@clawscarf/cli 0.1.0-alpha.1

package/scripts/people.js

@@ -0,0 +1,52 @@
+import { Command } from "commander";
+import { sessionRequest } from "./session.js";
+import * as api from "../services/access/generated/sdk.gen.js";
+import { writeResult } from "./output.js";
+export function peopleCommand(program) {
+    const command = new Command("people")
+        .description("Manage people and invitations as a signed-in administrator")
+        .requiredOption("--origin <url>", "Server origin")
+        .requiredOption("--session-file <path>", "Private file containing your session credential");
+    const request = () => sessionRequest(command.opts());
+    command.command("list").action(async () => {
+        const result = (await api.listPeople(await request())).data;
+        writeResult(program, result, result.people
+            .map((person) => `${person.name} <${person.email}> · ${person.role ?? "Unavailable"} · ${person.id}`)
+            .join("\n"));
+    });
+    command.command("invite <email>").action(async (email) => {
+        const result = (await api.createInvitation({ ...(await request()), body: { email } })).data;
+        writeResult(program, result, `Invitation for ${email}\n${result.url}\nExpires ${result.invitation.expiresAt}`);
+    });
+    command.command("invitations").action(async () => {
+        const result = (await api.listInvitations(await request())).data;
+        writeResult(program, result, result.invitations
+            .map((item) => `${item.email} · ${item.status} · ${item.id}`)
+            .join("\n") || "No invitations.");
+    });
+    command
+        .command("revoke-invitation <id>")
+        .action(async (invitationId) => {
+        await api.revokeInvitation({
+            ...(await request()),
+            path: { invitationId },
+        });
+        writeResult(program, { revoked: true }, "Invitation revoked.");
+    });
+    command
+        .command("role <userId> <role>")
+        .requiredOption("--expected-role <role>", "Previously observed native role")
+        .action(async (userId, role, options) => {
+        await api.setPersonRole({
+            ...(await request()),
+            path: { userId },
+            body: { role, expectedRole: options.expectedRole },
+        });
+        writeResult(program, { updated: true }, "Role updated.");
+    });
+    command.command("remove <userId>").action(async (userId) => {
+        await api.removePerson({ ...(await request()), path: { userId } });
+        writeResult(program, { removed: true }, "Access removed. Team files remain.");
+    });
+    return command;
+}

package/scripts/release/create.js

@@ -0,0 +1,62 @@
+import { OperatorError } from "../errors.js";
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { copyFile, lstat, mkdir, readFile, rm, writeFile, } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { dirname, join, resolve } from "node:path";
+import { z } from "zod";
+import { releaseSchema } from "./definition.js";
+// Build inputs use the release contract, replacing tool digests with source paths.
+const inputSchema = releaseSchema.extend({
+    tools: z.strictObject({
+        openshell: releaseSchema.shape.tools.shape.openshell.extend({
+            cli: z.string().min(1),
+            gateway: z.string().min(1),
+        }),
+    }),
+});
+async function tool(source, destination, file) {
+    const stat = await lstat(source);
+    if (!stat.isFile() || !(stat.mode & 0o111))
+        throw new OperatorError("Release tools must be regular executable files.");
+    await copyFile(source, destination);
+    const hash = createHash("sha256");
+    for await (const bytes of createReadStream(destination)) {
+        if (!Buffer.isBuffer(bytes))
+            throw new OperatorError("Invalid file stream");
+        hash.update(bytes);
+    }
+    return { file, sha256: hash.digest("hex") };
+}
+/** Assemble portable payloads from explicit, already-built inputs. Never mutate sources. */
+export async function createDevelopmentRelease(options) {
+    const input = inputSchema.parse(JSON.parse(await readFile(options.inputFile, "utf8")));
+    const directory = dirname(resolve(options.inputFile));
+    const output = resolve(options.outputDirectory);
+    await mkdir(output); // Refuse to merge with an existing bundle.
+    try {
+        for (const name of ["LICENSE", "THIRD_PARTY_NOTICES.md"])
+            await copyFile(fileURLToPath(new URL(`../../${name}`, import.meta.url)), join(output, name));
+        await mkdir(join(output, "tools"));
+        const release = releaseSchema.parse({
+            ...input,
+            tools: {
+                openshell: {
+                    ...input.tools.openshell,
+                    cli: await tool(resolve(directory, input.tools.openshell.cli), join(output, "tools/openshell"), "tools/openshell"),
+                    gateway: await tool(resolve(directory, input.tools.openshell.gateway), join(output, "tools/openshell-gateway"), "tools/openshell-gateway"),
+                },
+            },
+        });
+        const releaseFile = join(output, "clawscarf-release.json");
+        await writeFile(releaseFile, JSON.stringify(release, null, 2) + "\n", {
+            flag: "wx",
+            mode: 0o600,
+        });
+        return release;
+    }
+    catch (error) {
+        await rm(output, { recursive: true, force: true });
+        throw error;
+    }
+}

