buildai-cli 0.3.35__tar.gz → 0.3.36__tar.gz

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/CLAUDE 2.md

@@ -16,8 +16,6 @@ buildai query "SELECT count(*) FROM core.clips"        # API-backed
 buildai admin query "SELECT count(*) FROM core.clips"   # DB-direct
 buildai admin schema tables                              # Schema introspection
 buildai admin schema describe core.clips                 # Table details
-uv run buildai dev use local                             # Set this worktree's deployment profile
-uv run buildai dev current                               # Show resolved worktree target
 buildai admin --write database migrate all               # Run migrations
 buildai admin database diff --from preview --to production  # Migration delta
 ```
@@ -27,9 +25,9 @@ buildai admin database diff --from preview --to production  # Migration delta
 - `admin` subcommands require workspace install + gcloud IAM.
 - Writes require `--write` flag.
 - Production migrations prompt for confirmation.
-- Worktree app/runtime targeting comes from `uv run buildai dev use <profile>`.
+- Worktree app/runtime targeting comes from explicit env vars and the repo Makefile, not a saved CLI context layer.
 - `buildai admin --env` selects the explicit DB lane: `production`, `preview`, `dev`.
-- Do not confuse `--env preview` with the deployment profiles `local`, `preview`, or `staging`.
+- Do not confuse `--env preview` with any old local preset names. The CLI no longer manages worktree deployment profiles.
 
 ## Reference
 

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/CLAUDE.md

@@ -16,8 +16,6 @@ buildai query "SELECT count(*) FROM core.clips"        # API-backed
 buildai admin query "SELECT count(*) FROM core.clips"   # DB-direct
 buildai admin schema tables                              # Schema introspection
 buildai admin schema describe core.clips                 # Table details
-uv run buildai dev use local                             # Set this worktree's deployment profile
-uv run buildai dev current                               # Show resolved worktree target
 buildai admin --write database migrate all               # Run migrations
 buildai admin database status                               # Migration status
 ```
@@ -27,7 +25,7 @@ buildai admin database status                               # Migration status
 - `admin` subcommands require workspace install + gcloud IAM.
 - Writes require `--write` flag.
 - Production migrations prompt for confirmation.
-- Worktree app/runtime targeting comes from `uv run buildai dev use <profile>`.
+- Worktree app/runtime targeting comes from explicit env vars and the repo Makefile, not a saved CLI context layer.
 - `buildai admin --env` selects the explicit DB lane: `production`, `dev`.
 
 ## Reference

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: buildai-cli
-Version: 0.3.35
+Version: 0.3.36
 Summary: Build AI CLI (Typer)
 Requires-Python: >=3.11
 Requires-Dist: buildai-data

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/cli/commands/database.py

@@ -12,7 +12,6 @@ All database operations under one command group:
     buildai admin database discover        # Retired legacy discovery flow
     buildai admin database status          # Overall database health summary
     buildai admin database roles           # Role management
-    buildai admin database roles-setup     # Apply least-privilege roles/grants
     buildai admin database audit           # Permission auditing
     buildai admin database seed            # Run seed data scripts
 """
@@ -26,9 +25,7 @@ from typing import Any, Sequence
 
 import asyncpg
 import typer
-from infra.auth_principal_targets import get_runtime_targets_with_database_access
-from infra.migration_tracking import audit_migration_tracking, load_tracker_policy
-from infra.settings import Settings, switch_environment
+from api.service_catalog import list_api_services
 from rich.panel import Panel
 from rich.syntax import Syntax
 from rich.table import Table
@@ -62,6 +59,8 @@ from cli.context import (
     resolve_admin_connection_config,
 )
 from cli.guard import require_write
+from infra.migration_tracking import audit_migration_tracking, load_tracker_policy
+from infra.settings import Settings, switch_environment
 
 # =============================================================================
 # Constants
@@ -84,7 +83,7 @@ async def _get_admin_connection(settings: Settings):
 
