@domesystems/templates 0.3.3 → 0.3.5

package/README.md

@@ -5,6 +5,7 @@ Pull immutable Dome template releases, publish public templates from GitHub, and
 ```bash
 npx @domesystems/templates login --registry https://templates-registry.domesystems.ai --github
 npx @domesystems/templates pull dome-systems/ai-agent-for-documentation --registry https://templates-registry.domesystems.ai --dir ai-agent-for-documentation
+npx @domesystems/templates generate --dir ai-agent-for-documentation
 npx @domesystems/templates up --dir ai-agent-for-documentation
 ```
 
@@ -28,11 +29,16 @@ templates login [--server <URL>|--registry <URL>] [--github]
 templates logout [--server <URL>|--registry <URL>]
 templates doctor <pull|up|publish> [--dir <directory>] [--server <URL>|--registry <URL>] [--json]
 templates pull <scope/package[@version]> [--dir <directory>] [--server <URL>|--registry <URL>]
-templates up [--dir <directory>] [--port <host-port>] [--server <URL>|--registry <URL>] [--import-job <job-id>] [--skip-provision|--provision] [--no-start] [--detach]
+templates generate [--dir <directory>] [--output <file>] [--force]
+templates up [--dir <directory>] [--port <host-port>] [--server <URL>|--registry <URL>] [--import-job <job-id>] [--skip-provision|--provision] [--no-start] [--detach] [--verbose]
 templates publish [--dry-run] [--server <URL>|--registry <URL>]
 ```
 
-`pull` only accepts scoped package names, verifies the Registry SHA-256 before extraction, accepts only the archive's `template/` root, writes `.dome-template-lock.yaml`, and never overwrites a non-empty directory. `up` is local-only and never downloads or updates a release. When it provisions an unconfigured runtime, it reveals the import's one-time agent token, resolves the workspace default Gateway, and writes only `DOME_TOKEN` and `DOME_GATEWAY_URL` to the ignored `.env` before starting Docker. `publish` reads the scoped name and SemVer version from `template.yaml`, requires a clean Git checkout, and cannot replace a published version.
+`pull` only accepts scoped package names, verifies the Registry SHA-256 before extraction, accepts only the archive's `template/` root, writes `.dome-template-lock.yaml`, and never overwrites a non-empty directory. `generate` reads `catalog` in `template.yaml` and writes a `dome.tf` with the matching Gateway, connections, model pool, agent, Rules, Guards, quotas, and runtime key. Generated model pools are non-default so templates can be installed into workspaces that already have a default pool. It never replaces an existing file unless you pass `--force`; review the generated Terraform before importing it. `up` is local-only and never downloads or updates a release. When it provisions an unconfigured runtime, it reveals the import's one-time agent token, resolves the workspace default Gateway, and writes only `DOME_TOKEN` and `DOME_GATEWAY_URL` to the ignored `.env` before starting Docker. `publish` reads the scoped name and SemVer version from `template.yaml`, requires a clean Git checkout, and cannot replace a published version.
+
+## Publishing from a GitHub organization
+
+Run `templates publish` from the directory containing `template.yaml`. The package scope must be the repository owner's exact GitHub handle: a template in `https://github.com/acme/templates` can publish as `acme/example`, not a personal handle. Before publishing, link GitHub and authorize the Dome Templates Registry App for the source repository. For organization repositories, the linked GitHub user must be a repository administrator. Use `templates doctor publish` to check both Registry sign-in and GitHub publishing access before uploading an artifact.
