pray-cli 1.6.0

data/lib/pray/trust_ops.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Pray
+  module Trust
+    module_function
+
+    def list_policy(scope:, source_url: nil, home: trust_home)
+      policy = load_policy_or_default(home)
+      source_url ? list_policy_for_source(policy, scope, source_url) : list_policy_all(policy, scope)
+    end
+
+    def show_policy_toml(home = trust_home)
+      format_policy(load_policy_or_default(home))
+    end
+
+    def add_allowed_signing_key(key, match_prefix: nil, home: trust_home)
+      normalized = normalize_key(key)
+      raise Error.unsupported("signing key is empty") if normalized.empty?
+
+      policy = load_policy_or_default(home)
+      rule = match_prefix ? mutable_rule_for_match_prefix!(policy, match_prefix) : policy.default_rule
+      unless rule.allowed_signing_keys.any? { |existing| normalize_key(existing) == normalized }
+        rule.allowed_signing_keys << normalized
+      end
+      save_policy(policy, home)
+    end
+
+    def remove_allowed_signing_key(key, match_prefix: nil, home: trust_home)
+      normalized = normalize_key(key)
+      raise Error.unsupported("signing key is empty") if normalized.empty?
+
+      policy = load_policy_or_default(home)
+      rule = match_prefix ? mutable_rule_for_match_prefix!(policy, match_prefix) : policy.default_rule
+      before = rule.allowed_signing_keys.length
+      rule.allowed_signing_keys.reject! { |existing| normalize_key(existing) == normalized }
+      if rule.allowed_signing_keys.length == before
+        raise Error.unsupported(
+          "signing key not found in allowed_signing_keys for #{match_prefix || "<default>"}"
+        )
+      end
+      save_policy(policy, home)
+    end
+
+    def set_require_signed_commit(match_prefix, enabled, home: trust_home)
+      raise Error.unsupported("match-prefix is empty") if match_prefix.to_s.strip.empty?
+
+      policy = load_policy_or_default(home)
+      mutable_rule_for_match_prefix!(policy, match_prefix).require_signed_commit = enabled
+      save_policy(policy, home)
+    end
+
+    def set_allow(match_prefix, allow, home: trust_home)
+      raise Error.unsupported("match-prefix is empty") if match_prefix.to_s.strip.empty?
+
+      policy = load_policy_or_default(home)
+      mutable_rule_for_match_prefix!(policy, match_prefix).allow = allow
+      save_policy(policy, home)
+    end
+
+    def import_registry(source_url, match_prefix: nil, include_host_key: false, home: trust_home)
+      if source_url.start_with?("pray+ssh://", "ssh+pray://")
+        raise Error.unsupported("pray_ssh registry import is not implemented yet in pray-cli Ruby")
+      end
+      raise Error.unsupported("--host-key requires pray_ssh sources") if include_host_key
+
+      publishers = fetch_ssh_publisher_fingerprints(source_url)
+      raise Error.unsupported("no v1/ssh_publishers.json found for #{source_url}") if publishers.nil?
+      if publishers.empty?
+        raise Error.unsupported(
+          "v1/ssh_publishers.json for #{source_url} lists no publisher fingerprints"
+        )
+      end
+
+      prefix = match_prefix || source_url
+      policy = load_policy_or_default(home)
+      rule = mutable_rule_for_match_prefix!(policy, prefix)
+      publishers_added = append_missing!(rule.allowed_publishers, publishers)
+      save_policy(policy, home)
+      {publishers_added: publishers_added, host_keys_added: 0}
+    end
+
+    def import_repo(source_url, repository, match_prefix: nil, home: trust_home)
+      keys = repository_signing_keys(repository)
+      if keys.empty?
