@companyhelm/cli 0.0.12 → 0.1.4

package/dist/core/runtime/PublicImageTagRegistry.js

@@ -0,0 +1,148 @@
+import { buildManagedImageReference, getManagedImageDefinition } from "./ManagedImages.js";
+const RETRYABLE_STATUS_CODES = new Set([429, 500, 502, 503, 504]);
+const MAX_FETCH_ATTEMPTS = 3;
+const DEFAULT_RETRY_DELAY_MS = 250;
+class PublicRegistryRequestError extends Error {
+    status;
+    retryAfterMs;
+    constructor(url, status, retryAfterMs) {
+        super(`Public registry returned ${status} for ${url}.`);
+        this.status = status;
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+export class PublicImageTagRegistry {
+    async listAvailableTags(service, limit = 20) {
+        if (!Number.isInteger(limit) || limit < 1) {
+            throw new Error("Image tag limit must be a positive integer.");
+        }
+        const { repositoryPath } = getManagedImageDefinition(service);
+        const token = await this.fetchToken(repositoryPath);
+        const response = await fetch(`https://public.ecr.aws/v2/${repositoryPath}/tags/list`, {
+            headers: {
+                Authorization: `Bearer ${token}`
+            }
+        });
+        if (!response.ok) {
+            throw new Error(`Public registry returned ${response.status} for ${service} tags.`);
+        }
+        const payload = (await response.json());
+        if (payload.errors?.length) {
+            throw new Error(payload.errors[0]?.message || `Unable to load ${service} image tags.`);
+        }
+        const uniqueTags = [...new Set(payload.tags ?? [])].map((tag, position) => ({ tag, position }));
+        const createdAtByDigest = new Map();
+        const tagsWithMetadata = [];
+        for (const { tag, position } of uniqueTags) {
+            tagsWithMetadata.push({
+                tag,
+                position,
+                createdAt: await this.fetchCreatedAt(repositoryPath, token, tag, createdAtByDigest)
+            });
+        }
+        return tagsWithMetadata
+            .sort((left, right) => {
+            const leftTimestamp = left.createdAt ? Date.parse(left.createdAt) : Number.NEGATIVE_INFINITY;
+            const rightTimestamp = right.createdAt ? Date.parse(right.createdAt) : Number.NEGATIVE_INFINITY;
+            if (rightTimestamp !== leftTimestamp) {
+                return rightTimestamp - leftTimestamp;
+            }
+            return left.position - right.position;
+        })
+            .slice(0, limit)
+            .map(({ tag, createdAt }) => ({ tag, createdAt }));
+    }
+    buildImageReference(service, tag) {
+        return buildManagedImageReference(service, tag);
+    }
+    async fetchToken(repositoryPath) {
+        const scope = `repository:${repositoryPath}:pull`;
+        const response = await fetch(`https://public.ecr.aws/token/?service=public.ecr.aws&scope=${encodeURIComponent(scope)}`);
+        if (!response.ok) {
+            throw new Error(`Public registry token request returned ${response.status}.`);
+        }
+        const payload = (await response.json());
+        if (!payload.token) {
+            throw new Error("Public registry token response did not include a token.");
+        }
+        return payload.token;
+    }
+    async fetchCreatedAt(repositoryPath, token, tag, createdAtByDigest) {
+        try {
+            const manifestReference = await this.fetchJson(`https://public.ecr.aws/v2/${repositoryPath}/manifests/${encodeURIComponent(tag)}`, {
+                Authorization: `Bearer ${token}`,
+                Accept: [
+                    "application/vnd.oci.image.index.v1+json",
+                    "application/vnd.docker.distribution.manifest.list.v2+json",
+                    "application/vnd.oci.image.manifest.v1+json",
+                    "application/vnd.docker.distribution.manifest.v2+json"
+                ].join(", ")
+            });
+            const digest = this.selectManifestDigest(manifestReference);
+            const manifest = digest
+                ? await this.fetchJson(`https://public.ecr.aws/v2/${repositoryPath}/manifests/${encodeURIComponent(digest)}`, {
+                    Authorization: `Bearer ${token}`,
+                    Accept: ["application/vnd.oci.image.manifest.v1+json", "application/vnd.docker.distribution.manifest.v2+json"].join(", ")
+                })
+                : manifestReference;
+            const configDigest = "config" in manifest ? manifest.config?.digest : undefined;
+            if (!configDigest) {
+                return undefined;
+            }
+            if (createdAtByDigest.has(configDigest)) {
+                return createdAtByDigest.get(configDigest);
+            }
+            const config = await this.fetchJson(`https://public.ecr.aws/v2/${repositoryPath}/blobs/${configDigest}`, {
+                Authorization: `Bearer ${token}`
+            });
+            createdAtByDigest.set(configDigest, config.created);
+            return config.created;
+        }
+        catch (error) {
+            if (error instanceof PublicRegistryRequestError) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    selectManifestDigest(manifest) {
+        if (!("manifests" in manifest) || !manifest.manifests?.length) {
+            return undefined;
+        }
+        return (manifest.manifests.find((entry) => entry.platform?.os === "linux" && entry.platform?.architecture === "amd64")
+            ?.digest ?? manifest.manifests[0]?.digest);
+    }
+    async fetchJson(url, headers) {
+        for (let attempt = 1; attempt <= MAX_FETCH_ATTEMPTS; attempt += 1) {
+            const response = await fetch(url, { headers });
+            if (response.ok) {
+                return (await response.json());
+            }
+            const retryAfterMs = this.parseRetryAfterMs(response);
+            if (attempt < MAX_FETCH_ATTEMPTS && RETRYABLE_STATUS_CODES.has(response.status)) {
+                await this.sleep(retryAfterMs ?? DEFAULT_RETRY_DELAY_MS * attempt);
+                continue;
+            }
+            throw new PublicRegistryRequestError(url, response.status, retryAfterMs);
+        }
+        throw new PublicRegistryRequestError(url, 500);
+    }
+    parseRetryAfterMs(response) {
+        const retryAfter = response.headers.get("retry-after");
+        if (!retryAfter) {
+            return undefined;
+        }
+        const retryAfterSeconds = Number.parseInt(retryAfter, 10);
+        if (Number.isFinite(retryAfterSeconds)) {
+            return Math.max(retryAfterSeconds, 0) * 1000;
+        }
+        const retryAt = Date.parse(retryAfter);
+        if (Number.isNaN(retryAt)) {
+            return undefined;
+        }
+        return Math.max(retryAt - Date.now(), 0);
+    }
+    async sleep(delayMs) {
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+    }
+}

