@chabokan.net/cli 0.8.15 → 0.9.0

package/dist/helper.js

@@ -1,14 +1,55 @@
-import * as fs from "fs";
+import * as fs from "node:fs";
+import * as os from "node:os";
 import { GLOBAL_CONF_PATH } from "./constants.js";
-import axios from "axios";
-import { dirname, join, relative } from "path";
+import axios, { isAxiosError } from "axios";
+import { dirname, join, relative } from "node:path";
 import boxen from 'boxen';
 import chalk from 'chalk';
 import semver from 'semver';
-import pkgJson from 'package-json';
-import semverDiff from 'semver-diff';
+// The config file holds plain-text API tokens, so it must stay owner-only.
+const CONFIG_FILE_MODE = 0o600;
+const PACKAGE_NAME = "@chabokan.net/cli";
+// The update check runs before every command, so it must never be something the
+// user waits on. It is capped hard, cached, and skippable.
+const UPDATE_CHECK_TIMEOUT_MS = 1500;
+const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
+const UPDATE_CACHE_PATH = join(os.tmpdir(), 'chabok-cli', 'update-check.json');
+// Node surfaces certificate problems as error codes. These are permanent
+// failures: retrying will not help, and they must not be reported as a
+// generic "check your internet connection".
+const TLS_ERROR_CODES = new Set([
+    'CERT_HAS_EXPIRED',
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'ERR_TLS_CERT_ALTNAME_INVALID',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+]);
+const HTML_ENTITIES = {
+    ' ': ' ',
+    '‌': '‌',
+    '&': '&',
+    '&lt;': '<',
+    '&gt;': '>',
+    '&quot;': '"',
+    '&#39;': "'",
+};
+/** Some API error/description text comes wrapped in HTML tags (e.g. `<p>...</p>`). */
+export function stripHtml(text) {
+    return text
+        .replaceAll(/<[^>]*>/g, '')
+        .replaceAll(/&[a-z#0-9]+;/gi, (entity) => HTML_ENTITIES[entity] ?? entity)
+        .trim();
+}
+function isTlsError(code) {
+    return code !== undefined && TLS_ERROR_CODES.has(code);
+}
+export function isDebug() {
+    return process.env.CHABOK_DEBUG === "true";
+}
 export function isObject(obj) {
-    return obj != null && typeof obj === 'object' && obj.constructor?.name === "Object";
+    // `typeof null === 'object'`, so null needs its own check; undefined is
+    // already excluded by the typeof test.
+    return obj !== null && typeof obj === 'object' && obj.constructor?.name === "Object";
 }
 export function isEmptyObject(obj) {
     return obj !== null && typeof obj === 'object' && obj.constructor === Object && Object.keys(obj).length === 0;
@@ -22,7 +63,7 @@ export function read_config_file() {
         if (!fs.existsSync(GLOBAL_CONF_PATH)) {
             return config_json;
         }
-        const fileContent = fs.readFileSync(GLOBAL_CONF_PATH).toString('utf-8');
+        const fileContent = fs.readFileSync(GLOBAL_CONF_PATH).toString('utf8');
         if (!fileContent.trim()) {
             return config_json;
         }
@@ -35,57 +76,99 @@ export function read_config_file() {
         }
     }
     catch (error) {
-        if (process.env.CHABOK_DEBUG === "true") {
+        if (isDebug()) {
             console.error(`Error reading config file (${GLOBAL_CONF_PATH}):`, error);
         }
         // File doesn't exist or invalid JSON, return default
     }
     return config_json;
 }
-export async function get_all_services(filter = {}, axiosConfig) {
-    const all_services = [];
+export function write_config_file(config_json) {
+    // `mode` only applies when the file is created, so tighten it explicitly
+    // afterwards for configs written by older versions of the CLI.
+    fs.writeFileSync(GLOBAL_CONF_PATH, JSON.stringify(config_json, null, 2), {
+        mode: CONFIG_FILE_MODE,
+    });
     try {
-        let url_filter = "";
-        Object.keys(filter).forEach((item, index) => {
-            const key = item;
-            const value = filter[item];
-            if (index === 0) {
-                url_filter += `?${key}=${encodeURIComponent(value)}`;
+        fs.chmodSync(GLOBAL_CONF_PATH, CONFIG_FILE_MODE);
+    }
+    catch (error) {
+        // chmod is unsupported on some filesystems (e.g. Windows); not fatal.
