@cef-ai/cli 0.2.1

package/dist/lib/api.js

@@ -0,0 +1,330 @@
+import crypto from 'crypto';
+// ROB error message fragments (for consistent handling and easier maintenance)
+const ROB_HTTP_FORBIDDEN = '403';
+const ROB_MSG_FORBIDDEN = 'Forbidden';
+const ROB_HTTP_CONFLICT = '409';
+const ROB_MSG_ALREADY_EXISTS = 'already exists';
+async function fetchJson(url, init) {
+    let res;
+    try {
+        res = await fetch(url, {
+            ...init,
+            signal: AbortSignal.timeout(30_000),
+        });
+    }
+    catch (err) {
+        const cause = err?.cause?.message ?? err?.cause ?? err?.message ?? String(err);
+        throw new Error(`Network error calling ${url}: ${cause}`);
+    }
+    if (!res.ok) {
+        const body = await res.text();
+        throw new Error(`HTTP ${res.status} ${res.statusText} (${url}): ${body}`);
+    }
+    const text = await res.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid JSON from ${url}: ${msg}`);
+    }
+}
+async function request(url, init) {
+    return fetchJson(url, init);
+}
+async function requestAs(url, init) {
+    return fetchJson(url, init);
+}
+export function createApiClient(env, asPubKey, agentServiceId) {
+    const base = `${env.orchestratorUrl}/api/v1/agent-services/${asPubKey}`;
+    const headers = {
+        'Content-Type': 'application/json',
+        Authorization: `Bearer ${env.authToken}`,
+    };
+    function post(url, body) {
+        return request(url, { method: 'POST', headers, body: JSON.stringify(body) });
+    }
+    function put(url, body) {
+        return request(url, { method: 'PUT', headers, body: JSON.stringify(body) });
+    }
+    function get(url) {
+        return requestAs(url, { method: 'GET', headers });
+    }
+    function del(url) {
+        return request(url, { method: 'DELETE', headers });
+    }
+    let cachedServiceId = undefined;
+    const fallbackServiceId = agentServiceId;
+    function getRobHeaders() {
+        let robOrigin = env.robOrigin;
+        if (!robOrigin) {
+            const match = env.robApiUrl.match(/api\.rob\.(\w+)\.cere\.io/);
+            if (match)
+                robOrigin = `https://rob.${match[1]}.cere.io`;
+        }
+        return { ...headers, ...(robOrigin && { Origin: robOrigin, Referer: `${robOrigin}/` }) };
+    }
+    async function requireServiceId() {
+        if (cachedServiceId)
+            return cachedServiceId;
+        if (!env.robApiUrl)
+            throw new Error('CEF_ROB_API_URL is required for this operation');
+        try {
+            const services = await listAgentServices(env.robApiUrl, env.authToken);
+            const match = services.find(s => s.publicKey === asPubKey);
+            if (!match) {
+                throw new Error(`No agent service found with publicKey ${asPubKey}. ` +
+                    `Run \`npx tsx src/cli.ts services\` to see available services.`);
+            }
+            cachedServiceId = match.id;
+            return cachedServiceId;
+        }
+        catch (err) {
+            if (fallbackServiceId) {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.warn(`[ROB] Could not list data services (${msg}). Using agentServiceId from config: ${fallbackServiceId}`);
+                cachedServiceId = fallbackServiceId;
+                return fallbackServiceId;
+            }
+            throw err;
+        }
+    }
+    return {
+        getResolvedAgentServiceId() {
+            return cachedServiceId;
+        },
+        // ─── Engagement ───────────────────────────────────────────────────────
+        createEngagement(payload) {
+            return post(`${base}/engagements`, payload);
+        },
+        updateEngagement(engagementId, payload) {
+            return put(`${base}/engagements/${engagementId}`, payload);
+        },
+        // ─── Agent ───────────────────────────────────────────────────────────
+        createAgent(payload) {
+            return post(`${base}/agents`, payload);
+        },
+        updateAgent(agentId, payload) {
+            return put(`${base}/agents/${agentId}`, payload);
+        },
+        // ─── Workspace ────────────────────────────────────────────────────────
+        async createWorkspaceOnRob(name) {
+            const svcId = await requireServiceId();
+            const url = `${env.robApiUrl.replace(/\/$/, '')}/data-services/${svcId}/organizations`;
+            const res = await request(url, {
