@di-framework/tenant-cli 0.0.0-stage → 6.0.10

package/dist/client/sse.d.ts

@@ -0,0 +1,12 @@
+/** One server-sent event, as the `text/event-stream` format frames it. */
+export interface SseEvent {
+    event?: string;
+    data: string;
+    id?: string;
+}
+/**
+ * Parses a `text/event-stream` body into events. Comment lines (`:`) are skipped, `data:` lines
+ * of one event join with newlines, and a blank line dispatches. The hand-written part of the
+ * client: OpenAPI describes the streaming operations but not their framing.
+ */
+export declare function events(body: ReadableStream<Uint8Array>): AsyncGenerator<SseEvent>;

package/dist/client/sse.js

@@ -0,0 +1,61 @@
+/**
+ * Parses a `text/event-stream` body into events. Comment lines (`:`) are skipped, `data:` lines
+ * of one event join with newlines, and a blank line dispatches. The hand-written part of the
+ * client: OpenAPI describes the streaming operations but not their framing.
+ */
+export async function* events(body) {
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let pending = { data: [] };
+    const flush = () => {
+        if (pending.data.length === 0 && pending.event === undefined)
+            return undefined;
+        const done = { data: pending.data.join('\n') };
+        if (pending.event !== undefined)
+            done.event = pending.event;
+        if (pending.id !== undefined)
+            done.id = pending.id;
+        pending = { data: [] };
+        return done;
+    };
+    const take = (line) => {
+        if (line === '')
+            return flush();
+        if (line.startsWith(':'))
+            return undefined;
+        const colon = line.indexOf(':');
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        if (field === 'event')
+            pending.event = value;
+        else if (field === 'data')
+            pending.data.push(value);
+        else if (field === 'id')
+            pending.id = value;
+        return undefined;
+    };
+    const reader = body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        buffer += decoder.decode(value, { stream: true });
+        let newline = buffer.indexOf('\n');
+        while (newline !== -1) {
+            const line = buffer.slice(0, newline).replace(/\r$/, '');
+            buffer = buffer.slice(newline + 1);
+            const event = take(line);
+            if (event)
+                yield event;
+            newline = buffer.indexOf('\n');
+        }
+    }
+    const tail = take(buffer.replace(/\r$/, ''));
+    if (tail)
+        yield tail;
+    const last = flush();
+    if (last)
+        yield last;
+}

package/dist/credentials.d.ts

@@ -0,0 +1,42 @@
+/**
+ * One account's credential. The file and shape are the ones `platform/tenant-auth`'s CLI writes
+ * (`$DI_FRAMEWORK_HOME/credentials.json`), so a login made there seeds the pilot. The pilot
+ * reads `controller.url` and the token; it never writes a kubeconfig.
+ */
+export interface Credential {
+    account: string;
+    user: string;
+    role: string;
+    via: 'identity' | 'api-key';
+    accessToken?: string;
+    refreshToken?: string;
+    apiKey?: string;
+    /** Access token expiry; absent for API keys. */
+    expiresAt?: string;
+    /** Where an identity login refreshes and revokes: the issuer and the public client id. */
+    issuer?: string;
+    clientId?: string;
+    controller: {
+        url: string;
+        certificateAuthorityData?: string;
+    };
+    console?: string;
+}
+/** True when an identity token is gone or within a minute of expiring, so it must be refreshed. */
+export declare function needsRefresh(credential: Credential, now?: number): boolean;
+export type CredentialStore = Record<string, Credential>;
+export declare class CliError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+export declare const home: (env?: NodeJS.ProcessEnv) => string;
+export declare function readStore(env?: NodeJS.ProcessEnv): CredentialStore;
+export declare function writeStore(store: CredentialStore, env?: NodeJS.ProcessEnv): void;
+/** The bearer a credential presents: the API key, or the identity access token while it lasts. */
+export declare function bearer(credential: Credential): string;
+/**
+ * The account a command runs against: `--account`, then `DI_TENANT_ACCOUNT`, then the only
+ * credential on disk.
+ */
+export declare function resolveAccount(flag: string | undefined, env: NodeJS.ProcessEnv, store: CredentialStore): string;
+export declare function load(account: string, env?: NodeJS.ProcessEnv): Credential;

