@bnbagent/deploy-provider-bnb 0.3.0

package/src/extras.ts

@@ -0,0 +1,150 @@
+/**
+ * bnb-ONLY CLI extras (deliberately NOT on the CloudProvider contract — they
+ * would leak platform concepts into core), mirroring how `cognito` is the aws
+ * extra:
+ *
+ *   clients — the A2A/MCP buyer token plane (client-integration.md §5b):
+ *             mint / list / revoke per-agent OAuth2 invoke clients.
+ *   token   — platform API tokens (bnbk_…) for CI/automation: mint / list /
+ *             revoke; consumed via BNBAGENT_API_TOKEN. Account-level: needs no
+ *             project spec (spec is undefined outside a project).
+ *
+ * Output contract: with --json the platform's response object is printed to
+ * stdout VERBATIM (machine channel — orchestrators must not scrape human
+ * text); human summaries go to the logger (stderr) otherwise.
+ *
+ * ★ Minted secrets (client_secret / bnbk_ token) are shown ONCE by the
+ *   platform and printed ONCE here on the user's explicit request — never
+ *   stored, never logged elsewhere.
+ */
+import type { Context, DeploymentSpec } from "@bnbagent/deploy-core";
+import { authedRequest } from "./client.ts";
+import type { ApiTokenCreated, ApiTokenList, InvokeClientCreated, InvokeClientList, TrialStatus } from "./api-types.ts";
+
+const wantsJson = (ctx: Context): boolean => Boolean((ctx.flags as Record<string, unknown>).json);
+const emit = (data: unknown): void => {
+  process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+};
+
+/**
+ * `bnbagent-deploy trial [--json]` — the structured trial-clock read
+ * (GET /v1/account/trial: case/started_at/expires_at/remaining_seconds).
+ * Account-level: works in any directory. Orchestrators gate deploy offers on it.
+ */
+export async function trialCmd(_spec: DeploymentSpec | undefined, ctx: Context): Promise<void> {
+  const trial: TrialStatus = await authedRequest(ctx, "GET", "/v1/account/trial");
+  if (wantsJson(ctx)) {
+    emit(trial);
+    return;
+  }
+  const detail =
+    trial.case === "active"
+      ? ` — expires ${trial.expires_at} (${Math.max(0, Math.round((trial.remaining_seconds ?? 0) / 3600))}h left)`
+      : "";
+  ctx.logger.info(`Trial: ${trial.case}${detail}`);
+}
+
+/** `bnbagent-deploy clients [--new [--label x] | --revoke <id>] [--json]` (default: list). */
+export async function clientsCmd(spec: DeploymentSpec | undefined, ctx: Context): Promise<void> {
+  if (!spec) throw new Error("clients needs the agent's spec (run inside a project with agent-deploy.toml).");
+  const flags = ctx.flags as Record<string, unknown>;
+  const json = wantsJson(ctx);
+  const slug = encodeURIComponent(spec.name);
+
+  if (flags.new) {
+    const label = typeof flags.label === "string" && flags.label ? { label: flags.label } : {};
+    const created: InvokeClientCreated = await authedRequest(
+      ctx,
+      "POST",
+      `/v1/agents/${slug}/invoke-clients`,
+      { json: label },
+    );
+    if (json) {
+      emit(created); // verbatim platform response — the ONE structured chance to capture the secret
+    } else {
+      ctx.logger.success(`Invoke client minted for '${spec.name}'. Hand these to the buyer:`);
+      process.stdout.write(
+        [
+          `client_id:     ${created.client_id}`,
+          `client_secret: ${created.client_secret}`,
+          `token_url:     ${created.token_url}`,
+          `scope:         ${created.scope}`,
+          "",
+        ].join("\n"),
+      );
+      ctx.logger.info(
+        "Buyer flow: POST token_url (grant_type=client_credentials) → Bearer token → call the A2A/MCP endpoint.",
+      );
+    }
+    ctx.logger.warn("The client_secret is shown ONCE — store it now; it cannot be retrieved again.");
+    return;
+  }
+
+  if (typeof flags.revoke === "string" && flags.revoke) {
+    await authedRequest(ctx, "DELETE", `/v1/invoke-clients/${encodeURIComponent(flags.revoke)}`);
+    if (json) emit({ revoked: true, id: flags.revoke });
+    else ctx.logger.success(`Revoked invoke client ${flags.revoke}.`);
+    return;
+  }
+
+  const list: InvokeClientList = await authedRequest(ctx, "GET", `/v1/agents/${slug}/invoke-clients`);
+  if (json) {
+    emit(list);
+    return;
+  }
+  if (!list.clients.length) {
+    ctx.logger.info(`No invoke clients for '${spec.name}' yet — mint one: bnbagent-deploy clients --new`);
+    return;
+  }
+  for (const c of list.clients) {
+    const state = c.revokedAt ? "revoked" : "active";
+    ctx.logger.info(`${c.clientId}  ${state}  ${c.label ?? ""}  (id ${c.id}, created ${c.createdAt})`);
+  }
+  ctx.logger.info("Revoke one: bnbagent-deploy clients --revoke <id>");
+}
+
+/**
+ * `bnbagent-deploy token [--new | --revoke <id>] [--json]` (default: list).
