@corvio/admin-cli 0.1.0-beta.3 → 0.1.0-beta.4

package/dist/cli.js

@@ -12,6 +12,7 @@ import {
   option,
   readAdminCredential,
   readTextFile,
+  resolveNpmUpdateStatus,
   runMain,
   sleep,
   storeAdminCredential,
@@ -19,7 +20,7 @@ import {
   writeResult,
 } from "./core.js";
 
-const VERSION = "0.1.0-beta.3";
+const VERSION = "0.1.0-beta.4";
 const DEFAULT_API_BASE = "https://api.corvio.ai/v1";
 const USER_AGENT = `corvio-admin-cli/${VERSION}`;
 
@@ -37,6 +38,7 @@ Usage:
   corvio-admin worker-jobs list --purpose <reason>
   corvio-admin usage events|summary --purpose <reason>
   corvio-admin receipts get <id>
+  corvio-admin update check
 
 Authentication:
   CORVIO_ADMIN_API_KEY=cva_... takes precedence over the stored device-link login.
@@ -192,6 +194,20 @@ async function capabilities(options) {
   writeResult({ cli_version: VERSION, auth_source: credential.source, api: index, principal: identity }, { json: options.json });
 }
 
+async function updateCheck(options) {
+  const { api } = await client(options);
+  const index = await api.request("/admin");
+  const result = await resolveNpmUpdateStatus({
+    currentVersion: VERSION,
+    policy: index?.distribution?.admin_cli || {
+      package: "@corvio/admin-cli",
+      dist_tag: "beta",
+    },
+    userAgent: USER_AGENT,
+  });
+  writeResult(result, { json: options.json });
+}
+
 async function catalog(options) {
   const { api } = await client(options);
   writeResult(await api.request("/admin/data/catalog"), { json: options.json });
@@ -247,6 +263,7 @@ async function main({ options, positionals }) {
     throw new CliError("auth action must be login, status, or logout.");
   }
   if (command === "capabilities") return capabilities(options);
+  if (command === "update" && (action || "check") === "check") return updateCheck(options);
   if (command === "skill" && action === "download") return downloadSkill(options);
   if (command === "catalog") return catalog(options);
   if (command === "query") return query(options);

package/dist/core.js

@@ -105,10 +105,92 @@ export function normalizeApiBase(value, fallback) {
   return raw.endsWith("/v1") ? raw : `${raw}/v1`;
 }
 