package/scripts/release/definition.js

@@ -0,0 +1,51 @@
+import { z } from "zod";
+import { liteLlmImage, postgresImage } from "../deployment/images.js";
+export const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const image = z
+    .string()
+    .regex(/^(?:sha256:[a-f0-9]{64}|[a-zA-Z0-9][a-zA-Z0-9._:/-]*@sha256:[a-f0-9]{64})$/);
+const file = z.strictObject({
+    file: z.string().min(1),
+    sha256: digest,
+    url: z
+        .url()
+        .refine((value) => {
+        const url = new URL(value);
+        return (url.protocol === "https:" && !url.username && !url.password && !url.hash);
+    }, "Tool downloads require HTTPS without credentials.")
+        .optional(),
+});
+/** Pinned runtime metadata, independent of recipe defaults and deployment state. */
+export const releaseSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    version: z.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+    sourceRevision: z.string().regex(/^[a-f0-9]{40}$/),
+    platforms: z.array(z.literal("darwin-arm64")).min(1).max(1),
+    images: z
+        .strictObject({
+        postgres: z.literal(postgresImage),
+        gateway: image,
+        companion: image,
+        openshellClient: image,
+        relay: image.optional(),
+        models: z.literal(liteLlmImage).optional(),
+        browser: z
+            .strictObject({
+            chromium: image,
+            node: image,
+            dns: image,
+            egress: image,
+        })
+            .optional(),
+    })
+        .refine((images) => Boolean(images.browser) === Boolean(images.relay), {
+        message: "Browser and relay images must be supplied together.",
+    }),
+    tools: z.strictObject({
+        openshell: z.strictObject({
+            version: z.string().min(1),
+            cli: file,
+            gateway: file,
+        }),
+    }),
+});

package/scripts/session.js

@@ -0,0 +1,27 @@
+import { session } from "../services/access/generated/sdk.gen.js";
+import { cloudUrlSchema } from "./cloud/url.js";
+import { readInputFile } from "./installation/files.js";
+import { InstallationError } from "./installation/errors.js";
+/** One bounded, non-redirecting authenticated operation for both management clients. */
+export async function sessionRequest(options) {
+    if (!options.origin || !options.sessionFile)
+        throw new InstallationError("invalid_configuration", "Use --origin and --session-file for application management.");
+    const origin = cloudUrlSchema.parse(options.origin);
+    const token = (await readInputFile(options.sessionFile, true))
+        .toString("utf8")
+        .trim();
+    if (!/^[A-Za-z0-9_-]{43,128}$/.test(token))
+        throw new InstallationError("invalid_configuration", "Invalid session credential.");
+    const base = {
+        baseUrl: origin,
+        redirect: "error",
+        signal: AbortSignal.timeout(90_000),
+        throwOnError: true,
+        headers: { cookie: `clawscarf_session=${token}`, origin },
+    };
+    const current = (await session(base)).data;
+    return {
+        ...base,
+        headers: { ...base.headers, "x-csrf-token": current.csrfToken },
+    };
+}