package/dist/core/runtime/RuntimePaths.d.ts

@@ -0,0 +1,12 @@
+export declare class RuntimePaths {
+    private readonly root;
+    constructor(root: string);
+    stateFilePath(): string;
+    composeFilePath(): string;
+    apiConfigPath(): string;
+    frontendConfigPath(): string;
+    seedFilePath(): string;
+    runnerConfigPath(): string;
+    runnerStateDbPath(): string;
+    runnerLogPath(): string;
+}

package/dist/core/runtime/RuntimePaths.js

@@ -0,0 +1,31 @@
+import path from "node:path";
+export class RuntimePaths {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    stateFilePath() {
+        return path.join(this.root, "state.json");
+    }
+    composeFilePath() {
+        return path.join(this.root, "docker-compose.yaml");
+    }
+    apiConfigPath() {
+        return path.join(this.root, "api-config.yaml");
+    }
+    frontendConfigPath() {
+        return path.join(this.root, "frontend-config.yaml");
+    }
+    seedFilePath() {
+        return path.join(this.root, "seed.sql");
+    }
+    runnerConfigPath() {
+        return path.join(this.root, "runner");
+    }
+    runnerStateDbPath() {
+        return path.join(this.runnerConfigPath(), "state.db");
+    }
+    runnerLogPath() {
+        return path.join(this.runnerConfigPath(), "daemon.log");
+    }
+}

package/dist/core/runtime/RuntimeState.d.ts

@@ -0,0 +1,24 @@
+export interface RuntimePorts {
+    apiHttp: number;
+    ui: number;
+    runnerGrpc: number;
+    agentCliGrpc: number;
+}
+export interface RuntimeState {
+    version: 1;
+    company: {
+        id: string;
+        name: string;
+    };
+    auth: {
+        username: string;
+        password: string;
+        jwtPrivateKeyPem: string;
+        jwtPublicKeyPem: string;
+    };
+    runner: {
+        name: string;
+        secret: string;
+    };
+    ports: RuntimePorts;
+}

package/dist/core/runtime/RuntimeState.js

@@ -0,0 +1 @@
+export {};

package/dist/core/runtime/RuntimeStateStore.d.ts

@@ -0,0 +1,10 @@
+import type { RuntimeState } from "./RuntimeState.js";
+export declare class RuntimeStateStore {
+    private readonly root;
+    private readonly runtimePaths;
+    private static readonly DEFAULT_USERNAME;
+    constructor(root: string);
+    initialize(): RuntimeState;
+    load(): RuntimeState | null;
+    private save;
+}