+ * Account-level — usable in ANY directory (`--provider bnb` + BNBAGENT_API_URL
+ * outside a project); the spec, when present, only supplies [bnb] apiUrl.
+ */
+export async function tokenCmd(_spec: DeploymentSpec | undefined, ctx: Context): Promise<void> {
+  const flags = ctx.flags as Record<string, unknown>;
+  const json = wantsJson(ctx);
+
+  if (flags.new) {
+    const created: ApiTokenCreated = await authedRequest(ctx, "POST", "/v1/tokens", { json: {} });
+    if (json) {
+      emit(created); // verbatim — the ONE structured chance to capture the token
+    } else {
+      ctx.logger.success("Platform API token minted (tenant scope). For CI/automation:");
+      process.stdout.write(`${created.token}\n`);
+      ctx.logger.info("Use it via the BNBAGENT_API_TOKEN env var (replaces the interactive session).");
+    }
+    ctx.logger.warn("The token is shown ONCE — store it now (e.g. a CI secret).");
+    return;
+  }
+
+  if (typeof flags.revoke === "string" && flags.revoke) {
+    await authedRequest(ctx, "DELETE", `/v1/tokens/${encodeURIComponent(flags.revoke)}`);
+    if (json) emit({ revoked: true, id: flags.revoke });
+    else ctx.logger.success(`Revoked API token ${flags.revoke}.`);
+    return;
+  }
+
+  const list: ApiTokenList = await authedRequest(ctx, "GET", "/v1/tokens");
+  if (json) {
+    emit(list);
+    return;
+  }
+  if (!list.tokens.length) {
+    ctx.logger.info("No API tokens yet — mint one: bnbagent-deploy token --new");
+    return;
+  }
+  for (const t of list.tokens) {
+    ctx.logger.info(
+      `${t.prefix ?? "bnbk_…"}  ${t.scope ?? "tenant"}  expires ${t.expires_at ?? "never"}  (id ${t.id})`,
+    );
+  }
+  ctx.logger.info("Revoke one: bnbagent-deploy token --revoke <id>");
+}

package/src/image.ts

@@ -0,0 +1,222 @@
+/**
+ * Ship a CONTAINER-IMAGE artifact to the trial platform (client-integration.md
+ * §3b): the platform brokers a private repo + a short-lived push credential;
+ * WE drive the local Docker CLI — build (single manifest, the platform's
+ * advertised arch), stdin-only login, push with bounded retries (a re-login
+ * between attempts refreshes the short-lived token), then complete the
+ * artifact against the resolved content digest.
+ *
+ * Docker mechanics (probe, cross-build preflight, transient-retry build,
+ * constrained-network knobs) are the shared core helpers (`docker.ts`).
+ * ★ The registry password is passed ONLY via stdin — never argv, never logged.
