@dharta/cli 0.6.77

package/dist/commands/env.js

@@ -0,0 +1,300 @@
+// `dharta env list|set|unset|pull|diff` (RFC 0013 CLI-8): the prod half
+// of declare-or-bind. Declarations live in dharta.toml [env]; .env binds
+// locally; these verbs manage the prod bindings and report drift.
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+import { randomUUID } from "node:crypto";
+import TOML from "@iarna/toml";
+import { inferAgentSlug, validateAgentSelectorOptions } from "../agent.js";
+import { table } from "../output.js";
+import { normalizeNonBlank } from "../validators.js";
+// Env values routinely hold credentials the setter never flagged `--secret`
+// (a GitHub PAT, a webhook signing key). `list` therefore masks EVERY value by
+// default - a routine listing must never dump a live secret to the terminal or
+// CI logs. A short tail is kept so an operator can still tell two bindings
+// apart (matching how `whoami`/model keys show only a tail); `--reveal` prints
+// the full value for the rare time it is actually needed.
+export function maskEnvValue(v, reveal) {
+    if (reveal)
+        return v.value ?? "";
+    if (v.secret)
+        return "•••••• (secret)";
+    const val = v.value ?? "";
+    if (val === "")
+        return "";
+    return val.length > 4 ? `…${val.slice(-4)}` : "••••";
+}
+export async function envListData(ctx, opts = {}) {
+    const slug = await inferAgentSlug(opts);
+    const body = await ctx.http.request({
+        path: `/api/agents/${encodeURIComponent(slug)}/env`,
+    });
+    return { slug, env: body.env };
+}
+export async function envList(ctx, opts = {}) {
+    const { slug, env } = await envListData(ctx, opts);
+    if (env.length === 0) {
+        return `No env vars set for ${slug}. Bind one with: dharta env set NAME=value`;
+    }
+    return table(env.map((v) => ({
+        name: v.name,
+        value: maskEnvValue(v, opts.reveal === true),
+        updated: v.updated_at ?? "",
+    })));
+}
+export async function envSetData(ctx, assignment, opts = {}) {
+    const { name, value } = parseEnvAssignment(assignment);
+    const slug = await inferAgentSlug(opts);
+    const body = { value };
+    if (opts.secret)
+        body.secret = true;
+    await ctx.http.request({
+        method: "PUT",
+        path: `/api/agents/${encodeURIComponent(slug)}/env/${encodeURIComponent(name)}`,
+        body,
+        headers: { "Idempotency-Key": randomUUID() },
+    });
+    return { slug, name, secret: !!opts.secret };
+}
+export function validateEnvAssignment(assignment) {
+    parseEnvAssignment(assignment);
+}
+export function validateEnvName(name) {
+    normalizeEnvName(name);
+}
+function parseEnvAssignment(assignment) {
+    const eq = assignment.indexOf("=");
+    if (eq <= 0) {
+        throw new Error("Usage: dharta env set NAME=value [--secret]");
+    }
+    const name = normalizeEnvName(assignment.slice(0, eq));
+    const value = assignment.slice(eq + 1);
+    return { name, value };
+}
+export async function envSet(ctx, assignment, opts = {}) {
+    const { slug, name, secret } = await envSetData(ctx, assignment, opts);
+    return (`Set ${name}${secret ? " (secret)" : ""} on ${slug}. ` +
+        "The next build picks it up; redeploy with git push dharta main if needed.");
+}
+export async function envUnsetData(ctx, name, opts = {}) {
+    const normalizedName = normalizeEnvName(name);
+    const slug = await inferAgentSlug(opts);
+    await ctx.http.request({
+        method: "DELETE",
+        path: `/api/agents/${encodeURIComponent(slug)}/env/${encodeURIComponent(normalizedName)}`,
+        headers: { "Idempotency-Key": randomUUID() },
+    });
+    return { slug, name: normalizedName, removed: true };
+}
+export async function envUnset(ctx, name, opts = {}) {
+    const { slug, name: removed } = await envUnsetData(ctx, name, opts);
+    return `Removed ${removed} from ${slug}.`;
+}
+// Hydrate .env from prod (D6): secret-marked values are excluded unless
+// --include-secrets (bounded env:secrets:read key);
