xgic-payload-cms-cli 0.2.2__tar.gz → 0.2.4__tar.gz

{xgic_payload_cms_cli-0.2.2 → xgic_payload_cms_cli-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: xgic-payload-cms-cli
-Version: 0.2.2
+Version: 0.2.4
 Summary: XGIC CLI Payload CMS module - product commands and helpers (xgic.cli.payload).
 Project-URL: Homepage, https://github.com/xgic/payload-cms-cli
 Project-URL: Repository, https://github.com/xgic/payload-cms-cli
@@ -90,7 +90,7 @@ One brand (`xgic`), clear ownership, and dry-run-friendly destructive paths.
 uv pip install \
   "xgic-cli>=0.2.0,<0.3" \
   "xgic-dev-cli>=0.2.0,<0.3" \
-  "xgic-payload-cms-cli>=0.2.2,<0.3"
+  "xgic-payload-cms-cli>=0.2.4,<0.3"
 xgic payload --help
 ```
 
@@ -118,7 +118,7 @@ xgic payload dev
 xgic payload dev
 ```
 
-Optional: `xgic payload env` (status), `xgic payload env --regenerate --yes` (rotate credentials only — not required for first setup).
+Optional: `xgic payload env` (status), `xgic payload env --regenerate --yes` (rewrite credentials in `.devcontainer/.env` **and** sync the app `.env` — not required for first setup). Regenerate does **not** delete Compose DB volume data; it also does **not** change the password already stored in that volume—recreate the volume (`xgic payload reset --yes`, destructive) or update the DB role to match. Non-destructive live rotation is tracked separately.
 
 Prefer the end-user template for application work: [payload-cms](https://github.com/xgic/payload-cms).
 
@@ -131,9 +131,9 @@ All product commands nest under **`xgic payload`**:
 | Command | Purpose |
 |---------|---------|
 | `xgic payload dev` | **Primary daily command** — smart start (up if needed, DB check, `pnpm dev`) |
-| `xgic payload setup [--quiet]` | **First-run one-shot:** env (if missing) + DB profile + scaffold (idempotent) |
+| `xgic payload setup [--quiet]` | **First-run one-shot:** env (if missing) + DB profile + scaffold (idempotent). `pnpx` is invoked with `--allow-build=@swc/core` (and other native packages) so pnpm 10+ can run generator install scripts. |
 | `xgic payload env [--json]` | Product env status (project name, `.env`, services) |
-| `xgic payload env --regenerate --yes` | Rotate credentials in `.devcontainer/.env` (optional; setup creates env when absent) |
+| `xgic payload env --regenerate --yes` | Rewrite `.devcontainer/.env` (`DATABASE_URL`) and sync the app `.env` (optional; setup creates env when absent). Does **not** delete DB volume data; does **not** update the password inside an existing volume |
 | `xgic payload schema` | Run template schema generator when present |
 | `xgic payload reset` | Fast targeted reset (project folder + active DB volume) |
 

{xgic_payload_cms_cli-0.2.2 → xgic_payload_cms_cli-0.2.4}/README.md

@@ -55,7 +55,7 @@ One brand (`xgic`), clear ownership, and dry-run-friendly destructive paths.
 uv pip install \
   "xgic-cli>=0.2.0,<0.3" \
   "xgic-dev-cli>=0.2.0,<0.3" \
-  "xgic-payload-cms-cli>=0.2.2,<0.3"
+  "xgic-payload-cms-cli>=0.2.4,<0.3"
 xgic payload --help
 ```
 
@@ -83,7 +83,7 @@ xgic payload dev
 xgic payload dev
 ```
 
-Optional: `xgic payload env` (status), `xgic payload env --regenerate --yes` (rotate credentials only — not required for first setup).
+Optional: `xgic payload env` (status), `xgic payload env --regenerate --yes` (rewrite credentials in `.devcontainer/.env` **and** sync the app `.env` — not required for first setup). Regenerate does **not** delete Compose DB volume data; it also does **not** change the password already stored in that volume—recreate the volume (`xgic payload reset --yes`, destructive) or update the DB role to match. Non-destructive live rotation is tracked separately.
 
 Prefer the end-user template for application work: [payload-cms](https://github.com/xgic/payload-cms).
 
@@ -96,9 +96,9 @@ All product commands nest under **`xgic payload`**:
 | Command | Purpose |
 |---------|---------|
 | `xgic payload dev` | **Primary daily command** — smart start (up if needed, DB check, `pnpm dev`) |
-| `xgic payload setup [--quiet]` | **First-run one-shot:** env (if missing) + DB profile + scaffold (idempotent) |
+| `xgic payload setup [--quiet]` | **First-run one-shot:** env (if missing) + DB profile + scaffold (idempotent). `pnpx` is invoked with `--allow-build=@swc/core` (and other native packages) so pnpm 10+ can run generator install scripts. |
 | `xgic payload env [--json]` | Product env status (project name, `.env`, services) |
-| `xgic payload env --regenerate --yes` | Rotate credentials in `.devcontainer/.env` (optional; setup creates env when absent) |
+| `xgic payload env --regenerate --yes` | Rewrite `.devcontainer/.env` (`DATABASE_URL`) and sync the app `.env` (optional; setup creates env when absent). Does **not** delete DB volume data; does **not** update the password inside an existing volume |
 | `xgic payload schema` | Run template schema generator when present |
 | `xgic payload reset` | Fast targeted reset (project folder + active DB volume) |
 

{xgic_payload_cms_cli-0.2.2 → xgic_payload_cms_cli-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "xgic-payload-cms-cli"
-version = "0.2.2"
+version = "0.2.4"
 description = "XGIC CLI Payload CMS module - product commands and helpers (xgic.cli.payload)."
 readme = "README.md"
 license = { text = "Apache-2.0" }