package/dist/credentials.js

@@ -0,0 +1,65 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** True when an identity token is gone or within a minute of expiring, so it must be refreshed. */
+export function needsRefresh(credential, now = Date.now()) {
+    if (credential.via !== 'identity' || !credential.refreshToken)
+        return false;
+    if (!credential.accessToken)
+        return true;
+    return credential.expiresAt !== undefined && Date.parse(credential.expiresAt) - now <= 60_000;
+}
+export class CliError extends Error {
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = 'CliError';
+    }
+}
+export const home = (env = process.env) => env.DI_FRAMEWORK_HOME ?? join(homedir(), '.di-framework');
+const credentialsPath = (env) => join(home(env), 'credentials.json');
+export function readStore(env) {
+    const path = credentialsPath(env);
+    return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : {};
+}
+export function writeStore(store, env) {
+    const directory = home(env);
+    if (!existsSync(directory))
+        mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const path = credentialsPath(env);
+    writeFileSync(path, `${JSON.stringify(store, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+/** The bearer a credential presents: the API key, or the identity access token while it lasts. */
+export function bearer(credential) {
+    if (credential.apiKey)
+        return credential.apiKey;
+    if (!credential.accessToken)
+        throw new CliError('the credential holds no token; log in again');
+    if (credential.expiresAt && Date.parse(credential.expiresAt) <= Date.now()) {
+        throw new CliError('the login has expired; run login again');
+    }
+    return credential.accessToken;
+}
+/**
+ * The account a command runs against: `--account`, then `DI_TENANT_ACCOUNT`, then the only
+ * credential on disk.
+ */
+export function resolveAccount(flag, env, store) {
+    const named = flag ?? env.DI_TENANT_ACCOUNT;
+    if (named)
+        return named;
+    const accounts = Object.keys(store);
+    if (accounts.length === 1)
+        return accounts[0];
+    throw new CliError(accounts.length === 0
+        ? 'not logged in; run: login --controller <url> --account <tenant>'
+        : `--account <tenant> is required; logged in to ${accounts.join(', ')}`);
+}
+export function load(account, env) {
+    const credential = readStore(env)[account];
+    if (!credential)
+        throw new CliError(`not logged in to ${account}; run: login --account ${account}`);
+    return credential;
+}

package/dist/init.d.ts

@@ -0,0 +1,17 @@
+export interface InitOptions {
+    /** Positional name, also the directory unless `dir` is given. */
+    name?: string;
+    dir?: string;
+    /** `--name`: the project name when it differs from the directory. */
+    projectName?: string;
+    force?: boolean;
+    cwd: string;
+}
+/**
+ * The minimal di-framework seed: a package manifest, the component config, and one HTTP
+ * handler. It creates no platform resources; `services create` and `deploy` do that later.
+ */
+export declare function init(options: InitOptions): {
+    directory: string;
+    files: string[];
+};

package/dist/init.js

@@ -0,0 +1,41 @@
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { basename, join, resolve } from 'node:path';
+import { CliError } from "./credentials.js";
+/**
+ * The minimal di-framework seed: a package manifest, the component config, and one HTTP
+ * handler. It creates no platform resources; `services create` and `deploy` do that later.
+ */
+export function init(options) {
+    const directory = resolve(options.cwd, options.dir ?? options.name ?? '.');
+    const name = options.projectName ?? options.name ?? basename(directory);
+    if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+        throw new CliError(`project name must be a lowercase DNS label, got ${JSON.stringify(name)}`);
+    }
+    const files = {
+        'package.json': `${JSON.stringify({
+            name,
+            private: true,
+            type: 'module',
+            scripts: { build: 'di-framework platform build', deploy: 'di-tenant deploy apply' },
+            dependencies: { '@di-framework/core': '^6.0.3', '@di-framework/http': '^6.0.3' },
+        }, null, 2)}\n`,
+        'di-framework.config.json': `${JSON.stringify({ name, entry: 'src/app.ts', output: `dist/${name}.wasm` }, null, 2)}\n`,
+        'src/app.ts': [
+            '/** One HTTP handler; the platform routes requests for this service here. */',
+            'export default function fetch(request: Request): Response {',
+            '  return Response.json({ service: ' +
+                JSON.stringify(name) +
+                ', path: new URL(request.url).pathname });',
+            '}',
+            '',
+        ].join('\n'),
+    };
+    const existing = Object.keys(files).filter((file) => existsSync(join(directory, file)));
+    if (existing.length > 0 && !options.force) {
+        throw new CliError(`${existing.join(', ')} already exist in ${directory}; pass --force to overwrite`);
+    }
+    mkdirSync(join(directory, 'src'), { recursive: true });
+    for (const [file, content] of Object.entries(files))
+        writeFileSync(join(directory, file), content);
+    return { directory, files: Object.keys(files) };
+}