+function parseSemver(value) {
+  const match = String(value || "").trim().match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/);
+  if (!match) return null;
+  return {
+    core: match.slice(1, 4).map((item) => Number.parseInt(item, 10)),
+    pre: match[4] ? match[4].split(".") : [],
+  };
+}
+
+export function compareVersions(left, right) {
+  const a = parseSemver(left);
+  const b = parseSemver(right);
+  if (!a || !b) return 0;
+  for (let index = 0; index < 3; index += 1) {
+    if (a.core[index] !== b.core[index]) return a.core[index] > b.core[index] ? 1 : -1;
+  }
+  if (a.pre.length === 0 && b.pre.length > 0) return 1;
+  if (b.pre.length === 0 && a.pre.length > 0) return -1;
+  for (let index = 0; index < Math.max(a.pre.length, b.pre.length); index += 1) {
+    if (a.pre[index] === undefined) return -1;
+    if (b.pre[index] === undefined) return 1;
+    if (a.pre[index] === b.pre[index]) continue;
+    const aNumber = /^\d+$/.test(a.pre[index]) ? Number.parseInt(a.pre[index], 10) : null;
+    const bNumber = /^\d+$/.test(b.pre[index]) ? Number.parseInt(b.pre[index], 10) : null;
+    if (aNumber !== null && bNumber !== null) return aNumber > bNumber ? 1 : -1;
+    if (aNumber !== null) return -1;
+    if (bNumber !== null) return 1;
+    return a.pre[index] > b.pre[index] ? 1 : -1;
+  }
+  return 0;
+}
+
+export async function resolveNpmUpdateStatus({
+  currentVersion,
+  policy,
+  userAgent,
+  allowRegistryFailure = false,
+  fetchImpl = globalThis.fetch,
+  registryBase = process.env.CORVIO_NPM_REGISTRY_BASE || "https://registry.npmjs.org",
+}) {
+  const packageName = String(policy?.package || "").trim();
+  const distTag = String(policy?.dist_tag || "beta").trim();
+  if (!packageName) throw new CliError("The API did not advertise an npm package.", { code: "update_policy_invalid" });
+  const encoded = encodeURIComponent(packageName).replace("%40", "@");
+  let latestVersion = null;
+  let registryError = null;
+  try {
+    const registry = String(registryBase).replace(/\/+$/, "");
+    const response = await fetchImpl(`${registry}/${encoded}`, {
+      headers: { accept: "application/json", "user-agent": userAgent },
+      signal: AbortSignal.timeout(2500),
+    });
+    if (!response.ok) throw new Error(`npm registry returned ${response.status}`);
+    const metadata = await response.json();
+    latestVersion = String(metadata?.["dist-tags"]?.[distTag] || "").trim() || null;
+  } catch (error) {
+    registryError = error instanceof Error ? error.message : String(error);
+    if (!allowRegistryFailure) {
+      throw new CliError(`Unable to check npm for updates: ${registryError}`, {
+        code: "update_check_failed",
+        exitCode: EXIT.REMOTE,
+      });
+    }
+  }
+  const minimum = String(policy.minimum_supported_version || "").trim() || null;
+  return {
+    package: packageName,
+    channel: String(policy.channel || distTag),
+    dist_tag: distTag,
+    current_version: currentVersion,
+    latest_published_version: latestVersion,
+    reviewed_version: String(policy.reviewed_version || "").trim() || null,
+    minimum_supported_version: minimum,
+    update_available: Boolean(latestVersion && compareVersions(latestVersion, currentVersion) > 0),
+    supported: minimum ? compareVersions(currentVersion, minimum) >= 0 : true,
+    install_command: String(policy.install_command || `npm install --global ${packageName}@${distTag}`),
+    automatic_install: false,
+    ...(registryError ? { registry_error: registryError } : {}),
+  };
+}
+
 export class ApiClient {
-  constructor({ baseUrl, credential = null, userAgent, fetchImpl = globalThis.fetch }) {
+  constructor({ baseUrl, credential = null, workspaceId = null, userAgent, fetchImpl = globalThis.fetch }) {
     this.baseUrl = baseUrl.replace(/\/+$/, "");
     this.credential = credential;
+    this.workspaceId = String(workspaceId || "").trim() || null;
     this.userAgent = userAgent;
     this.fetchImpl = fetchImpl;
   }
@@ -129,6 +211,10 @@ export class ApiClient {
         throw new CliError("Corvio authentication is required.", { code: "auth_required", exitCode: EXIT.AUTH });
       }
       requestHeaders.authorization = `Bearer ${this.credential}`;
+      if (this.workspaceId) {
+        requestHeaders["X-Corvio-Workspace-Id"] = this.workspaceId;
+        requestHeaders["X-Corvio-Workspace-Context-Contract"] = "required-v1";
+      }
     }
     let response;
     try {
@@ -179,6 +265,10 @@ export class ApiClient {
         throw new CliError("Corvio authentication is required.", { code: "auth_required", exitCode: EXIT.AUTH });
       }
       requestHeaders.authorization = `Bearer ${this.credential}`;
+      if (this.workspaceId) {
+        requestHeaders["X-Corvio-Workspace-Id"] = this.workspaceId;
+        requestHeaders["X-Corvio-Workspace-Context-Contract"] = "required-v1";
+      }
     }
     let response;
     try {
@@ -208,6 +298,31 @@ export class ApiClient {
     }
     return bytes;
   }
+
+  async putUrl(url, content, { headers = {} } = {}) {
+    let response;
+    try {
+      response = await this.fetchImpl(String(url), {
+        method: "PUT",
+        headers,
+        body: content,
+      });
+    } catch (cause) {
+      throw new CliError(`Unable to upload the file: ${cause instanceof Error ? cause.message : String(cause)}`, {
+        code: "upload_network_error",
+        exitCode: EXIT.REMOTE,
+      });
+    }
+    if (!response.ok) {
+      const message = (await response.text()).slice(0, 500);
+      throw new CliError(message || `File upload failed (${response.status}).`, {
+        code: "upload_failed",
+        status: response.status,
+        exitCode: EXIT.REMOTE,
+      });
+    }
+    return { ok: true, status: response.status };
+  }
 }
 
 function configRoot(env = process.env) {
@@ -220,6 +335,10 @@ export function workspaceCredentialPath(env = process.env) {
   return join(configRoot(env), "credentials.json");
 }
 
+export function workspaceContextPath(env = process.env) {
+  return join(configRoot(env), "workspace-context.json");
+}
+
 export function adminCredentialPath(env = process.env) {
   return join(configRoot(env), "admin-credentials.json");
 }
@@ -227,8 +346,8 @@ export function adminCredentialPath(env = process.env) {
 export async function readWorkspaceCredential(env = process.env) {
   const environmentKey = String(env.CORVIO_API_KEY || "").trim();
   if (environmentKey) {
-    if (!environmentKey.startsWith("cvk_")) {
-      throw new CliError("CORVIO_API_KEY must be a Workspace cvk_ key.", {
+    if (!environmentKey.startsWith("cvu_") && !environmentKey.startsWith("cvk_")) {
+      throw new CliError("CORVIO_API_KEY must be a user cvu_ key or legacy Workspace cvk_ key.", {
         code: "invalid_workspace_key",
         exitCode: EXIT.AUTH,
       });
@@ -245,14 +364,15 @@ export async function readWorkspaceCredential(env = process.env) {
   }
   const profileName = String(parsed.active_profile || "default");
   const profile = parsed.profiles?.[profileName];
-  const key = String(profile?.api_key || "").trim();
-  if (!key.startsWith("cvk_")) {
+  const metadata = String(parsed.api_key || "").trim() ? parsed : profile;
+  const key = String(metadata?.api_key || "").trim();
+  if (!key.startsWith("cvu_") && !key.startsWith("cvk_")) {
     throw new CliError("Stored Corvio credentials are invalid; run `corvio auth login` again.", {
       code: "credential_store_invalid",
       exitCode: EXIT.AUTH,
     });
   }
-  return { key, source: "device_link", profile: profileName, metadata: profile };
+  return { key, source: "device_link", profile: profileName, metadata };
 }
 
