@cloud-cli/on 1.62.1 → 1.63.1

package/dist/api-key-repository.d.ts

@@ -1,4 +1,4 @@
-export declare const API_KEY_SCOPES: readonly ["workflows:read", "workflows:write", "logs:read", "artifacts:read", "runs:control", "runs:dispatch", "workers:read"];
+export declare const API_KEY_SCOPES: readonly ["workflows:read", "workflows:write", "logs:read", "artifacts:read", "runs:control", "runs:dispatch", "workers:read", "secrets:read", "secrets:write"];
 export type ApiKeyScope = (typeof API_KEY_SCOPES)[number];
 export declare class ApiKeyRepository {
     init(): Promise<void>;
@@ -6,7 +6,7 @@ export declare class ApiKeyRepository {
     issue(name: string, scopes: string[]): Promise<{
         id: `${string}-${string}-${string}-${string}-${string}`;
         name: string;
-        scopes: ("workflows:read" | "workflows:write" | "logs:read" | "artifacts:read" | "runs:control" | "runs:dispatch" | "workers:read")[];
+        scopes: ("workflows:read" | "workflows:write" | "logs:read" | "artifacts:read" | "runs:control" | "runs:dispatch" | "workers:read" | "secrets:read" | "secrets:write")[];
         token: string;
     }>;
     scopesForToken(token: string): Promise<string[] | null>;

package/dist/api-key-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-repository.d.ts","sourceRoot":"","sources":["../src/api-key-repository.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,gIAAiI,CAAC;AAC7J,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,qBAAa,gBAAgB;IACrB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB,IAAI;IAKJ,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;;IAUpC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAQvD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI3C"}
+{"version":3,"file":"api-key-repository.d.ts","sourceRoot":"","sources":["../src/api-key-repository.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,cAAc,iKAAkK,CAAC;AAC9L,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,qBAAa,gBAAgB;IACrB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB,IAAI;IAKJ,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;;;;;;IAUpC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAQvD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI3C"}

package/dist/config.d.ts

@@ -5,5 +5,6 @@ export declare function printHelp(): void;
 export declare function loadFromArgs(): Promise<{
     config: RunnerConfig | null;
     command: string;
+    subject?: string;
 }>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGjE,wBAAsB,UAAU,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAuBrE;AAED,wBAAgB,aAAa,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,GAAG,YAAY,CAqC7G;AAED,wBAAgB,SAAS,SAuBxB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB9F"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGjE,wBAAsB,UAAU,CAAC,MAAM,KAAA,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAuBrE;AAED,wBAAgB,aAAa,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,GAAG,YAAY,CAqC7G;AAED,wBAAgB,SAAS,SAwBxB;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC;IAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyBhH"}

package/dist/oidc-user-repository-BNQF3qnb.js

@@ -0,0 +1,2 @@
+import { t as e } from "./oidc-user-repository-CiprwzOj.js";
+export { e as OidcUserRepository };

package/dist/oidc-user-repository-CiprwzOj.js

@@ -0,0 +1,24 @@
+import { t as e } from "./db-client-BvMkK1lx.js";
+//#region src/oidc-user-repository.ts
+var t = class {
+	async init() {
+		await e.exec("CREATE TABLE IF NOT EXISTS oidc_users (\n      subject TEXT PRIMARY KEY, email TEXT, name TEXT, photo TEXT,\n      role TEXT NOT NULL DEFAULT 'user',\n      created_at DATETIME DEFAULT CURRENT_TIMESTAMP,\n      updated_at DATETIME DEFAULT CURRENT_TIMESTAMP\n    )");
+	}
+	async upsert(t) {
+		await e.run("INSERT INTO oidc_users (subject, email, name, photo) VALUES (?, ?, ?, ?)\n      ON CONFLICT(subject) DO UPDATE SET email = excluded.email, name = excluded.name, photo = excluded.photo, updated_at = CURRENT_TIMESTAMP", [
+			t.id,
+			t.email || null,
+			t.name || null,
+			t.photo || null
+		]);
+	}
+	async role(t) {
+		return (await e.get("SELECT role FROM oidc_users WHERE subject = ?", [t]))?.role === "admin" ? "admin" : "user";
+	}
+	async promote(t) {
+		let n = await e.run("UPDATE oidc_users SET role = 'admin', updated_at = CURRENT_TIMESTAMP WHERE subject = ?", [t]);
+		return Number(n?.changes || 0) > 0;
+	}
+};
+//#endregion
+export { t };