 
 Use `--verbose` with a command to include its diagnostic stack trace when it fails. When publishing requires a GitHub connection, the CLI opens the authorization page automatically; complete it, then run `publish` again.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@domesystems/templates",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Pull, publish, and run versioned Dome templates.",
   "repository": {
     "type": "git",

package/src/cli.mjs

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { readManifest, readPublishManifest } from "./manifest.mjs";
+import { generateDomeTerraform } from "./generate.mjs";
 import { imageForRuntime, renderCompose } from "./runtime.mjs";
 import { extractRelease, initializeEnvironment, writeRuntimeEnvironment } from "./template-files.mjs";
 import { createArchive, publishSource } from "./publish-files.mjs";
@@ -9,19 +10,19 @@ import { DEFAULT_REGISTRY, clearSelectedTarget, deleteProfile, directRegistry, d
 
 function ansi(code, value, options) { return options.color && process.stdout.isTTY ? `\u001B[${code}m${value}\u001B[0m` : value; }
 function line(kind, value, options) { const styles = { info: ["•", "36"], success: ["✓", "32"], warning: ["!", "33"], error: ["✗", "31"] }; const [mark, code] = styles[kind]; return `${ansi(code, mark, options)} ${value}`; }
-function usage() { return "Usage:\n  templates login [--server <Dome application URL>|--registry <Registry URL>] [--github]\n  templates logout [--server <Dome application URL>|--registry <Registry URL>]\n  templates doctor <pull|up|publish> [package] [--dir <directory>] [--server <URL>|--registry <URL>] [--json]\n  templates pull <scope/package[@version]> [--dir <directory>] [--server <URL>|--registry <URL>]\n  templates up [--dir <directory>] [--port <host-port>] [--server <URL>|--registry <URL>] [--import-job <job-id>] [--skip-provision|--provision] [--no-start] [--detach] [--verbose]\n  templates publish [--dry-run] [--server <Dome application URL>|--registry <Registry URL>]\n"; }
+function usage() { return "Usage:\n  templates login [--server <Dome application URL>|--registry <Registry URL>] [--github]\n  templates logout [--server <Dome application URL>|--registry <Registry URL>]\n  templates doctor <pull|up|publish> [package] [--dir <directory>] [--server <URL>|--registry <URL>] [--json]\n  templates pull <scope/package[@version]> [--dir <directory>] [--server <URL>|--registry <URL>]\n  templates generate [--dir <directory>] [--output <file>] [--force]\n  templates up [--dir <directory>] [--port <host-port>] [--server <URL>|--registry <URL>] [--import-job <job-id>] [--skip-provision|--provision] [--no-start] [--detach] [--verbose]\n  templates publish [--dir <directory>] [--dry-run] [--server <Dome application URL>|--registry <Registry URL>]\n"; }
 function parse(argv) {
   if (!argv.length || argv.includes("--help") || argv.includes("-h")) return { help: true };
   const [command, ...rest] = argv;
-  const options = { server: undefined, directory: undefined, port: 3000, dryRun: false, json: false, github: false, importJob: undefined, provision: true, forceProvision: false, start: true, detach: false, verbose: false, color: !process.env.NO_COLOR };
+  const options = { server: undefined, directory: undefined, output: "dome.tf", force: false, port: 3000, dryRun: false, json: false, github: false, importJob: undefined, provision: true, forceProvision: false, start: true, detach: false, verbose: false, color: !process.env.NO_COLOR };
   const values = [];
   for (let i = 0; i < rest.length; i += 1) {
     const arg = rest[i];
-    if (arg === "--server" || arg === "--registry" || arg === "--dir" || arg === "--port" || arg === "--color" || arg === "--import-job") { const value = rest[++i]; if (!value) throw new Error(`${arg} requires a value.`); if (arg === "--server") options.server = normalizeServer(value); else if (arg === "--registry") options.registry = normalizeServer(value); else if (arg === "--dir") options.directory = value; else if (arg === "--import-job") options.importJob = value; else if (arg === "--color") { if (!["auto", "always", "never"].includes(value)) throw new Error("--color must be auto, always, or never."); options.color = value === "always" || (value === "auto" && !process.env.NO_COLOR); } else { options.port = Number(value); if (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535) throw new Error("--port requires an integer from 1 to 65535."); } }
-    else if (arg === "--github") options.github = true; else if (arg === "--dry-run") options.dryRun = true; else if (arg === "--json") options.json = true; else if (arg === "--skip-provision") options.provision = false; else if (arg === "--provision") options.forceProvision = true; else if (arg === "--no-start") options.start = false; else if (arg === "--detach") options.detach = true; else if (arg === "--verbose") options.verbose = true; else if (arg.startsWith("-")) throw new Error(`Unknown option: ${arg}`); else values.push(arg);