+        raise Error.unsupported(
+          "no commit signing key/fingerprint found for HEAD in #{repository}"
+        )
+      end
+
+      prefix = match_prefix || source_url
+      policy = load_policy_or_default(home)
+      rule = mutable_rule_for_match_prefix!(policy, prefix)
+      added = append_missing!(rule.allowed_signing_keys, keys)
+      save_policy(policy, home)
+      added
+    end
+
+    def list_policy_all(policy, scope)
+      lines = []
+      if %i[all global].include?(scope)
+        lines << format_rule_block("scope: global", policy.default_rule).rstrip
+      end
+      if %i[all local].include?(scope)
+        if policy.rules.empty?
+          lines << "scope: local\n  (no rules)"
+        else
+          policy.rules.sort_by { |rule| rule.match_prefix.to_s }.each do |rule|
+            prefix = rule.match_prefix || "-"
+            lines << format_rule_block("scope: local (#{prefix})", rule).rstrip
+          end
+        end
+      end
+      lines.join("\n\n")
+    end
+
+    def list_policy_for_source(policy, scope, source_url)
+      lines = ["source: #{source_url}", ""]
+      if %i[all global].include?(scope)
+        lines << format_rule_block("scope: global", policy.default_rule).rstrip
+        lines << ""
+      end
+      if %i[all local].include?(scope)
+        matched = policy.rules.select do |rule|
+          prefix = rule.match_prefix
+          prefix && !prefix.empty? && source_url.start_with?(prefix)
+        end
+        matched.sort_by! { |rule| -(rule.match_prefix&.length || 0) }
+        lines << if matched.empty?
+          "scope: local\n  (no matching rules)"
+        else
+          matched.map { |rule|
+            format_rule_block("scope: local (#{rule.match_prefix})", rule).rstrip
+          }.join("\n")
+        end
+        lines << ""
+      end
+      if scope == :all
+        effective = best_rule(policy, source_url)
+        lines << if effective.match_prefix
+          "effective_scope: local (#{effective.match_prefix})"
+        else
+          "effective_scope: global"
+        end
+      end
+      lines.join("\n").strip
+    end
+
+    def fetch_ssh_publisher_fingerprints(source_url)
+      body = read_distribution_bytes(source_url, "v1/ssh_publishers.json")
+      return nil unless body
+
+      data = JSON.parse(body)
+      Array(data["publishers"]).filter_map do |entry|
+        fingerprint = entry["fingerprint"].to_s
+        next if fingerprint.empty?
+
+        normalize_key(fingerprint)
+      end
+    rescue JSON::ParserError => error
+      raise Error.parse("ssh publishers", error.message)
+    end
+
+    def read_distribution_bytes(source_url, relative_path)
+      if source_url.start_with?("http://", "https://")
+        begin
+          return Registry.send(:http_get, Registry.send(:join_url, source_url, relative_path))
+        rescue Error
+          return nil
+        end
+      end
+
+      root = source_url.delete_prefix("file://")
+      path = File.join(root, relative_path)
+      return nil unless File.file?(path)
+
+      File.read(path)
+    end
+
+    def repository_signing_keys(repository)
+      keys = []
+      key = git_format(repository, "%GK")
+      keys << normalize_key(key) unless key.empty?
+      fingerprint = git_format(repository, "%GF")
+      keys << normalize_key(fingerprint) unless fingerprint.empty?
+      keys.uniq
+    end
+
+    def git_format(repository, format)
+      output = IO.popen(
+        ["git", "-C", repository, "log", "-1", "--format=#{format}"],
+        err: File::NULL, &:read
+      )
+      return "" unless $?.success?
+
+      output.to_s.strip
+    end
+  end
+end
+
+require_relative "trust_feed"

data/lib/pray/verify.rb

@@ -0,0 +1,257 @@
+# frozen_string_literal: true
+
+module Pray
+  VerificationFinding = Struct.new(:kind, :message) do
+    def warning? = kind == "orphan_marker"
+    def error? = !warning?
+  end
+
+  VerificationReport = Struct.new(:findings) do
+    def initialize(findings: [])
+      super
+    end
+
+    def clean? = findings.empty?
+    def warnings? = findings.any?(&:warning?)
+    def errors? = findings.any?(&:error?)