     Resolution order:
     1. ALLOYDB_ADMIN_IAM_USER_* env vars (explicit override)
-    2. deployment_profiles.yaml database_admin section (canonical source of truth)
+    2. explicit ALLOYDB_ADMIN_IAM_USER_* / ALLOYDB_ADMIN_IMPERSONATE_SA_* env wiring
     3. ALLOYDB_PSW_PROD password fallback
     """
     return await open_admin_database(settings)
@@ -227,6 +226,60 @@ class DatabaseStatus:
         return "READY FOR TESTING"
 
 
+@dataclass(frozen=True)
+class _RuntimeDbTarget:
+    service_slug: str
+    gcp_service_account_email: str
+    alloydb_iam_user: str
+
+
+def _runtime_db_targets() -> list[_RuntimeDbTarget]:
+    """Return the current runtime principals that should exist as AlloyDB IAM users."""
+    api_targets = [
+        _RuntimeDbTarget(
+            service_slug=service.service_slug,
+            gcp_service_account_email=service.runtime_service_account,
+            alloydb_iam_user=service.runtime_db_user,
+        )
+        for service in list_api_services()
+    ]
+    worker_targets = [
+        _RuntimeDbTarget(
+            service_slug="mcp",
+            gcp_service_account_email="mcp-sa@data-470400.iam.gserviceaccount.com",
+            alloydb_iam_user="mcp-sa@data-470400.iam",
+        ),
+        _RuntimeDbTarget(
+            service_slug="frame-extractor",
+            gcp_service_account_email="frame-extractor-sa@data-470400.iam.gserviceaccount.com",
+            alloydb_iam_user="frame-extractor-sa@data-470400.iam",
+        ),
+        _RuntimeDbTarget(
+            service_slug="frame-embed",
+            gcp_service_account_email="frame-embed-sa@data-470400.iam.gserviceaccount.com",
+            alloydb_iam_user="frame-embed-sa@data-470400.iam",
+        ),
+        _RuntimeDbTarget(
+            service_slug="frame-inference",
+            gcp_service_account_email="frame-inference-sa@data-470400.iam.gserviceaccount.com",
+            alloydb_iam_user="frame-inference-sa@data-470400.iam",
+        ),
+        _RuntimeDbTarget(
+            service_slug="migrations-runner",
+            gcp_service_account_email="migrations-runner-sa@data-470400.iam.gserviceaccount.com",
+            alloydb_iam_user="migrations-runner-sa@data-470400.iam",
+        ),
+    ]
+    seen: set[str] = set()
+    targets: list[_RuntimeDbTarget] = []
+    for target in [*api_targets, *worker_targets]:
+        if target.gcp_service_account_email in seen:
+            continue
+        seen.add(target.gcp_service_account_email)
+        targets.append(target)
+    return targets
+
+
 def _migration_requires_system_admin(path: Path) -> bool:
     for line in path.read_text(encoding="utf-8").splitlines()[:10]:
         if line.strip().lower() == "-- requires-system-admin: true":
@@ -1392,90 +1445,6 @@ def roles(ctx: typer.Context) -> None:
     asyncio.run(run())
 