+// every pull is audited server-side.
+export async function envPullData(ctx, opts = {}) {
+    const dir = path.resolve(opts.dir ?? process.cwd());
+    const target = path.join(dir, ".env");
+    await validateEnvPullOptions(opts);
+    const slug = await inferAgentSlug(opts);
+    const body = await ctx.http.request({
+        method: "POST",
+        path: `/api/agents/${encodeURIComponent(slug)}/env/pull`,
+        body: { include_secrets: !!opts.includeSecrets },
+        headers: { "Idempotency-Key": randomUUID() },
+    });
+    const bound = body.env.filter((v) => !v.withheld);
+    const lines = bound.map((v) => `${v.name}=${quoteIfNeeded(v.value ?? "")}`);
+    const withheld = body.env.filter((v) => v.withheld).map((v) => v.name);
+    await writeEnvFile(target, `# Pulled from ${slug} by dharta env pull - do not commit.\n${lines.join("\n")}\n`);
+    return { slug, path: target, written: bound.map((v) => v.name), withheld };
+}
+export async function envPull(ctx, opts = {}) {
+    const res = await envPullData(ctx, opts);
+    const n = res.written.length;
+    let out = `Wrote ${n} value${n === 1 ? "" : "s"} to ${res.path}.`;
+    if (res.withheld.length > 0) {
+        out +=
+            `\n${res.withheld.length} secret value${res.withheld.length === 1 ? "" : "s"} withheld (${res.withheld.join(", ")}). ` +
+                "Re-run with --include-secrets using a key with env:secrets:read to fetch them (audited).";
+    }
+    return out;
+}
+// Local (.env) vs prod drift, plus the dharta.toml [env] declarations -
+// the report half of declare-or-bind (dev warns, build fails, diff
+// explains).
+export async function envDiffData(ctx, opts = {}) {
+    const dir = path.resolve(opts.dir ?? process.cwd());
+    await validateEnvDiffOptions(opts);
+    const slug = await inferAgentSlug(opts);
+    const local = parseDotenvFile(await readOptionalLocalFile(path.join(dir, ".env"), ".env"));
+    const declared = await declaredEnvNames(dir);
+    const body = await ctx.http.request({
+        path: `/api/agents/${encodeURIComponent(slug)}/env`,
+    });
+    const prod = new Map(body.env.map((v) => [v.name, v]));
+    const drift = [];
+    for (const [name, entry] of prod) {
+        if (!(name in local)) {
+            drift.push({ kind: "prod-only", name, secret: entry.secret });
+        }
+        else if (!entry.secret && entry.value !== local[name]) {
+            drift.push({ kind: "value-differs", name });
+        }
+        else if (entry.secret) {
+            drift.push({ kind: "secret", name, secret: true });
+        }
+    }
+    for (const name of Object.keys(local)) {
+        if (!prod.has(name))
+            drift.push({ kind: "local-only", name });
+    }
+    for (const name of declared) {
+        if (!prod.has(name) && !(name in local))
+            drift.push({ kind: "declared-only", name });
+    }
+    return { slug, drift };
+}
+export async function envDiff(ctx, opts = {}) {
+    const { slug, drift } = await envDiffData(ctx, opts);
+    if (drift.length === 0)
+        return `No drift: .env and ${slug}'s prod bindings agree.`;
+    return drift.map(formatDrift).join("\n");
+}
+function formatDrift(d) {
+    switch (d.kind) {
+        case "prod-only":
+            return `prod only      ${d.name}${d.secret ? " (secret)" : ""} - add to .env (dharta env pull)`;
+        case "value-differs":
+            return `value differs  ${d.name} - local .env and prod disagree`;
+        case "secret":
+            return `secret         ${d.name} - prod value not comparable`;
+        case "local-only":
+            return `local only     ${d.name} - bind in prod with: dharta env set ${d.name}=...`;
+        case "declared-only":
+            return `declared only  ${d.name} - in dharta.toml [env] but bound nowhere`;
+    }
+}
+async function declaredEnvNames(dir) {
+    const raw = await readOptionalLocalFile(path.join(dir, "dharta.toml"), "dharta.toml");
+    if (!raw)
+        return [];