+                method: 'POST',
+                headers: getRobHeaders(),
+                body: JSON.stringify({ name }),
+            });
+            const data = (res.data ?? res);
+            const id = String(data.id ?? '');
+            if (!id)
+                throw new Error(`ROB workspace created but no ID in response: ${JSON.stringify(res)}`);
+            return id;
+        },
+        createWorkspace(payload) {
+            return post(`${base}/workspaces`, payload);
+        },
+        updateWorkspace(workspaceId, payload) {
+            return put(`${base}/workspaces/${workspaceId}`, payload);
+        },
+        getWorkspaces() {
+            return get(`${base}/workspaces`);
+        },
+        // ─── Stream ───────────────────────────────────────────────────────────
+        createStream(workspaceId, payload) {
+            return post(`${base}/workspaces/${workspaceId}/streams`, payload);
+        },
+        updateStream(streamId, payload) {
+            return put(`${base}/streams/${streamId}`, payload);
+        },
+        // ─── Deployment ───────────────────────────────────────────────────────
+        createDeployment(streamId, payload) {
+            return post(`${base}/streams/${streamId}/deployments`, payload);
+        },
+        updateDeployment(deploymentId, payload) {
+            return put(`${base}/deployments/${deploymentId}`, payload);
+        },
+        // ─── Cubby ────────────────────────────────────────────────────────────
+        async createCubby(payload) {
+            return post(`${base}/cubbies`, payload);
+        },
+        async updateCubby(cubbyId, payload) {
+            return put(`${base}/cubbies/${cubbyId}`, payload);
+        },
+        // ─── Status (read) ────────────────────────────────────────────────────
+        getAgents() {
+            return get(`${base}/agents`);
+        },
+        getEngagements() {
+            return get(`${base}/engagements`);
+        },
+        // ─── Ontology (full workspace/stream/deployment tree) ──────────────────
+        getOntology() {
+            return requestAs(`${base}/ontology`, { method: 'GET', headers });
+        },
+        // ─── Cubbies (read) ─────────────────────────────────────────────────
+        async getCubbies() {
+            const res = await get(`${base}/cubbies`);
+            return res.data;
+        },
+        async getCubbyInstances(cubbyId) {
+            const res = await requestAs(`${base}/cubbies/${cubbyId}/instances`, { method: 'GET', headers });
+            return Array.isArray(res) ? res : (res.data ?? []);
+        },
+        async getCubbyStats(cubbyId) {
+            return requestAs(`${base}/cubbies/${cubbyId}/stats`, { method: 'GET', headers });
+        },
+        // ─── Delete ─────────────────────────────────────────────────────────
+        deleteEngagement(engagementId) {
+            return del(`${base}/engagements/${engagementId}`);
+        },
+        deleteAgent(agentId) {
+            return del(`${base}/agents/${agentId}`);
+        },
+        deleteWorkspace(workspaceId) {
+            return del(`${base}/workspaces/${workspaceId}`);
+        },
+        deleteStream(streamId) {
+            return del(`${base}/streams/${streamId}`);
+        },
+        deleteDeployment(deploymentId) {
+            return del(`${base}/deployments/${deploymentId}`);
+        },
+        // ─── Raft ─────────────────────────────────────────────────────────────
+        createRaft(streamId, payload) {
+            return post(`${base}/streams/${streamId}/rafts`, payload);
+        },
+        updateRaft(raftId, payload) {
+            return put(`${base}/rafts/${raftId}`, payload);
+        },
+        deleteRaft(raftId) {
+            return del(`${base}/rafts/${raftId}`);
+        },
+        // Shared ROB (RMS) sync: register or update raft. Best-effort: warns on failure.
+        async syncRaftToRob(payload, method) {
+            if (!env.robApiUrl)
+                return;
+            const action = method === 'POST' ? 'registration' : 'update';
+            try {
+                const svcId = await requireServiceId();
+                const base = `${env.robApiUrl.replace(/\/$/, '')}/rms-node-backend/rafts`;
+                const url = method === 'POST' ? base : `${base}/${payload.raftId}`;
+                await request(url, {
+                    method,