package/dist/main.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env bun
+export {};

package/dist/main.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env bun
+import { readFileSync } from 'node:fs';
+import { run } from "./cli.js";
+/** The platform's URL opener; a failure only means the printed URL has to be visited by hand. */
+function openBrowser(url) {
+    const command = process.platform === 'darwin'
+        ? ['open', url]
+        : process.platform === 'win32'
+            ? ['cmd', '/c', 'start', '', url]
+            : ['xdg-open', url];
+    try {
+        Bun.spawn(command, { stdio: ['ignore', 'ignore', 'ignore'] }).unref();
+    }
+    catch {
+        // Printed URL stays the fallback.
+    }
+}
+process.exit(await run(process.argv.slice(2), {
+    stdout: (line) => console.log(line),
+    stderr: (line) => console.error(line),
+    stdin: () => readFileSync(0, 'utf8'),
+    open: openBrowser,
+    env: process.env,
+    cwd: process.cwd(),
+}));

package/dist/oidc.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The identity-server side of a login, for a public native client (RFC 8252): OpenID discovery,
+ * PKCE, the authorization URL, and the code, refresh, and revocation calls, all without a
+ * client secret. `client_id` alone identifies the CLI; the code verifier is what protects it.
+ */
+export interface ProviderMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    revocation_endpoint?: string;
+}
+export interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    id_token?: string;
+    scope?: string;
+}
+export declare class OidcError extends Error {
+    readonly status?: number | undefined;
+    constructor(message: string, status?: number | undefined);
+}
+type Fetch = typeof fetch;
+export declare function base64url(bytes: Uint8Array): string;
+export declare function randomToken(bytes?: number): string;
+export declare function pkce(verifier?: string): Promise<{
+    verifier: string;
+    challenge: string;
+}>;
+export declare function discover(issuer: string, doFetch?: Fetch): Promise<ProviderMetadata>;
+export interface AuthorizationRequest {
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    nonce: string;
+    codeChallenge: string;
+}
+export declare function authorizationUrl(metadata: ProviderMetadata, request: AuthorizationRequest): string;
+export declare function exchangeCode(metadata: ProviderMetadata, exchange: {
+    clientId: string;
+    redirectUri: string;
+    code: string;
+    codeVerifier: string;
+}, doFetch?: Fetch): Promise<TokenResponse>;
+/** Rotates the refresh token; identity-server revokes the family if the old one is replayed. */
+export declare function refreshTokens(metadata: ProviderMetadata, exchange: {
+    clientId: string;
+    refreshToken: string;
+}, doFetch?: Fetch): Promise<TokenResponse>;
+/** RFC 7009; revoking the refresh token ends the whole authorization. Failures are ignored. */
+export declare function revokeToken(metadata: ProviderMetadata, clientId: string, token: string, doFetch?: Fetch): Promise<void>;
+export {};