{xgic_payload_cms_cli-0.2.2 → xgic_payload_cms_cli-0.2.4}/src/xgic/cli/payload/__init__.py

@@ -21,7 +21,7 @@ from xgic.cli.payload.project import (
     load_create_payload_config,
 )
 
-__version__ = "0.2.2"
+__version__ = "0.2.4"
 
 __all__ = [
     "DEFAULT_COMPOSE_PROJECT",

xgic_payload_cms_cli-0.2.4/src/xgic/cli/payload/commands/dev.py

@@ -0,0 +1,215 @@
+"""``xgic payload dev`` — smart Payload CMS development server start."""
+
+from __future__ import annotations
+
+import os
+import signal
+import subprocess
+import sys
+from pathlib import Path
+
+from xgic.cli.app import CommandContext
+from xgic.cli.core.environment import EnvironmentType
+from xgic.cli.payload.config import (
+    DEFAULT_PRIMARY_SERVICE,
+    db_ready,
+    get_compose_project_name,
+    get_db_profile,
+    make_payload_docker_controller,
+)
+from xgic.cli.payload.layout import display_project_location, resolve_project_dir
+from xgic.cli.payload.project import (
+    ensure_db_services,
+    is_payload_project_complete,
+    load_create_payload_config,
+)
+from xgic.cli.utils.output import print_info, print_success, print_warning
+
+# Exit codes commonly used when the user presses Ctrl+C / sends SIGINT.
+_SIGINT_EXIT_CODES = {130, -signal.SIGINT, 128 + signal.SIGINT}
+
+
+def _app_cwd(project_dir: Path) -> Path:
+    if project_dir == Path("."):
+        return Path.cwd()
+    return (Path.cwd() / project_dir).resolve()
+
+
+def _terminate_pnpm(proc: subprocess.Popen[bytes]) -> None:
+    if proc.poll() is not None:
+        return
+    try:
+        if sys.platform == "win32":
+            proc.terminate()
+        else:
+            proc.send_signal(signal.SIGINT)
+    except OSError:
+        pass
+    try:
+        proc.wait(timeout=15)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        proc.wait(timeout=5)
+
+
+def _report_pnpm_exit(returncode: int, app_cwd: Path) -> int:
+    try:
+        rel = Path(os.path.relpath(app_cwd, Path.cwd()))
+    except ValueError:
+        rel = app_cwd
+    project_hint = display_project_location(rel)
+
+    if returncode in _SIGINT_EXIT_CODES:
+        print_info("Development server stopped by user (Ctrl+C).")
+        return 0
+
+    if returncode == 0:
+        # Next.js often exits 0 on SIGTERM (child exitCode null -> || 0).
+        # That is not a healthy idle end for a long-running app dev server.
+        print_warning(
+            "The app dev child process exited with code 0 while under "
+            "`xgic payload dev`. For a long-running Next.js server that usually means "
+            "SIGTERM/SIGINT, a compile crash, or the terminal session ended "
+            "- not a normal idle shutdown."
+        )
+        print_info("Retry with: xgic payload dev")
+        print_info(
+            f"If it stops again while Compiling / (app: {project_hint}), "
+            "check DB connectivity, free memory, and (on bind-mounted "
+            "Windows workspaces) named volumes for node_modules/.next."
+        )
+        return 1
+
+    print_warning(
+        f"The app dev child process exited with code {returncode} "
+        "(launched by `xgic payload dev`)."
+    )
+    print_info("Retry with: xgic payload dev")
+    return returncode or 1
+
+
+def _run_pnpm_dev(app_cwd: Path) -> int:
+    """Run pnpm dev in the foreground until it stops.
+
+    Do not install shell ``trap ... exit 0`` handlers: they made SIGTERM
+    stops look like a successful idle exit while the page was still
+    compiling / serving. Inherit stdio so the VS Code terminal stays attached.
+    """
+    print_info(f"Launching pnpm dev in {app_cwd}...")
+    print_info(
+        "First HTTP request compiles the website template "
+        "(cold Turbopack); later requests are much faster."
+    )
+    env = os.environ.copy()
+    if env.get("CI", "").lower() in {"1", "true", "yes"}:
+        print_warning(
+            "CI=true is set in this environment; unsetting for pnpm dev "
+            "so Next.js stays in interactive watch mode."
+        )
+        env["CI"] = ""
+
+    try:
+        proc = subprocess.Popen(
+            ["pnpm", "dev"],
+            cwd=str(app_cwd),
+            env=env,
+            stdin=sys.stdin,
+            stdout=sys.stdout,
+            stderr=sys.stderr,
+        )
+    except FileNotFoundError:
+        print_warning(
+            "pnpm not found. Run inside the Dev Container image "
+            "(or install pnpm on PATH)."
+        )
+        return 1
+
+    try:
+        returncode = proc.wait()
+    except KeyboardInterrupt:
+        print_info("Stopping development server (Ctrl+C)...")
+        _terminate_pnpm(proc)
+        print_info("Development server stopped by user (Ctrl+C).")
+        return 0
+
+    return _report_pnpm_exit(returncode, app_cwd)
+
+
+def run_dev(ctx: CommandContext) -> int:
+    """Start DB if needed and launch the Payload CMS app dev server."""
+    env = ctx.env
+    cfg = load_create_payload_config()
+    project_dir = resolve_project_dir(cfg)
+
+    if not is_payload_project_complete(project_dir):
+        print_warning(
+            "Payload CMS app is not set up yet at "
+            f"{display_project_location(project_dir)}."
+        )
+        print_info("Run first:  xgic payload env --regenerate --yes")
+        print_info("Then:       xgic payload setup")
+        print_info("Then:       xgic payload dev")
+        return 1
+
+    print_info("Starting Payload CMS development server...")
+    print_info(f"App location: {display_project_location(project_dir)}")
+
+    docker = make_payload_docker_controller(env)
+    docker.project_name = get_compose_project_name()
+    profile = get_db_profile()
+
+    # Never recreate the primary Dev Container service; only ensure DB.
+    if not db_ready(docker):
+        print_warning(
+            f"Database ({profile}) not ready. Starting DB service only..."
+        )
+        db_rc = ensure_db_services(quiet=False)
+        if db_rc != 0:
+            print_warning(
+                "Could not start database. Fix Compose/DB, then re-run "
+                "xgic payload dev."
+            )
+            return db_rc
+    else:
+        print_success("Database is ready")
+
+    app_cwd = _app_cwd(project_dir)
+    if not (app_cwd / "package.json").is_file():
+        print_warning(f"No package.json under {app_cwd}")
+        return 1
+
+    if env.env_type in (
+        EnvironmentType.DEV_CONTAINER,
+        EnvironmentType.GENERIC_CONTAINER,
+    ):
+        return _run_pnpm_dev(app_cwd)
+
+    # Host: try docker exec into primary service (optional path)
+    rel = (
+        "."
+        if project_dir == Path(".")
+        else project_dir.as_posix().strip("/")
+    )
+    try:
+        print_info(
+            f"Launching pnpm dev via container service "
+            f"{DEFAULT_PRIMARY_SERVICE!r}..."
+        )
+        docker.exec(
+            DEFAULT_PRIMARY_SERVICE,
+            "sh",
+            "-c",
+            f"cd /workspace/{rel} && exec pnpm dev",
+            check=False,
+        )
+    except Exception as e:
+        print_warning(f"Failed to launch pnpm dev from host: {e}")
+        print_info(
+            "Prefer: Dev Containers → Reopen in Container, then "
+            "xgic payload dev"
+        )
+        return 1
+
+    print_success("Environment ready for development.")
+    print_info("Environment context: " + env.describe())
+    return 0