+                    headers: getRobHeaders(),
+                    body: JSON.stringify({
+                        id: payload.raftId,
+                        name: payload.name,
+                        description: payload.description ?? '',
+                        dataServiceId: svcId,
+                        dataSourcesIds: payload.dataSourcesIds ?? [],
+                        indexingScript: {
+                            id: payload.streamId,
+                            name: payload.name,
+                            tsCode: payload.tsCode,
+                        },
+                        queryOperations: payload.queryOperations ?? [],
+                    }),
+                });
+            }
+            catch (robErr) {
+                const msg = robErr instanceof Error ? robErr.message : String(robErr);
+                if (msg.includes(ROB_HTTP_FORBIDDEN) || msg.includes(ROB_MSG_FORBIDDEN)) {
+                    console.warn(`[raft] ROB ${action} failed for "${payload.name}" (403 Forbidden).` +
+                        (method === 'POST' ? ' Use the same JWT as the ROB UI (CEF_AUTH_TOKEN).' : ''));
+                }
+                else if (method === 'POST' &&
+                    (msg.includes(ROB_HTTP_CONFLICT) || msg.includes(ROB_MSG_ALREADY_EXISTS))) {
+                    // Already registered, ignore
+                }
+                else {
+                    console.warn(`[raft] ROB ${action} failed for "${payload.name}": ${msg}`);
+                }
+            }
+        },
+        // Registers a raft with ROB (RMS) so it appears in the ROB UI. Best-effort: warns on failure.
+        registerRaftOnRob(payload) {
+            return this.syncRaftToRob(payload, 'POST');
+        },
+        // Updates a raft on ROB (RMS). Best-effort: warns on failure.
+        updateRaftOnRob(payload) {
+            return this.syncRaftToRob(payload, 'PUT');
+        },
+        // ─── MCP / Playground ─────────────────────────────────────────────────
+        callTool(agentId, toolName, args) {
+            const mcpUrl = `${env.orchestratorUrl}/api/v1/mcp/agent-services/${asPubKey}/agents/${agentId}`;
+            const body = {
+                jsonrpc: '2.0',
+                id: Date.now(),
+                method: 'tools/call',
+                params: { name: toolName, arguments: args },
+                context: {
+                    jobId: `playground-${crypto.randomUUID()}`,
+                    workspaceId: 'playground',
+                    engagementId: '',
+                    deploymentId: '',
+                    executionId: crypto.randomUUID(),
+                },
+            };
+            return requestAs(mcpUrl, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(body),
+            });
+        },
+        listTools(agentId) {
+            const mcpUrl = `${env.orchestratorUrl}/api/v1/mcp/agent-services/${asPubKey}/agents/${agentId}`;
+            return requestAs(mcpUrl, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({
+                    jsonrpc: '2.0',
+                    id: Date.now(),
+                    method: 'tools/list',
+                    params: {},
+                }),
+            });
+        },
+    };
+}
+export async function listAgentServices(robApiUrl, authToken) {
+    const res = await request(robApiUrl + '/data-services', {
+        method: 'GET',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${authToken}`,
+        },
+    });
+    return (res.data ?? []);
+}
+export async function createAgentServiceOnRob(robApiUrl, authToken, name) {
+    const res = await request(robApiUrl + '/data-services', {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${authToken}`,
+        },
+        body: JSON.stringify({ name }),
+    });
+    const data = (res.data ?? res);
+    return {
+        id: String(data.id ?? ''),
+        name: String(data.name ?? ''),
+        publicKey: String(data.publicKey ?? ''),
+        archived: Boolean(data.archived),
+        createdAt: String(data.createdAt ?? ''),
+    };
+}
+export async function createAgentServiceOnOrchestrator(orchestratorUrl, authToken, agentServicePubKey, bucketId, name) {
+    return request(`${orchestratorUrl}/api/v1/agent-services`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `Bearer ${authToken}`,
+        },
+        body: JSON.stringify({ agentServicePubKey, bucketId, name }),
+    });
+}