 
-@app.command("roles-setup")
-def roles_setup(
-    ctx: typer.Context,
-    dry_run: Annotated[bool, typer.Option("--dry-run", help="Show SQL without executing")] = False,
-    as_admin: Annotated[
-        bool,
-        typer.Option(
-            "--as-admin",
-            help="Connect as postgres user via password auth (requires ALLOYDB_PSW_PROD)",
-        ),
-    ] = False,
-    yes: Annotated[
-        bool, typer.Option("--yes", "-y", help="Skip confirmation for production")
-    ] = False,
-) -> None:
-    """
-    Apply least-privilege role and grant setup.
-
-    Uses scripts/ops/create-db-roles-leastpriv.sql.
-    """
-    settings: Settings = ctx.obj["settings"]
-
-    if not dry_run:
-        require_write(ctx, "Database role setup")
-
-    sql_path = REPO_ROOT / "scripts" / "ops" / "create-db-roles-leastpriv.sql"
-
-    if not sql_path.exists():
-        error(f"SQL file not found: {sql_path}")
-        raise typer.Exit(1)
-
-    sql_content = sql_path.read_text()
-
-    if dry_run:
-        info("SQL to execute:")
-        console.print(Syntax(sql_content, "sql", theme="monokai", line_numbers=False))
-        return
-
-    if settings.is_production and not yes:
-        warning("This will modify PRODUCTION database roles!")
-        if not typer.confirm("Are you sure you want to continue?"):
-            raise typer.Abort()
-
-    async def run() -> None:
-        db = None
-        connection_context = None
-        using_owner_role = False
-
-        try:
-            if as_admin:
-                info("Connecting as postgres (password auth)...")
-                db = await _get_admin_connection(settings)
-                conn = db.conn
-            else:
-                connection_context = get_connection(settings)
-                conn = await connection_context.__aenter__()
-                using_owner_role = await _set_owner_role(conn)
-                if using_owner_role:
-                    dim("Using role: buildai_owner")
-                else:
-                    dim("Role buildai_owner not available, using default permissions")
-
-            await conn.execute(sql_content)
-            success("Role setup completed.")
-
-        except Exception as e:
-            error(f"Role setup failed: {e}")
-            raise typer.Exit(1)
-
-        finally:
-            if using_owner_role:
-                try:
-                    await conn.execute("RESET ROLE")
-                except Exception:
-                    pass
-
-            if db is not None:
-                await db.close()
-            elif connection_context is not None:
-                await connection_context.__aexit__(None, None, None)
-
-    asyncio.run(run())
-
-
 @app.command()
 def audit(
     ctx: typer.Context,
@@ -1502,7 +1471,7 @@ def audit(
 
     # Check IAM roles
     info("Checking GCP IAM roles...")
-    runtime_targets = get_runtime_targets_with_database_access()
+    runtime_targets = _runtime_db_targets()
     required_roles = ["roles/alloydb.client", "roles/alloydb.databaseUser"]
 
     iam_table = Table(title="IAM Role Audit")
@@ -1516,8 +1485,6 @@ def audit(
     for target in runtime_targets:
         sa_email = target.gcp_service_account_email
         db_login = target.alloydb_iam_user
-        if sa_email is None or db_login is None:
-            continue
         sa_name = sa_email.split("@", 1)[0]
         row = [sa_name, db_login]
 

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/cli/config.py

@@ -7,8 +7,6 @@ import os
 from pathlib import Path
 from typing import Any
 
-from cli.dev_context import load_dev_context
-
 CONFIG_DIR = Path.home() / ".buildai"
 CREDENTIALS_PATH = CONFIG_DIR / "credentials.json"
 DEFAULT_API_URL = "https://api.build.ai"
@@ -41,13 +39,6 @@ def clear_credential() -> None:
         CREDENTIALS_PATH.unlink()
 
 
-def _workspace_context() -> dict[str, Any] | None:
-    try:
-        return load_dev_context()
-    except Exception:
-        return None
-
-
 def _clean_str(value: Any) -> str | None:
     if not isinstance(value, str):
         return None
@@ -74,11 +65,6 @@ def resolve_api_url(*, include_workspace: bool = True) -> str:
     env_api_url = os.getenv("BUILDAI_API_URL")
     if env_api_url:
         return env_api_url.rstrip("/")
-    if include_workspace:
-        workspace_context = _workspace_context()
-        workspace_api_url = _clean_str((workspace_context or {}).get("api_url"))
-        if workspace_api_url:
-            return workspace_api_url.rstrip("/")
     api_url = load_credentials().get("api_url")
     if isinstance(api_url, str) and api_url:
         return api_url.rstrip("/")
@@ -109,8 +95,4 @@ def resolve_cli_profile(explicit: str | None = None) -> str:
     env_profile = _clean_str(os.getenv("BUILDAI_CLI_PROFILE"))
     if env_profile:
         return env_profile
-    workspace_context = _workspace_context()
-    workspace_profile = _clean_str((workspace_context or {}).get("cli_access_profile"))
-    if workspace_profile:
-        return workspace_profile
     return "internal_viewer"

