@apex-actions/cli 0.68.0 → 0.69.0

package/dist/cli/logs/main.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { readLogs } from '../../src/application/read-logs.js';
+import { deleteLogs, readLogs } from '../../src/application/read-logs.js';
 import { readLogView } from '../../src/application/search-logs.js';
 import { HttpControlPlane, NotConfiguredError, RealSleeper } from '../../src/infrastructure/control-plane-http.js';
 import { authorityNote, totalsPhrase } from '../../src/domain/logsearch.js';
@@ -74,6 +74,10 @@ const handler = async (run, options) => {
             console.error(chalk.red(unknownRunMessage(outcome.selector)));
             process.exitCode = 2;
             return;
+        case 'deleted':
+            console.error(chalk.yellow(`this run’s logs were deleted${outcome.by === undefined ? '' : ` by ${outcome.by}`} on ${outcome.at}`));
+            process.exitCode = 1;
+            return;
         case 'unknown-job':
             console.error(chalk.red(`no job matches ${outcome.selector}`));
             console.error(chalk.dim(`jobs in this run: ${outcome.available.join(', ')}`));
@@ -114,6 +118,48 @@ const handler = async (run, options) => {
         }
     }
 };
+const deleteCommand = new Command('delete')
+    .description('Delete every job’s log for a finished run — for everyone, and not undoable')
+    .argument('<run>', 'run id, #number, or "latest" — required, never assumed')
+    .option('--repo <owner/repo>', 'limit the run search to one repository')
+    .action(async (run, options) => {
+    const repository = options.repo === undefined ? undefined : parseRepository(options.repo);
+    if (options.repo !== undefined && repository === undefined) {
+        console.error(chalk.red(`--repo must be owner/repo, got ${options.repo}`));
+        process.exitCode = 2;
+        return;
+    }
+    let api;
+    try {
+        api = new HttpControlPlane();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof NotConfiguredError ? err.message : String(err)));
+        process.exitCode = 2;
+        return;
+    }
+    const outcome = await deleteLogs(api, { run, repository });
+    switch (outcome.kind) {
+        case 'deleted':
+            console.log(`deleted the logs of run ${outcome.runId}`);
+            return;
+        case 'in-progress':
+            console.error(chalk.red(`run ${outcome.runId} has not finished; its logs can be deleted once it has`));
+            process.exitCode = 1;
+            return;
+        case 'no-runs':
+            console.error(chalk.yellow('no runs found'));
+            process.exitCode = 2;
+            return;
+        case 'unknown-run':
+            console.error(chalk.red(unknownRunMessage(outcome.selector)));
+            process.exitCode = 2;
+            return;
+        case 'refused':
+            console.error(chalk.red(outcome.detail));
+            process.exitCode = 1;
+    }
+});
 export default new Command('logs')
     .description('Stream or fetch logs for a run or job')
     .argument('[run]', 'run id, #number, or "latest"', 'latest')
@@ -122,4 +168,5 @@ export default new Command('logs')
     .option('--follow', 'keep reading until the run completes')
     .option('--summary', 'print what the log says about the tests it ran, instead of the log')
     .option('--json', 'print the run and its logs as JSON')
-    .action(handler);
+    .action(handler)
+    .addCommand(deleteCommand);

package/dist/cli/main.js

@@ -24,6 +24,7 @@ import Schedule from './schedule/main.js';
 import Oidc from './oidc/main.js';
 import Actions from './actions/main.js';
 import Terms from './terms/main.js';
+import Tenant from './tenant/main.js';
 import Notify from './notify/main.js';
 import Lsp from './lsp/main.js';
 import Login from './login/main.js';
@@ -78,6 +79,7 @@ const program = new Command()
     .addCommand(Oidc)
     .addCommand(Actions)
     .addCommand(Terms)
+    .addCommand(Tenant)
     .addCommand(Notify)
     .addCommand(Login)
     .addCommand(Logout)