package/dist/lib/config.d.ts

@@ -0,0 +1,12 @@
+import type { CefConfig, EnvConfig, ResolvedConfig } from './types.js';
+export declare function validateConfig(config: CefConfig): void;
+export declare function loadEnv(): EnvConfig;
+export declare function resolveFilePaths(config: CefConfig, baseDir: string): void;
+export interface DevConfig {
+    config: CefConfig;
+    configPath: string;
+    configDir: string;
+}
+/** Load config for local dev mode. Skips env validation (no auth token required). */
+export declare function loadConfigForDev(configPath: string): DevConfig;
+export declare function loadConfig(configPath: string): ResolvedConfig;

package/dist/lib/config.js

@@ -0,0 +1,120 @@
+import fs from 'fs';
+import path from 'path';
+import { parse } from 'yaml';
+import dotenv from 'dotenv';
+import { toCamelCase } from './utils.js';
+export function validateConfig(config) {
+    if (!config || typeof config !== 'object') {
+        throw new Error('Config file must contain a YAML object');
+    }
+    if (!config.agentServicePubKey || typeof config.agentServicePubKey !== 'string') {
+        throw new Error('Config missing required field: agentServicePubKey (string)');
+    }
+    if (!/^0x[0-9a-fA-F]{64}$/.test(config.agentServicePubKey)) {
+        throw new Error('Config field agentServicePubKey must be a 64-character hex string prefixed with 0x');
+    }
+    for (const section of ['engagements', 'agents', 'cubbies', 'workspaces']) {
+        const value = config[section];
+        if (value !== undefined && !Array.isArray(value)) {
+            throw new Error(`Config field "${section}" must be an array`);
+        }
+    }
+    for (const agent of config.agents ?? []) {
+        if (!Array.isArray(agent.tasks)) {
+            throw new Error(`Agent "${agent.name ?? '?'}" is missing required "tasks" array`);
+        }
+    }
+    for (const cubby of config.cubbies ?? []) {
+        if (!cubby.alias || typeof cubby.alias !== 'string') {
+            throw new Error(`Cubby "${cubby.name ?? '?'}" is missing required "alias" field`);
+        }
+    }
+}
+export function loadEnv() {
+    let authToken = (process.env['CEF_AUTH_TOKEN'] ?? '').trim();
+    if (!authToken)
+        throw new Error('Missing required env var: CEF_AUTH_TOKEN');
+    if (authToken.toLowerCase().startsWith('bearer ')) {
+        authToken = authToken.slice(7).trim();
+    }
+    const orchestratorUrl = process.env['CEF_ORCHESTRATOR_URL'];
+    if (!orchestratorUrl)
+        throw new Error('Missing required env var: CEF_ORCHESTRATOR_URL');
+    const robApiUrl = (process.env['CEF_ROB_API_URL'] ?? '').trim();
+    const robOrigin = (process.env['CEF_ROB_ORIGIN'] ?? '').trim() || undefined;
+    return { authToken, orchestratorUrl, robApiUrl, robOrigin };
+}
+function resolveAndValidatePath(baseDir, file, label) {
+    const filePath = path.resolve(baseDir, file);
+    const resolvedBase = path.resolve(baseDir);
+    if (!filePath.startsWith(resolvedBase + path.sep) && filePath !== resolvedBase) {
+        throw new Error(`${label} file path escapes config directory: ${file}`);
+    }
+    if (!fs.existsSync(filePath)) {
+        throw new Error(`${label} file not found: ${filePath}`);
+    }
+    return filePath;
+}
+export function resolveFilePaths(config, baseDir) {