+    try {
+        const parsed = TOML.parse(raw);
+        const env = parsed.env;
+        return env && typeof env === "object" ? Object.keys(env) : [];
+    }
+    catch {
+        return [];
+    }
+}
+export function parseDotenvFile(content) {
+    const vars = {};
+    if (!content)
+        return vars;
+    for (const raw of content.split("\n")) {
+        let line = raw.trim();
+        if (line.startsWith("export "))
+            line = line.slice("export ".length).trim();
+        if (!line || line.startsWith("#") || !line.includes("="))
+            continue;
+        const idx = line.indexOf("=");
+        const name = line.slice(0, idx).trim();
+        let value = line.slice(idx + 1).trim();
+        if (value.length >= 2 && (value[0] === '"' || value[0] === "'") && value.endsWith(value[0])) {
+            value = value.slice(1, -1);
+        }
+        else {
+            value = value.split(" #", 1)[0].trim();
+        }
+        vars[name] = value;
+    }
+    return vars;
+}
+function quoteIfNeeded(value) {
+    return /[\s#"']/.test(value) ? JSON.stringify(value) : value;
+}
+function normalizeEnvName(name) {
+    return normalizeNonBlank(name, "env var name");
+}
+export async function validateEnvPullOptions(opts = {}) {
+    validateAgentSelectorOptions({ agent: opts.agent, project: opts.project, dir: opts.dir });
+    const dir = path.resolve(opts.dir ?? process.cwd());
+    await validateEnvPullTarget(dir, path.join(dir, ".env"), !!opts.force);
+}
+export async function validateEnvDiffOptions(opts = {}) {
+    validateAgentSelectorOptions({ agent: opts.agent, project: opts.project, dir: opts.dir });
+    await validateEnvReadDir(path.resolve(opts.dir ?? process.cwd()));
+}
+async function readOptionalLocalFile(file, label) {
+    try {
+        return await fs.readFile(file, "utf8");
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            return null;
+        if (code === "EISDIR")
+            throw new Error(`Cannot read ${label} at ${file}: expected a file, got a directory.`);
+        throw new Error(`Cannot read ${label} at ${file}: ${error.message}`);
+    }
+}
+async function validateEnvReadDir(dir) {
+    let stat;
+    try {
+        stat = await fs.stat(dir);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            throw new Error(`Cannot read env files in ${dir}: directory does not exist.`);
+        throw new Error(`Cannot read env files in ${dir}: ${error.message}`);
+    }
+    if (!stat.isDirectory()) {
+        throw new Error(`Cannot read env files in ${dir}: expected a directory.`);
+    }
+}
+async function validateEnvPullTarget(dir, target, force) {
+    let dirStat;
+    try {
+        dirStat = await fs.stat(dir);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            throw new Error(`Cannot write .env in ${dir}: directory does not exist.`);
+        throw new Error(`Cannot write .env in ${dir}: ${error.message}`);
+    }
+    if (!dirStat.isDirectory()) {
+        throw new Error(`Cannot write .env in ${dir}: expected a directory.`);
+    }
+    try {
+        const targetStat = await fs.stat(target);
+        if (targetStat.isDirectory()) {
+            throw new Error(`Cannot write .env to ${target}: expected a file, got a directory.`);
+        }
+        if (!force) {
+            throw new Error(`${target} already exists. Re-run with --force to overwrite it (local-only keys are lost).`);
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+}
+async function writeEnvFile(target, content) {
+    try {
+        await fs.writeFile(target, content, { mode: 0o600 });
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT")
+            throw new Error(`Cannot write .env to ${target}: parent directory does not exist.`);
+        if (code === "EISDIR")
+            throw new Error(`Cannot write .env to ${target}: expected a file, got a directory.`);
+        throw new Error(`Cannot write .env to ${target}: ${error.message}`);
+    }
+}
+//# sourceMappingURL=env.js.map