package/dist/oidc.js

@@ -0,0 +1,110 @@
+/**
+ * The identity-server side of a login, for a public native client (RFC 8252): OpenID discovery,
+ * PKCE, the authorization URL, and the code, refresh, and revocation calls, all without a
+ * client secret. `client_id` alone identifies the CLI; the code verifier is what protects it.
+ */
+export class OidcError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = 'OidcError';
+    }
+}
+export function base64url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+export function randomToken(bytes = 32) {
+    return base64url(crypto.getRandomValues(new Uint8Array(bytes)));
+}
+export async function pkce(verifier = randomToken(32)) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return { verifier, challenge: base64url(new Uint8Array(digest)) };
+}
+export async function discover(issuer, doFetch = fetch) {
+    const url = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+    const response = await doFetch(url);
+    if (!response.ok)
+        throw new OidcError(`discovery at ${issuer} answered ${response.status}`, response.status);
+    const metadata = (await response.json());
+    for (const field of ['issuer', 'authorization_endpoint', 'token_endpoint']) {
+        if (!metadata[field])
+            throw new OidcError(`discovery at ${issuer} lacks ${field}`);
+    }
+    // The CLI only ever talks to the issuer it was pointed at: a document that names endpoints
+    // elsewhere would send the authorization code or refresh token to another host.
+    const origin = new URL(issuer).origin;
+    for (const field of [
+        'authorization_endpoint',
+        'token_endpoint',
+        'revocation_endpoint',
+    ]) {
+        const endpoint = metadata[field];
+        if (endpoint && new URL(endpoint).origin !== origin)
+            throw new OidcError(`discovery at ${issuer}: ${field} is not under the issuer`);
+    }
+    return metadata;
+}
+export function authorizationUrl(metadata, request) {
+    const url = new URL(metadata.authorization_endpoint);
+    url.search = new URLSearchParams({
+        response_type: 'code',
+        client_id: request.clientId,
+        redirect_uri: request.redirectUri,
+        scope: request.scope,
+        state: request.state,
+        nonce: request.nonce,
+        code_challenge: request.codeChallenge,
+        code_challenge_method: 'S256',
+    }).toString();
+    return url.toString();
+}
+async function tokenRequest(endpoint, form, doFetch) {
+    const response = await doFetch(endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(form),
+    });
+    if (!response.ok) {
+        let code = `${response.status}`;
+        try {
+            code = String((await response.json()).error ?? code);
+        }
+        catch {
+            // No OAuth error body; the status is the message.
+        }
+        throw new OidcError(`token endpoint refused the ${form.grant_type} grant: ${code}`, response.status);
+    }
+    return (await response.json());
+}
+export function exchangeCode(metadata, exchange, doFetch = fetch) {
+    return tokenRequest(metadata.token_endpoint, {
+        grant_type: 'authorization_code',
+        client_id: exchange.clientId,
+        code: exchange.code,
+        redirect_uri: exchange.redirectUri,
+        code_verifier: exchange.codeVerifier,
+    }, doFetch);
+}
+/** Rotates the refresh token; identity-server revokes the family if the old one is replayed. */
+export function refreshTokens(metadata, exchange, doFetch = fetch) {
+    return tokenRequest(metadata.token_endpoint, {
+        grant_type: 'refresh_token',
+        client_id: exchange.clientId,
+        refresh_token: exchange.refreshToken,
+    }, doFetch);
+}
+/** RFC 7009; revoking the refresh token ends the whole authorization. Failures are ignored. */
+export async function revokeToken(metadata, clientId, token, doFetch = fetch) {
+    const endpoint = metadata.revocation_endpoint ?? `${metadata.issuer}/oauth2/revoke`;
+    try {
+        await doFetch(endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ token, client_id: clientId }),
+        });
+    }
+    catch {
+        // The credential is forgotten locally either way; the token expires on its own.
+    }
+}

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@di-framework/tenant-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "6.0.10",
+  "private": false,
+  "type": "module",
+  "license": "(MIT OR Apache-2.0)",
+  "description": "Pilot tenant CLI: talks only to the tenant controller's OpenAPI contract with an identity-server credential; never to Kubernetes.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/di-framework/platform",
+    "directory": "platform/tenant-cli"
+  },
+  "homepage": "https://github.com/di-framework/platform",
+  "files": [
+    "dist",
+    "api/v1/openapi.yaml",
+    "README.md"
+  ],
+  "exports": {
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "bun": "./dist/client/index.js",
+      "import": "./dist/client/index.js",
+      "default": "./dist/client/index.js"
+    },
+    "./src/api/*": "./src/api/*",
+    "./tests/support/*": "./tests/support/*",
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "di-tenant": "dist/main.js"
+  },
+  "scripts": {
+    "cli": "bun src/main.ts",
+    "generate:api": "di-framework generate && bun scripts/generate-openapi.ts",
+    "generate:client": "openapi-typescript api/v1/openapi.yaml -o src/client/schema.d.ts",
+    "generate": "bun run generate:api && bun run generate:client",
+    "build": "rm -rf dist && bun x tsc -p tsconfig.build.json && cp src/client/schema.d.ts dist/client/schema.d.ts && bun ../../scripts/fix-esm-imports.ts dist",
+    "test": "bun test"
+  },
+  "dependencies": {
+    "@di-framework/core": "^6.0.3",
+    "@di-framework/http": "^6.0.3"
+  },
+  "devDependencies": {
+    "openapi-typescript": "7.13.0"
+  }
+}