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/cli/context.py

@@ -22,9 +22,9 @@ from dataclasses import dataclass
 from typing import TYPE_CHECKING, AsyncGenerator
 
 import asyncpg
-from infra.settings import Settings, get_settings
 
 from infra import Database, get_logger
+from infra.settings import Settings, get_settings
 
 if TYPE_CHECKING:
     from dal.context import Context
@@ -38,7 +38,6 @@ _UNRESTRICTED_CLI_PROFILES = frozenset(
     {
         "internal_admin",
         "internal_viewer",
-        "analyst",
         "developer",
         "operator",
         "ml_engineer",
@@ -82,25 +81,12 @@ def resolve_admin_connection_config(
 ) -> AdminConnectionConfig | None:
     """Resolve the canonical admin DB login for this environment, if one exists.
 
-    Resolution order is explicit env overrides first, then the checked-in
-    deployment profile, then the production password fallback already used by
-    privileged database commands.
+    Resolution order is explicit env overrides first, then the production
+    password fallback already used by privileged database commands.
     """
-    from infra.deployment_profiles import resolve_deployment_profile
-
     admin_iam_user = settings.effective_alloydb_admin_iam_user
     admin_impersonate_sa = settings.effective_alloydb_admin_impersonate_sa
 
-    if not admin_iam_user or not admin_impersonate_sa:
-        try:
-            profile_name = os.environ.get("BUILDAI_DEPLOYMENT_PROFILE", "production")
-            profile = resolve_deployment_profile(profile_name)
-            if profile.database_admin:
-                admin_iam_user = admin_iam_user or profile.database_admin.iam_user
-                admin_impersonate_sa = admin_impersonate_sa or profile.database_admin.impersonate_sa
-        except (ValueError, KeyError):
-            pass
-
     if admin_iam_user and admin_impersonate_sa:
         return AdminConnectionConfig(
             user=admin_iam_user,
@@ -137,8 +123,7 @@ async def open_admin_database(settings: Settings) -> Database:
     if config is None:
         raise RuntimeError(
             "Admin credentials not configured for this environment. "
-            "Set ALLOYDB_ADMIN_IAM_USER_* / ALLOYDB_ADMIN_IMPERSONATE_SA_* or "
-            "define database_admin in deployment_profiles.yaml."
+            "Set ALLOYDB_ADMIN_IAM_USER_* / ALLOYDB_ADMIN_IMPERSONATE_SA_*."
         )
 
     ip_type = "PRIVATE" if settings.use_private_ip else "PUBLIC"

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/cli/main.py

@@ -18,7 +18,6 @@ from cli.commands.api_proxy import api
 from cli.commands.assets_cli import app as assets_app
 from cli.commands.auth_lite import login, logout, whoami
 from cli.commands.clips import app as clips_app
-from cli.commands.dev import app as dev_app
 from cli.commands.inference import app as inference_app
 from cli.commands.jobs import app as jobs_app
 from cli.commands.query_api import query
@@ -208,7 +207,6 @@ Build AI CLI — query data, run inference, sign media URLs.
 
 Get started:
   uv tool install buildai-cli          Install the standalone CLI
-  uv run buildai dev use local         Set this worktree's dev target
   buildai login                         Authenticate (opens browser)
   buildai whoami                        Show your identity and permissions
   buildai query "SELECT count(*) FROM core.clips"
@@ -253,7 +251,6 @@ app.command("whoami")(whoami)
 app.command("logout")(logout)
 app.command("query")(query)
 
-app.add_typer(dev_app, name="dev")
 app.add_typer(clips_app, name="clips")
 app.add_typer(assets_app, name="assets")
 app.add_typer(inference_app, name="inference")
@@ -275,7 +272,7 @@ def admin_callback(
         None,
         "--env",
         "-e",
-        help="Target environment. Defaults to APP_ENV, then worktree context, then production.",
+        help="Target environment. Defaults to APP_ENV, then production.",
     ),
     auth: str = typer.Option(None, "--auth", "-a", help="Auth method: iam or password."),
     user: str = typer.Option(None, "--user", "-u", help="Override database user."),
@@ -306,7 +303,6 @@ if has_core():
     from cli.commands.medoid import app as medoid_app
     from cli.commands.operations import app as operations_app
     from cli.commands.partners import app as partners_app
-    from cli.commands.permissions import app as permissions_app
     from cli.commands.projection import app as projection_app
     from cli.commands.query import query as admin_query
     from cli.commands.schema import app as schema_app
@@ -321,7 +317,6 @@ if has_core():
     admin_app.add_typer(embed_app, name="embeddings")
     admin_app.add_typer(database_app, name="database")
     admin_app.add_typer(external_app, name="external")
-    admin_app.add_typer(permissions_app, name="permissions")
     admin_app.add_typer(projection_app, name="projection")
     admin_app.add_typer(medoid_app, name="medoid")
 