+    if (arg === "--server" || arg === "--registry" || arg === "--dir" || arg === "--output" || arg === "--port" || arg === "--color" || arg === "--import-job") { const value = rest[++i]; if (!value) throw new Error(`${arg} requires a value.`); if (arg === "--server") options.server = normalizeServer(value); else if (arg === "--registry") options.registry = normalizeServer(value); else if (arg === "--dir") options.directory = value; else if (arg === "--output") options.output = value; else if (arg === "--import-job") options.importJob = value; else if (arg === "--color") { if (!["auto", "always", "never"].includes(value)) throw new Error("--color must be auto, always, or never."); options.color = value === "always" || (value === "auto" && !process.env.NO_COLOR); } else { options.port = Number(value); if (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535) throw new Error("--port requires an integer from 1 to 65535."); } }
+    else if (arg === "--github") options.github = true; else if (arg === "--dry-run") options.dryRun = true; else if (arg === "--json") options.json = true; else if (arg === "--force") options.force = true; else if (arg === "--skip-provision") options.provision = false; else if (arg === "--provision") options.forceProvision = true; else if (arg === "--no-start") options.start = false; else if (arg === "--detach") options.detach = true; else if (arg === "--verbose") options.verbose = true; else if (arg.startsWith("-")) throw new Error(`Unknown option: ${arg}`); else values.push(arg);
   }
   if (options.server && options.registry) throw new Error("Use either --server or --registry, not both.");
-  if (!["login", "logout", "doctor", "pull", "up", "publish"].includes(command)) throw new Error(`Unknown command: ${command}`);
+  if (!["login", "logout", "doctor", "pull", "generate", "up", "publish"].includes(command)) throw new Error(`Unknown command: ${command}`);
   return { command, values, options };
 }
 function remoteTarget(options) { return options.registry ? directRegistry(options.registry) : options.server ?? readSelectedTarget() ?? directRegistry(DEFAULT_REGISTRY); }
@@ -52,6 +53,12 @@ async function pull(name, options, output, fetchImplementation) {
   fs.mkdirSync(target, { recursive: true }); await extractRelease(Buffer.from(await response.arrayBuffer()), target, release); const created = initializeEnvironment(target);
   output(line("success", `Pulled ${release.name}@${release.version}`, options)); output(`  Saved to ${target}`); if (created) output(line("success", "Created .env from .env.example", options));
 }
+function generate(options, output) {
+  const target = path.resolve(process.cwd(), options.directory ?? ".");
+  const manifest = readManifest(target);
+  const file = generateDomeTerraform(target, { output: options.output, force: options.force, manifest });
+  output(line("success", `Generated ${file}`, options));
+}
 function run(command, args, cwd) { const result = spawnSync(command, args, { cwd, stdio: "inherit" }); if (result.error || result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed.`); }
 function json(text, command) { try { return JSON.parse(text.slice(text.indexOf("{"))); } catch { throw new Error(`${command} did not return valid JSON.`); } }
 function runJSON(command, args, cwd, { reveal = false } = {}) {
@@ -63,12 +70,25 @@ function runJSON(command, args, cwd, { reveal = false } = {}) {
     child.on("close", (status) => status === 0 ? resolve(json(stdout, command)) : reject(new Error(`${command} ${args.join(" ")} failed.`)));
   });
 }
+export function importExportURL(settingsURL) {
+  try {
+    const url = new URL(settingsURL.trim());
+    url.pathname = `${url.pathname.replace(/\/$/, "")}/import-export`;
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function importDashboardURL(cwd) {
+  const result = spawnSync("dome", ["open", "settings", "--quiet"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+  return result.status === 0 ? importExportURL(result.stdout) : null;
+}
 function configured(target) { const env = path.join(target, ".env"); return fs.existsSync(env) && ["DOME_TOKEN", "DOME_GATEWAY_URL"].every((key) => new RegExp(`^${key}=(?!\\s*$|undefined|\"\")`, "m").test(fs.readFileSync(env, "utf8"))); }
 export function importMadeNoChanges(job) { const summary = job?.plan_summary ?? job?.planSummary; if (!summary) return false; return ["create_count", "update_count", "import_count"].every((key) => Number(summary[key] ?? summary[key.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase())] ?? 0) === 0); }
 export function importHasPendingOutputs(job) { return (job?.outputs_state ?? job?.outputsState) === "pending"; }
 export function importCreatedResources(job) { const summary = job?.plan_summary ?? job?.planSummary; return Number(summary?.create_count ?? summary?.createCount ?? 0) > 0; }
 async function configureRuntime(target, jobID, options, output) { const gateways = await runJSON("dome", ["gateways", "list", "--json"], target); const gatewayURL = gateways?.data?.gateways?.find((candidate) => candidate.is_default)?.endpoints?.gateway_url; if (!gatewayURL) throw new Error("The import did not configure a default Gateway for the runtime."); const revealed = await runJSON("dome", ["import", "outputs", jobID, "--json"], target); const tokens = Object.entries(revealed?.data?.outputs ?? {}).filter(([key, value]) => key.endsWith("_token") && typeof value === "string"); if (tokens.length !== 1) throw new Error("The import did not produce exactly one runtime agent token."); writeRuntimeEnvironment(target, { DOME_TOKEN: tokens[0][1], DOME_GATEWAY_URL: gatewayURL }); output(line("success", "Configured the runtime with the imported agent credentials.", options)); }
