@alchemint/fuse-cli 0.0.0-stage → 0.1.0

package/src/core.mjs

@@ -0,0 +1,353 @@
+import { createHash, randomUUID } from 'node:crypto';
+import {
+  mkdir,
+  open,
+  readFile,
+  rename,
+  link,
+  unlink,
+  stat,
+  chmod,
+} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+
+export class CliError extends Error {
+  constructor(exit, code, message, detail = {}) {
+    super(message);
+    Object.assign(this, {
+      exit,
+      code,
+      kind:
+        ['usage', 'auth', 'rejected', 'unknown', 'timeout', 'job_failed'][
+          exit - 2
+        ] || 'error',
+      ...detail,
+    });
+  }
+}
+export const need = (value, name) => {
+  if (value === undefined || value === '')
+    throw new CliError(2, 'INPUT_REQUIRED', `Required: ${name}`);
+  return value;
+};
+export const id = (value, name) => encodeURIComponent(need(value, name));
+export function duration(value = '30m') {
+  const match = /^(\d+)(s|m|h)?$/.exec(String(value));
+  if (!match || Number(match[1]) === 0)
+    throw new CliError(
+      2,
+      'INVALID_TIMEOUT',
+      'Use a positive duration such as 30s, 30m, or 2h.',
+    );
+  return Number(match[1]) * { s: 1000, m: 60000, h: 3600000 }[match[2] || 's'];
+}
+export function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  if (value && typeof value === 'object')
+    return `{${Object.keys(value)
+      .sort()
+      .map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`)
+      .join(',')}}`;
+  return JSON.stringify(value);
+}
+export const digest = (value) =>
+  createHash('sha256')
+    .update(typeof value === 'string' ? value : canonical(value))
+    .digest('hex');
+export async function readJson(file) {
+  try {
+    return JSON.parse(await readFile(need(file, 'JSON file'), 'utf8'));
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw new CliError(2, 'INVALID_FILE', `Cannot read JSON file: ${file}`);
+  }
+}
+export async function exists(file) {
+  try {
+    await stat(file);
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') return false;
+    throw error;
+  }
+}
+export async function writeJson(file, data, exclusive = false) {
+  file = path.resolve(file);
+  await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+  const temp = `${file}.${randomUUID()}.tmp`;
+  const handle = await open(temp, 'wx', 0o600);
+  try {
+    await handle.writeFile(`${JSON.stringify(data, null, 2)}\n`);
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  try {
+    if (exclusive) {
+      await link(temp, file);
+      await unlink(temp);
+    } else await rename(temp, file);
+  } catch (error) {
+    await unlink(temp);
+    if (error.code === 'EEXIST')
+      throw new CliError(2, 'FILE_EXISTS', `File already exists: ${file}`);
+    throw error;
+  }
+  const directory = await open(path.dirname(file), 'r');
+  try {
+    await directory.sync();
+  } finally {
+    await directory.close();
+  }
+}
+export function cleanMessage(message) {
+  return String(message)
+    .replace(/Bearer\s+\S+/gi, 'Bearer [redacted]')
+    .replace(/https?:\/\/\S+/g, '[URL]')
+    .slice(0, 500);
+}
+export function errorData(error) {
+  return {
+    kind: error.kind || 'error',
+    code: error.code || 'LOCAL_ERROR',
+    message: cleanMessage(error.message),
+    http_status: error.http_status ?? null,
+    request_id: error.request_id ?? null,
+    ...(error.receipt ? { receipt: error.receipt } : {}),
+  };
+}
+export function project(data, fields) {
+  if (!fields) return data;
+  const keys = fields.split(',');
+  const one = (item) =>
+    Object.fromEntries(
+      keys.map((key) => [
+        key,
+        key.split('.').reduce((value, part) => value?.[part], item) ?? null,
+      ]),
+    );
+  return Array.isArray(data) ? data.map(one) : one(data);
+}
+export function apiBase(
+  input = process.env.FUSE_API_URL || 'https://fuse.alchemint.xyz/api',
+) {
+  const url = new URL(input);
+  if (
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash ||
+    !['', '/', '/api', '/api/'].includes(url.pathname) ||
+    (url.protocol !== 'https:' &&
+      !(
+        url.protocol === 'http:' &&
+        ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)
+      ))
+  ) {
+    throw new CliError(
+      2,
+      'INVALID_API_URL',
+      'Use the fixed HTTPS FUSE origin, or local HTTP localhost, with /api.',
+    );
+  }
+  return `${url.origin}/api`;
+}
+export const configRoot = () =>
+  process.env.FUSE_CONFIG_DIR || path.join(os.homedir(), '.config', 'fuse');
+export const authDirectory = (base) => path.join(configRoot(), digest(base));
+export async function loadCredential(base) {
+  if (process.env.FUSE_TOKEN) return process.env.FUSE_TOKEN;
+  const active = path.join(authDirectory(base), 'active.json');
+  if (!(await exists(active))) return null;
+  const selected = await readJson(active);
+  return (
+    await readJson(
+      path.join(
+        authDirectory(base),
+        `${id(selected.user_id, 'user_id')}-${id(selected.workspace_id, 'workspace_id')}.json`,
+      ),
+    )
+  ).access_token;
+}
+export async function saveCredential(base, token, account, expiresAt) {
+  const directory = authDirectory(base);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await chmod(directory, 0o700);
+  const subject = {
+    user_id: account.user.id,
+    workspace_id: account.workspace.id,
