };
+    }
+    catch (error) {
+        return { reason: error.message ?? String(error), success: false };
+    }
+}

package/dist/lib/executor-start/format.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Workspaces look like `org/name`, which is not filesystem-safe. The
+ * write-side in `app deploy --local` (commands/app/deploy/index.ts) MUST use
+ * the same sanitization.
+ */
+export declare function sanitizeWorkspaceForFilename(workspace: string): string;
+/**
+ * Strip credentials from log strings before flushing them to the cloud.
+ * Removes:
+ *   - any occurrence of the actual hereyaGitPassword value
+ *   - userinfo from URLs (https://user:pass@host -> https://host)
+ */
+export declare function redactCredentials(str: string, password?: string): string;

package/dist/lib/executor-start/format.js

@@ -0,0 +1,22 @@
+/**
+ * Workspaces look like `org/name`, which is not filesystem-safe. The
+ * write-side in `app deploy --local` (commands/app/deploy/index.ts) MUST use
+ * the same sanitization.
+ */
+export function sanitizeWorkspaceForFilename(workspace) {
+    return workspace.replaceAll('/', '-');
+}
+/**
+ * Strip credentials from log strings before flushing them to the cloud.
+ * Removes:
+ *   - any occurrence of the actual hereyaGitPassword value
+ *   - userinfo from URLs (https://user:pass@host -> https://host)
+ */
+export function redactCredentials(str, password) {
+    let out = str;
+    if (password) {
+        out = out.split(password).join('[REDACTED]');
+    }
+    out = out.replaceAll(/(https?:\/\/|git:\/\/)([^/\s@]+@)/g, '$1');
+    return out;
+}

package/dist/lib/executor-start/job-dispatch.d.ts

@@ -0,0 +1,15 @@
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
+import { LocalExecutor } from '../../executor/local.js';
+export interface JobDispatchHooks {
+    log(msg: string): void;
+    warn(msg: string): void;
+}
+/**
+ * Dispatches a single job to the right handler, with periodic log flushing
+ * and heartbeating to the cloud. Errors are caught and reported as failed jobs.
+ */
+export declare function dispatchJob(job: {
+    id: string;
+    payload: any;
+    type: string;
+}, executor: LocalExecutor, cloudBackend: CloudBackend, hooks: JobDispatchHooks): Promise<void>;

package/dist/lib/executor-start/job-dispatch.js

@@ -0,0 +1,89 @@
+import { executeAppJob } from './execute-app-job.js';
+import { executeDeployJob } from './execute-deploy-job.js';
+import { executeInitJob } from './execute-init-job.js';
+/**
+ * Dispatches a single job to the right handler, with periodic log flushing
+ * and heartbeating to the cloud. Errors are caught and reported as failed jobs.
+ */
+export async function dispatchJob(job, executor, cloudBackend, hooks) {
+    let logBuffer = '';
+    const logInterval = setInterval(async () => {
+        if (logBuffer) {
+            const logs = logBuffer;
+            logBuffer = '';
+            try {
+                await cloudBackend.updateExecutorJob({ jobId: job.id, logs });
+            }
+            catch {
+                // log flush errors are non-fatal
+            }
+        }
+    }, 10_000);
+    const heartbeatInterval = setInterval(async () => {
+        try {
+            await cloudBackend.updateExecutorJob({ jobId: job.id });
+        }
+        catch {
+            // heartbeat errors are non-fatal
+        }
+    }, 30_000);
+    const logger = {
+        debug(msg) {
+            logBuffer += msg + '\n';
+        },
+        error(msg) {
+            logBuffer += msg + '\n';
+        },
+        info(msg) {
+            logBuffer += msg + '\n';
+        },
+    };
+    const finalize = async (result, label) => {
+        clearInterval(logInterval);
+        clearInterval(heartbeatInterval);
+        await cloudBackend.updateExecutorJob({
+            jobId: job.id,
+            logs: logBuffer,
+            result,
+            status: result.success ? 'completed' : 'failed',
+        });
+        hooks.log(`Job ${job.id} ${result.success ? 'completed' : 'failed'}${label ? ` (${label})` : ''}`);
+    };
+    try {
+        if (job.type === 'resolve-env') {
+            const resolved = await executor.resolveEnvValues(job.payload);
+            await finalize({ env: resolved, success: true }, 'resolve-env');
+            return;
+        }
+        if (job.type === 'deploy' || job.type === 'undeploy') {
+            const deployResult = await executeDeployJob(job, executor, cloudBackend, logger);
+            await finalize(deployResult, job.type);
+            return;
+        }
+        if (job.type === 'init') {
+            const initResult = await executeInitJob(job, executor, logger);
+            await finalize(initResult, 'init');
+            return;
+        }
+        if (job.type === 'app-deploy' || job.type === 'app-destroy') {
+            const appJobResult = await executeAppJob(job, cloudBackend, logger);
+            await finalize(appJobResult, job.type);
+            return;
+        }
+        const result = job.type === 'provision'
+            ? await executor.provision({ ...job.payload, logger })
+            : await executor.destroy({ ...job.payload, logger });
+        await finalize(result, '');
+    }
+    catch (error) {
+        clearInterval(logInterval);
+        clearInterval(heartbeatInterval);
+        await cloudBackend.updateExecutorJob({
+            jobId: job.id,
+            logs: logBuffer + `\nError: ${error.message}\n`,
+            result: { reason: error.message, success: false },
+            status: 'failed',
+        });
+        hooks.warn(`Job ${job.id} failed: ${error.message}`);
+    }
+}

package/dist/lib/package/index.d.ts

@@ -105,10 +105,10 @@ export declare const PackageMetadata: z.ZodObject<{
     }> | undefined>;
     snakeCase: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    infra: InfrastructureType;
     iac: IacType;
+    infra: InfrastructureType;
     dependencies?: Record<string, string> | undefined;
-    kind?: "package" | "app" | undefined;
+    kind?: "app" | "package" | undefined;
     parameters?: Record<string, {
         description?: string | undefined;
         default?: string | undefined;
@@ -125,10 +125,10 @@ export declare const PackageMetadata: z.ZodObject<{
     outputs?: Record<string, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">> | undefined;
     snakeCase?: boolean | undefined;
 }, {
-    infra: InfrastructureType;
     iac: IacType;
+    infra: InfrastructureType;
     dependencies?: Record<string, string> | undefined;
-    kind?: "package" | "app" | undefined;
+    kind?: "app" | "package" | undefined;
     parameters?: Record<string, {
         description?: string | undefined;
         default?: string | undefined;