package/dist/cli/tenant/main.js

@@ -0,0 +1,81 @@
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { listDepartures, purgeDeparture } from '../../src/application/manage-departures.js';
+import { HttpControlPlane, NotConfiguredError } from '../../src/infrastructure/control-plane-http.js';
+import { countsLine, departureLine } from '../../src/domain/departures.js';
+/** Build the API client, or explain what is missing and stop. */
+const api = () => {
+    try {
+        return new HttpControlPlane();
+    }
+    catch (err) {
+        console.error(chalk.red(err instanceof NotConfiguredError ? err.message : String(err)));
+        process.exitCode = 2;
+        return undefined;
+    }
+};
+const departuresCommand = new Command('departures')
+    .description('Every tenant that uninstalled, newest first, and when its data is deleted (control-plane ADR-0069)')
+    .option('--json', 'machine-readable output')
+    .action(async (opts) => {
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await listDepartures(client);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    if (opts.json === true) {
+        console.log(JSON.stringify(outcome.value, null, 2));
+        return;
+    }
+    if (outcome.value.length === 0) {
+        console.log(chalk.green('no tenant has left'));
+        return;
+    }
+    for (const d of outcome.value)
+        console.log(`  ${departureLine(d)}`);
+});
+const purgeCommand = new Command('purge')
+    .description("Delete one departed tenant's data now, whatever its window — a dry run unless --apply")
+    .argument('<installationId>', 'the installation that left')
+    .option('--apply', 'delete it (default: report what would be deleted)')
+    .option('--json', 'machine-readable output')
+    .action(async (raw, opts) => {
+    const installationId = Number(raw);
+    if (!Number.isSafeInteger(installationId) || installationId <= 0) {
+        console.error(chalk.red(`expected a positive installation id, got ${JSON.stringify(raw)}`));
+        process.exitCode = 2;
+        return;
+    }
+    const client = api();
+    if (!client)
+        return;
+    const outcome = await purgeDeparture(client, installationId, opts.apply === true);
+    if (outcome.kind === 'refused') {
+        console.error(chalk.red(outcome.message));
+        process.exitCode = 1;
+        return;
+    }
+    const report = outcome.value;
+    if (opts.json === true) {
+        console.log(JSON.stringify(report, null, 2));
+        return;
+    }
+    console.log(departureLine(report.departure));
+    if (report.applied && report.counts !== null) {
+        console.log(`${chalk.green('✔')} purged: ${countsLine(report.counts)}`);
+        return;
+    }
+    if (report.departure.purgedAt !== null) {
+        console.log(chalk.dim(`already purged${report.counts === null ? '' : `: ${countsLine(report.counts)}`}`));
+        return;
+    }
+    console.log(chalk.yellow(`${report.repositories.length} repositor${report.repositories.length === 1 ? 'y' : 'ies'} and everything under ${report.repositories.length === 1 ? 'it' : 'them'} would be deleted, with the installation's deliveries and organisation secrets. Re-run with --apply.`));
+});
+export default new Command('tenant')
+    .description("Departed tenants: who left, when their data is deleted, and deleting it now on request")
+    .addCommand(departuresCommand)
+    .addCommand(purgeCommand);

package/dist/src/application/manage-departures.js

@@ -0,0 +1,18 @@
+const attempt = async (fn) => {
+    try {
+        return { kind: 'ok', value: await fn() };
+    }
+    catch (err) {
+        return { kind: 'refused', message: err instanceof Error ? err.message : String(err) };
+    }
+};
+/** Every departed tenant, newest first, and the clock on its data. */
+export const listDepartures = async (api) => await attempt(() => api.departures());
+/**
+ * Purge one departed tenant's data now, whatever its window — a dry run unless
+ * `apply`. The control plane decides everything: that the tenant left, that its
+ * account did not come back, what it held. The machine token is the only
+ * caller it accepts, because the tenant has gone and no GitHub authority is
+ * left to ask.
+ */
+export const purgeDeparture = async (api, installationId, apply) => await attempt(() => api.purgeDeparture(installationId, apply));