package/dist/core/runtime/RuntimeStateStore.js

@@ -0,0 +1,58 @@
+import fs from "node:fs";
+import { PortAllocator } from "./PortAllocator.js";
+import { RuntimePaths } from "./RuntimePaths.js";
+import { createPemKeyPair, randomCompanyId, randomSecret } from "./Secrets.js";
+export class RuntimeStateStore {
+    root;
+    runtimePaths;
+    static DEFAULT_USERNAME = "admin@local";
+    constructor(root) {
+        this.root = root;
+        this.runtimePaths = new RuntimePaths(root);
+    }
+    initialize() {
+        const existingState = this.load();
+        if (existingState) {
+            return existingState;
+        }
+        fs.mkdirSync(this.root, { recursive: true });
+        const authKeys = createPemKeyPair();
+        const state = {
+            version: 1,
+            company: {
+                id: randomCompanyId(),
+                name: "Local CompanyHelm"
+            },
+            auth: {
+                username: RuntimeStateStore.DEFAULT_USERNAME,
+                password: randomSecret(),
+                jwtPrivateKeyPem: authKeys.privateKeyPem,
+                jwtPublicKeyPem: authKeys.publicKeyPem
+            },
+            runner: {
+                name: "local-runner",
+                secret: randomSecret()
+            },
+            ports: new PortAllocator().allocate()
+        };
+        this.save(state);
+        return state;
+    }
+    load() {
+        if (!fs.existsSync(this.runtimePaths.stateFilePath())) {
+            return null;
+        }
+        const state = JSON.parse(fs.readFileSync(this.runtimePaths.stateFilePath(), "utf8"));
+        if (state.auth.username !== RuntimeStateStore.DEFAULT_USERNAME && state.auth.username === "admin") {
+            state.auth.username = RuntimeStateStore.DEFAULT_USERNAME;
+            this.save(state);
+        }
+        return state;
+    }
+    save(state) {
+        fs.writeFileSync(this.runtimePaths.stateFilePath(), `${JSON.stringify(state, null, 2)}\n`, {
+            encoding: "utf8",
+            mode: 0o600
+        });
+    }
+}

package/dist/core/runtime/Secrets.d.ts

@@ -0,0 +1,10 @@
+export declare function randomSecret(length?: number): string;
+export declare function randomCompanyId(): string;
+export declare function createPasswordHash(password: string): {
+    passwordSalt: string;
+    passwordHash: string;
+};
+export declare function createPemKeyPair(): {
+    privateKeyPem: string;
+    publicKeyPem: string;
+};

package/dist/core/runtime/Secrets.js

@@ -0,0 +1,26 @@
+import { generateKeyPairSync, randomBytes, randomUUID, scryptSync } from "node:crypto";
+export function randomSecret(length = 24) {
+    return randomBytes(length).toString("base64url");
+}
+export function randomCompanyId() {
+    return randomUUID();
+}
+export function createPasswordHash(password) {
+    const passwordSalt = randomBytes(16).toString("hex");
+    const passwordHash = scryptSync(password, passwordSalt, 64).toString("hex");
+    return {
+        passwordSalt,
+        passwordHash
+    };
+}
+export function createPemKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+        modulusLength: 2048,
+        privateKeyEncoding: { format: "pem", type: "pkcs1" },
+        publicKeyEncoding: { format: "pem", type: "pkcs1" }
+    });
+    return {
+        privateKeyPem: privateKey,
+        publicKeyPem: publicKey
+    };
+}

package/dist/core/runtime/VersionCatalog.d.ts

@@ -0,0 +1,10 @@
+import { type RuntimeImages } from "./ImageCatalog.js";
+export interface RuntimeVersions {
+    cliPackage: string;
+    runnerPackage: string;
+    images: RuntimeImages;
+}
+export declare class VersionCatalog {
+    resolve(): RuntimeVersions;
+    private readPackageVersion;
+}

package/dist/core/runtime/VersionCatalog.js

@@ -0,0 +1,21 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { ImageCatalog } from "./ImageCatalog.js";
+const require = createRequire(import.meta.url);
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+export class VersionCatalog {
+    resolve() {
+        return {
+            cliPackage: this.readPackageVersion(path.resolve(__dirname, "../../../package.json")),
+            runnerPackage: this.readPackageVersion(require.resolve("@companyhelm/runner/package.json")),
+            images: new ImageCatalog().resolve()
+        };
+    }
+    readPackageVersion(packageJsonPath) {
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        return `${packageJson.name}@${packageJson.version}`;
+    }
+}