{xgic_payload_cms_cli-0.2.2 → xgic_payload_cms_cli-0.2.4}/src/xgic/cli/payload/commands/reset.py

@@ -97,7 +97,7 @@ def run_reset(ctx: CommandContext) -> int:
         print_info("Rotating credentials (--rotate-credentials)...")
         rc = perform_env_regenerate(yes=True)
         if rc == 0:
-            print_success("Credentials rotated in .env.")
+            print_success("Credentials rotated in compose and app .env.")
         else:
             print_warning("Credential rotation had issues (check .env).")
 

xgic_payload_cms_cli-0.2.4/src/xgic/cli/payload/env_helpers.py

@@ -0,0 +1,335 @@
+"""Payload CMS product env file generation (credentials + secrets)."""
+
+from __future__ import annotations
+
+import os
+import re
+import secrets
+import subprocess
+from pathlib import Path
+
+from xgic.cli.payload.config import (
+    DEFAULT_CONFIG_FILE,
+    get_compose_project_name,
+    get_db_config,
+    get_db_profile,
+)
+from xgic.cli.utils.output import print_info, print_success, print_warning
+
+ENV_FILE = Path(".devcontainer/.env")
+DEFAULT_NEXT_PUBLIC_SERVER_URL = "http://localhost:3000"
+
+_PLACEHOLDER_RE = re.compile(
+    r"^(?:YOUR_[A-Z0-9_]*|CHANGE_?ME|CHANGEME|XXX|TODO)?$",
+    re.IGNORECASE,
+)
+_STALE_VOLUME_WARNING = (
+    "Regenerate rewrites credential files only — it does NOT delete "
+    "Compose database volume data. It also does NOT update the password "
+    "already stored inside that volume, so the app may fail auth until "
+    "you either (1) recreate the volume (destructive: "
+    "xgic payload reset --yes) or (2) update the database role password "
+    "to match the new files (non-destructive; tracked as a separate "
+    "rotate feature)."
+)
+
+
+def generate_fresh_env_content(
+    *,
+    config_file: Path = DEFAULT_CONFIG_FILE,
+) -> str:
+    """Pure: return compose .env content with fresh secrets + db from config."""
+    db_name, db_user = get_db_config(config_file)
+    payload_secret = secrets.token_hex(32)
+    adapter = get_db_profile(config_file)
+
+    if adapter == "mongodb":
+        mongo_pass = secrets.token_hex(16)
+        return f"""MONGO_INITDB_ROOT_USERNAME={db_user}
+MONGO_INITDB_ROOT_PASSWORD={mongo_pass}
+MONGO_INITDB_DATABASE={db_name}
+PAYLOAD_SECRET={payload_secret}
+DATABASE_URL=mongodb://{db_user}:{mongo_pass}@mongodb:27017/{db_name}?authSource=admin
+"""
+
+    pg_pass = secrets.token_hex(16)
+    return f"""POSTGRES_USER={db_user}
+POSTGRES_PASSWORD={pg_pass}
+POSTGRES_DB={db_name}
+PAYLOAD_SECRET={payload_secret}
+DATABASE_URL=postgres://{db_user}:{pg_pass}@postgres:5432/{db_name}
+"""
+
+
+def parse_dotenv(content: str) -> dict[str, str]:
+    """Parse KEY=value assignments from .env text (last key wins)."""
+    values: dict[str, str] = {}
+    for line in content.splitlines():
+        stripped = line.strip()
+        if not stripped or stripped.startswith("#") or "=" not in stripped:
+            continue
+        key, _, value = stripped.partition("=")
+        key = key.strip()
+        if not key:
+            continue
+        values[key] = value.strip().strip('"').strip("'")
+    return values
+
+
+def looks_like_placeholder(value: str) -> bool:
+    """Return True for empty values or YOUR_* / CHANGE_ME style placeholders."""
+    return _PLACEHOLDER_RE.fullmatch(value.strip().strip('"').strip("'")) is not None
+
+
+def _set_env_key(content: str, key: str, value: str) -> str:
+    pattern = re.compile(rf"^{re.escape(key)}=.*$", re.MULTILINE)
+    replacement = f"{key}={value}"
+    if pattern.search(content):
+        return pattern.sub(replacement, content, count=1)
+    if content and not content.endswith("\n"):
+        content += "\n"
+    return content + f"{replacement}\n"
+
+
+def _remove_env_key(content: str, key: str) -> str:
+    return re.sub(rf"^{re.escape(key)}=.*\r?\n?", "", content, flags=re.MULTILINE)
+
+
+def compute_synced_project_env_content(
+    original_content: str,
+    live_db_uri: str,
+    live_payload_secret: str,
+    *,
+    cron_secret: str | None = None,
+    preview_secret: str | None = None,
+    next_public_server_url: str | None = None,
+) -> str:
+    """Return app .env content with live DATABASE_URL / secrets.
+
+    Writes Payload-canonical ``DATABASE_URL`` only (migrates a lone
+    ``DATABASE_URI``). Generates ``CRON_SECRET`` / ``PREVIEW_SECRET`` when
+    missing or still placeholders. Preserves other keys; sets
+    ``NEXT_PUBLIC_SERVER_URL`` when absent.
+    """
+    content = original_content
+    parsed = parse_dotenv(content)
+
+    if live_db_uri:
+        if "DATABASE_URL" in parsed:
+            content = _set_env_key(content, "DATABASE_URL", live_db_uri)
+            content = _remove_env_key(content, "DATABASE_URI")
+        elif "DATABASE_URI" in parsed:
+            content = re.sub(
+                r"^DATABASE_URI=.*$",
+                f"DATABASE_URL={live_db_uri}",
+                content,
+                count=1,
+                flags=re.MULTILINE,
+            )
+            content = _remove_env_key(content, "DATABASE_URI")
+        else:
+            content = _set_env_key(content, "DATABASE_URL", live_db_uri)
+
+    if live_payload_secret:
+        content = _set_env_key(content, "PAYLOAD_SECRET", live_payload_secret)
+
+    cron_val = parsed.get("CRON_SECRET")
+    if cron_val is None or looks_like_placeholder(cron_val):
+        content = _set_env_key(
+            content, "CRON_SECRET", cron_secret or secrets.token_hex(32)
+        )
+
+    preview_val = parsed.get("PREVIEW_SECRET")
+    if preview_val is None or looks_like_placeholder(preview_val):
+        content = _set_env_key(
+            content, "PREVIEW_SECRET", preview_secret or secrets.token_hex(32)
+        )
+
+    if "NEXT_PUBLIC_SERVER_URL" not in parsed:
+        content = _set_env_key(
+            content,
+            "NEXT_PUBLIC_SERVER_URL",
+            next_public_server_url or DEFAULT_NEXT_PUBLIC_SERVER_URL,
+        )
+
+    return content
+
+
+def load_live_env_from_devcontainer(
+    env_file: Path = Path(".devcontainer/.env"),
+) -> tuple[str, str]:
+    """Load DATABASE_URL and PAYLOAD_SECRET from process env or compose .env."""
+    db_url = os.environ.get("DATABASE_URL") or os.environ.get("DATABASE_URI", "")