+        if (isDebug()) {
+            console.error(`Could not restrict permissions on ${GLOBAL_CONF_PATH}:`, error);
+        }
+    }
+}
+/**
+ * Retries a request that failed before the server produced a response.
+ * Only safe for idempotent (GET) calls: a response-less failure still might
+ * mean a non-idempotent request was applied server-side.
+ */
+async function getWithRetry(endpoint, axiosConfig, retries = 2) {
+    let lastError;
+    // Attempts are inherently sequential: each one waits for the previous
+    // failure and its backoff, so awaiting inside the loop is the point.
+    /* eslint-disable no-await-in-loop */
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            const { data } = await axios.get(endpoint, axiosConfig);
+            return data;
+        }
+        catch (error) {
+            lastError = error;
+            const isTransient = isAxiosError(error) && !error.response && !isTlsError(error.code);
+            if (!isTransient || attempt === retries) {
+                throw error;
             }
-            else {
-                url_filter += `&${key}=${encodeURIComponent(value)}`;
+            if (isDebug()) {
+                console.error(`Request to ${endpoint} failed (${error.code}), retrying...`);
             }
-        });
-        const endpoint = "services/" + url_filter;
-        const { data } = await axios.get(endpoint, axiosConfig);
-        if (data.services && Array.isArray(data.services)) {
-            data.services.forEach((item) => {
-                all_services.push({
-                    value: item.main_name,
-                    name: `${item.main_name} (${item.platform.name})`
-                });
+            await new Promise(resolve => {
+                setTimeout(resolve, 500 * (attempt + 1));
             });
         }
     }
-    catch (error) {
-        const errorInfo = handleApiError(error, 'Failed to fetch services list.', {
-            endpoint: 'services/',
-            operation: 'Fetch services'
+    /* eslint-enable no-await-in-loop */
+    throw lastError;
+}
+/**
+ * Fetches the account's services. Throws on failure so callers can surface a
+ * real error instead of an empty list that reads as "you have no services".
+ */
+export async function get_all_services(filter = {}, axiosConfig) {
+    const all_services = [];
+    const query = new URLSearchParams(filter).toString();
+    const endpoint = `services/${query ? `?${query}` : ""}`;
+    const data = await getWithRetry(endpoint, axiosConfig);
+    if (data.services && Array.isArray(data.services)) {
+        data.services.forEach((item) => {
+            all_services.push({
+                value: item.main_name,
+                name: `${item.main_name} (${item.platform.name})`,
+                platform: item.platform.name
+            });
         });
-        if (process.env.CHABOK_DEBUG === "true") {
-            console.error('Error fetching services:', errorInfo);
-            if (axios.isAxiosError(error)) {
-                console.error('Full error:', error);
-            }
-        }
-        else {
-            // Only log critical errors in non-debug mode
-            if (errorInfo.status && errorInfo.status >= 500) {
-                console.error(`Error fetching services: ${errorInfo.message}`);
+    }
+    return all_services;
+}
+/**
+ * Pulls a list of records out of an API response whose exact wrapper key
+ * isn't guaranteed (some endpoints return a bare array, others wrap it under
+ * `data`, `results`, or a resource-named key).