+    for (const engagement of config.engagements ?? []) {
+        const filePath = resolveAndValidatePath(baseDir, engagement.file, 'Engagement');
+        engagement.tsCode = fs.readFileSync(filePath, 'utf8');
+        engagement._resolvedFilePath = filePath;
+    }
+    for (const agent of config.agents ?? []) {
+        if (!agent.alias)
+            agent.alias = toCamelCase(agent.name);
+        for (const task of agent.tasks) {
+            if (!task.alias)
+                task.alias = toCamelCase(task.name);
+            const filePath = resolveAndValidatePath(baseDir, task.file, 'Agent task');
+            task.tsCode = fs.readFileSync(filePath, 'utf8');
+            task._resolvedFilePath = filePath;
+            if (task.batch_file) {
+                const batchPath = resolveAndValidatePath(baseDir, task.batch_file, 'Agent task batch');
+                task.batchSql = fs.readFileSync(batchPath, 'utf8');
+            }
+        }
+    }
+    // Cubbies have no file references to resolve (migrations are inline)
+    for (const workspace of config.workspaces ?? []) {
+        for (const stream of workspace.streams ?? []) {
+            for (const raft of stream.rafts ?? []) {
+                if (raft.file) {
+                    const filePath = resolveAndValidatePath(baseDir, raft.file, 'Raft');
+                    raft.tsCode = fs.readFileSync(filePath, 'utf8');
+                    raft._resolvedFilePath = filePath;
+                }
+            }
+        }
+    }
+}
+/** Load config for local dev mode. Skips env validation (no auth token required). */
+export function loadConfigForDev(configPath) {
+    const absolutePath = path.resolve(configPath);
+    if (!fs.existsSync(absolutePath)) {
+        throw new Error(`Config file not found: ${absolutePath}`);
+    }
+    const configDir = path.dirname(absolutePath);
+    // Load .env for optional vars but don't fail on missing required vars
+    dotenv.config({ path: path.join(configDir, '.env') });
+    const raw = fs.readFileSync(absolutePath, 'utf8');
+    const config = parse(raw);
+    validateConfig(config);
+    resolveFilePaths(config, configDir);
+    return { config, configPath: absolutePath, configDir };
+}
+export function loadConfig(configPath) {
+    const absolutePath = path.resolve(configPath);
+    if (!fs.existsSync(absolutePath)) {
+        throw new Error(`Config file not found: ${absolutePath}`);
+    }
+    const configDir = path.dirname(absolutePath);
+    dotenv.config({ path: path.join(configDir, '.env') });
+    const raw = fs.readFileSync(absolutePath, 'utf8');
+    const config = parse(raw);
+    validateConfig(config);
+    const env = loadEnv();
+    resolveFilePaths(config, configDir);
+    return { config, env, configPath: absolutePath };
+}

package/dist/lib/runtime/agent-router.d.ts

@@ -0,0 +1,12 @@
+import type { AgentConfig } from '../types.js';
+export declare class AgentRouter {
+    private tasks;
+    private agentTasks;
+    loadAgents(agents: AgentConfig[]): void;
+    call(agentAlias: string, taskAlias: string, payload: unknown, context: unknown): Promise<unknown>;
+    reloadTask(agentAlias: string, taskAlias: string, tsCode: string): void;
+    getLoadedAgents(): string[];
+    getTasksForAgent(agentAlias: string): string[];
+    private compileAndStore;
+    private transpile;
+}