-async function up(options, output) { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readManifest(target); const needsCredentials = !configured(target); output(line("info", `Checking ${target}`, options)); fs.writeFileSync(path.join(target, ".dome-compose.yaml"), renderCompose(manifest.app.runtime, options.port)); if (options.importJob) { output(line("info", "Saving credentials from the selected Dome import", options)); await configureRuntime(target, options.importJob, options, output); } else if (options.provision && (needsCredentials || options.forceProvision)) { output(line("info", "Setting up Dome resources", options)); const imported = await runJSON("dome", ["import", "dome.tf", "--json"], target); const job = imported?.data?.job; if (!job?.id) throw new Error("Dome import did not return a job ID."); if (importCreatedResources(job) && importHasPendingOutputs(job)) await configureRuntime(target, job.id, options, output); else if (needsCredentials) throw new Error(`Dome matched existing resources and did not create a new runtime token. Recover a pending import with templates up --dir ${options.directory ?? "."} --import-job <job-id>, or rotate the runtime key and set DOME_TOKEN and DOME_GATEWAY_URL in .env.`); else output(line("success", "Dome resources are already up to date; keeping the existing runtime credentials.", options)); } if (options.start) { output(line("info", `Starting app at http://localhost:${options.port}`, options)); run("docker", ["compose", "-f", ".dome-compose.yaml", "up", ...(options.detach ? ["--detach"] : [])], target); } }
+async function up(options, output) { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readManifest(target); const needsCredentials = !configured(target); output(line("info", `Checking ${target}`, options)); fs.writeFileSync(path.join(target, ".dome-compose.yaml"), renderCompose(manifest.app.runtime, options.port)); if (options.importJob) { output(line("info", "Saving credentials from the selected Dome import", options)); await configureRuntime(target, options.importJob, options, output); } else if (options.provision && (needsCredentials || options.forceProvision)) { output(line("info", "Setting up Dome resources", options)); let imported; try { imported = await runJSON("dome", ["import", "dome.tf", "--json"], target); } catch (caught) { const dashboardURL = importDashboardURL(target); const details = dashboardURL ? ` View the import details: ${dashboardURL}` : ""; throw new Error(`${caught.message}${details}`); } const job = imported?.data?.job; if (!job?.id) throw new Error("Dome import did not return a job ID."); if (importCreatedResources(job) && importHasPendingOutputs(job)) await configureRuntime(target, job.id, options, output); else if (needsCredentials) throw new Error(`Dome matched existing resources and did not create a new runtime token. Recover a pending import with templates up --dir ${options.directory ?? "."} --import-job <job-id>, or rotate the runtime key and set DOME_TOKEN and DOME_GATEWAY_URL in .env.`); else output(line("success", "Dome resources are already up to date; keeping the existing runtime credentials.", options)); } if (options.start) { output(line("info", `Starting app at http://localhost:${options.port}`, options)); run("docker", ["compose", "-f", ".dome-compose.yaml", "up", ...(options.detach ? ["--detach"] : [])], target); } }
 async function publish(options, output, fetchImplementation) { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readPublishManifest(target); const source = publishSource(target); const name = manifest.metadata.name; const [scope, slug] = name.split("/"); const archive = options.dryRun ? null : createArchive(source); output(line("info", `Checking ${name}@${manifest.metadata.version}`, options)); const payload = { name, version: manifest.metadata.version, title: manifest.metadata.title, summary: manifest.metadata.summary ?? "", sha256: archive?.sha256, size_bytes: archive?.buffer.length, source: { repository: manifest.metadata.source.repository, path: manifest.metadata.source.path, commit: source.commit, remote: source.remote, files: source.files } };
   const remote = remoteTarget(options); let registry; let attempt;
   try { ({ target: registry, body: attempt } = await registryRequest(remote, "/v1/publish-attempts", { method: "POST", body: { ...payload, dry_run: options.dryRun }, authenticated: true, fetchImplementation })); } catch (caught) {
@@ -78,7 +98,7 @@ async function publish(options, output, fetchImplementation) { const target = pa
   if (options.dryRun) { output(line("success", `Publish plan is valid for ${name}@${manifest.metadata.version}`, options)); return; }
   try { output(line("info", "Uploading release artifact", options)); const upload = await fetchImplementation(attempt.upload_url, { method: "PUT", headers: { "content-type": "application/zip" }, body: archive.buffer }); if (!upload.ok) throw new Error(`Artifact upload failed: ${upload.status} ${upload.statusText}.`); const { body: published } = await registryRequest(registry, `/v1/publish-attempts/${encodeURIComponent(attempt.id)}/complete`, { method: "POST", body: { sha256: archive.sha256, size_bytes: archive.buffer.length }, authenticated: true, fetchImplementation }); output(line("success", `Published ${published.name ?? name}@${published.version ?? manifest.metadata.version}`, options)); if (published.url) output(`  ${published.url}`); } finally { archive.cleanup(); }
 }