+ */
+export function extractRecords(data, wrapperKeys = []) {
+    if (Array.isArray(data)) {
+        return data.filter((item) => isObject(item));
+    }
+    if (isObject(data)) {
+        for (const key of wrapperKeys) {
+            const wrapped = data[key];
+            if (Array.isArray(wrapped)) {
+                return wrapped.filter((item) => isObject(item));
             }
         }
     }
-    return all_services;
+    return [];
 }
 export function trimLines(lines) {
     return lines.reduce((prev, line) => {
@@ -100,13 +183,13 @@ export const loadIgnoreFile = (ignoreInstance, ignoreFilePath, projectPath) => {
     const relativeToProjectPath = patterns.map((pattern) => {
         const dir = dirname(ignoreFilePath);
         if (pattern.startsWith('!')) {
-            const absolutePrefix = pattern.substr(1).startsWith('/') ? '/' : '';
-            return '!' + absolutePrefix + relative(projectPath, join(dir, pattern.substr(1)));
+            const absolutePrefix = pattern.slice(1).startsWith('/') ? '/' : '';
+            return '!' + absolutePrefix + relative(projectPath, join(dir, pattern.slice(1)));
         }
         const absolutePrefix = pattern.startsWith('/') ? '/' : '';
         return absolutePrefix + relative(projectPath, join(dir, pattern));
     });
-    const linuxify = relativeToProjectPath.map(p => p.replace(/\\/g, '/'));
+    const linuxify = relativeToProjectPath.map(p => p.replaceAll('\\', '/'));
     ignoreInstance.add(linuxify);
 };
 export function addIgnorePatterns(ignoreInstance, projectPath, dir) {
@@ -123,34 +206,101 @@ export function addIgnorePatterns(ignoreInstance, projectPath, dir) {
         loadIgnoreFile(ignoreInstance, gitignorePath, projectPath);
     }
 }
+/** True when the user has opted out of update checks, or we are in CI. */
+function updateCheckDisabled() {
+    return Boolean(process.env.CHABOK_NO_UPDATE_CHECK ||
+        process.env.NO_UPDATE_NOTIFIER ||
+        process.env.CI);
+}
+function readUpdateCache() {
+    try {
+        const raw = fs.readFileSync(UPDATE_CACHE_PATH).toString('utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed?.checkedAt === 'number') {
+            return parsed;
+        }
+    }
+    catch {
+        // No cache yet, or it is unreadable — treat as "never checked".
+    }
+    return undefined;
+}
+function writeUpdateCache(cache) {
+    try {
+        fs.mkdirSync(dirname(UPDATE_CACHE_PATH), { recursive: true });
+        fs.writeFileSync(UPDATE_CACHE_PATH, JSON.stringify(cache));
+    }
+    catch (error) {
+        // A cache we cannot write just means we check again next time.
+        if (isDebug()) {
+            console.error('Could not write the update-check cache:', error);
+        }
+    }
+}
+/**
+ * Asks the npm registry for the latest published version, giving up after
+ * `timeoutMs`. axios aborts on timeout rather than leaving the socket
+ * dangling, so a slow network cannot hold the process open after the command
+ * has finished.
+ */
+async function fetchLatestVersion(timeoutMs) {
+    const registry = (process.env.CHABOK_NPM_REGISTRY || 'https://registry.npmjs.org').replace(/\/+$/, '');
+    const url = `${registry}/${PACKAGE_NAME.replace('/', '%2f')}/latest`;
+    const { data } = await axios.get(url, {
+        timeout: timeoutMs,
+        headers: { accept: 'application/json' },
+        // This call is deliberately independent of the CLI's API client: no auth
+        // header, no baseURL, no proxy-agent inherited from the command.
+        transitional: { clarifyTimeoutError: true },
+    });
+    return data.version;
+}
+/**
+ * Tells the user about a newer release. This runs ahead of every command, so it
+ * is deliberately defensive: it is skippable, it only hits the network once a
+ * day, it gives up after 1.5s, and any failure is silent. A user with no
+ * internet should not notice that this function exists.
+ */
 export const checkUpdate = async (version) => {
-    const name = "@chabokan.net/cli";
+    if (updateCheckDisabled()) {
+        return;
+    }
     try {
-        const { version: latestVersion } = await pkgJson(name);
-        // check if local package version is less than the remote version
-        const updateAvailable = semver.lt(version, latestVersion);
-        if (updateAvailable) {
-            let updateType = '';
-            // check the type of version difference which is usually patch, minor, major etc.
