viza 1.7.27 → 1.7.31

package/dist/src/cli/program.js

@@ -8,6 +8,7 @@ import { registerAwsCommand } from "../commands/aws/register.js";
 import { registerInfraCommand } from "../commands/infra/register.js";
 import { registerAgeCommand } from "../commands/age/register.js";
 import { registerBillingCommand } from "../commands/billing/register.js";
+import { registerGithubCommand } from "../commands/github/register.js";
 export function createProgram() {
     const program = new Command();
     program
@@ -19,6 +20,7 @@ export function createProgram() {
     registerAwsCommand(program);
     registerBillingCommand(program);
     registerBootstrapCommand(program);
+    registerGithubCommand(program);
     registerInfraCommand(program);
     registerLoginCommand(program);
     program

package/dist/src/commands/billing/login/aws/aws.js

@@ -41,20 +41,15 @@ export async function loginBillingAwsCommand(options) {
             admin: options.admin === true
         }
     }, {
-        log: "hide",
+        log: "show",
     });
-    if (!result)
-        return;
-    if (result.status !== "success") {
-        return;
-    }
-    if (result.kind !== "runtime") {
-        return;
-    }
-    if (!result.data) {
+    if (!result ||
+        result.status !== "success" ||
+        result.kind !== "runtime" ||
+        !result.data?.result) {
         return;
     }
-    const awsResult = result.data;
+    const awsResult = result.data.result;
     if (typeof awsResult.loginUrl !== "string" ||
         typeof awsResult.shortUrl !== "string" ||
         typeof awsResult.ttlHours !== "number") {

package/dist/src/commands/github/register.js

@@ -0,0 +1,7 @@
+import { registerGithubSecretsCommand } from "./secrets/register.js";
+export function registerGithubCommand(program) {
+    const github = program
+        .command("github")
+        .description("GitHub operations");
+    registerGithubSecretsCommand(github);
+}

package/dist/src/commands/github/secrets/backup/backup.js

@@ -0,0 +1,57 @@
+import { resolveEnv } from "../../../../context/env.js";
+import { resolveResourceHubIntent } from "../../../../context/hubIntent.js";
+import { dispatchIntentAndWait } from "../../../../core/dispatch.js";
+/**
+ * Target teams for `viza login aws`.
+ * This is a CLI-only UX constraint for fail-fast validation.
+ * NOT a policy and MUST NOT be sent to gateway.
+ */
+const TARGET_TEAMS = {
+    "dev": [
+        "viza-super"
+    ],
+    "prod": [
+        "viza-super"
+    ]
+};
+/**
+ * viza github secrets backup
+ *
+ * Flow:
+ * 1) Resolve env (deterministic)
+ * 2) Resolve user identity (trusted via gh auth)
+ * 3) CLI pre-check against target teams (fail-fast UX)
+ * 4) Derive ONE valid team (deterministic)
+ * 5) Dispatch frozen intent to gateway
+ */
+export async function backupGithubSecretsCommand(options) {
+    // 1) Resolve environment
+    const env = resolveEnv(options);
+    const intent = resolveResourceHubIntent(env);
+    // Resolve allowed teams
+    // - Dispatch mode: restrict by targetEnv
+    // - Status mode: allow union of all env teams (read-only query)
+    const allowedTeams = options.status === true && env === "dev"
+        ? Array.from(new Set([
+            ...TARGET_TEAMS.dev,
+            ...TARGET_TEAMS.prod,
+        ]))
+        : TARGET_TEAMS[env];
+    // 5) Dispatch intent (freeze)
+    await dispatchIntentAndWait({
+        intent,
+        commandType: "github.secrets.backup",
+        infraKey: "core",
+        targetEnv: env,
+        allowedTeams,
+        selfHosted: options.selfHosted === true,
+        keepLog: options.removeLog !== true,
+        flowGates: {
+            secrets: true,
+        },
+        payload: {}
+    }, {
+        status: options.status === true,
+        log: "show",
+    });
+}

package/dist/src/commands/github/secrets/backup/register.js

@@ -0,0 +1,17 @@
+import { backupGithubSecretsCommand } from "./backup.js";
+import { getResolvedOptions } from "../../../../cli/resolveOptions.js";
+/**
+ * Register:
+ * viza github secrets backup
+ */
+export function registerGithubSecretsBackupCommand(program) {
+    program
+        .command("backup")
+        .description("Backup GitHub secrets and environment variables to AWS SSM")
+        .option("--prod", "Use production environment")
+        .option("--dev", "Use development environment")
+        .action(async (_opts, command) => {
+        const fullOpts = getResolvedOptions(command);
+        await backupGithubSecretsCommand(fullOpts);
+    });
+}