+ */
+import { existsSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import type { Context, DeploymentSpec } from "@bnbagent/deploy-core";
+import {
+  assertCrossBuildCapable,
+  constrainedNetworkArgs,
+  dockerBuildWithRetry,
+  ensureDocker,
+  runDocker,
+} from "@bnbagent/deploy-core";
+import { authedRequest } from "./client.ts";
+import type { ImageArtifactCreated } from "./api-types.ts";
+
+/** Platform/AgentCore hard cap — fail before a doomed multi-minute push (also checked server-side). */
+const IMAGE_LIMIT_BYTES = 2 * 1024 * 1024 * 1024;
+const PUSH_MAX_ATTEMPTS = 3;
+
+export class TrialImageError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "TrialImageError";
+  }
+}
+
+export interface ShippedImage {
+  artifactId: string;
+  /** The pushed content digest — the deploy idempotency key's content half. */
+  digest: string;
+  /** Full pushed reference (`<repository>@sha256:…`) for record.imageUri. */
+  imageUri: string;
+}
+
+/** Build/retag, push to the brokered repo, and return the verified artifact id + digest. */
+export async function shipImageArtifact(spec: DeploymentSpec, ctx: Context): Promise<ShippedImage> {
+  await ensureDockerWrapped();
+
+  // Resolve all local inputs BEFORE minting the artifact — its push credential
+  // is short-lived, so don't burn its window on local misconfiguration.
+  let dockerfile: string | undefined;
+  let contextPath: string | undefined;
+  if (spec.type === "container") {
+    contextPath = resolve(ctx.baseDir, spec.path ?? ".");
+    dockerfile = resolveDockerfile(spec, ctx, contextPath);
+  } else if (!spec.image) {
+    throw new TrialImageError('type = "image" but deploy.image is empty.');
+  }
+
+  ctx.logger.step("Requesting a brokered image repository from the platform…");
+  const art: ImageArtifactCreated = await authedRequest(ctx, "POST", "/v1/artifacts/image", { json: {} });
+  if (spec.platform && spec.platform !== art.platform) {
+    throw new TrialImageError(
+      `The trial platform runs ${art.platform} images (got platform = "${spec.platform}"). ` +
+        `Remove the platform field or set it to ${art.platform}.`,
+    );
+  }
+  const tag = `${art.repository}:${art.artifactId.toLowerCase()}`;
+
+  if (spec.type === "container") {
+    // HARD preflight before the multi-minute build: an incapable host fails
+    // now, actionably — not late with 'exec format error'.
+    try {
+      await assertCrossBuildCapable(art.platform, ctx);
+    } catch (e) {
+      throw new TrialImageError(
+        `${(e as Error).message}\n  (The trial platform's runtime is ${art.platform}; an arm64 host — e.g. Apple Silicon — needs no emulation.)`,
+      );
+    }
+    ctx.logger.step(`Building ${tag} (${art.platform})…`);
+    // --provenance/--sbom off → a single manifest, not an OCI attestation index
+    // (the runtime rejects a multi-manifest index).
+    const buildArgs = [
+      "build", "--platform", art.platform, "--provenance=false", "--sbom=false",
+      ...constrainedNetworkArgs(),
+      "-t", tag, "-f", dockerfile!, contextPath!,
+    ];
+    try {
+      await dockerBuildWithRetry(buildArgs, ctx);
+    } catch (e) {
+      throw new TrialImageError((e as Error).message);
+    }
+  } else {
+    await ensureLocalImage(spec.image!, ctx);
+    ctx.logger.info(`Using prebuilt image ${spec.image} — make sure it is ${art.platform}, single manifest.`);
+    await docker(["tag", spec.image!, tag], ctx);
+  }
+
+  const size = await imageSize(tag, ctx);
+  if (size > IMAGE_LIMIT_BYTES) {
+    throw new TrialImageError(
+      `The image is ${(size / 1024 / 1024 / 1024).toFixed(1)}GB — the trial platform caps images at 2GB.`,
+    );
+  }
+
+  await registryLogin(art, ctx);
+  ctx.logger.info(`Pushing ${tag}…`);
+  for (let attempt = 1; ; attempt++) {
+    try {
+      await docker(["push", tag], ctx);
+      break;
+    } catch (e) {
+      if (attempt >= PUSH_MAX_ATTEMPTS) throw e;
+      ctx.logger.warn(
+        `Push failed (attempt ${attempt}/${PUSH_MAX_ATTEMPTS}) — re-logging in and retrying ` +
+          `(the brokered token is short-lived; transient registry/network errors are common on multi-layer pushes).`,