+    secret = os.environ.get("PAYLOAD_SECRET", "")
+    if (db_url and secret) or not env_file.is_file():
+        return db_url, secret
+    try:
+        parsed = parse_dotenv(env_file.read_text(encoding="utf-8"))
+    except OSError:
+        return db_url, secret
+    if not db_url:
+        db_url = parsed.get("DATABASE_URL") or parsed.get("DATABASE_URI", "")
+    if not secret:
+        secret = parsed.get("PAYLOAD_SECRET", "")
+    return db_url, secret
+
+
+def sync_live_env_into_project(
+    project_dir: Path,
+    live_db_uri: str,
+    live_payload_secret: str,
+    *,
+    env_path: Path | None = None,
+    create_if_missing: bool = False,
+) -> Path | None:
+    """Best-effort sync of live credentials into the generated project's .env.
+
+    Returns the path written (or already matching), or None when skipped.
+    """
+    if env_path is None:
+        base = Path.cwd() if project_dir == Path(".") else project_dir
+        env_path = base / ".env"
+    if not env_path.is_file() and not create_if_missing:
+        return None
+
+    try:
+        content = env_path.read_text(encoding="utf-8") if env_path.is_file() else ""
+        new_content = compute_synced_project_env_content(
+            content, live_db_uri, live_payload_secret
+        )
+        if new_content != content:
+            env_path.parent.mkdir(parents=True, exist_ok=True)
+            env_path.write_text(new_content, encoding="utf-8")
+        return env_path
+    except Exception:
+        return None
+
+
+def compose_db_volume_name(*, config_file: Path = DEFAULT_CONFIG_FILE) -> str:
+    """Return the conventional Compose DB volume name for this workspace."""
+    return f"{get_compose_project_name(config_file)}-{get_db_profile(config_file)}-data"
+
+
+def compose_db_volume_exists(*, config_file: Path = DEFAULT_CONFIG_FILE) -> bool:
+    """Return True when ``docker volume inspect`` finds the Compose DB volume."""
+    name = compose_db_volume_name(config_file=config_file)
+    try:
+        result = subprocess.run(
+            ["docker", "volume", "inspect", name],
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        return result.returncode == 0
+    except Exception:
+        return False
+
+
+def _infer_workspace_root(config_file: Path, env_file: Path) -> Path:
+    for candidate in (config_file, env_file):
+        path = candidate if candidate.is_absolute() else Path.cwd() / candidate
+        if path.parent.name == ".devcontainer":
+            return path.parent.parent
+    return Path.cwd()
+
+
+def _resolve_app_env_path(config_file: Path, env_file: Path) -> Path:
+    from xgic.cli.payload.layout import resolve_project_dir
+    from xgic.cli.payload.project import load_create_payload_config
+
+    root = _infer_workspace_root(config_file, env_file)
+    rel = resolve_project_dir(load_create_payload_config(config_file), root=root)
+    if rel == Path(".") or str(rel) in (".", ""):
+        return root / ".env"
+    return root / rel / ".env"
+
+
+def _warn_stale_compose_db_volume(
+    *,
+    config_file: Path,
+    env_existed: bool,
+    planned: bool = False,
+) -> None:
+    """Warn when file rewrite cannot fix a volume initialized with the old password."""
+    exists = compose_db_volume_exists(config_file=config_file)
+    if not exists and not env_existed:
+        return
+    prefix = "Dry run: " if planned else ""
+    if exists:
+        name = compose_db_volume_name(config_file=config_file)
+        print_warning(
+            f"{prefix}Detected existing Compose DB volume {name!r}. "
+            "Data in that volume is kept, but it may still hold the "
+            "previous password (connectivity can break until reset or "
+            "an in-place role password update)."
+        )
+    print_warning(f"{prefix}{_STALE_VOLUME_WARNING}")
+
+
+def perform_env_regenerate(
+    *,
+    dry_run: bool = False,
+    yes: bool = False,
+    env_file: Path = ENV_FILE,
+    config_file: Path = DEFAULT_CONFIG_FILE,
+) -> int:
+    """Regenerate compose .env and sync the Payload app .env (guarded)."""
+    from xgic.cli.payload.project import is_payload_project_complete
+
+    content = generate_fresh_env_content(config_file=config_file)
+    env_existed = env_file.is_file()
+    app_env = _resolve_app_env_path(config_file, env_file)
+    would_sync = app_env.is_file() or is_payload_project_complete(app_env.parent)
+
+    if dry_run:
+        print_info("Dry run: would write fresh credentials to .env")
+        print_info(f"  (content length: {len(content)} chars)")
+        print_info(f"  compose env: {env_file}")
+        if would_sync:
+            print_info(f"  would sync app env: {app_env}")
+        _warn_stale_compose_db_volume(
+            config_file=config_file,
+            env_existed=env_existed,
+            planned=True,
+        )
+        return 0
+
+    if not yes:
+        print_warning("This will overwrite .env with new random credentials.")
+        print_warning("Re-run with --yes to proceed.")
+        return 1
+
+    try:
+        env_file.parent.mkdir(parents=True, exist_ok=True)
+        env_file.write_text(content, encoding="utf-8")
+    except Exception as e:
+        print_warning(f"Failed to write {env_file}: {e}")
+        return 1
+
+    parsed = parse_dotenv(content)
+    live_db = parsed.get("DATABASE_URL") or parsed.get("DATABASE_URI", "")
+    live_secret = parsed.get("PAYLOAD_SECRET", "")
+    written = sync_live_env_into_project(
+        app_env.parent,
+        live_db,
+        live_secret,
+        env_path=app_env,
+        create_if_missing=is_payload_project_complete(app_env.parent),
+    )
+
+    db_name, db_user = get_db_config(config_file)
+    adapter = get_db_profile(config_file)
+    print_success(f"Generated fresh credentials in {env_file}")
+    if adapter == "mongodb":
+        print_info(f"  (MONGO DB for {db_name})")
+    else:
+        print_info(f"  (POSTGRES_DB={db_name}, POSTGRES_USER={db_user})")
+    if written is not None:
+        print_success(f"Synced credentials into {written}")
+    _warn_stale_compose_db_volume(
+        config_file=config_file,
+        env_existed=env_existed,
+        planned=False,
+    )
+    return 0