-async function doctor(subject, options, output, fetchImplementation) { const checks = []; const add = (name, passed, remediation) => checks.push({ name, passed, remediation }); const remote = remoteTarget(options); try { if (subject === "pull") { if (typeof remote === "string") await discover(remote, fetchImplementation); add("Registry reachability", true); } else if (subject === "up") { const target = path.resolve(process.cwd(), options.directory ?? "."); readManifest(target); add("template.yaml", true); add("Docker Compose", spawnSync("docker", ["compose", "version"], { stdio: "ignore" }).status === 0, "Install Docker Desktop or Docker Engine with the Compose plugin."); add("Dome CLI", spawnSync("dome", ["--version"], { stdio: "ignore" }).status === 0, "Install the Dome CLI."); } else if (subject === "publish") { readPublishManifest(path.resolve(process.cwd(), options.directory ?? ".")); publishSource(path.resolve(process.cwd(), options.directory ?? ".")); const profile = readProfile(remote.server ?? remote); add("Registry sign-in", Boolean(profile?.token), `Run npx @domesystems/templates login ${remoteLocation(options)}`); } else throw new Error("doctor expects pull, up, or publish."); } catch (error) { add("Preflight", false, error.message); }
+async function doctor(subject, options, output, fetchImplementation) { const checks = []; const add = (name, passed, remediation) => checks.push({ name, passed, remediation }); const remote = remoteTarget(options); try { if (subject === "pull") { if (typeof remote === "string") await discover(remote, fetchImplementation); add("Registry reachability", true); } else if (subject === "up") { const target = path.resolve(process.cwd(), options.directory ?? "."); readManifest(target); add("template.yaml", true); add("Docker Compose", spawnSync("docker", ["compose", "version"], { stdio: "ignore" }).status === 0, "Install Docker Desktop or Docker Engine with the Compose plugin."); add("Dome CLI", spawnSync("dome", ["--version"], { stdio: "ignore" }).status === 0, "Install the Dome CLI."); } else if (subject === "publish") { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readPublishManifest(target); const source = publishSource(target); const profile = readProfile(remote.server ?? remote); add("Registry sign-in", Boolean(profile?.token), `Run npx @domesystems/templates login ${remoteLocation(options)}`); if (profile?.token) { const { body } = await registryRequest(remote, "/v1/github/access", { method: "POST", body: { repository: manifest.metadata.source.repository, path: manifest.metadata.source.path, commit: source.commit }, authenticated: true, fetchImplementation }); add("GitHub publishing access", body.repository_authorized === true, body.message ?? "Link GitHub, authorize the Dome Templates Registry App for the source repository, and ensure you are a repository administrator."); } } else throw new Error("doctor expects pull, up, or publish."); } catch (error) { add("Preflight", false, error.message); }
   if (options.json) output(JSON.stringify({ server: remote.registry ?? remote, checks })); else checks.forEach((check) => output(line(check.passed ? "success" : "error", check.passed ? check.name : `${check.name}: ${check.remediation}`, options))); if (checks.some((check) => !check.passed)) throw new Error(`Cannot continue until ${subject} checks pass.`);
 }
-export async function main(argv, { output = console.log, error = console.error, fetchImplementation = globalThis.fetch, sleep, exit = (code) => { process.exitCode = code; }, open = openBrowser } = {}) { let options; try { const parsed = parse(argv); if (parsed.help) return output(usage()); const { command, values } = parsed; options = parsed.options; const remote = remoteTarget(options); if (options.json) options.color = false; if (command === "login") { const destination = options.registry ?? options.server ?? (typeof remote === "string" ? remote : remote.registry); output(line("info", `Opening sign-in for ${destination}`, options)); const session = await login(remote, { github: options.github, fetchImplementation, sleep, onStart: (started) => { open(started.verification_uri); output(options.verbose ? `Opening ${started.verification_uri}.` : `If your browser didn't open, open ${started.verification_uri} and enter ${started.user_code ?? "the displayed code"}.`); } }); writeSelectedTarget(remote); output(line("success", `Signed in as ${session.session.email}`, options)); return; } if (command === "logout") { const server = remote.server ?? remote; const profile = readProfile(server); if (profile?.token) await registryRequest(remote, "/v1/auth/logout", { method: "POST", authenticated: true, fetchImplementation }); deleteProfile(server); clearSelectedTarget(remote); output(line("success", `Signed out of ${server}`, options)); return; } if (command === "pull") return await pull(values[0], options, output, fetchImplementation); if (command === "up") return await up(options, output); if (command === "publish") return await publish(options, output, fetchImplementation); return await doctor(values[0], options, output, fetchImplementation); } catch (caught) { const detail = options?.verbose && caught?.stack ? caught.stack : caught.message; error(line("info", `Error: ${detail}`, { color: false })); exit(1); } }