-            const verDiff = semverDiff(version, latestVersion);
-            if (verDiff) {
-                updateType = verDiff;
+        const cache = readUpdateCache();
+        const cacheIsFresh = cache && Date.now() - cache.checkedAt < UPDATE_CHECK_INTERVAL_MS;
+        let latestVersion = cacheIsFresh ? cache.latestVersion : undefined;
+        if (!cacheIsFresh) {
+            try {
+                latestVersion = await fetchLatestVersion(UPDATE_CHECK_TIMEOUT_MS);
             }
-            const msg = {
-                updateAvailable: `${updateType} update available ${chalk.dim(version)} → ${chalk.green(latestVersion)}`,
-                runUpdate: `Run ${chalk.cyan(`npm i -g ${name}`)} to update`,
-            };
-            // notify the user about the available update
-            console.log(boxen(`${msg.updateAvailable}\n${msg.runUpdate}`, {
-                margin: 1,
-                padding: 1,
-                align: 'center',
-            }));
+            catch (error) {
+                // A failed lookup must still be recorded below, otherwise every command
+                // run offline pays the timeout again.
+                if (isDebug()) {
+                    console.error('Update check request failed:', error);
+                }
+            }
+            writeUpdateCache({ checkedAt: Date.now(), latestVersion });
+        }
+        if (!latestVersion || !semver.valid(latestVersion) || !semver.lt(version, latestVersion)) {
+            return;
         }
+        const updateType = semver.diff(version, latestVersion) ?? '';
+        const lines = [
+            `${updateType} update available ${chalk.dim(version)} → ${chalk.green(latestVersion)}`,
+            `Run ${chalk.cyan(`npm i -g ${PACKAGE_NAME}`)} to update`,
+        ];
+        // stderr, not stdout: the banner must never end up inside piped output
+        // such as `chabok service logs -s app > app.log`.
+        process.stderr.write(boxen(lines.join('\n'), {
+            margin: 1,
+            padding: 1,
+            align: 'center',
+        }) + '\n');
     }
     catch (error) {
-        // Silently fail if update check fails (network issues, etc.)
-        if (process.env.CHABOK_DEBUG === "true") {
+        // Never let the update check break, delay or noisily fail a real command.
+        if (isDebug()) {
             console.error('Failed to check for updates:', error);
         }
     }
@@ -162,7 +312,13 @@ export function handleApiError(error, defaultMessage, context) {
     if (context?.endpoint) {
         errorInfo.endpoint = context.endpoint;
     }
-    if (axios.isAxiosError(error)) {
+    if (context?.serviceName) {
+        errorInfo.serviceName = context.serviceName;
+    }
+    if (context?.operation) {
+        errorInfo.operation = context.operation;
+    }
+    if (isAxiosError(error)) {
         // Extract endpoint from error config
         if (error.config?.url) {
             errorInfo.endpoint = error.config.url;
@@ -171,8 +327,8 @@ export function handleApiError(error, defaultMessage, context) {
             errorInfo.endpoint = `${error.config.baseURL}${errorInfo.endpoint || ''}`;
         }
         if (error.response) {
-            const status = error.response.status;
-            const data = error.response.data;
+            const { status } = error.response;
+            const { data } = error.response;
             errorInfo.status = status;
             // Build detailed error message based on status code
             let message = defaultMessage;
@@ -218,19 +374,29 @@ export function handleApiError(error, defaultMessage, context) {
                 default:
                     message = defaultMessage;
             }
-            // Try to extract detailed error message from response
+            // Try to extract detailed error message from response. Some endpoints
+            // (e.g. cloudservers/create/) reply with a `messages` (plural) key
+            // instead of `message`, and wrap the text in HTML tags.