package/dist/commands/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/commands/env.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,yEAAyE;AACzE,kEAAkE;AAElE,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,aAAa,CAAC;AAE/B,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAA0B,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AASrD,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,CAA6C,EAAE,MAAe;IACzF,IAAI,MAAM;QAAE,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,iBAAiB,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AACvD,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,OAAmB,EAAE;IAErB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAsB;QACvD,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,MAAM;KACpD,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,OAAmB,EAAE;IAClE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,uBAAuB,IAAI,4CAA4C,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CACV,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;QAC5C,OAAO,EAAE,CAAC,CAAC,UAAU,IAAI,EAAE;KAC5B,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAe,EACf,UAAkB,EAClB,OAAmB,EAAE;IAErB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACpC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,IAAI,CAAC,EAAE;QAC/E,IAAI;QACJ,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE;KAC7C,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,kBAAkB,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,GAAe,EACf,UAAkB,EAClB,OAAmB,EAAE;IAErB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACvE,OAAO,CACL,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI;QACtD,2EAA2E,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAe,EACf,IAAY,EACZ,OAAmB,EAAE;IAErB,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,QAAQ,kBAAkB,CAAC,cAAc,CAAC,EAAE;QACzF,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE;KAC7C,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAe,EACf,IAAY,EACZ,OAAmB,EAAE;IAErB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,OAAO,WAAW,OAAO,SAAS,IAAI,GAAG,CAAC;AAC5C,CAAC;AAED,wEAAwE;AACxE,oDAAoD;AACpD,qCAAqC;AACrC,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEtC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAsB;QACvD,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,WAAW;QACxD,IAAI,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;QAChD,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE;KAC7C,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEvE,MAAM,YAAY,CAChB,MAAM,EACN,iBAAiB,IAAI,yCAAyC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACnF,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,OAAmB,EAAE;IAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,GAAG,CAAC;IAClE,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,GAAG;YACD,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtH,0FAA0F,CAAC;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD,wEAAwE;AACxE,mEAAmE;AACnE,aAAa;AACb,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,OAAmB,EAAE;IAErB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAE7C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAsB;QACvD,IAAI,EAAE,eAAe,kBAAkB,CAAC,IAAI,CAAC,MAAM;KACpD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,OAAmB,EAAE;IAClE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,sBAAsB,IAAI,yBAAyB,CAAC;IACnF,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,CAAa;IAChC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,kBAAkB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kCAAkC,CAAC;QAClG,KAAK,eAAe;YAClB,OAAO,kBAAkB,CAAC,CAAC,IAAI,iCAAiC,CAAC;QACnE,KAAK,QAAQ;YACX,OAAO,kBAAkB,CAAC,CAAC,IAAI,8BAA8B,CAAC;QAChE,KAAK,YAAY;YACf,OAAO,kBAAkB,CAAC,CAAC,IAAI,wCAAwC,CAAC,CAAC,IAAI,MAAM,CAAC;QACtF,KAAK,eAAe;YAClB,OAAO,kBAAkB,CAAC,CAAC,IAAI,2CAA2C,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;IACtF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAsB;IACpD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,iBAAiB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAmB,EAAE;IAChE,4BAA4B,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,MAAM,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAmB,EAAE;IAChE,4BAA4B,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,IAAI,qCAAqC,CAAC,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,6BAA6B,CAAC,CAAC;QACrG,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,yBAAyB,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,GAAW,EAAE,MAAc,EAAE,KAAc;IAC9E,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,6BAA6B,CAAC,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,qCAAqC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,kFAAkF,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC/D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,oCAAoC,CAAC,CAAC;QAC3G,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,qCAAqC,CAAC,CAAC;QAC5G,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;AACH,CAAC"}