+  end
+
+  module Verify
+    module_function
+
+    def inspect_project(project, lockfile)
+      collect_verification_report(project, lockfile).first
+    end
+
+    def verify_project(project, lockfile, strict: false)
+      report = inspect_project(project, lockfile)
+      return report if report.clean?
+
+      if strict || report.errors?
+        raise Error.verify(format_verification_report(report))
+      end
+
+      report
+    end
+
+    def drift_project(project, lockfile)
+      report, rendered_targets = collect_verification_report(project, lockfile)
+      Render.render_project(project).each do |target|
+        normalized_fresh = Hashing.normalize_line_endings(target.content)
+        on_disk = rendered_targets[target.path]
+        on_disk = Hashing.normalize_line_endings(on_disk) if on_disk
+        unless on_disk == normalized_fresh
+          report.findings << VerificationFinding.new(
+            kind: "renderer_drift",
+            message: "#{target.path} differs from fresh render"
+          )
+        end
+        unless lockfile_targets(lockfile).include?(target.path)
+          report.findings << VerificationFinding.new(
+            kind: "renderer_drift",
+            message: "#{target.path} is not tracked in lockfile"
+          )
+        end
+      end
+
+      if report.clean?
+        report
+      else
+        raise Error.verify(format_drift_report(report))
+      end
+    end
+
+    def collect_verification_report(project, lockfile)
+      report = VerificationReport.new
+      rendered_targets = {}
+
+      if project.manifest_hash != lockfile.manifest_hash
+        report.findings << VerificationFinding.new(
+          kind: "verify_error",
+          message: "Prayfile changed since `Prayfile.lock` was generated. Run `pray install` to refresh the lockfile."
+        )
+      end
+
+      locked_packages = lockfile.package.to_h { |entry| [entry.name, entry] }
+      project.packages.each do |package|
+        locked = locked_packages.delete(package.declaration.name)
+        if locked
+          if locked.tree_hash != package.tree_hash
+            report.findings << VerificationFinding.new(
+              kind: "package_integrity",
+              message: "Package `#{package.declaration.name}` no longer matches the locked tree hash. Run `pray install` to re-resolve packages."
+            )
+          end
+          if locked.version != package.spec.version
+            report.findings << VerificationFinding.new(
+              kind: "verify_error",
+              message: "Package `#{package.declaration.name}` resolved to version #{package.spec.version} but `Prayfile.lock` has #{locked.version}. Run `pray install` to refresh the lockfile."
+            )
+          end
+        else
+          report.findings << VerificationFinding.new(
+            kind: "verify_error",
+            message: "Package `#{package.declaration.name}` is declared in Prayfile but missing from `Prayfile.lock`. Run `pray install` to update the lockfile."
+          )
+        end
+      end
+      locked_packages.each_value do |locked|
+        report.findings << VerificationFinding.new(
+          kind: "verify_error",
+          message: "Package `#{locked.name}` is in `Prayfile.lock` but not declared in Prayfile. Remove it from the lockfile with `pray install` or add it back to Prayfile."
+        )
+      end
+
+      target_spans = lockfile.managed_span.group_by(&:target)
+      target_spans.each do |target_path, spans|
+        absolute_path = File.join(project.project_root, target_path)
+        unless File.exist?(absolute_path)
+          report.findings << VerificationFinding.new(
+            kind: "verify_error",
+            message: "Rendered file `#{target_path}` is missing. Run `pray install` to generate it."
+          )
+          next
+        end
+
+        text = File.read(absolute_path)
+        rendered_targets[target_path] = text
+        lines = text.lines(chomp: true)
+        markers = marker_positions(lines)
+        spans.each do |span|
+          marker = markers[span.id]
+          if marker.nil?
+            report.findings << VerificationFinding.new(
+              kind: "removed_prayer",
+              message: "`#{target_path}` is missing managed marker `#{span.id}` for `#{span.package}::#{span.export}`. Run `pray install` to restore the managed span."