package/dist/src/commands/github/secrets/register.js

@@ -0,0 +1,9 @@
+import { registerGithubSecretsBackupCommand } from "./backup/register.js";
+import { registerGithubSecretsRestoreCommand } from "./restore/register.js";
+export function registerGithubSecretsCommand(github) {
+    const secrets = github
+        .command("secrets")
+        .description("GitHub secrets management");
+    registerGithubSecretsBackupCommand(secrets);
+    registerGithubSecretsRestoreCommand(secrets);
+}

package/dist/src/commands/github/secrets/restore/register.js

@@ -0,0 +1,17 @@
+import { restoreGithubSecretsCommand } from "./restore.js";
+import { getResolvedOptions } from "../../../../cli/resolveOptions.js";
+/**
+ * Register:
+ * viza github secrets restore
+ */
+export function registerGithubSecretsRestoreCommand(program) {
+    program
+        .command("restore")
+        .description("Restore GitHub secrets and environment variables to AWS SSM")
+        .option("--prod", "Use production environment")
+        .option("--dev", "Use development environment")
+        .action(async (_opts, command) => {
+        const fullOpts = getResolvedOptions(command);
+        await restoreGithubSecretsCommand(fullOpts);
+    });
+}

package/dist/src/commands/github/secrets/restore/restore.js

@@ -0,0 +1,57 @@
+import { resolveEnv } from "../../../../context/env.js";
+import { resolveRuntimeHubIntent } from "../../../../context/hubIntent.js";
+import { dispatchIntentAndWait } from "../../../../core/dispatch.js";
+/**
+ * Target teams for `viza login aws`.
+ * This is a CLI-only UX constraint for fail-fast validation.
+ * NOT a policy and MUST NOT be sent to gateway.
+ */
+const TARGET_TEAMS = {
+    "dev": [
+        "viza-super"
+    ],
+    "prod": [
+        "viza-super"
+    ]
+};
+/**
+ * viza github secrets restore
+ *
+ * Flow:
+ * 1) Resolve env (deterministic)
+ * 2) Resolve user identity (trusted via gh auth)
+ * 3) CLI pre-check against target teams (fail-fast UX)
+ * 4) Derive ONE valid team (deterministic)
+ * 5) Dispatch frozen intent to gateway
+ */
+export async function restoreGithubSecretsCommand(options) {
+    // 1) Resolve environment
+    const env = resolveEnv(options);
+    const intent = resolveRuntimeHubIntent();
+    // Resolve allowed teams
+    // - Dispatch mode: restrict by targetEnv
+    // - Status mode: allow union of all env teams (read-only query)
+    const allowedTeams = options.status === true && env === "dev"
+        ? Array.from(new Set([
+            ...TARGET_TEAMS.dev,
+            ...TARGET_TEAMS.prod,
+        ]))
+        : TARGET_TEAMS[env];
+    // 5) Dispatch intent (freeze)
+    await dispatchIntentAndWait({
+        intent,
+        commandType: "github.secrets.restore",
+        infraKey: "core",
+        targetEnv: env,
+        allowedTeams,
+        selfHosted: options.selfHosted === true,
+        keepLog: options.removeLog !== true,
+        flowGates: {
+            secrets: true,
+        },
+        payload: {}
+    }, {
+        status: options.status === true,
+        log: "show",
+    });
+}

package/dist/src/commands/login/aws/aws.js

@@ -60,20 +60,15 @@ export async function loginAwsCommand(options) {
         }
     }, {
         status: options.status === true,
-        log: "hide",
+        log: "show",
     });
-    if (!result)
-        return;
-    if (result.status !== "success") {
-        return;
-    }
-    if (result.kind !== "runtime") {
-        return;
-    }
-    if (!result.data) {
+    if (!result ||
+        result.status !== "success" ||
+        result.kind !== "runtime" ||
+        !result.data?.result) {
         return;
     }
-    const awsResult = result.data;
+    const awsResult = result.data.result;
     if (typeof awsResult.loginUrl !== "string" ||
         typeof awsResult.shortUrl !== "string" ||
         typeof awsResult.ttlHours !== "number") {