package/dist/lib/runtime/agent-router.js

@@ -0,0 +1,78 @@
+import vm from 'vm';
+import ts from 'typescript';
+const TS_COMPILE_OPTIONS = {
+    target: ts.ScriptTarget.ES2022,
+    module: ts.ModuleKind.ES2022,
+    strict: false,
+    noImplicitAny: false,
+    removeComments: false,
+    esModuleInterop: true,
+};
+export class AgentRouter {
+    tasks = new Map(); // key: agentAlias/taskAlias
+    agentTasks = new Map(); // agentAlias -> [taskAlias, ...]
+    loadAgents(agents) {
+        for (const agent of agents) {
+            const taskAliases = [];
+            for (const task of agent.tasks) {
+                const code = task.tsCode ?? '';
+                this.compileAndStore(agent.alias, task.alias, code);
+                taskAliases.push(task.alias);
+            }
+            this.agentTasks.set(agent.alias, taskAliases);
+        }
+    }
+    async call(agentAlias, taskAlias, payload, context) {
+        const key = `${agentAlias}/${taskAlias}`;
+        const compiled = this.tasks.get(key);
+        if (!compiled) {
+            if (!this.agentTasks.has(agentAlias)) {
+                throw new Error(`Agent "${agentAlias}" not found`);
+            }
+            throw new Error(`Task "${taskAlias}" not found on agent "${agentAlias}"`);
+        }
+        const event = { payload, event_type: 'agent_call' };
+        // Build restricted sandbox
+        const sandbox = {
+            event,
+            context,
+            console: {
+                log: context?.log ?? (() => { }),
+                warn: context?.warn ?? (() => { }),
+                error: context?.error ?? (() => { }),
+            },
+            Promise,
+            // Math, JSON, etc. are available in vm by default
+        };
+        // Wrap code to capture the handle function and call it
+        const wrappedCode = `
+      ${compiled.compiledJs}
+      __result__ = handle(event, context);
+    `;
+        const vmContext = vm.createContext(sandbox);
+        vm.runInContext(wrappedCode, vmContext);
+        // handle returns a Promise
+        const result = await sandbox.__result__;
+        return result;
+    }
+    reloadTask(agentAlias, taskAlias, tsCode) {
+        this.compileAndStore(agentAlias, taskAlias, tsCode);
+    }
+    getLoadedAgents() {
+        return [...this.agentTasks.keys()];
+    }
+    getTasksForAgent(agentAlias) {
+        return this.agentTasks.get(agentAlias) ?? [];
+    }
+    compileAndStore(agentAlias, taskAlias, tsCode) {
+        const key = `${agentAlias}/${taskAlias}`;
+        const compiledJs = this.transpile(tsCode);
+        this.tasks.set(key, { agentAlias, taskAlias, compiledJs });
+    }
+    transpile(tsCode) {
+        const result = ts.transpileModule(tsCode, {
+            compilerOptions: TS_COMPILE_OPTIONS,
+        });
+        return result.outputText;
+    }
+}

package/dist/lib/runtime/context-builder.d.ts

@@ -0,0 +1,27 @@
+import type { LogCollector } from './log-collector.js';
+import type { AgentRouter } from './agent-router.js';
+import type { CubbyManager } from './cubby-manager.js';
+import type { StreamManager } from './stream-manager.js';
+export interface BuildContextOptions {
+    executionId: string;
+    logCollector: LogCollector;
+    agentRouter: AgentRouter;
+    cubbyManager: CubbyManager;
+    streamManager: StreamManager;
+    workspaceId: string;
+    agentServiceId: string;
+    agentAlias?: string;
+    taskAlias?: string;
+    callerLabel?: string;
+}
+/**
+ * Builds the context object injected into agent/engagement V8 sandboxes.
+ *
+ * This is THE single source of truth for the Context API shape.
+ * When the platform API changes, update this file.
+ *
+ * Properties are grouped into:
+ * 1. Typed properties (from typecheck.ts Context interface)
+ * 2. Non-typed extensions (in platform docs but not in typecheck.ts)
+ */
+export declare function buildContext(opts: BuildContextOptions): any;