+export async function main(argv, { output = console.log, error = console.error, fetchImplementation = globalThis.fetch, sleep, exit = (code) => { process.exitCode = code; }, open = openBrowser } = {}) { let options; try { const parsed = parse(argv); if (parsed.help) return output(usage()); const { command, values } = parsed; options = parsed.options; const remote = remoteTarget(options); if (options.json) options.color = false; if (command === "login") { const destination = options.registry ?? options.server ?? (typeof remote === "string" ? remote : remote.registry); output(line("info", `Opening sign-in for ${destination}`, options)); const session = await login(remote, { github: options.github, fetchImplementation, sleep, onStart: (started) => { open(started.verification_uri); output(options.verbose ? `Opening ${started.verification_uri}.` : `If your browser didn't open, open ${started.verification_uri} and enter ${started.user_code ?? "the displayed code"}.`); } }); writeSelectedTarget(remote); output(line("success", `Signed in as ${session.session.email}`, options)); return; } if (command === "logout") { const server = remote.server ?? remote; const profile = readProfile(server); if (profile?.token) await registryRequest(remote, "/v1/auth/logout", { method: "POST", authenticated: true, fetchImplementation }); deleteProfile(server); clearSelectedTarget(remote); output(line("success", `Signed out of ${server}`, options)); return; } if (command === "pull") return await pull(values[0], options, output, fetchImplementation); if (command === "generate") return generate(options, output); if (command === "up") return await up(options, output); if (command === "publish") return await publish(options, output, fetchImplementation); return await doctor(values[0], options, output, fetchImplementation); } catch (caught) { const detail = options?.verbose && caught?.stack ? caught.stack : caught.message; error(line("info", `Error: ${detail}`, { color: false })); exit(1); } }

package/src/generate.mjs

@@ -0,0 +1,220 @@
+import fs from "node:fs";
+import path from "node:path";
+
+const label = (value) => {
+  const rendered = String(value ?? "").replace(/[^A-Za-z0-9_]/g, "_").replace(/^[^A-Za-z_]/, "_");
+  if (!rendered) throw new Error("Template resources need a name.");
+  return rendered;
+};
+const q = (value) => JSON.stringify(String(value));
+const attr = (name, value) => `${name.padEnd(19)} = ${value}`;
+const block = (type, name, body) => `resource ${q(type)} ${q(name)} {\n${body.map((line) => `  ${line}`).join("\n")}\n}`;
+const variable = (name) => `variable ${q(name)} {\n  type      = string\n  sensitive = true\n}`;
+const nameFor = (prefix, value) => `${prefix}_${label(value)}`;
+
+function required(object, key, message) {
+  if (!object?.[key]) throw new Error(message);
+  return object[key];
+}
+
+function secretVariable(secret) {
+  return secret?.variable ? label(secret.variable) : null;
+}
+
+function connectionBlocks(connection, gatewayLabel, variables) {
+  const connectionLabel = label(required(connection, "name", "Every catalog connection needs a name."));
+  const auth = connection.auth ?? { method: "none" };
+  const lines = [
+    attr("workspace_id", "var.workspace_id"),
+    attr("name", q(connection.name)),
+    attr("protocol", q(required(connection, "protocol", `Connection ${connection.name} needs a protocol.`))),
+    attr("url", q(required(connection, "url", `Connection ${connection.name} needs a URL.`))),
+    attr("auth_method", q(auth.method)),
+  ];
+  if (auth.credential) lines.push(attr("credential_type", q(auth.credential)));
+  if (auth.oauth) {
+    const oauth = Object.entries(auth.oauth).map(([key, value]) => {
+      const destination = key === "scopes" ? "default_scopes" : key;
+      return `${destination} = ${Array.isArray(value) ? `[${value.map(q).join(", ")}]` : q(value)}`;
+    });
+    lines.push(`oauth = { ${oauth.join(", ")} }`);
+  }
+  const secret = auth.secret;
+  if (secretVariable(secret)) {
+    const key = auth.header ?? "Authorization";
+    variables.add(secretVariable(secret));
+    lines.push(attr("secret_values", `{ ${q(key)} = var.${secretVariable(secret)} }`));
+  }
+  const output = [block("dome_mcp_connection", connectionLabel, lines)];
+  for (const tool of [...(connection.permit ?? []), ...(connection.forbid ?? [])]) {
+    output.push(block("dome_gateway_tool", nameFor(connectionLabel, tool), [
+      attr("workspace_id", "var.workspace_id"),
+      attr("gateway", `dome_gateway.${gatewayLabel}.name`),
+      attr("mcp_connection", `dome_mcp_connection.${connectionLabel}.name`),
+      attr("tool", q(tool)),
+    ]));
+  }
+  return output;
+}
+
+function modelBlocks(model, pool, gatewayLabel, variables) {
+  const modelLabel = label(required(model, "name", "catalog.model needs a name."));
+  const poolLabel = label(required(pool, "name", "catalog.pool needs a name."));
+  const secret = model.secret;
+  const modelLines = [
+    attr("workspace_id", "var.workspace_id"),
+    attr("name", q(model.name)),
+    attr("provider_id", q(required(model, "provider", "catalog.model needs a provider."))),
+    attr("provider_config", `jsonencode({ model = ${q(required(model, "model_id", "catalog.model needs a model_id."))} })`),
+  ];
+  if (secretVariable(secret)) {
+    const variableName = secretVariable(secret);
+    // Dome shared API-key credentials are stored against the provider's
+    // managed header.  Its default is x-api-key; Authorization is not a
+    // substitute and is rejected by the Management API.