{xgic_payload_cms_cli-0.2.2 → xgic_payload_cms_cli-0.2.4}/src/xgic/cli/payload/plugin.py

@@ -67,7 +67,7 @@ def register(
     penv.add_argument(
         "--regenerate",
         action="store_true",
-        help="Write fresh credentials to .devcontainer/.env",
+        help="Write fresh credentials to .devcontainer/.env and sync the app .env",
     )
     penv.add_argument(
         "--yes",
@@ -116,6 +116,6 @@ def register(
     reset.add_argument(
         "--rotate-credentials",
         action="store_true",
-        help="Also regenerate .devcontainer/.env credentials",
+        help="Also regenerate compose + app .env credentials",
     )
     reset.set_defaults(func=run_reset)

{xgic_payload_cms_cli-0.2.2 → xgic_payload_cms_cli-0.2.4}/src/xgic/cli/payload/project.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 import contextlib
 import json
-import os
 import re
 import subprocess
 import time
@@ -19,6 +18,10 @@ from xgic.cli.payload.config import (
     get_db_profile,
     make_payload_docker_controller,
 )
+from xgic.cli.payload.env_helpers import (
+    load_live_env_from_devcontainer,
+    sync_live_env_into_project,
+)
 from xgic.cli.payload.layout import (
     create_payload_target_arg,
     display_project_location,
@@ -26,6 +29,20 @@ from xgic.cli.payload.layout import (
 )
 from xgic.cli.utils.output import print_info, print_success, print_warning
 
+_sync_live_env_into_project = sync_live_env_into_project
+
+# Native packages whose install scripts pnpm 10+ otherwise skips.
+# @swc/core is required by create-payload-app itself; the rest match the
+# website template allow-list plus Next.js optional native add-ons.
+NATIVE_PNPM_BUILDS: tuple[str, ...] = (
+    "@swc/core",
+    "@parcel/watcher",
+    "esbuild",
+    "sharp",
+    "unrs-resolver",
+    "workerd",
+)
+
 
 def load_create_payload_config(
     config_path: Path = DEFAULT_CONFIG_FILE,
@@ -76,6 +93,134 @@ def is_payload_project_complete(project_dir: Path) -> bool:
     return any(p.exists() for p in candidates)
 