package/dist/commands/files.d.ts

@@ -0,0 +1,14 @@
+import type { CliContext } from "../context.js";
+export interface WorkspaceEntry {
+    path: string;
+    kind: string;
+    size: number;
+    mode: number;
+}
+export interface WorkspaceListing {
+    snapshot: string;
+    entries: WorkspaceEntry[];
+}
+export declare function filesLsData(ctx: CliContext, agent: string, instance: string): Promise<WorkspaceListing>;
+export declare function filesLs(ctx: CliContext, agent: string, instance: string): Promise<string>;
+export declare function filesGet(ctx: CliContext, agent: string, instance: string, path: string, out?: string): Promise<string | null>;

package/dist/commands/files.js

@@ -0,0 +1,84 @@
+import { HttpClient } from "@dharta/sdk";
+import { randomUUID } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+import { cliFormatError, cliFormatNetworkError, cliFormatRawError } from "../api-error.js";
+import { table } from "../output.js";
+import { validateAgentSlug } from "../agent.js";
+async function mintFilesToken(ctx, agent, instance) {
+    const res = await ctx.http.request({
+        method: "POST",
+        path: `/api/agents/${encodeURIComponent(agent)}/workspace_tokens`,
+        headers: { "Idempotency-Key": randomUUID() },
+        body: { instance, scope: "workspace_read" },
+    });
+    if (!res.token) {
+        throw new Error("The Dharta server did not return a workspace token.");
+    }
+    if (!res.files_url) {
+        throw new Error("This Dharta server does not expose the files API (files_url missing). Upgrade the server (RFC 0060).");
+    }
+    return { token: res.token, files_url: res.files_url };
+}
+// A data-plane HttpClient bound to the files host, authenticated with the minted token.
+// Returns the client plus the base path from `files_url` (`/workspace/<agent>/<karta>`).
+function filesClient(ctx, mint) {
+    const url = new URL(mint.files_url);
+    const http = new HttpClient({
+        apiKey: mint.token,
+        baseUrl: url.origin,
+        fetch: ctx.fetch,
+        formatError: cliFormatError,
+        formatNetworkError: cliFormatNetworkError,
+    });
+    return { http, basePath: url.pathname };
+}
+function normalizeInstance(instance) {
+    const trimmed = instance.trim();
+    if (!trimmed)
+        throw new Error("A dharta id is required.");
+    return trimmed;
+}
+export async function filesLsData(ctx, agent, instance) {
+    const slug = validateAgentSlug(agent, "agent slug");
+    const karta = normalizeInstance(instance);
+    const mint = await mintFilesToken(ctx, slug, karta);
+    const { http, basePath } = filesClient(ctx, mint);
+    const listing = await http.request({ path: basePath });
+    return {
+        snapshot: typeof listing.snapshot === "string" ? listing.snapshot : "",
+        entries: Array.isArray(listing.entries) ? listing.entries : [],
+    };
+}
+export async function filesLs(ctx, agent, instance) {
+    const listing = await filesLsData(ctx, agent, instance);
+    if (listing.entries.length === 0) {
+        return `No files in ${agent}/${instance} (snapshot ${listing.snapshot || "—"}).`;
+    }
+    const rows = [...listing.entries]
+        .sort((a, b) => a.path.localeCompare(b.path))
+        .map((e) => ({ path: e.path, size: String(e.size) }));
+    return table(rows);
+}
+// Fetch one file's bytes. Writes to `out` (a status line is returned) or, when `out` is
+// omitted, streams the raw bytes to stdout (returns null so nothing else is printed - a
+// trailing newline would corrupt binary output).
+export async function filesGet(ctx, agent, instance, path, out) {
+    const slug = validateAgentSlug(agent, "agent slug");
+    const karta = normalizeInstance(instance);
+    const filePath = path.trim();
+    if (!filePath)
+        throw new Error("A file path is required.");
+    const mint = await mintFilesToken(ctx, slug, karta);
+    const { http, basePath } = filesClient(ctx, mint);
+    const res = await http.raw(`${basePath}/file?path=${encodeURIComponent(filePath)}`);
+    if (!res.ok)
+        throw await cliFormatRawError(res);
+    const bytes = Buffer.from(await res.arrayBuffer());
+    if (out) {
+        await writeFile(out, bytes);
+        return `Wrote ${bytes.length} bytes to ${out}.`;
+    }
+    process.stdout.write(bytes);
+    return null;
+}
+//# sourceMappingURL=files.js.map

package/dist/commands/files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../src/commands/files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA2BhD,KAAK,UAAU,cAAc,CAAC,GAAe,EAAE,KAAa,EAAE,QAAgB;IAC5E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAyC;QACzE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,eAAe,kBAAkB,CAAC,KAAK,CAAC,mBAAmB;QACjE,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE;QAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE;KAC5C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;AACxD,CAAC;AAED,wFAAwF;AACxF,yFAAyF;AACzF,SAAS,WAAW,CAAC,GAAe,EAAE,IAAe;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC;QAC1B,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,OAAO,EAAE,GAAG,CAAC,MAAM;QACnB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,cAAc;QAC3B,kBAAkB,EAAE,qBAAqB;KAC1C,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,KAAa,EACb,QAAgB;IAEhB,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzE,OAAO;QACL,QAAQ,EAAE,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QACtE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,KAAa,EAAE,QAAgB;IAC5E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,eAAe,KAAK,IAAI,QAAQ,cAAc,OAAO,CAAC,QAAQ,IAAI,GAAG,IAAI,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;SAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,wFAAwF;AACxF,wFAAwF;AACxF,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAe,EACf,KAAa,EACb,QAAgB,EAChB,IAAY,EACZ,GAAY;IAEZ,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,cAAc,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO,SAAS,KAAK,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/commands/git-credential.d.ts