+            )
+          else
+            open_line, close_line, checksum = marker
+            if checksum != span.ideal_checksum
+              report.findings << VerificationFinding.new(
+                kind: "custom_implementation",
+                message: "`#{target_path}` marker `#{span.id}` (`#{span.package}::#{span.export}`) was edited. Restore the managed block or run `pray install` to regenerate it."
+              )
+            end
+            if open_line != span.open_line || close_line != span.close_line
+              report.findings << VerificationFinding.new(
+                kind: "position_drift",
+                message: "`#{target_path}` marker `#{span.id}` (`#{span.package}::#{span.export}`) moved to different lines. Run `pray install` to restore expected positions."
+              )
+            end
+          end
+        end
+        find_orphan_marker_findings(spans, markers, target_path).each do |finding|
+          report.findings << finding
+        end
+      end
+
+      project.local_files.each do |local|
+        next if local.optional
+        next if File.exist?(local.path)
+
+        report.findings << VerificationFinding.new(
+          kind: "verify_error",
+          message: Resolve.missing_local_embed_guidance(local.manifest_path)
+        )
+      end
+
+      [report, rendered_targets]
+    end
+
+    def find_orphan_marker_findings(spans, markers, target_path)
+      tracked_ids = spans.to_h { |span| [span.id, true] }
+      markers.keys.filter_map do |marker_id|
+        next if marker_id == "0" || tracked_ids[marker_id]
+
+        VerificationFinding.new(
+          kind: "orphan_marker",
+          message: "`#{target_path}` contains marker `#{marker_id}` that is not tracked in `Prayfile.lock`. Remove the marker or run `pray install` to reconcile."
+        )
+      end
+    end
+
+    def marker_positions(lines)
+      markers = {}
+      active = nil
+      lines.each_with_index do |line, index|
+        parsed = parse_marker(line)
+        if parsed.nil?
+          active[2] << line if active
+          next
+        end
+        case parsed
+        when :ignore
+          next
+        else
+          identifier = parsed
+          if active.nil?
+            active = [identifier, index + 1, []]
+          elsif active[0] == identifier
+            checksum = Hashing.checksum_managed_body_line_refs(active[2])
+            markers[active[0]] = [active[1], index + 1, checksum]
+            active = nil
+          end
+        end
+      end
+      markers
+    end
+
+    def parse_marker(line)
+      trimmed = line.strip
+      remainder = trimmed.delete_prefix("<!--").strip
+      return nil unless remainder.start_with?("pray:")
+
+      content = remainder.delete_prefix("pray:").strip.delete_suffix("-->").strip
+      return :ignore if content == "0 ignore-comments"
+      return content if content.match?(/\A[a-z0-9]+\z/)
+
+      nil
+    end
+
+    def lockfile_targets(lockfile)
+      lockfile.target.flat_map(&:outputs)
+    end
+
+    def format_verification_report(report)
+      report.findings.map { |finding| "#{finding.kind}: #{finding.message}" }.join("\n")
+    end
+
+    def format_drift_report(report)
+      sections = {}
+      report.findings.each do |finding|
+        section = drift_section_for_kind(finding.kind)
+        sections[section] ||= []
+        sections[section] << finding
+      end
+
+      ordered = [
+        "Lockfile changes",
+        "Package changes",
+        "Managed span changes",
+        "Rendered file changes",
+        "Warnings"
+      ]
+      lines = []
+      ordered.each do |section|
+        findings = sections[section]
+        next unless findings
+
+        lines << section
+        findings.each do |finding|
+          lines << "  #{finding.kind}: #{finding.message}"
+        end
+      end
+      lines.join("\n")
+    end
+
+    def drift_section_for_kind(kind)
+      case kind
+      when "verify_error" then "Lockfile changes"