 
+def pnpx_allow_build_args(
+    packages: tuple[str, ...] = NATIVE_PNPM_BUILDS,
+) -> list[str]:
+    """Return ``pnpx --allow-build=…`` flags for native install scripts."""
+    return [f"--allow-build={name}" for name in packages]
+
+
+def merge_package_json_only_built(
+    text: str, names: tuple[str, ...] = NATIVE_PNPM_BUILDS
+) -> str:
+    """Return package.json text with ``pnpm.onlyBuiltDependencies`` merged."""
+    data = json.loads(text)
+    pnpm = data.setdefault("pnpm", {})
+    existing = pnpm.get("onlyBuiltDependencies") or []
+    if not isinstance(existing, list):
+        existing = []
+    str_existing = [str(item) for item in existing]
+    merged = list(dict.fromkeys([*str_existing, *names]))
+    if merged == str_existing:
+        return text
+    pnpm["onlyBuiltDependencies"] = merged
+    return json.dumps(data, indent=2) + "\n"
+
+
+def yaml_map_key(name: str) -> str:
+    """Quote YAML mapping keys that are not plain scalars (e.g. ``@swc/core``)."""
+    if not name or name[0] in "@`&*!|>%{}[]'\"" or any(
+        ch in name for ch in ":#"
+    ):
+        return json.dumps(name)
+    return name
+
+
+def parse_yaml_map_key(raw: str) -> str:
+    """Strip optional YAML quotes from a mapping key token."""
+    raw = raw.strip()
+    if len(raw) >= 2 and raw[0] == raw[-1] and raw[0] in "\"'":
+        return raw[1:-1]
+    return raw
+
+
+def _allow_builds_block(names: list[str]) -> list[str]:
+    return ["allowBuilds:"] + [f"  {yaml_map_key(n)}: true" for n in names]
+
+
+def merge_workspace_allow_builds(
+    text: str, names: tuple[str, ...] = NATIVE_PNPM_BUILDS
+) -> str:
+    """Return pnpm-workspace.yaml text with ``allowBuilds`` keys merged.
+
+    Avoids a YAML dependency: only handles the generated website-template
+    shape (a top-level ``allowBuilds:`` mapping of ``name: true``).
+    Always re-emits the block so unquoted ``@`` keys from 0.2.3 are repaired.
+    """
+    normalized = text if text.endswith("\n") or text == "" else text + "\n"
+    lines = normalized.splitlines()
+    start = next(
+        (i for i, ln in enumerate(lines) if ln.startswith("allowBuilds:")),
+        None,
+    )
+    if start is None:
+        extra = _allow_builds_block(list(names))
+        return normalized + "\n".join(extra) + "\n"
+
+    existing: list[str] = []
+    end = start + 1
+    while end < len(lines):
+        ln = lines[end]
+        if not ln.strip():
+            end += 1
+            continue
+        if ln.startswith(" ") or ln.startswith("\t"):
+            key_raw = ln.strip().split(":", 1)[0]
+            existing.append(parse_yaml_map_key(key_raw))
+            end += 1
+            continue
+        break
+    merged = list(dict.fromkeys([*existing, *names]))
+    block = _allow_builds_block(merged)
+    new_lines = lines[:start] + block + lines[end:]
+    return "\n".join(new_lines) + "\n"
+
+
+def ensure_native_pnpm_builds(
+    project_dir: Path, *, quiet: bool = False
+) -> None:
+    """Allow-list native install scripts in a generated Payload CMS app."""
+    changed = False
+    workspace = project_dir / "pnpm-workspace.yaml"
+    package_json = project_dir / "package.json"
+    try:
+        if workspace.is_file():
+            old = workspace.read_text(encoding="utf-8")
+            new = merge_workspace_allow_builds(old)
+            if new != old:
+                workspace.write_text(new, encoding="utf-8")
+                changed = True
+        if package_json.is_file():
+            old = package_json.read_text(encoding="utf-8")
+            new = merge_package_json_only_built(old)
+            if new != old:
+                package_json.write_text(new, encoding="utf-8")
+                changed = True
+    except (OSError, json.JSONDecodeError) as e:
+        if not quiet:
+            print_warning(f"Could not update pnpm native allow-list: {e}")
+        return
+    if not changed:
+        return
+    if not quiet:
+        print_info(
+            "Allowing native pnpm install scripts "
+            f"({', '.join(NATIVE_PNPM_BUILDS)}) in "
+            f"{display_project_location(project_dir)}."
+        )
+    result = subprocess.run(
+        ["pnpm", "install"],
+        cwd=str(project_dir),
+        check=False,
+    )
+    if result.returncode != 0 and not quiet:
+        print_warning(
+            "pnpm install after native allow-list update exited "
+            f"{result.returncode}. Re-run inside the app directory if "
+            "install scripts were skipped."
+        )
+
+
 def build_create_payload_command(
     target: str,
     *,
@@ -87,6 +232,7 @@ def build_create_payload_command(
     """Return the argv list for a non-interactive create-payload-app run."""
     cmd = [
         "pnpx",
+        *pnpx_allow_build_args(),
         "create-payload-app@latest",
         target,
         "-t",
@@ -116,80 +262,6 @@ def resolve_db_connection_string(
     return live_db_uri or json_db_uri or None
 