@@ -0,0 +1 @@
+export declare function gitCredential(operation: string, stdin: string): Promise<string>;

package/dist/commands/git-credential.js

@@ -0,0 +1,70 @@
+import { HttpClient } from "@dharta/sdk";
+import { randomUUID } from "node:crypto";
+import { activeProfile } from "../config.js";
+// `dharta git-credential <operation>` - a git credential helper in the protocol sense,
+// wired by `dharta login` via `credential.<git host>.helper = !dharta git-credential`.
+//
+// Two hosts, two auth models (RFC 0043 D8):
+//   - the RFC 0011 PUSH host (git_base_url): answer with the stored API key (the server
+//     ignores the username, "dharta" by convention).
+//   - the workspace CLONE host (workspace_git_base_url, the DATA PLANE): mint a per-clone
+//     read-only token OUT OF BAND (a metadata call to the control plane) and answer with
+//     it, so the clone bytes flow only from the data plane and never through the control
+//     plane. `dharta login` sets `useHttpPath=true` for this host so git passes the repo
+//     path, from which we read the karta id.
+//
+// store/erase are no-ops: the API key already lives in ~/.dharta/config.toml and the
+// minted token is short-lived (git never persists this secret).
+export async function gitCredential(operation, stdin) {
+    if (operation !== "get")
+        return "";
+    const profile = await activeProfile();
+    const attrs = new Map();
+    for (const line of stdin.split("\n")) {
+        const idx = line.indexOf("=");
+        if (idx > 0)
+            attrs.set(line.slice(0, idx), line.slice(idx + 1));
+    }
+    const protocol = attrs.get("protocol");
+    if (protocol !== "https" && protocol !== "http")
+        return "";
+    const host = attrs.get("host");
+    if (!host)
+        return "";
+    const wsBase = profile.workspace_git_base_url;
+    if (wsBase && host === new URL(wsBase).host) {
+        const token = await mintWorkspaceToken(profile, attrs.get("path") ?? "");
+        return token ? `username=karta\npassword=${token}\n` : "";
+    }
+    if (profile.git_base_url && host === new URL(profile.git_base_url).host) {
+        return `username=karta\npassword=${profile.api_key}\n`;
+    }
+    return "";
+}
+// Mint a read-only workspace token for the karta named by the request path. With
+// `useHttpPath=true`, git passes a path like `git/<agent>/<karta>` (no leading slash,
+// possibly with extra segments we ignore). Returns null on any failure - git then falls
+// back to its normal prompt/deny, never a crash.
+async function mintWorkspaceToken(profile, path) {
+    const m = path.replace(/^\/+/, "").match(/^git\/([^/]+)\/([^/]+)/);
+    if (!m)
+        return null;
+    const [, agent, instance] = m;
+    const http = new HttpClient({
+        apiKey: profile.api_key,
+        baseUrl: profile.base_url,
+    });
+    try {
+        const res = await http.request({
+            method: "POST",
+            path: `/api/agents/${encodeURIComponent(agent)}/workspace_tokens`,
+            headers: { "Idempotency-Key": randomUUID() },
+            body: { instance },
+        });
+        return res.token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=git-credential.js.map

package/dist/commands/git-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential.js","sourceRoot":"","sources":["../../src/commands/git-credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAC;AAE3D,uFAAuF;AACvF,uFAAuF;AACvF,EAAE;AACF,4CAA4C;AAC5C,wFAAwF;AACxF,qDAAqD;AACrD,0FAA0F;AAC1F,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AACzF,6CAA6C;AAC7C,EAAE;AACF,qFAAqF;AACrF,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAiB,EACjB,KAAa;IAEb,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IAEtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,MAAM,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAC9C,IAAI,MAAM,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,CAAC,CAAC,4BAA4B,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,OAAO,4BAA4B,OAAO,CAAC,OAAO,IAAI,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,iFAAiF;AACjF,sFAAsF;AACtF,wFAAwF;AACxF,iDAAiD;AACjD,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE9B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC,OAAO;QACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;KAC1B,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAqB;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,eAAe,kBAAkB,CAAC,KAAK,CAAC,mBAAmB;YACjE,OAAO,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE;YAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/commands/kartas.d.ts