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/cli/ops_init.py

@@ -11,7 +11,6 @@ import os
 from enum import Enum
 
 import typer
-from infra.deployment_profiles import resolve_deployment_profile
 
 from cli.console import error, info, warning
 
@@ -34,87 +33,11 @@ def _parse_env(value: str) -> str:
     return normalized
 
 
-def _resolve_context_app_env(context: dict[str, object] | None) -> str | None:
-    if not context:
-        return None
-    value = context.get("app_env")
-    if not isinstance(value, str):
-        return None
-    cleaned = value.strip().lower()
-    return cleaned or None
-
-
-def _apply_context_database_target(
-    context: dict[str, object] | None,
-    *,
-    deployment_profile: str | None,
-) -> None:
-    database_target: dict[str, object] = {}
-    runtime_target: dict[str, object] = {}
-    if deployment_profile:
-        resolved_profile = resolve_deployment_profile(
-            deployment_profile,
-            env_id=(
-                str(context.get("preview_env_id")).strip()
-                if isinstance(context, dict) and context.get("preview_env_id")
-                else None
-            ),
-        )
-        database_target = resolved_profile.database_target.as_context_dict()
-        runtime_target["region"] = resolved_profile.runtime_region
-    if context and (
-        (context.get("deployment_profile") or context.get("profile")) == deployment_profile
-    ):
-        raw_runtime_target = context.get("runtime_target")
-        if isinstance(raw_runtime_target, dict):
-            runtime_target.update(raw_runtime_target)
-        raw_database_target = context.get("database_target")
-        if isinstance(raw_database_target, dict):
-            database_target.update(raw_database_target)
-
-    if database_target.get("cluster") or database_target.get("instance"):
-        # Neutralize stale .env overrides so the resolved context target wins.
-        os.environ.setdefault("ALLOYDB_INSTANCE_URI", "")
-
-    cluster = database_target.get("cluster")
-    if isinstance(cluster, str) and cluster.strip():
-        os.environ.setdefault("ALLOYDB_CLUSTER", cluster.strip())
-
-    instance = database_target.get("instance")
-    if isinstance(instance, str) and instance.strip():
-        os.environ.setdefault("ALLOYDB_INSTANCE", instance.strip())
-
-    runtime_region = runtime_target.get("region")
-    if isinstance(runtime_region, str) and runtime_region.strip():
-        os.environ.setdefault("GCP_REGION", runtime_region.strip())
-
-    region = database_target.get("region")
-    if isinstance(region, str) and region.strip():
-        os.environ.setdefault("ALLOYDB_REGION", region.strip())
-
-    database_name = database_target.get("database")
-    if isinstance(database_name, str) and database_name.strip():
-        os.environ.setdefault("DB_NAME", database_name.strip())
-
-    normalized_profile = (deployment_profile or "").strip().lower()
-    if normalized_profile == "production":
-        user_key = "ALLOYDB_USER_PROD"
-        iam_key = "ALLOYDB_IAM_AUTH_PROD"
-    else:
-        user_key = "ALLOYDB_USER_PREVIEW"
-        iam_key = "ALLOYDB_IAM_AUTH_PREVIEW"
-
-    user = database_target.get("user")
-    if isinstance(user, str) and user.strip():
-        os.environ.setdefault(user_key, user.strip())
-
-    if "use_iam_auth" in database_target:
-        os.environ.setdefault(iam_key, "true" if bool(database_target["use_iam_auth"]) else "false")
-
-
 def _auth_env_prefix(settings_app_env: object) -> str:
     if str(settings_app_env) == "production":
         return "PROD"
+    if str(settings_app_env) == "development":
+        return "DEV"
     if str(settings_app_env) == "test":
         return "DEV"
     return "PREVIEW"
@@ -133,20 +56,17 @@ def init_ops_context(ctx: typer.Context):
         return ctx.obj["settings"]
 
     from cli._has_core import require_core
-    from cli.dev_context import load_dev_context
 
     require_core("this command")
 