package/dist/oidc-user-repository.d.ts

@@ -0,0 +1,9 @@
+import type { OidcUser } from './oidc.js';
+export type OidcRole = 'user' | 'admin';
+export declare class OidcUserRepository {
+    init(): Promise<void>;
+    upsert(user: OidcUser): Promise<void>;
+    role(subject: string): Promise<OidcRole>;
+    promote(subject: string): Promise<boolean>;
+}
+//# sourceMappingURL=oidc-user-repository.d.ts.map

package/dist/oidc-user-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-user-repository.d.ts","sourceRoot":"","sources":["../src/oidc-user-repository.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAExC,qBAAa,kBAAkB;IACvB,IAAI;IASJ,MAAM,CAAC,IAAI,EAAE,QAAQ;IAMrB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAKxC,OAAO,CAAC,OAAO,EAAE,MAAM;CAI9B"}

package/dist/oidc.d.ts

@@ -24,6 +24,8 @@ export declare class OidcClient {
         cookie: string;
     }>;
     userFromCookie(cookieHeader: string | undefined): OidcUser | undefined;
+    setRole(cookieHeader: string, role: 'user' | 'admin'): void;
+    roleFromCookie(cookieHeader: string | undefined): "user" | "admin" | undefined;
     accessTokenFromCookie(cookieHeader: string | undefined): {
         accessToken: string;
         expiresAt: number;

package/dist/oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAmBD,qBAAa,UAAU;IACrB,OAAO,CAAC,qBAAqB,CAAC,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;gBAE3C,MAAM,EAAE,UAAU;IAI9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,IAAI,OAAO,YAEV;IAED,IAAI,QAAQ,WAEX;IAEK,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYhE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCpH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS;IAKtE,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS;;;;IAMhD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAUvD,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,WAAW,CAAC,EAAE,MAAM;IAUlH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS;IAM5C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,WAAW;YAOL,cAAc;IAa5B,OAAO,CAAC,KAAK;CAKd"}
+{"version":3,"file":"oidc.d.ts","sourceRoot":"","sources":["../src/oidc.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAoBD,qBAAa,UAAU;IACrB,OAAO,CAAC,qBAAqB,CAAC,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;gBAE3C,MAAM,EAAE,UAAU;IAI9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,IAAI,OAAO,YAEV;IAED,IAAI,QAAQ,WAEX;IAEK,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYhE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCpH,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS;IAKtE,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAMpD,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS;IAI/C,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS;;;;IAMhD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC;IAUvD,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,WAAW,CAAC,EAAE,MAAM;IAUlH,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS;IAM5C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,WAAW;YAOL,cAAc;IAa5B,OAAO,CAAC,KAAK;CAKd"}