+    const secretHeader = model.secret_header ?? "x-api-key";
+    variables.add(variableName);
+    modelLines.push(
+      attr("auth_method", q("api-key")),
+      attr("credential_type", q("shared")),
+      attr("managed_header_name", q(secretHeader)),
+      attr("secret_values", `{ ${q(secretHeader)} = var.${variableName} }`),
+    );
+  }
+  return [
+    block("dome_llm_connection", modelLabel, modelLines),
+    block("dome_llm_pool", poolLabel, [
+      attr("workspace_id", "var.workspace_id"),
+      attr("name", q(pool.name)),
+      // Generated templates must coexist with any pool already installed in
+      // the target workspace.  A workspace permits only one default pool, so
+      // never make a reusable template's pool the default during provisioning.
+      attr("is_default", "false"),
+    ]),
+    block("dome_llm_pool_member", modelLabel, [
+      attr("workspace_id", "var.workspace_id"),
+      attr("pool", `dome_llm_pool.${poolLabel}.name`),
+      attr("llm_connection", `dome_llm_connection.${modelLabel}.name`),
+    ]),
+    block("dome_gateway_llm_pool", poolLabel, [
+      attr("workspace_id", "var.workspace_id"),
+      attr("gateway", `dome_gateway.${gatewayLabel}.name`),
+      attr("llm_pool", `dome_llm_pool.${poolLabel}.name`),
+    ]),
+  ];
+}
+
+function rulesBlock(root, rules, agentLabel) {
+  if (!rules?.file) return [];
+  const file = path.resolve(root, rules.file);
+  if (!fs.statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`Rules file not found: ${rules.file}.`);
+  const filename = path.basename(rules.file);
+  const contents = fs.readFileSync(file, "utf8").trimEnd();
+  return [block("dome_agent_rules_bundle", agentLabel, [
+    attr("workspace_id", "var.workspace_id"),
+    attr("agent", `dome_agent.${agentLabel}.name`),
+    "files = {",
+    `  ${q(filename)} = <<-CEDAR`,
+    ...contents.split("\n").map((line) => `  ${line}`),
+    "  CEDAR",
+    "}",
+  ])];
+}
+
+function guardBlocks(root, guards, refs) {
+  const filters = guards?.filters ?? [];
+  const blocks = [];
+  const bindings = new Map();
+  for (const filter of filters) {
+    const filterLabel = label(required(filter, "name", "Every Guard filter needs a name."));
+    let config;
+    if (filter.redact_ssn) config = "jsonencode({ text = { components = [{ action = \"FILTER_ACTION_REDACT\", matchers = [{ ssn = {} }] }] } })";
+    else if (filter.config) {
+      const file = path.resolve(root, filter.config);
+      if (!fs.statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`Guard config not found: ${filter.config}.`);
+      config = `jsonencode(jsondecode(<<-JSON\n${fs.readFileSync(file, "utf8").trimEnd()}\nJSON\n))`;
+    } else throw new Error(`Guard ${filter.name} needs config or redact_ssn.`);
+    blocks.push(block("dome_filter", filterLabel, [attr("workspace_id", "var.workspace_id"), attr("name", q(filter.name)), attr("description", q(filter.description ?? filter.name)), attr("config", config)]));
+    const binding = required(filter, "bind", `Guard ${filter.name} needs a bind target.`);
+    const kind = binding.model ? "model" : binding.tool ? "tool" : null;
+    if (!kind) throw new Error(`Guard ${filter.name} must bind to a model or tool.`);
+    const target = kind === "model" ? label(binding.model) : label(binding.tool);
+    const key = `${kind}:${target}:${binding.direction ?? "request"}`;
+    bindings.set(key, [...(bindings.get(key) ?? []), filterLabel]);
+  }
+  for (const [key, filterLabels] of bindings) {
+    const [kind, target, direction] = key.split(":");
+    const resource = kind === "model" ? "dome_llm_connection_filters" : "dome_mcp_connection_filters";
+    const attribute = kind === "model" ? "llm_connection" : "mcp_connection";
+    blocks.push(block(resource, `${target}_${direction}`, [
+      attr("workspace_id", "var.workspace_id"),
+      attr(attribute, `${kind === "model" ? "dome_llm_connection" : "dome_mcp_connection"}.${target}.name`),
+      attr("direction", q(direction)),
+      attr("filters", `[${filterLabels.map((item) => `dome_filter.${item}.name`).join(", ")}]`),
+    ]));
+  }
+  return blocks;
+}
+
+function quotaBlocks(quotas, refs) {
+  return (quotas ?? []).map((quota) => {
+    const subject = required(quota, "subject", "Every quota needs a subject.");
+    const target = subject === "agent" ? quota.agent : subject === "model" ? quota.model : quota.connection ?? String(quota.tool ?? "").split("/")[0];