 
-def load_live_env_from_devcontainer(
-    env_file: Path = Path(".devcontainer/.env"),
-) -> tuple[str, str]:
-    """Load DATABASE_URI and PAYLOAD_SECRET from .devcontainer/.env if present."""
-    db_uri = os.environ.get("DATABASE_URI", "")
-    secret = os.environ.get("PAYLOAD_SECRET", "")
-    if (db_uri and secret) or not env_file.is_file():
-        return db_uri, secret
-    try:
-        for line in env_file.read_text(encoding="utf-8").splitlines():
-            line = line.strip()
-            if not line or line.startswith("#") or "=" not in line:
-                continue
-            key, _, value = line.partition("=")
-            key = key.strip()
-            value = value.strip().strip('"').strip("'")
-            if key == "DATABASE_URI" and not db_uri:
-                db_uri = value
-            elif key == "PAYLOAD_SECRET" and not secret:
-                secret = value
-    except OSError:
-        pass
-    return db_uri, secret
-
-
-def compute_synced_project_env_content(
-    original_content: str, live_db_uri: str, live_payload_secret: str
-) -> str:
-    """Return .env content with live DATABASE_URL / PAYLOAD_SECRET."""
-    content = original_content
-    if live_db_uri:
-        content = re.sub(
-            r"^DATABASE_URL=.*$",
-            f"DATABASE_URL={live_db_uri}",
-            content,
-            flags=re.MULTILINE,
-        )
-        # Some templates use DATABASE_URI
-        content = re.sub(
-            r"^DATABASE_URI=.*$",
-            f"DATABASE_URI={live_db_uri}",
-            content,
-            flags=re.MULTILINE,
-        )
-    if live_payload_secret:
-        content = re.sub(
-            r"^PAYLOAD_SECRET=.*$",
-            f"PAYLOAD_SECRET={live_payload_secret}",
-            content,
-            flags=re.MULTILINE,
-        )
-    return content
-
-
-def _sync_live_env_into_project(
-    project_dir: Path, live_db_uri: str, live_payload_secret: str
-) -> None:
-    """Best-effort sync of live credentials into the generated project's .env."""
-    base = Path.cwd() if project_dir == Path(".") else project_dir
-    gen_env = base / ".env"
-    if not gen_env.is_file():
-        return
-
-    try:
-        content = gen_env.read_text(encoding="utf-8")
-        new_content = compute_synced_project_env_content(
-            content, live_db_uri, live_payload_secret
-        )
-        if new_content != content:
-            gen_env.write_text(new_content, encoding="utf-8")
-    except Exception:
-        pass
-
-
 def validate_compose_project_name(name: str) -> str:
     """Return a Docker Compose–safe project name or raise ValueError."""
     cleaned = name.strip().lower()
@@ -383,12 +455,6 @@ def ensure_payload_project(*, quiet: bool = False) -> int:
             check=False,
             capture_output=True,
         )
-    with contextlib.suppress(Exception):
-        subprocess.run(
-            ["corepack", "pnpm", "approve-builds", "@swc/core"],
-            check=False,
-            capture_output=True,
-        )
 
     cmd = build_create_payload_command(
         target,
@@ -442,5 +508,6 @@ def ensure_payload_project(*, quiet: bool = False) -> int:
             "Payload CMS project created successfully at "
             f"{display_project_location(project_dir)}."
         )
+    ensure_native_pnpm_builds(project_dir, quiet=quiet)
     _sync_live_env_into_project(project_dir, live_db_uri, live_secret)
     return 0

xgic_payload_cms_cli-0.2.2/src/xgic/cli/payload/commands/dev.py

@@ -1,137 +0,0 @@
-"""``xgic payload dev`` — smart Payload CMS development server start."""
-
-from __future__ import annotations
-
-import subprocess
-from pathlib import Path
-
-from xgic.cli.app import CommandContext
-from xgic.cli.core.environment import EnvironmentType
-from xgic.cli.payload.config import (
-    DEFAULT_PRIMARY_SERVICE,
-    db_ready,
-    get_compose_project_name,
-    get_db_profile,
-    make_payload_docker_controller,
-)
-from xgic.cli.payload.layout import display_project_location, resolve_project_dir
-from xgic.cli.payload.project import (
-    ensure_db_services,
-    is_payload_project_complete,
-    load_create_payload_config,
-)
-from xgic.cli.utils.output import print_info, print_success, print_warning
-
-
-def _app_cwd(project_dir: Path) -> Path:
-    if project_dir == Path("."):
-        return Path.cwd()
-    return (Path.cwd() / project_dir).resolve()
-
-
-def run_dev(ctx: CommandContext) -> int:
-    """Start DB if needed and launch the Payload CMS app dev server."""
-    env = ctx.env
-    cfg = load_create_payload_config()
-    project_dir = resolve_project_dir(cfg)
-
-    if not is_payload_project_complete(project_dir):
-        print_warning(
-            "Payload CMS app is not set up yet at "
-            f"{display_project_location(project_dir)}."
-        )
-        print_info("Run first:  xgic payload env --regenerate --yes")
-        print_info("Then:       xgic payload setup")
-        print_info("Then:       xgic payload dev")
-        return 1
-
-    print_info("Starting Payload CMS development server...")
-    print_info(f"App location: {display_project_location(project_dir)}")
-
-    docker = make_payload_docker_controller(env)
-    docker.project_name = get_compose_project_name()
-    profile = get_db_profile()
-
-    # Never recreate the primary Dev Container service; only ensure DB.
-    if not db_ready(docker):
-        print_warning(
-            f"Database ({profile}) not ready. Starting DB service only..."
-        )
-        db_rc = ensure_db_services(quiet=False)
-        if db_rc != 0:
-            print_warning(
-                "Could not start database. Fix Compose/DB, then re-run "
-                "xgic payload dev."
-            )
-            return db_rc
-    else:
-        print_success("Database is ready")
-
-    app_cwd = _app_cwd(project_dir)
-    if not (app_cwd / "package.json").is_file():
-        print_warning(f"No package.json under {app_cwd}")
-        return 1
-
-    if env.env_type in (
-        EnvironmentType.DEV_CONTAINER,
-        EnvironmentType.GENERIC_CONTAINER,
-    ):
-        try:
-            print_info(f"Launching pnpm dev in {app_cwd}...")
-            result = subprocess.run(
-                ["sh", "-c", 'trap "exit 0" INT TERM; exec pnpm dev'],
-                cwd=str(app_cwd),
-                check=False,
-            )
-            if result.returncode in (130, -2, 2):
-                print_info("Development server stopped by user (Ctrl+C).")
-                return 0
-            if result.returncode != 0:
-                print_warning(f"pnpm dev exited with code {result.returncode}.")
-                print_info(
-                    f"Fallback: cd {display_project_location(project_dir)} "
-                    "&& pnpm dev"
-                )
-                return result.returncode or 1
-            print_info("Development server exited cleanly.")
-            return 0
-        except KeyboardInterrupt:
-            print_info("Development server stopped by user (Ctrl+C).")
-            return 0
-        except FileNotFoundError:
-            print_warning(
-                "pnpm not found. Run inside the Dev Container image "
-                "(or install pnpm on PATH)."
-            )
-            return 1
-
-    # Host: try docker exec into primary service (optional path)
-    rel = (
-        "."
-        if project_dir == Path(".")
-        else project_dir.as_posix().strip("/")
-    )
-    try:
-        print_info(
-            f"Launching pnpm dev via container service "
-            f"{DEFAULT_PRIMARY_SERVICE!r}..."
-        )
-        docker.exec(
-            DEFAULT_PRIMARY_SERVICE,
-            "sh",
-            "-c",
-            f"cd /workspace/{rel} && "
-            "sh -c 'trap \"exit 0\" INT TERM; exec pnpm dev'",
-            check=False,
-        )
-    except Exception as e:
-        print_warning(f"Failed to launch pnpm dev from host: {e}")
-        print_info(
-            "Prefer: Dev Containers → Reopen in Container, then "
-            "xgic payload dev"
-        )
-        return 1
-
-    print_success("Environment ready for development.")
-    print_info("Environment context: " + env.describe())
-    return 0