@@ -0,0 +1,101 @@
+import type { CliContext } from "../context.js";
+export interface KartaMember {
+    id: string | number;
+    email: string;
+    role: string;
+    joined_at: string;
+}
+export interface KartaRecord {
+    id: string;
+    name: string | null;
+    vanity_slug: string | null;
+    access_audience: string | null;
+    access_model: string;
+    state: string;
+    agent: {
+        id: string | number;
+        slug: string;
+        name: string;
+    } | null;
+    url: string | null;
+    members?: KartaMember[];
+}
+export interface KartaConfigureOptions {
+    name?: string;
+    slug?: string;
+    access?: string;
+}
+export interface KartaListOptions {
+    agent?: string;
+    named?: boolean;
+    archived?: boolean;
+}
+export interface KartaNameOptions {
+    name?: string;
+    slug?: string;
+}
+export interface KartaCreateOptions {
+    agent?: string;
+    slug?: string;
+    access?: string;
+    members?: string[];
+    memberRole?: string;
+}
+export declare function validateKartaCreateOptions(name: string, options: KartaCreateOptions): void;
+export declare function kartasCreateData(ctx: CliContext, name: string, options: KartaCreateOptions): Promise<{
+    karta: KartaRecord;
+}>;
+export declare function kartasCreate(ctx: CliContext, name: string, options: KartaCreateOptions): Promise<string>;
+export declare function kartasListData(ctx: CliContext, options?: KartaListOptions): Promise<KartaRecord[]>;
+export declare function kartasList(ctx: CliContext, options?: KartaListOptions): Promise<string>;
+export declare function kartasShowData(ctx: CliContext, id: string): Promise<KartaRecord>;
+export declare function kartasShow(ctx: CliContext, id: string): Promise<string>;
+export declare function validateKartaConfigureOptions(options: KartaConfigureOptions): void;
+export declare function validateKartaNameOptions(options: KartaNameOptions): void;
+export declare function kartasNameData(ctx: CliContext, id: string, options: KartaNameOptions): Promise<{
+    karta: KartaRecord;
+}>;
+export declare function kartasName(ctx: CliContext, id: string, options: KartaNameOptions): Promise<string>;
+export declare function kartasConfigureData(ctx: CliContext, id: string, options: KartaConfigureOptions): Promise<{
+    karta: KartaRecord;
+}>;
+export declare function kartasConfigure(ctx: CliContext, id: string, options: KartaConfigureOptions): Promise<string>;
+export declare function kartasArchiveData(ctx: CliContext, id: string): Promise<{
+    karta: KartaRecord;
+}>;
+export declare function kartasArchive(ctx: CliContext, id: string): Promise<string>;
+export declare function kartasRestoreData(ctx: CliContext, id: string): Promise<{
+    karta: KartaRecord;
+}>;
+export declare function kartasRestore(ctx: CliContext, id: string): Promise<string>;
+export declare function kartaMembersGrantData(ctx: CliContext, id: string, email: string, role: string): Promise<{
+    member: KartaMember;
+}>;
+export declare function kartaMembersGrant(ctx: CliContext, id: string, email: string, role: string): Promise<string>;
+export declare function kartaMembersSetRoleData(ctx: CliContext, id: string, membershipId: string, role: string): Promise<{
+    member: KartaMember;
+}>;
+export declare function kartaMembersSetRole(ctx: CliContext, id: string, membershipId: string, role: string): Promise<string>;
+export declare function kartaMembersRevokeData(ctx: CliContext, id: string, membershipId: string): Promise<{
+    id: string;
+    membership_id: string;
+    revoked: true;
+}>;
+export declare function kartaMembersRevoke(ctx: CliContext, id: string, membershipId: string): Promise<string>;
+export interface KartaEnvRecord {
+    name: string;
+    secret: boolean;
+    value?: string | null;
+    updated_at?: string;
+    updated_by?: string;
+}
+export declare function kartaEnvListData(ctx: CliContext, agent: string, karta: string): Promise<KartaEnvRecord[]>;
+export declare function kartaEnvList(ctx: CliContext, agent: string, karta: string): Promise<string>;
+export declare function kartaEnvSetData(ctx: CliContext, agent: string, karta: string, name: string, value: string, options?: {
+    secret?: boolean;
+}): Promise<KartaEnvRecord>;
+export declare function kartaEnvSet(ctx: CliContext, agent: string, karta: string, name: string, value: string, options?: {
+    secret?: boolean;
+}): Promise<string>;
+export declare function kartaEnvUnsetData(ctx: CliContext, agent: string, karta: string, name: string): Promise<void>;
+export declare function kartaEnvUnset(ctx: CliContext, agent: string, karta: string, name: string): Promise<string>;