package/dist/on.js

@@ -41,7 +41,7 @@ function u(e, t) {
 	};
 }
 function d() {
-	console.log("\n🏃 Runner CLI 🏃\n\nUsage:\n  npx -y @cloud-cli/on <command> [options]\n  pnpm dlx -y @cloud-cli/on <command> [options]\n\nCommands:\n    start-server    Runs Webhook Ingress Server only (API Gateway mode)\n    start-scheduler Runs cron and solar workflow triggers\n    start-workers   Runs event-driven workers (Scalable Worker mode)\n\nOptions:\n  -c, --config     Path to runner.config.mjs (default: ./runner.config.mjs, env: RUNNER_CONFIG_PATH)\n   -d, --database   Node.js database module URL (env: DATABASE_URL)\n  -p, --port       Port for Webhook Ingress Server (default: 11235, env: PORT)\n   -k, --workers    Maximum concurrent jobs (default: 5, env: RUNNER_WORKERS)\n                    Worker tags (comma-separated env: RUNNER_TAGS)\n                    Webhook server URL (env: RUNNER_SERVER_URL)\n                    OIDC settings (env: RUNNER_OIDC_PROVIDER_URL, RUNNER_OIDC_CLIENT_ID, RUNNER_OIDC_CLIENT_SECRET)\n    -h, --help       Show this help message\n  ");
+	console.log("\n🏃 Runner CLI 🏃\n\nUsage:\n  npx -y @cloud-cli/on <command> [options]\n  pnpm dlx -y @cloud-cli/on <command> [options]\n\nCommands:\n    start-server    Runs Webhook Ingress Server only (API Gateway mode)\n    start-scheduler Runs cron and solar workflow triggers\n    start-workers   Runs event-driven workers (Scalable Worker mode)\n    promote-admin   Promote an existing OIDC user (requires --subject)\n\nOptions:\n  -c, --config     Path to runner.config.mjs (default: ./runner.config.mjs, env: RUNNER_CONFIG_PATH)\n   -d, --database   Node.js database module URL (env: DATABASE_URL)\n  -p, --port       Port for Webhook Ingress Server (default: 11235, env: PORT)\n   -k, --workers    Maximum concurrent jobs (default: 5, env: RUNNER_WORKERS)\n                    Worker tags (comma-separated env: RUNNER_TAGS)\n                    Webhook server URL (env: RUNNER_SERVER_URL)\n                    OIDC settings (env: RUNNER_OIDC_PROVIDER_URL, RUNNER_OIDC_CLIENT_ID, RUNNER_OIDC_CLIENT_SECRET)\n    -h, --help       Show this help message\n  ");
 }
 async function f() {
 	let { values: e, positionals: t } = c({
@@ -64,6 +64,7 @@ async function f() {
 				type: "string",
 				short: "k"
 			},
+			subject: { type: "string" },
 			help: {
 				type: "boolean",
 				short: "h"
@@ -72,7 +73,8 @@ async function f() {
 	});
 	return e.help && (d(), process.exit(0)), {
 		config: await l(e),
-		command: t[0] || "start"
+		command: t[0] || "start",
+		subject: e.subject
 	};
 }
 //#endregion
@@ -94,37 +96,46 @@ function p() {
 //#region src/index.ts
 async function m() {
 	p();
-	let { config: e, command: t } = await f();
+	let { config: e, command: t, subject: n } = await f();
 	if (!e) {
 		process.exitCode = 1;
 		return;
 	}
-	let [{ QueueManager: n }, { SecretStore: r }, { WebhookServer: i }, { startWorkers: a }, { WorkflowRepository: o }, { WorkflowScheduler: s }] = await Promise.all([
+	let [{ QueueManager: r }, { SecretStore: i }, { WebhookServer: a }, { startWorkers: o }, { WorkflowRepository: s }, { WorkflowScheduler: c }, { OidcUserRepository: l }] = await Promise.all([
 		import("./queue-DhXXzxm3.js"),
 		import("./secrets-DhkqmawU.js"),
-		import("./server-Bsv8pJk2.js"),
+		import("./server-DwdQsiqw.js"),
 		import("./worker-BwNyfSpp.js"),
 		import("./workflows-DQQIVH7c.js"),
-		import("./scheduler-2d1UPcxM.js")
-	]), c = new r(), l = new n(process.env.WORKER_NAME || "cli");
+		import("./scheduler-2d1UPcxM.js"),
+		import("./oidc-user-repository-BNQF3qnb.js")
+	]);
+	if (t === "promote-admin") {
+		if (!n) throw Error("Usage: on promote-admin --subject <oidc-subject>");
+		let e = new l();
+		if (await e.init(), !await e.promote(n)) throw Error(`OIDC user not found: ${n}`);
+		console.log(`Promoted OIDC user ${n} to admin.`);
+		return;
+	}
+	let u = new i(), m = new r(process.env.WORKER_NAME || "cli");
 	switch (t) {
 		case "start-server":
-			console.log("🌐 Starting Ingress Gateway..."), await l.init(), await i.withPort({
+			console.log("🌐 Starting Ingress Gateway..."), await m.init(), await a.withPort({
 				config: e,
-				queue: l,
-				secrets: c,
+				queue: m,
+				secrets: u,
 				adminToken: e.adminToken,
 				port: e.port
 			});
 			break;
 		case "start-workers":
-			console.log(`⚙️ Starting worker scheduler with ${e.workers} concurrent slot(s)...`), await l.init(), a(e.workers, l, c, e);
+			console.log(`⚙️ Starting worker scheduler with ${e.workers} concurrent slot(s)...`), await m.init(), o(e.workers, m, u, e);
 			break;
 		case "start-scheduler": {
-			console.log("Starting workflow scheduler..."), await l.init();
-			let t = new o();
+			console.log("Starting workflow scheduler..."), await m.init();
+			let t = new s();
 			await t.init();
-			let n = new s(l, t, e);
+			let n = new c(m, t, e);
 			n.start();
 			let r = () => {
 				n.stop(), process.exit(0);