package/services/access/generated/client.gen.d.ts

@@ -0,0 +1,12 @@
+import { type Client, type ClientOptions, type Config } from '../../../generated/http/client/index.js';
+import type { ClientOptions as ClientOptions2 } from './types.gen.js';
+/**
+ * The `createClientConfig()` function will be called on client initialization
+ * and the returned object will become the client's initial configuration.
+ *
+ * You may want to initialize your client this way instead of calling
+ * `setConfig()`. This is useful for example if you're using Next.js
+ * to ensure your client always has the correct values.
+ */
+export type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (override?: Config<ClientOptions & T>) => Config<Required<ClientOptions> & T>;
+export declare const client: Client;

package/services/access/generated/client.gen.js

@@ -0,0 +1,3 @@
+// This file is auto-generated by @hey-api/openapi-ts
+import { createClient, createConfig } from '../../../generated/http/client/index.js';
+export const client = createClient(createConfig({ baseUrl: 'services' }));

package/services/access/generated/fastify.gen.d.ts

@@ -0,0 +1,49 @@
+import type { RouteHandler } from 'fastify';
+import type { CompleteLoginData, CreateInvitationData, CreateInvitationResponses, EnrollPersonData, EnrollPersonResponses, HealthResponses, ListInvitationsResponses, ListPeopleResponses, LogoutResponses, PrepareTeamResponses, RemovePersonData, RemovePersonResponses, RevokeInvitationData, RevokeInvitationResponses, SessionResponses, SetPersonRoleData, SetPersonRoleResponses, StartLoginData } from './types.gen.js';
+export type RouteHandlers = {
+    health: RouteHandler<{
+        Reply: HealthResponses;
+    }>;
+    startLogin: RouteHandler<{
+        Querystring?: StartLoginData['query'];
+    }>;
+    completeLogin: RouteHandler<{
+        Querystring: CompleteLoginData['query'];
+    }>;
+    session: RouteHandler<{
+        Reply: SessionResponses;
+    }>;
+    logout: RouteHandler<{
+        Reply: LogoutResponses;
+    }>;
+    listPeople: RouteHandler<{
+        Reply: ListPeopleResponses;
+    }>;
+    enrollPerson: RouteHandler<{
+        Body: EnrollPersonData['body'];
+        Reply: EnrollPersonResponses;
+    }>;
+    removePerson: RouteHandler<{
+        Params: RemovePersonData['path'];
+        Reply: RemovePersonResponses;
+    }>;
+    prepareTeam: RouteHandler<{
+        Reply: PrepareTeamResponses;
+    }>;
+    setPersonRole: RouteHandler<{
+        Body: SetPersonRoleData['body'];
+        Params: SetPersonRoleData['path'];
+        Reply: SetPersonRoleResponses;
+    }>;
+    listInvitations: RouteHandler<{
+        Reply: ListInvitationsResponses;
+    }>;
+    createInvitation: RouteHandler<{
+        Body: CreateInvitationData['body'];
+        Reply: CreateInvitationResponses;
+    }>;
+    revokeInvitation: RouteHandler<{
+        Params: RevokeInvitationData['path'];
+        Reply: RevokeInvitationResponses;
+    }>;
+};

package/services/access/generated/fastify.gen.js

@@ -0,0 +1,2 @@
+// This file is auto-generated by @hey-api/openapi-ts
+export {};