             if (typeof data === 'object' && data !== null) {
                 if ('message' in data && typeof data.message === 'string') {
-                    errorInfo.details = data.message;
-                    message = `${message} ${data.message}`;
+                    errorInfo.details = stripHtml(data.message);
+                    message = `${message} ${errorInfo.details}`;
+                }
+                else if ('messages' in data && typeof data.messages === 'string') {
+                    errorInfo.details = stripHtml(data.messages);
+                    message = `${message} ${errorInfo.details}`;
+                }
+                else if ('messages' in data && Array.isArray(data.messages)) {
+                    errorInfo.details = data.messages.map((m) => stripHtml(String(m))).join(' ');
+                    message = `${message} ${errorInfo.details}`;
                 }
                 else if ('error' in data && typeof data.error === 'string') {
-                    errorInfo.details = data.error;
-                    message = `${message} ${data.error}`;
+                    errorInfo.details = stripHtml(data.error);
+                    message = `${message} ${errorInfo.details}`;
                 }
                 else if ('detail' in data && typeof data.detail === 'string') {
-                    errorInfo.details = data.detail;
-                    message = `${message} ${data.detail}`;
+                    errorInfo.details = stripHtml(data.detail);
+                    message = `${message} ${errorInfo.details}`;
                 }
                 else if (Array.isArray(data) && data.length > 0) {
                     errorInfo.details = JSON.stringify(data);
@@ -241,29 +407,41 @@ export function handleApiError(error, defaultMessage, context) {
                 }
             }
             else if (typeof data === 'string') {
-                errorInfo.details = data;
-                message = `${message} ${data}`;
+                errorInfo.details = stripHtml(data);
+                message = `${message} ${errorInfo.details}`;
             }
             errorInfo.message = message;
             errorInfo.code = error.code || `HTTP_${status}`;
         }
         else if (error.request) {
             // Request was made but no response received
-            if (error.code === 'ECONNREFUSED') {
-                errorInfo.message = "Connection refused: Unable to connect to the server. Please check your internet connection and try again.";
-                errorInfo.code = 'ECONNREFUSED';
-            }
-            else if (error.code === 'ETIMEDOUT' || error.code === 'ECONNABORTED') {
-                errorInfo.message = "Request timeout: The server took too long to respond. Please check your connection and try again.";
+            if (isTlsError(error.code)) {
+                errorInfo.message = `TLS error (${error.code}): the server's certificate could not be verified. If you are intentionally targeting a server with a self-signed certificate, set CHABOK_INSECURE_TLS=true.`;
                 errorInfo.code = error.code;
             }
-            else if (error.code === 'ENOTFOUND') {
-                errorInfo.message = "DNS error: Unable to resolve server address. Please check your internet connection.";
-                errorInfo.code = 'ENOTFOUND';
-            }
             else {
-                errorInfo.message = "Network error: Unable to reach the server. Please check your internet connection and try again.";
-                errorInfo.code = error.code || 'NETWORK_ERROR';
+                switch (error.code) {
+                    case 'ECONNABORTED':
+                    case 'ETIMEDOUT': {
+                        errorInfo.message = "Request timeout: The server took too long to respond. Please check your connection and try again.";
+                        errorInfo.code = error.code;
+                        break;
+                    }
+                    case 'ECONNREFUSED': {
+                        errorInfo.message = "Connection refused: Unable to connect to the server. Please check your internet connection and try again.";
+                        errorInfo.code = 'ECONNREFUSED';
+                        break;
+                    }
+                    case 'ENOTFOUND': {
+                        errorInfo.message = "DNS error: Unable to resolve server address. Please check your internet connection.";
+                        errorInfo.code = 'ENOTFOUND';
+                        break;
+                    }
+                    default: {
+                        errorInfo.message = "Network error: Unable to reach the server. Please check your internet connection and try again.";
+                        errorInfo.code = error.code || 'NETWORK_ERROR';
+                    }
+                }
             }
         }
         else {
@@ -280,30 +458,33 @@ export function handleApiError(error, defaultMessage, context) {
     else if (typeof error === 'string') {
         errorInfo.message = error;
     }
-    // Add context information to message if available
-    if (context?.serviceName && !errorInfo.message.includes(context.serviceName)) {
-        errorInfo.message = `[Service: ${context.serviceName}] ${errorInfo.message}`;
-    }
-    if (context?.operation && !errorInfo.message.includes(context.operation)) {
-        errorInfo.message = `[Operation: ${context.operation}] ${errorInfo.message}`;
-    }
+    // Context is deliberately not prefixed onto the message: callers already
+    // mention the service they are acting on, and the status-specific messages
+    // above name it too. It is kept on `errorInfo` for the debug output.