+  };
+  await writeJson(
+    path.join(directory, `${subject.user_id}-${subject.workspace_id}.json`),
+    { api_url: base, ...subject, access_token: token, expires_at: expiresAt },
+  );
+  await writeJson(path.join(directory, 'active.json'), subject);
+}
+export async function forgetCredential(base) {
+  const active = path.join(authDirectory(base), 'active.json');
+  if (!(await exists(active))) return;
+  const selected = await readJson(active);
+  await unlink(
+    path.join(
+      authDirectory(base),
+      `${id(selected.user_id, 'user_id')}-${id(selected.workspace_id, 'workspace_id')}.json`,
+    ),
+  );
+  await unlink(active);
+}
+export class Client {
+  constructor(base, token, signal) {
+    Object.assign(this, { base, token, signal });
+  }
+  async request(
+    method,
+    endpoint,
+    body,
+    { anonymous = false, headers = {}, timeout = 60000 } = {},
+  ) {
+    if (!anonymous && !this.token)
+      throw new CliError(
+        3,
+        'AUTH_REQUIRED',
+        'Run fuse auth login for this API origin.',
+      );
+    if (!endpoint.startsWith('/') || endpoint.startsWith('//'))
+      throw new CliError(2, 'INVALID_ENDPOINT', 'Expected a FUSE API path.');
+    let response;
+    try {
+      response = await fetch(`${this.base}${endpoint}`, {
+        method,
+        redirect: 'error',
+        headers: {
+          'Content-Type': 'application/json',
+          ...headers,
+          ...(!anonymous ? { Authorization: `Bearer ${this.token}` } : {}),
+        },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        signal: this.signal
+          ? AbortSignal.any([this.signal, AbortSignal.timeout(timeout)])
+          : AbortSignal.timeout(timeout),
+      });
+    } catch {
+      throw new CliError(
+        5,
+        'TRANSPORT_UNKNOWN',
+        method === 'GET'
+          ? 'Could not read FUSE. Retry this read when connected.'
+          : 'The acceptance result is unknown. Keep the intent; do not change its key or blindly repeat this mutation.',
+      );
+    }
+    const request_id = response.headers.get('x-request-id');
+    if (response.status === 204) return undefined;
+    let envelope;
+    try {
+      envelope = await response.json();
+    } catch {
+      throw new CliError(
+        5,
+        'RESPONSE_UNKNOWN',
+        'FUSE returned no readable API response.',
+        { http_status: response.status, request_id },
+      );
+    }
+    if (!response.ok || !envelope.success) {
+      const exit = response.status === 401 ? 3 : response.status >= 500 ? 5 : 4;
+      if (exit === 3) this.token = null;
+      throw new CliError(
+        exit,
+        envelope.error_code || 'API_ERROR',
+        typeof envelope.error === 'string'
+          ? envelope.error
+          : `FUSE HTTP ${response.status}`,
+        {
+          http_status: response.status,
+          request_id,
+          retry_after: Number(response.headers.get('retry-after')) || null,
+          // DEV-2096：Script 那一集正在由誰編輯。
+          ...(envelope.error_code === 'SCRIPT_EPISODE_LOCKED'
+            ? { episode_id: envelope.episode_id, holder: envelope.holder }
+            : {}),
+        },
+      );
+    }
+    return envelope.data;
+  }
+  get(endpoint) {
+    return this.request('GET', endpoint);
+  }
+  post(endpoint, body, options) {
+    return this.request('POST', endpoint, body, options);
+  }
+}
+export async function subject(client) {
+  const account = await client.get('/identity/me');
+  return {
+    api_url: client.base,
+    user_id: account.user.id,
+    workspace_id: account.workspace.id,
+  };
+}
+export function sameSubject(expected, actual) {
+  for (const key of ['api_url', 'user_id', 'workspace_id'])
+    if (expected[key] !== actual[key])
+      throw new CliError(
+        3,
+        'SUBJECT_MISMATCH',
+        'This plan or receipt belongs to another API origin or account/workspace.',
+      );
+}
+export async function pause(ms, signal) {
+  if (signal?.aborted)
+    throw new CliError(
+      6,
+      'INTERRUPTED',
+      'Stopped local work; accepted FUSE jobs continue.',
+    );
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {
+      signal?.removeEventListener('abort', abort);
+      resolve();
+    }, ms);
+    function abort() {
+      clearTimeout(timer);
+      reject(
+        new CliError(
+          6,
+          'INTERRUPTED',
+          'Stopped local work; accepted FUSE jobs continue.',
+        ),
+      );
+    }
+    signal?.addEventListener('abort', abort, { once: true });
+  });
+}
+export async function withWriter(directory, action) {
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  const file = path.join(directory, '.writer');
+  let handle;
+  try {
+    handle = await open(file, 'wx', 0o600);
+  } catch (error) {
+    if (error.code === 'EEXIST')
+      throw new CliError(
+        2,
+        'STATE_LOCKED',
+        `State has a writer lock: ${file}. After confirming the recorded process is gone, remove that lock explicitly.`,
+      );
+    throw error;
+  }
+  await handle.writeFile(
+    JSON.stringify({
+      pid: process.pid,
+      hostname: os.hostname(),
+      started_at: new Date().toISOString(),
+    }),
+  );
+  try {
+    return await action();
+  } finally {
+    await handle.close();
+    await unlink(file);
+  }
+}