package/services/access/generated/index.d.ts

@@ -0,0 +1,2 @@
+export { completeLogin, createInvitation, enrollPerson, health, listInvitations, listPeople, logout, type Options, prepareTeam, removePerson, revokeInvitation, session, setPersonRole, startLogin } from './sdk.gen.js';
+export type { ClientOptions, CompleteLoginData, CompleteLoginError, CompleteLoginErrors, CompleteLoginResponse, CompleteLoginResponses, CreateInvitationData, CreateInvitationError, CreateInvitationErrors, CreateInvitationResponse, CreateInvitationResponses, EnrollPersonData, EnrollPersonError, EnrollPersonErrors, EnrollPersonResponse, EnrollPersonResponses, HealthData, HealthError, HealthErrors, HealthResponse, HealthResponses, Invitation, ListInvitationsData, ListInvitationsError, ListInvitationsErrors, ListInvitationsResponse, ListInvitationsResponses, ListPeopleData, ListPeopleError, ListPeopleErrors, ListPeopleResponse, ListPeopleResponses, LogoutData, LogoutError, LogoutErrors, LogoutResponse, LogoutResponses, NavigationLink, Person, PrepareTeamData, PrepareTeamError, PrepareTeamErrors, PrepareTeamResponses, Problem, RemovePersonData, RemovePersonError, RemovePersonErrors, RemovePersonResponses, RevokeInvitationData, RevokeInvitationError, RevokeInvitationErrors, RevokeInvitationResponses, Role, SessionData, SessionError, SessionErrors, SessionResponse, SessionResponses, SetPersonRoleData, SetPersonRoleError, SetPersonRoleErrors, SetPersonRoleResponses, StartLoginData, StartLoginError, StartLoginErrors, StartLoginResponse, StartLoginResponses, User } from './types.gen.js';

package/services/access/generated/index.js

@@ -0,0 +1,2 @@
+// This file is auto-generated by @hey-api/openapi-ts
+export { completeLogin, createInvitation, enrollPerson, health, listInvitations, listPeople, logout, prepareTeam, removePerson, revokeInvitation, session, setPersonRole, startLogin } from './sdk.gen.js';

package/services/access/generated/sdk.gen.d.ts

@@ -0,0 +1,28 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from '../../../generated/http/client/index.js';
+import type { CompleteLoginData, CompleteLoginErrors, CompleteLoginResponses, CreateInvitationData, CreateInvitationErrors, CreateInvitationResponses, EnrollPersonData, EnrollPersonErrors, EnrollPersonResponses, HealthData, HealthErrors, HealthResponses, ListInvitationsData, ListInvitationsErrors, ListInvitationsResponses, ListPeopleData, ListPeopleErrors, ListPeopleResponses, LogoutData, LogoutErrors, LogoutResponses, PrepareTeamData, PrepareTeamErrors, PrepareTeamResponses, RemovePersonData, RemovePersonErrors, RemovePersonResponses, RevokeInvitationData, RevokeInvitationErrors, RevokeInvitationResponses, SessionData, SessionErrors, SessionResponses, SetPersonRoleData, SetPersonRoleErrors, SetPersonRoleResponses, StartLoginData, StartLoginErrors, StartLoginResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare const health: <ThrowOnError extends boolean = false>(options?: Options<HealthData, ThrowOnError>) => RequestResult<HealthResponses, HealthErrors, ThrowOnError>;
+export declare const startLogin: <ThrowOnError extends boolean = false>(options?: Options<StartLoginData, ThrowOnError>) => RequestResult<StartLoginResponses, StartLoginErrors, ThrowOnError>;
+export declare const completeLogin: <ThrowOnError extends boolean = false>(options: Options<CompleteLoginData, ThrowOnError>) => RequestResult<CompleteLoginResponses, CompleteLoginErrors, ThrowOnError>;
+export declare const session: <ThrowOnError extends boolean = false>(options?: Options<SessionData, ThrowOnError>) => RequestResult<SessionResponses, SessionErrors, ThrowOnError>;
+export declare const logout: <ThrowOnError extends boolean = false>(options?: Options<LogoutData, ThrowOnError>) => RequestResult<LogoutResponses, LogoutErrors, ThrowOnError>;
+export declare const listPeople: <ThrowOnError extends boolean = false>(options?: Options<ListPeopleData, ThrowOnError>) => RequestResult<ListPeopleResponses, ListPeopleErrors, ThrowOnError>;
+export declare const enrollPerson: <ThrowOnError extends boolean = false>(options: Options<EnrollPersonData, ThrowOnError>) => RequestResult<EnrollPersonResponses, EnrollPersonErrors, ThrowOnError>;
+export declare const removePerson: <ThrowOnError extends boolean = false>(options: Options<RemovePersonData, ThrowOnError>) => RequestResult<RemovePersonResponses, RemovePersonErrors, ThrowOnError>;
+export declare const prepareTeam: <ThrowOnError extends boolean = false>(options?: Options<PrepareTeamData, ThrowOnError>) => RequestResult<PrepareTeamResponses, PrepareTeamErrors, ThrowOnError>;
+export declare const setPersonRole: <ThrowOnError extends boolean = false>(options: Options<SetPersonRoleData, ThrowOnError>) => RequestResult<SetPersonRoleResponses, SetPersonRoleErrors, ThrowOnError>;
+export declare const listInvitations: <ThrowOnError extends boolean = false>(options?: Options<ListInvitationsData, ThrowOnError>) => RequestResult<ListInvitationsResponses, ListInvitationsErrors, ThrowOnError>;
+export declare const createInvitation: <ThrowOnError extends boolean = false>(options: Options<CreateInvitationData, ThrowOnError>) => RequestResult<CreateInvitationResponses, CreateInvitationErrors, ThrowOnError>;
+export declare const revokeInvitation: <ThrowOnError extends boolean = false>(options: Options<RevokeInvitationData, ThrowOnError>) => RequestResult<RevokeInvitationResponses, RevokeInvitationErrors, ThrowOnError>;