 export async function storeWorkspaceCredential(payload, env = process.env) {
@@ -260,28 +380,73 @@ export async function storeWorkspaceCredential(payload, env = process.env) {
   const root = dirname(path);
   await mkdir(root, { recursive: true, mode: 0o700 });
   await chmod(root, 0o700).catch(() => {});
-  const profileName = String(payload.workspace_id || "default");
+  const document = {
+    version: 2,
+    api_key: payload.secret,
+    key_id: payload.key_id,
+    audience: payload.audience || "user",
+    scopes: payload.scopes || [],
+    expires_at: payload.expires_at || null,
+    created_at: payload.created_at || new Date().toISOString(),
+    source: "device_link",
+  };
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(document, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+  await chmod(temporary, 0o600);
+  await rename(temporary, path);
+  await chmod(path, 0o600);
+  return { path, profile: "default" };
+}
+
+export async function readWorkspaceContext(env = process.env) {
+  const environmentWorkspaceId = String(env.CORVIO_WORKSPACE_ID || "").trim();
+  if (environmentWorkspaceId) {
+    return { workspaceId: environmentWorkspaceId, workspaceName: null, source: "environment" };
+  }
+  const path = workspaceContextPath(env);
+  try {
+    const parsed = JSON.parse(await readFile(path, "utf8"));
+    const workspaceId = String(parsed.active_workspace_id || "").trim();
+    if (!workspaceId) return null;
+    return {
+      workspaceId,
+      workspaceName: String(parsed.active_workspace_name || "").trim() || null,
+      source: "stored",
+    };
+  } catch (cause) {
+    if (cause?.code === "ENOENT") return null;
+    throw new CliError("Stored Corvio Workspace selection is unreadable.", {
+      code: "workspace_context_store_invalid",
+      exitCode: EXIT.AUTH,
+    });
+  }
+}
+
+export async function storeWorkspaceContext({ workspaceId, workspaceName = null }, env = process.env) {
+  const normalizedId = String(workspaceId || "").trim();
+  if (!normalizedId) throw new CliError("Workspace ID is required.", { code: "workspace_selection_required" });
+  const path = workspaceContextPath(env);
+  const root = dirname(path);
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  await chmod(root, 0o700).catch(() => {});
   const document = {
     version: 1,
-    active_profile: profileName,
-    profiles: {
-      [profileName]: {
-        api_key: payload.secret,
-        key_id: payload.key_id,
-        workspace_id: payload.workspace_id,
-        workspace_name: payload.workspace_name,
-        scopes: payload.scopes || [],
-        created_at: payload.created_at || new Date().toISOString(),
-        source: "device_link",
-      },
-    },
+    active_workspace_id: normalizedId,
+    active_workspace_name: String(workspaceName || "").trim() || null,
+    updated_at: new Date().toISOString(),
   };
   const temporary = `${path}.${randomUUID()}.tmp`;
   await writeFile(temporary, `${JSON.stringify(document, null, 2)}\n`, { mode: 0o600, flag: "wx" });
   await chmod(temporary, 0o600);
   await rename(temporary, path);
   await chmod(path, 0o600);
-  return { path, profile: profileName };
+  return { path, workspaceId: normalizedId };
+}
+
+export async function clearWorkspaceContext(env = process.env) {
+  const path = workspaceContextPath(env);
+  await rm(path, { force: true });
+  return path;
 }
 
 export async function clearWorkspaceCredential(env = process.env) {
@@ -388,13 +553,24 @@ export async function openBrowser(url) {
   const target = String(url);
   const command = platform() === "darwin" ? "open" : platform() === "win32" ? "cmd" : "xdg-open";
   const args = platform() === "win32" ? ["/c", "start", "", target] : [target];
-  try {
-    const child = spawn(command, args, { detached: true, stdio: "ignore" });
-    child.unref();
-    return true;
-  } catch {
-    return false;
-  }
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    const finish = (opened) => {
+      if (settled) return;
+      settled = true;
+      resolvePromise(opened);
+    };
+    try {
+      const child = spawn(command, args, { detached: true, stdio: "ignore" });
+      child.once("error", () => finish(false));
+      child.once("spawn", () => {
+        child.unref();
+        finish(true);
+      });
+    } catch {
+      finish(false);
+    }
+  });
 }
 
 export async function sleep(milliseconds) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corvio/admin-cli",
-  "version": "0.1.0-beta.3",
+  "version": "0.1.0-beta.4",
   "description": "Official read-only Corvio platform administrator CLI.",
   "type": "module",
   "bin": {