package/dist/core/status/StatusService.d.ts

@@ -0,0 +1,16 @@
+export type ManagedServiceStatus = "running" | "stopped";
+export interface StatusSnapshot {
+    postgres: ManagedServiceStatus;
+    api: ManagedServiceStatus;
+    frontend: ManagedServiceStatus;
+    runner: ManagedServiceStatus;
+}
+export interface StatusOverrides {
+    runner?: () => Promise<boolean> | boolean;
+}
+export declare class StatusService {
+    private readonly listRunningServices;
+    private readonly overrides;
+    constructor(listRunningServices: () => Promise<string>, overrides?: StatusOverrides);
+    read(): Promise<StatusSnapshot>;
+}

package/dist/core/status/StatusService.js

@@ -0,0 +1,21 @@
+export class StatusService {
+    listRunningServices;
+    overrides;
+    constructor(listRunningServices, overrides = {}) {
+        this.listRunningServices = listRunningServices;
+        this.overrides = overrides;
+    }
+    async read() {
+        const running = new Set((await this.listRunningServices())
+            .split("\n")
+            .map((service) => service.trim())
+            .filter(Boolean));
+        const runnerRunning = this.overrides.runner ? await this.overrides.runner() : running.has("runner");
+        return {
+            postgres: running.has("postgres") ? "running" : "stopped",
+            api: running.has("api") ? "running" : "stopped",
+            frontend: running.has("frontend") ? "running" : "stopped",
+            runner: runnerRunning ? "running" : "stopped"
+        };
+    }
+}

package/dist/core/ui/TerminalRenderer.d.ts

@@ -0,0 +1,17 @@
+import type { StatusReport } from "../../commands/dependencies.js";
+export declare class TerminalRenderer {
+    private readonly useColor;
+    private static readonly OSC;
+    private static readonly BEL;
+    constructor(useColor?: boolean);
+    renderBanner(): string;
+    success(message: string): string;
+    progress(message: string): string;
+    successHighlight(message: string): string;
+    clickableUrl(url: string): string;
+    renderStatus(report: StatusReport): string;
+    private renderServiceLine;
+    private warn;
+    private formatDetail;
+    private colorize;
+}

package/dist/core/ui/TerminalRenderer.js

@@ -0,0 +1,71 @@
+import chalk from "chalk";
+import figlet from "figlet";
+export class TerminalRenderer {
+    useColor;
+    static OSC = "\u001B]";
+    static BEL = "\u0007";
+    constructor(useColor = true) {
+        this.useColor = useColor;
+    }
+    renderBanner() {
+        const banner = figlet.textSync("COMPANYHELM", {
+            horizontalLayout: "fitted"
+        });
+        return this.colorize(`COMPANYHELM\n${banner}`, "cyan");
+    }
+    success(message) {
+        return `${this.colorize("[ok]", "green")} ${message}`;
+    }
+    progress(message) {
+        return this.colorize(`... ${message}`, "cyan");
+    }
+    successHighlight(message) {
+        if (!this.useColor) {
+            return message;
+        }
+        return chalk.green.bold(message);
+    }
+    clickableUrl(url) {
+        if (!this.useColor) {
+            return url;
+        }
+        const display = this.successHighlight(url);
+        return `${TerminalRenderer.OSC}8;;${url}${TerminalRenderer.BEL}${display}${TerminalRenderer.OSC}8;;${TerminalRenderer.BEL}`;
+    }
+    renderStatus(report) {
+        const lines = ["Status"];
+        lines.push(this.renderServiceLine("Postgres", report.services.postgres));
+        lines.push(this.renderServiceLine("API", report.services.api, report.apiUrl));
+        lines.push(this.renderServiceLine("Frontend", report.services.frontend, report.uiUrl));
+        lines.push(this.renderServiceLine("Runner", report.services.runner));
+        if (report.versions) {
+            lines.push(`CompanyHelm CLI: ${report.versions.cliPackage}`);
+            lines.push(`Runner package: ${report.versions.runnerPackage}`);
+            lines.push(`API image: ${report.versions.images.api}`);
+            lines.push(`Frontend image: ${report.versions.images.frontend}`);
+            lines.push(`Postgres image: ${report.versions.images.postgres}`);
+        }
+        if (report.username) {
+            lines.push(`username: ${report.username}`);
+        }
+        return lines.join("\n");
+    }
+    renderServiceLine(label, status, detail) {
+        const statusLabel = status === "running" ? this.success("running") : this.warn("stopped");
+        return detail && status === "running"
+            ? `${label}: ${statusLabel} (${this.formatDetail(detail)})`
+            : `${label}: ${statusLabel}`;
+    }
+    warn(message) {
+        return `${this.colorize("[!]", "yellow")} ${message}`;
+    }
+    formatDetail(detail) {
+        return detail.startsWith("http://") || detail.startsWith("https://") ? this.clickableUrl(detail) : detail;
+    }
+    colorize(text, color) {
+        if (!this.useColor) {
+            return text;
+        }
+        return chalk[color](text);
+    }
+}