xgic_payload_cms_cli-0.2.2/src/xgic/cli/payload/env_helpers.py

@@ -1,91 +0,0 @@
-"""Payload CMS product env file generation (credentials + secrets)."""
-
-from __future__ import annotations
-
-import json
-import secrets
-from pathlib import Path
-
-from xgic.cli.payload.config import DEFAULT_CONFIG_FILE, get_db_config
-from xgic.cli.utils.output import print_info, print_success, print_warning
-
-ENV_FILE = Path(".devcontainer/.env")
-
-
-def generate_fresh_env_content(
-    *,
-    config_file: Path = DEFAULT_CONFIG_FILE,
-) -> str:
-    """Pure: return .env content with fresh secrets + db from config."""
-    db_name, db_user = get_db_config(config_file)
-    payload_secret = secrets.token_hex(32)
-
-    adapter = "postgres"
-    if config_file.exists():
-        try:
-            with config_file.open(encoding="utf-8") as f:
-                cfg = json.load(f)
-            adapter = str(cfg.get("dbAdapter", "postgres")).lower()
-        except Exception:
-            pass
-
-    if adapter == "mongodb":
-        mongo_pass = secrets.token_hex(16)
-        return f"""MONGO_INITDB_ROOT_USERNAME={db_user}
-MONGO_INITDB_ROOT_PASSWORD={mongo_pass}
-MONGO_INITDB_DATABASE={db_name}
-PAYLOAD_SECRET={payload_secret}
-DATABASE_URI=mongodb://{db_user}:{mongo_pass}@mongodb:27017/{db_name}?authSource=admin
-"""
-
-    pg_pass = secrets.token_hex(16)
-    return f"""POSTGRES_USER={db_user}
-POSTGRES_PASSWORD={pg_pass}
-POSTGRES_DB={db_name}
-PAYLOAD_SECRET={payload_secret}
-DATABASE_URI=postgres://{db_user}:{pg_pass}@postgres:5432/{db_name}
-"""
-
-
-def perform_env_regenerate(
-    *,
-    dry_run: bool = False,
-    yes: bool = False,
-    env_file: Path = ENV_FILE,
-    config_file: Path = DEFAULT_CONFIG_FILE,
-) -> int:
-    """Regenerate .env with fresh credentials (guarded by --yes / dry-run)."""
-    if dry_run:
-        content = generate_fresh_env_content(config_file=config_file)
-        print_info("Dry run: would write fresh credentials to .env")
-        print_info(f"  (content length: {len(content)} chars)")
-        return 0
-
-    if not yes:
-        print_warning("This will overwrite .env with new random credentials.")
-        print_warning("Re-run with --yes to proceed.")
-        return 1
-
-    content = generate_fresh_env_content(config_file=config_file)
-    try:
-        env_file.parent.mkdir(parents=True, exist_ok=True)
-        with env_file.open("w", encoding="utf-8") as f:
-            f.write(content)
-        db_name, db_user = get_db_config(config_file)
-        adapter = "postgres"
-        if config_file.exists():
-            try:
-                with config_file.open(encoding="utf-8") as f:
-                    cfg = json.load(f)
-                adapter = str(cfg.get("dbAdapter", "postgres")).lower()
-            except Exception:
-                pass
-        print_success(f"Generated fresh credentials in {env_file}")
-        if adapter == "mongodb":
-            print_info(f"  (MONGO DB for {db_name})")
-        else:
-            print_info(f"  (POSTGRES_DB={db_name}, POSTGRES_USER={db_user})")
-        return 0
-    except Exception as e:
-        print_warning(f"Failed to write {env_file}: {e}")
-        return 1