+      when "package_integrity" then "Package changes"
+      when "custom_implementation", "removed_prayer", "position_drift", "orphan_marker" then "Managed span changes"
+      when "renderer_drift" then "Rendered file changes"
+      else "Warnings"
+      end
+    end
+  end
+end

data/lib/pray/version.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+module Pray
+  VERSION = "1.6.0"
+  GENERATED_BY = "pray 1.6.0"
+end

data/lib/pray-cli.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+require_relative "pray"
+require_relative "pray/cli"

data/lib/pray.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "pray/version"
+require_relative "pray/error"
+require_relative "pray/literal"
+require_relative "pray/statement_surface"
+require_relative "pray/substitute"
+require_relative "pray/hashing"
+require_relative "pray/constraint"
+require_relative "pray/manifest_json"
+require_relative "pray/destination"
+require_relative "pray/manifest"
+require_relative "pray/format_serialize"
+require_relative "pray/format_manifest"
+require_relative "pray/package_spec"
+require_relative "pray/lockfile"
+require_relative "pray/config"
+require_relative "pray/dotenv"
+require_relative "pray/project_context"
+require_relative "pray/environment"
+require_relative "pray/resolve_context"
+require_relative "pray/invocation"
+require_relative "pray/resolve"
+require_relative "pray/render"
+require_relative "pray/verify"
+require_relative "pray/registry"
+require_relative "pray/archive"
+require_relative "pray/plan"
+require_relative "pray/git_sources"
+require_relative "pray/publish"
+require_relative "pray/serve"
+require_relative "pray/session"
+require_relative "pray/auth_client"
+require_relative "pray/confess"
+require_relative "pray/sync"
+require_relative "pray/trust"
+require_relative "pray/materialize"
+
+class << Pray
+  public :parse_manifest, :read_manifest_text, :format_package_declaration, :replace_package_declaration,
+    :parse_package_spec, :parse_lockfile, :read_lockfile, :serialize_lockfile, :lockfile_hash,
+    :write_lockfile, :write_lockfile_if_changed, :lockfiles_equivalent?, :build_lockfile,
+    :resolve_project, :render_project, :materialize_project,
+    :inspect_project, :verify_project, :drift_project,
+    :default_manifest_path, :default_lockfile_path, :project_root_from_manifest
+end

data/pray-cli.gemspec

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "lib/pray/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "pray-cli"
+  spec.version = Pray::VERSION
+  spec.authors = ["Andrei Makarov"]
+  spec.email = ["contact@kiskolabs.com"]
+
+  spec.summary = "Package manager for the language placed before inference (Prayfile)"
+  spec.description = "Ruby Prayfile CLI and library: resolve, lock, render, verify, and publish inference input packages. Consumes path, git, and registry distribution points."
+  spec.homepage = "https://pray.kisko.dev"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 3.1.0"
+
+  spec.files = Dir.chdir(File.expand_path(__dir__)) do
+    Dir[
+      "lib/**/*",
+      "bin/**/*",
+      "README.md",
+      "LICENSE*",
+      "CHANGELOG.md",
+      "SECURITY.md",
+      "pray-cli.gemspec"
+    ].select { |path| File.file?(path) }
+  end
+
+  spec.bindir = "bin"
+  spec.executables = ["pray"]
+  spec.require_paths = ["lib"]
+
+  spec.metadata = {
+    "homepage_uri" => spec.homepage,
+    "source_code_uri" => "https://github.com/kiskolabs/pray/tree/main/rubygems/pray-cli",
+    "changelog_uri" => "https://github.com/kiskolabs/pray/blob/main/rubygems/pray-cli/CHANGELOG.md",
+    "bug_tracker_uri" => "https://github.com/kiskolabs/pray/issues",
+    "documentation_uri" => "https://github.com/kiskolabs/pray/tree/main/rubygems/pray-cli",
+    "rubygems_mfa_required" => "true"
+  }
+
+  spec.add_dependency "toml-rb", "~> 4.0"
+  spec.add_dependency "base64", "~> 0.2"
+
+  spec.add_development_dependency "rspec", "~> 3.13"
+  spec.add_development_dependency "polyrun", "~> 2.2"
+  spec.add_development_dependency "rbs", "~> 3.9"
+end