+    if (!target) throw new Error(`Quota ${quota.name ?? ""} needs a target.`);
+    const resource = subject === "agent" ? "dome_agent" : subject === "model" ? "dome_llm_connection" : "dome_mcp_connection";
+    const type = subject === "agent" ? "agent" : subject === "model" ? "model" : "tool_connection";
+    const amount = quota.unit === "dome_usd" ? Math.round(Number(quota.limit) * 1_000_000) : Number(quota.limit);
+    if (!Number.isFinite(amount)) throw new Error(`Quota ${quota.name ?? ""} needs a numeric limit.`);
+    return block("dome_quota", label(quota.name ?? `${subject}_${target}`), [
+      attr("workspace_id", "var.workspace_id"),
+      attr("dimension", q(type === "tool_connection" ? "tool" : "llm")),
+      attr("unit", q(required(quota, "unit", "Every quota needs a unit."))),
+      attr("subject_type", q(type)),
+      attr("subject", `${resource}.${label(target)}.name`),
+      attr("scope", q(quota.per_caller ? "per_caller" : "total")),
+      attr("window", q(required(quota, "window", "Every quota needs a window."))),
+      attr("limit_amount", String(amount)),
+      attr("name", q(required(quota, "name", "Every quota needs a name."))),
+    ]);
+  });
+}
+
+export function renderDomeTerraform(manifest, root) {
+  const catalog = required(manifest, "catalog", "template.yaml must declare catalog to generate dome.tf.");
+  const gateway = required(catalog, "gateway", "catalog.gateway is required to generate dome.tf.");
+  const agent = required(catalog, "agent", "catalog.agent is required to generate dome.tf.");
+  const gatewayLabel = label(required(gateway, "name", "catalog.gateway needs a name."));
+  const agentLabel = label(required(agent, "name", "catalog.agent needs a name."));
+  const variables = new Set();
+  const blocks = [
+    block("dome_gateway", gatewayLabel, [
+      attr("workspace_id", "var.workspace_id"), attr("name", q(gateway.name)),
+      ...(gateway.description ? [attr("description", q(gateway.description))] : []), attr("is_default", String(Boolean(gateway.default))),
+    ]),
+    ...(catalog.connections ?? []).flatMap((connection) => connectionBlocks(connection, gatewayLabel, variables)),
+  ];
+  if (catalog.model || catalog.pool) {
+    if (!catalog.model || !catalog.pool) throw new Error("catalog.model and catalog.pool must be declared together.");
+    blocks.push(...modelBlocks(catalog.model, catalog.pool, gatewayLabel, variables));
+  }
+  const actAs = agent.act_as;
+  const agentLines = [attr("workspace_id", "var.workspace_id"), attr("name", q(agent.name)), attr("allowed_gateways", `[dome_gateway.${gatewayLabel}.name]`)];
+  if (actAs?.method && actAs.method !== "none") {
+    agentLines.push(attr("act_as", `{ method = ${q(actAs.method)}, required = ${String(Boolean(actAs.required))} }`));
+    if (actAs.secret) { const variableName = label(actAs.secret); variables.add(variableName); agentLines.push(attr("act_as_hmac_secret", `var.${variableName}`)); }
+    if (actAs.allowed_subjects) agentLines.push(attr("actas_allowed_subjects", `[${actAs.allowed_subjects.map(q).join(", ")}]`));
+  }
+  blocks.push(block("dome_agent", agentLabel, agentLines), ...rulesBlock(root, catalog.rules, agentLabel), ...guardBlocks(root, catalog.guards, {}), ...quotaBlocks(catalog.quotas, {}));
+  blocks.push(block("dome_agent_key", "runtime", [attr("workspace_id", "var.workspace_id"), attr("agent", `dome_agent.${agentLabel}.name`), attr("name", q("runtime"))]));
+  const header = `terraform {\n  required_providers {\n    dome = { source = ${q("dome-systems/dome")}, version = ${q(">= 0.1.0")} }\n  }\n}\n\nvariable "workspace_id" { type = string }`;
+  const secretDeclarations = [...variables].sort().map(variable).join("\n\n");
+  const output = `output ${q(`${agentLabel}_token`)} {\n  value     = dome_agent_key.runtime.token\n  sensitive = true\n}`;
+  return [header, secretDeclarations, blocks.join("\n\n"), output].filter(Boolean).join("\n\n") + "\n";
+}
+
+export function generateDomeTerraform(directory, { output = "dome.tf", force = false, manifest }) {
+  const target = path.resolve(directory, output);
+  if (fs.existsSync(target) && !force) throw new Error(`${target} already exists. Use --force to replace it.`);
+  fs.writeFileSync(target, renderDomeTerraform(manifest, directory));
+  return target;
+}