package/dist/templates/docker-compose.yaml.tpl

@@ -0,0 +1,39 @@
+services:
+  postgres:
+    image: {{POSTGRES_IMAGE}}
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: companyhelm
+    volumes:
+      - companyhelm_postgres_data:/var/lib/postgresql/data
+      - "{{SEED_FILE_PATH}}:/run/companyhelm/seed.sql:ro"
+    networks:
+      - companyhelm
+
+  api:
+    image: {{API_IMAGE}}
+    platform: linux/amd64
+    depends_on:
+      - postgres
+    env_file:
+      - "{{API_ENV_PATH}}"
+    environment:
+      COMPANYHELM_CONFIG_PATH: /run/companyhelm/config.yaml
+    ports:
+      - "{{API_HTTP_PORT}}:4000"
+      - "{{RUNNER_GRPC_PORT}}:{{RUNNER_GRPC_PORT}}"
+      - "{{AGENT_CLI_GRPC_PORT}}:{{AGENT_CLI_GRPC_PORT}}"
+    volumes:
+      - "{{API_CONFIG_PATH}}:/run/companyhelm/config.yaml:ro"
+    networks:
+      - companyhelm
+
+{{FRONTEND_SERVICE_BLOCK}}
+
+networks:
+  companyhelm:
+    driver: bridge
+
+volumes:
+  companyhelm_postgres_data:

package/dist/templates/seed.sql.tpl

@@ -0,0 +1,76 @@
+BEGIN;
+
+INSERT INTO companies (id, name)
+VALUES ('{{COMPANY_ID}}', '{{COMPANY_NAME}}')
+ON CONFLICT (id) DO UPDATE
+SET name = EXCLUDED.name;
+
+UPDATE users
+SET first_name = '{{USER_FIRST_NAME}}',
+    last_name = NULL,
+    email = '{{USER_EMAIL}}',
+    auth_provider = 'companyhelm',
+    updated_at = NOW()
+WHERE id = '{{USER_ID}}'
+   OR email = '{{USER_EMAIL}}';
+
+INSERT INTO users (id, first_name, last_name, email, auth_provider, created_at, updated_at)
+SELECT
+  '{{USER_ID}}',
+  '{{USER_FIRST_NAME}}',
+  NULL,
+  '{{USER_EMAIL}}',
+  'companyhelm',
+  NOW(),
+  NOW()
+WHERE NOT EXISTS (
+  SELECT 1
+  FROM users
+  WHERE id = '{{USER_ID}}'
+     OR email = '{{USER_EMAIL}}'
+);
+
+UPDATE user_auths
+SET user_id = '{{USER_ID}}',
+    email = '{{USER_EMAIL}}',
+    password_salt = '{{PASSWORD_SALT}}',
+    password_hash = '{{PASSWORD_HASH}}',
+    updated_at = NOW()
+WHERE user_id = '{{USER_ID}}'
+   OR email = '{{USER_EMAIL}}';
+
+INSERT INTO user_auths (id, user_id, email, password_salt, password_hash, created_at, updated_at)
+SELECT
+  '{{USER_AUTH_ID}}',
+  '{{USER_ID}}',
+  '{{USER_EMAIL}}',
+  '{{PASSWORD_SALT}}',
+  '{{PASSWORD_HASH}}',
+  NOW(),
+  NOW()
+WHERE NOT EXISTS (
+  SELECT 1
+  FROM user_auths
+  WHERE user_id = '{{USER_ID}}'
+     OR email = '{{USER_EMAIL}}'
+);
+
+INSERT INTO company_members (company_id, user_id)
+VALUES ('{{COMPANY_ID}}', '{{USER_ID}}')
+ON CONFLICT (company_id, user_id) DO NOTHING;
+
+INSERT INTO agent_runners (id, company_id, secret_hash, status, name)
+VALUES (
+  '{{RUNNER_ID}}',
+  '{{COMPANY_ID}}',
+  '{{RUNNER_SECRET_HASH}}',
+  'ready',
+  '{{RUNNER_NAME}}'
+)
+ON CONFLICT (id) DO UPDATE
+SET company_id = EXCLUDED.company_id,
+    secret_hash = EXCLUDED.secret_hash,
+    status = EXCLUDED.status,
+    name = EXCLUDED.name;
+
+COMMIT;