+    from infra import init_observability
     from infra.auth import AuthError, get_effective_user_for_iam, validate_auth_config
     from infra.settings import Environment, ExecutionContext, Settings, get_settings
 
-    from infra import init_observability
-
     verbose = ctx.obj.get("_verbose", False)
     log_level = logging.DEBUG if verbose else logging.WARNING
     init_observability("cli", log_level=log_level, enable_json_logs=False)
 
-    workspace_context = load_dev_context()
     env_flag = ctx.obj.get("_env")
     auth_flag = ctx.obj.get("_auth")
     user_flag = ctx.obj.get("_user")
@@ -161,40 +81,13 @@ def init_ops_context(ctx: typer.Context):
             )
             raise typer.Exit(1)
     else:
-        app_env_str = (
-            os.getenv("APP_ENV")
-            or _resolve_context_app_env(workspace_context)
-            or Environment.PRODUCTION.value
-        )
+        app_env_str = os.getenv("APP_ENV") or Environment.PRODUCTION.value
         try:
             app_env = Environment(_parse_env(app_env_str))
         except ValueError:
             app_env = Environment.PRODUCTION
 
     os.environ["APP_ENV"] = app_env.value
-    deployment_profile = None
-    if isinstance(workspace_context, dict):
-        profile_name = workspace_context.get("deployment_profile") or workspace_context.get(
-            "profile"
-        )
-        if isinstance(profile_name, str) and profile_name.strip():
-            deployment_profile = profile_name.strip()
-        preview_env_id = workspace_context.get("preview_env_id")
-        if isinstance(preview_env_id, str) and preview_env_id.strip():
-            os.environ["BUILDAI_PREVIEW_ENV_ID"] = preview_env_id.strip()
-    if env_flag is not None:
-        deployment_profile = (
-            ""
-            if app_env == Environment.TEST
-            else "local"
-            if app_env == Environment.DEVELOPMENT
-            else "production"
-        )
-    elif deployment_profile is None and app_env != Environment.TEST:
-        deployment_profile = "local" if app_env == Environment.DEVELOPMENT else "production"
-    if deployment_profile:
-        os.environ["BUILDAI_DEPLOYMENT_PROFILE"] = deployment_profile
-    _apply_context_database_target(workspace_context, deployment_profile=deployment_profile)
     settings = Settings(app_env=app_env, execution_context=ExecutionContext.HUMAN)
 
     # --- resolve auth -------------------------------------------------------
@@ -255,17 +148,7 @@ def init_ops_context(ctx: typer.Context):
     ctx.obj["settings"] = settings
     ctx.obj["_ops_ready"] = True
 
-    context_profile = None
-    if isinstance(workspace_context, dict):
-        raw_profile = workspace_context.get("cli_access_profile")
-        if isinstance(raw_profile, str) and raw_profile.strip():
-            context_profile = raw_profile.strip()
-    profile = (
-        ctx.obj.get("cli_profile")
-        or os.getenv("BUILDAI_CLI_PROFILE")
-        or context_profile
-        or "internal_admin"
-    )
+    profile = ctx.obj.get("cli_profile") or os.getenv("BUILDAI_CLI_PROFILE") or "internal_admin"
     ctx.obj["cli_profile"] = profile
     os.environ["BUILDAI_CLI_PROFILE"] = profile
     if ctx.obj.get("allow_write"):

{buildai_cli-0.3.35 → buildai_cli-0.3.36}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "buildai-cli"
-version = "0.3.35"
+version = "0.3.36"
 description = "Build AI CLI (Typer)"
 requires-python = ">=3.11"
 dependencies = [