package/dist/src/application/read-logs.js

@@ -26,6 +26,11 @@ export const readLogs = async (api, sleeper, request) => {
             break;
         detail = fresh;
     }
+    // Deleted is a fact about the run, said once — not an error per job, and
+    // not an empty log, which would read as a job that printed nothing.
+    if (detail.run.logsDeletedAt !== undefined) {
+        return { kind: 'deleted', run: detail.run, at: detail.run.logsDeletedAt, by: detail.run.logsDeletedBy };
+    }
     const jobs = selectJobs(detail.jobs, request.job);
     const sections = [];
     for (const job of jobs)
@@ -38,3 +43,24 @@ export const readLogs = async (api, sleeper, request) => {
         exitCode: isLive(detail.run.status) ? 0 : detail.run.conclusion === 'success' ? 0 : 1,
     };
 };
+/**
+ * Delete every job's log for one finished run (DPA §3.5, TASK-0174).
+ *
+ * The run is resolved the way `apex logs` resolves it, but there is no
+ * default: `latest` has to be typed, because the run it names changes under
+ * the person between reading it and deleting it.
+ */
+export const deleteLogs = async (api, request) => {
+    try {
+        const resolved = await resolveRunId(api, request);
+        if (resolved.kind !== 'run')
+            return resolved;
+        const outcome = await api.deleteRunLogs(resolved.id);
+        if (outcome === 'not-found')
+            return { kind: 'unknown-run', selector: request.run };
+        return { kind: outcome, runId: resolved.id };
+    }
+    catch (err) {
+        return { kind: 'refused', detail: err instanceof Error ? err.message : String(err) };
+    }
+};

package/dist/src/domain/departures.js

@@ -0,0 +1,30 @@
+// domain layer — see ../../../../docs/conventions.md §1
+/**
+ * Where a departure stands, in the words an operator answering a deletion
+ * request needs: gone, kept because the account came back, or still waiting —
+ * and until when.
+ */
+export const departureState = (d) => {
+    if (d.purgedAt !== null)
+        return `purged ${d.purgedAt}`;
+    if (d.withdrawnAt !== null)
+        return `kept — the account reinstalled ${d.withdrawnAt}`;
+    return `due ${d.purgeAfter}`;
+};
+export const departureLine = (d) => `${d.owner} (installation ${d.installationId}) — left ${d.departedAt} by ${d.reason}; ${departureState(d)}`;
+/** The counts as one line, naming only what was there. */
+export const countsLine = (c) => {
+    const parts = [
+        [c.repositories, 'repository', 'repositories'],
+        [c.runs, 'run', 'runs'],
+        [c.jobs, 'job', 'jobs'],
+        [c.artifacts, 'artifact', 'artifacts'],
+        [c.cacheEntries, 'cache entry', 'cache entries'],
+        [c.deliveries, 'delivery', 'deliveries'],
+        [c.secrets, 'secret', 'secrets'],
+        [c.variables, 'variable', 'variables'],
+        [c.objects, 'stored object', 'stored objects'],
+    ];
+    const named = parts.filter(([n]) => n > 0).map(([n, one, many]) => `${n} ${n === 1 ? one : many}`);
+    return named.length === 0 ? 'nothing was held' : named.join(', ');
+};

package/dist/src/infrastructure/control-plane-http.js

@@ -199,6 +199,12 @@ export class HttpControlPlane {
         const body = await this.#json('POST', '/api/v1/terms/acceptance', { installationId, termsVersion: version });
         return body.accepted;
     }
+    async departures() {
+        return (await this.#json('GET', '/api/v1/admin/departures')).departures;
+    }
+    async purgeDeparture(installationId, apply) {
+        return await this.#json('POST', `/api/v1/departures/${installationId}/purge${apply ? '?apply=true' : ''}`);
+    }
     async actionPolicy(owner) {
         return await this.#json('GET', `/api/v1/orgs/${encodeURIComponent(owner)}/action-policy`);
     }
@@ -258,6 +264,16 @@ export class HttpControlPlane {
             throw new Error(await this.#errorMessage(response));
         return await response.text();
     }
+    async deleteRunLogs(runId) {
+        const response = await this.#request('DELETE', `/api/v1/runs/${encodeURIComponent(runId)}/logs`);
+        if (response.status === 404)
+            return 'not-found';
+        if (response.status === 409)
+            return 'in-progress';
+        if (!response.ok)
+            throw new Error(await this.#errorMessage(response));
+        return 'deleted';
+    }
     async dispatch(owner, repo, workflow, ref, inputs) {
         return await this.#json('POST', `/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/workflows/${encodeURIComponent(workflow)}/dispatches`, { ref, inputs });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apex-actions/cli",
-  "version": "0.68.0",
+  "version": "0.69.0",
   "license": "SEE LICENSE IN LICENSE",
   "//files": "Without this npm ships src, test and the CI config alongside the binary a user installs.",
   "files": [