package/services/access/generated/sdk.gen.js

@@ -0,0 +1,107 @@
+// This file is auto-generated by @hey-api/openapi-ts
+import { client } from './client.gen.js';
+export const health = (options) => (options?.client ?? client).get({ url: '/_clawscarf/health', ...options });
+export const startLogin = (options) => (options?.client ?? client).get({ url: '/_clawscarf/login', ...options });
+export const completeLogin = (options) => (options.client ?? client).get({ url: '/_clawscarf/callback', ...options });
+export const session = (options) => (options?.client ?? client).get({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }],
+    url: '/_clawscarf/session',
+    ...options
+});
+export const logout = (options) => (options?.client ?? client).post({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }, { name: 'x-csrf-token', type: 'apiKey' }],
+    url: '/_clawscarf/logout',
+    ...options
+});
+export const listPeople = (options) => (options?.client ?? client).get({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }],
+    url: '/_clawscarf/people',
+    ...options
+});
+export const enrollPerson = (options) => (options.client ?? client).post({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }, { name: 'x-csrf-token', type: 'apiKey' }],
+    url: '/_clawscarf/people',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+export const removePerson = (options) => (options.client ?? client).delete({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }, { name: 'x-csrf-token', type: 'apiKey' }],
+    url: '/_clawscarf/people/{userId}',
+    ...options
+});
+export const prepareTeam = (options) => (options?.client ?? client).post({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }, { name: 'x-csrf-token', type: 'apiKey' }],
+    url: '/_clawscarf/team',
+    ...options
+});
+export const setPersonRole = (options) => (options.client ?? client).put({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }, { name: 'x-csrf-token', type: 'apiKey' }],
+    url: '/_clawscarf/people/{userId}/role',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+export const listInvitations = (options) => (options?.client ?? client).get({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }],
+    url: '/_clawscarf/invitations',
+    ...options
+});
+export const createInvitation = (options) => (options.client ?? client).post({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }, { name: 'x-csrf-token', type: 'apiKey' }],
+    url: '/_clawscarf/invitations',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+export const revokeInvitation = (options) => (options.client ?? client).delete({
+    security: [{
+            in: 'cookie',
+            name: 'clawscarf_session',
+            type: 'apiKey'
+        }, { name: 'x-csrf-token', type: 'apiKey' }],
+    url: '/_clawscarf/invitations/{invitationId}',
+    ...options
+});