package/dist/src/core/dispatch.js

@@ -1,18 +1,24 @@
 import { dispatcherDispatch, } from "@vizamodo/viza-dispatcher";
 import chalk from "chalk";
 import { startSpinner, stopSpinner } from "../ui/spinner.js";
-import { renderLog } from "../ui/logRenderer.js";
+import { renderLog } from "../ui/infraLogRenderer.js";
 import { showDispatchBanner } from "../ui/banner.js";
 import { getCliVersion, checkForCliUpdateSoft } from "./version.js";
 import { resolveExecutionMode } from "./resolveExecutionMode.js";
+import { renderRuntimeLog } from "../ui/runtimeLogRenderer.js";
 /**
  * KISS log rendering.
  * - success + hide => no log
  * - otherwise => render log (if present)
  */
-function maybeRenderLog(result, policy, commandType) {
-    // Only GitHub execution produces log artifacts
+function maybeRenderLog(result, policy) {
+    // Runtime execution (hub-worker)
     if (result.kind !== "github") {
+        // Respect log policy: hide means do not render runtime logs
+        if (policy === "hide") {
+            return;
+        }
+        renderRuntimeLog(result.data);
         return;
     }
     // KISS: only skip logs when success + hide.
@@ -133,7 +139,7 @@ export async function dispatchIntentAndWait(input, opts = {}) {
     try {
         const result = await handle.wait();
         stopSpinner(spinner, result.status === "success" ? "✅ Done" : "❌ Failed");
-        maybeRenderLog(result, policy, input.commandType);
+        maybeRenderLog(result, policy);
         if (result.status !== "success") {
             throw new Error(`Dispatch failed: ${result.status}`);
         }

package/dist/src/ui/index.js

@@ -1,7 +1,7 @@
 // public exports (optional)
 import { showBanner } from "./banner.js";
 import { startSpinner, stopSpinner } from "./spinner.js";
-import { renderLog } from "./logRenderer.js";
+import { renderLog } from "./infraLogRenderer.js";
 export function beginUi(opts) {
     if (opts.banner) {
         showBanner(opts.banner);

package/dist/src/ui/runtimeLogRenderer.js

@@ -0,0 +1,48 @@
+import chalk from "chalk";
+/**
+ * Render logs for runtime commands executed via the hub worker.
+ * The runtime contract is:
+ *
+ * {
+ *   ok: boolean
+ *   correlationId: string
+ *   log: RuntimeLogEntry[]
+ *   result?: any
+ *   error?: any
+ * }
+ */
+export function renderRuntimeLog(runtime) {
+    if (!runtime) {
+        console.log(chalk.red("\n────── Runtime Command ───────────────────────────────────────────────────────────────────────────────────────────────────"));
+        console.log(chalk.red("No runtime data returned from dispatcher."));
+        return;
+    }
+    const { ok, correlationId, log = [], error } = runtime ?? {};
+    console.log(chalk.yellow(`\n────── Runtime Command (${correlationId ?? "unknown"}) ───────────────────────────────────────────────────────────────────────────────────────`));
+    if (!Array.isArray(log) || log.length === 0) {
+        console.log(chalk.gray("No runtime logs available."));
+    }
+    for (const entry of log) {
+        const step = entry?.step != null ? String(entry.step).padStart(2, "0") : "--";
+        const title = entry?.title ?? "step";
+        const message = entry?.message ?? "";
+        const duration = entry?.durationMs;
+        console.log(`\n${chalk.gray(step)} ${chalk.cyan(title)}`);
+        if (message) {
+            console.log(`   ${chalk.white(message)}`);
+        }
+        if (duration != null) {
+            console.log(`   ${chalk.gray(`(${duration}ms)`)}`);
+        }
+    }
+    if (!ok && error) {
+        console.log(chalk.red("\n────── ERROR ───────────────────────────────────────────────────────────────────────────────────────────────────────────"));
+        console.log(error?.message ?? error);
+        if (error?.stack) {
+            console.log(chalk.gray(error.stack));
+        }
+    }
+    console.log(ok
+        ? chalk.green("\n────── ✔ SUCCESS ──────────────────────────────────────────────────────────────────────────────────────────────────────────")
+        : chalk.red("\n────── ✖ FAILED ───────────────────────────────────────────────────────────────────────────────────────────────────────────"));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viza",
-  "version": "1.7.27",
+  "version": "1.7.31",
   "type": "module",
   "description": "Viza unified command line interface",
   "bin": {
@@ -17,7 +17,7 @@
     "release:full": "rm -rf dist && npx npm-check-updates -u && npm install && git add package.json package-lock.json && git commit -m 'chore(deps): auto update dependencies before release' || echo 'No changes' && node versioning.js && npm login && npm publish --tag latest --access public && git push"
   },
   "dependencies": {
-    "@vizamodo/viza-dispatcher": "^1.5.19",
+    "@vizamodo/viza-dispatcher": "^1.5.20",
     "adm-zip": "^0.5.16",
     "chalk": "^5.6.2",
     "clipboardy": "^5.3.1",
@@ -29,7 +29,7 @@
   "devDependencies": {
     "@types/adm-zip": "^0.5.7",
     "@types/figlet": "^1.7.0",
-    "@types/node": "^25.3.5",
+    "@types/node": "^25.4.0",
     "@types/prompts": "^2.4.9",
     "ts-node": "^10.9.2",
     "typescript": "^5.9.3"