+      );
+      await Bun.sleep(attempt * 5000);
+      await registryLogin(art, ctx);
+    }
+  }
+
+  const digest = await repoDigest(tag, art.repository, ctx);
+  ctx.logger.info(`Pushed ${art.repository}@${digest.slice(0, 19)}… — completing the artifact…`);
+  await authedRequest(ctx, "POST", `/v1/artifacts/${art.artifactId}/complete`, { json: { digest } });
+  ctx.logger.debug(`[bnb] image artifact ${art.artifactId} verified (${digest.slice(0, 19)}…)`);
+  return { artifactId: art.artifactId, digest, imageUri: `${art.repository}@${digest}` };
+}
+
+/** stdin-only login to the brokered registry (the password never touches argv/logs). */
+async function registryLogin(art: ImageArtifactCreated, ctx: Context): Promise<void> {
+  ctx.logger.debug(`[bnb] docker login → ${art.registry}`);
+  await docker(["login", "--username", art.username, "--password-stdin", art.registry], ctx, {
+    stdin: art.password,
+    quiet: true,
+  });
+}
+
+/** The pushed digest for OUR repo — never blindly RepoDigests[0] (other repos may be listed). */
+async function repoDigest(tag: string, repository: string, ctx: Context): Promise<string> {
+  const out = await docker(["inspect", "--format", "{{json .RepoDigests}}", tag], ctx, { quiet: true });
+  let digests: string[] = [];
+  try {
+    digests = JSON.parse(out.trim()) as string[];
+  } catch {
+    /* fall through to the error below */
+  }
+  const match = digests.find((d) => d.startsWith(`${repository}@`));
+  if (!match) {
+    throw new TrialImageError(
+      `Pushed, but could not resolve the content digest for ${repository} ` +
+        `(RepoDigests: ${digests.join(", ") || "none"}).`,
+    );
+  }
+  return match.slice(repository.length + 1); // "sha256:…"
+}
+
+async function imageSize(tag: string, ctx: Context): Promise<number> {
+  const out = await docker(["inspect", "--format", "{{.Size}}", tag], ctx, { quiet: true });
+  return Number(out.trim()) || 0;
+}
+
+/** For type = "image": the ref must resolve locally (pull it if it doesn't). */
+async function ensureLocalImage(ref: string, ctx: Context): Promise<void> {
+  try {
+    await docker(["image", "inspect", ref], ctx, { quiet: true });
+  } catch {
+    ctx.logger.info(`Image ${ref} not found locally — pulling…`);
+    try {
+      await docker(["pull", ref], ctx);
+    } catch (e) {
+      throw new TrialImageError(
+        `deploy.image "${ref}" is neither available locally nor pullable: ${(e as Error).message}`,
+      );
+    }
+  }
+}
+
+/**
+ * Resolve which Dockerfile to use — the SAME rules as the aws provider, and
+ * the same red line: this tool never GENERATES a Dockerfile.
+ */
+function resolveDockerfile(spec: DeploymentSpec, ctx: Context, contextPath: string): string {
+  if (spec.dockerfile) {
+    const p = isAbsolute(spec.dockerfile) ? spec.dockerfile : resolve(ctx.baseDir, spec.dockerfile);
+    if (!existsSync(p)) {
+      throw new TrialImageError(`deploy.dockerfile not found: ${p}\n  \`deploy\` only deploys — create it, then re-run.`);
+    }
+    return p;
+  }
+  const existing = join(contextPath, "Dockerfile");
+  if (existsSync(existing)) return existing;
+  throw new TrialImageError(
+    `type = "container" needs a Dockerfile, but none was found in ${contextPath}.\n` +
+      "  • Add one (copy from the container-ts example to start), or set deploy.dockerfile, or\n" +
+      '  • use type = "zip" (managed runtime, no Docker).\n' +
+      "  The container contract matches AgentCore: HTTP :8080 /invocations · A2A :9000 · MCP :8000 /mcp.",
+  );
+}
+
+async function ensureDockerWrapped(): Promise<void> {
+  try {
+    await ensureDocker(
+      '  Options: switch to type = "zip" (managed runtime, no Docker), or start Docker and retry.',
+    );
+  } catch (e) {
+    throw new TrialImageError((e as Error).message);
+  }
+}
+
+/** Provider-flavored wrapper: core runDocker throwing Error → TrialImageError. */
+async function docker(
+  args: string[],
+  ctx: Context,
+  opts: { stdin?: string; quiet?: boolean } = {},
+): Promise<string> {
+  try {
+    return await runDocker(args, { ...opts, ctx });
+  } catch (e) {
+    throw new TrialImageError((e as Error).message);
+  }
+}