     return errorInfo;
 }
 export function logErrorDetails(errorInfo, command) {
-    if (process.env.CHABOK_DEBUG === "true") {
-        command.log(chalk.dim('--- Error Details ---'));
-        if (errorInfo.status) {
-            command.log(chalk.dim(`Status Code: ${errorInfo.status}`));
-        }
-        if (errorInfo.endpoint) {
-            command.log(chalk.dim(`Endpoint: ${errorInfo.endpoint}`));
-        }
-        if (errorInfo.code) {
-            command.log(chalk.dim(`Error Code: ${errorInfo.code}`));
-        }
-        if (errorInfo.details) {
-            command.log(chalk.dim(`Details: ${errorInfo.details}`));
-        }
-        command.log(chalk.dim('--- End Error Details ---'));
+    if (!isDebug()) {
+        return;
+    }
+    command.log(chalk.dim('--- Error Details ---'));
+    if (errorInfo.operation) {
+        command.log(chalk.dim(`Operation: ${errorInfo.operation}`));
+    }
+    if (errorInfo.serviceName) {
+        command.log(chalk.dim(`Service: ${errorInfo.serviceName}`));
+    }
+    if (errorInfo.status) {
+        command.log(chalk.dim(`Status Code: ${errorInfo.status}`));
+    }
+    if (errorInfo.endpoint) {
+        command.log(chalk.dim(`Endpoint: ${errorInfo.endpoint}`));
+    }
+    if (errorInfo.code) {
+        command.log(chalk.dim(`Error Code: ${errorInfo.code}`));
+    }
+    if (errorInfo.details) {
+        command.log(chalk.dim(`Details: ${errorInfo.details}`));
     }
+    command.log(chalk.dim('--- End Error Details ---'));
 }

package/dist/types.d.ts

@@ -5,9 +5,15 @@ export interface ConfigFile {
 export interface UserConfig {
     token: string;
 }
+/**
+ * A service as offered to the user. `value`/`name` are the shape inquirer
+ * expects for a choice; `platform` is kept separately so tables do not have to
+ * parse it back out of the label.
+ */
 export interface Service {
     value: string;
     name: string;
+    platform: string;
 }
 export interface ApiResponse<T = unknown> {
     success: boolean;
@@ -39,14 +45,10 @@ export interface ChabokFile {
     service?: string;
     [key: string]: unknown;
 }
-export interface AxiosErrorResponse {
-    response?: {
-        status: number;
-        data?: unknown;
-        [key: string]: unknown;
-    };
-    data?: unknown;
-    message?: string;
+export interface ErrorContext {
+    endpoint?: string;
+    serviceName?: string;
+    operation?: string;
 }
 export interface ErrorInfo {
     message: string;
@@ -54,4 +56,22 @@ export interface ErrorInfo {
     endpoint?: string;
     details?: string;
     code?: string;
+    serviceName?: string;
+    operation?: string;
+}
+export interface DomainResponse extends ApiResponse {
+    domain_name?: string;
+}
+/**
+ * A resolved cloud server. `id` is what the API needs in request bodies;
+ * `hostname` is the only part ever shown to the user.
+ */
+export interface CloudServerRef {
+    id: string;
+    hostname: string;
+}
+/** A resolved wallet. `id` is what the API needs; `name` is shown to the user. */
+export interface WalletRef {
+    id: string;
+    name: string;
 }

package/dist/ui.d.ts

@@ -0,0 +1,23 @@
+export declare function success(message: string): string;
+export declare function error(message: string): string;
+export declare function warning(message: string): string;
+export declare function info(message: string): string;
+/** A dimmed follow-up line telling the user what to do next. */
+export declare function hint(message: string): string;
+/** Highlights a command the user is meant to run. */
+export declare function cmd(command: string): string;
+/** Highlights a value the user supplied or chose, such as a service name. */
+export declare function value(text: string): string;
+/**
+ * Renders an array of API records as a table without assuming which fields
+ * it contains — the columns are whichever keys are present on the first row.
+ * Used for endpoints whose response shape isn't fixed enough to hard-code a
+ * column list against.
+ */
+export declare function printRecords(records: Record<string, unknown>[]): void;
+/**
+ * Renders a single API record as Field/Value rows. Preferred over
+ * `printRecords` for one object with many fields, which would otherwise
+ * produce one very wide, mostly-empty table.
+ */
+export declare function printRecord(record: Record<string, unknown>): void;