@dreamlake/dreamlake-cli 0.2.0 → 0.9.2

package/dist/cli/auth/credentials.js

@@ -1,157 +0,0 @@
-// CLI-side credentials storage — multi-environment.
-//
-// One YAML file holds several named environments (staging, prod, custom…)
-// each with its own server/bss/auth/namespace/token, plus which one is
-// active. Switching environments never loses another's token.
-//
-//   $XDG_CONFIG_HOME/dreamlake/auth.yml  (default ~/.config/dreamlake/auth.yml, chmod 600)
-//
-// Shape:
-//   current: staging
-//   envs:
-//     staging: { server, bss, auth, namespace, token }
-//     prod:    { server, bss, auth, namespace, token }
-//
-// Old flat files ({server,bss,namespace,token}) are migrated on read into
-// a single env (named after the matching built-in, else "default").
-import { existsSync, chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
-import { homedir } from "node:os";
-import path from "node:path";
-import YAML from "yaml";
-export const BUILTIN_ENVS = {
-    staging: {
-        server: "https://staging-api.dreamlake.ai",
-        bss: "https://bs-0b713023d6574ac2936eb1e9cbe9cfaa.ecs.us-east-1.on.aws",
-        auth: "https://staging-auth.vuer.ai",
-    },
-    prod: {
-        server: "https://api.dreamlake.ai",
-        bss: "https://bs-66d8a7267cdf47e1809553f1b0c00edf.ecs.us-east-1.on.aws",
-        auth: "https://auth.vuer.ai",
-    },
-};
-export function builtinEnv(name) {
-    return BUILTIN_ENVS[name] ?? null;
-}
-// ─── paths ───────────────────────────────────────────────────────────
-export function configDir() {
-    const xdg = process.env.XDG_CONFIG_HOME;
-    if (xdg && xdg.length > 0)
-        return path.join(xdg, "dreamlake");
-    return path.join(homedir(), ".config", "dreamlake");
-}
-export function authFilePath() {
-    return path.join(configDir(), "auth.yml");
-}
-// ─── load / migrate ──────────────────────────────────────────────────
-/** Name a migrated flat env after the built-in whose server matches, else "default". */
-function nameForServer(server) {
-    for (const [name, urls] of Object.entries(BUILTIN_ENVS)) {
-        if (urls.server.replace(/\/+$/, "") === server.replace(/\/+$/, ""))
-            return name;
-    }
-    return "default";
-}
-/** Read the full auth file, migrating the legacy flat shape. Returns empty file if absent/corrupt. */
-export function loadAuthFile(filePath) {
-    const p = filePath ?? authFilePath();
-    const empty = { current: "", envs: {} };
-    if (!existsSync(p))
-        return empty;
-    let parsed;
-    try {
-        parsed = YAML.parse(readFileSync(p, "utf8"));
-    }
-    catch {
-        return empty;
-    }
-    if (!parsed || typeof parsed !== "object")
-        return empty;
-    const obj = parsed;
-    // New multi-env shape.
-    if (obj.envs && typeof obj.envs === "object") {
-        const envs = obj.envs;
-        const current = typeof obj.current === "string" ? obj.current : Object.keys(envs)[0] ?? "";
-        return { current, envs };
-    }
-    // Legacy flat shape → migrate.
-    if (typeof obj.server === "string" && typeof obj.token === "string") {
-        const name = nameForServer(obj.server);
-        return {
-            current: name,
-            envs: {
-                [name]: {
-                    server: obj.server,
-                    bss: typeof obj.bss === "string" ? obj.bss : "",
-                    namespace: typeof obj.namespace === "string" ? obj.namespace : "",
-                    token: obj.token,
-                },
-            },
-        };
-    }
-    return empty;
-}
-function writeAuthFile(file, filePath) {
-    const p = filePath ?? authFilePath();
-    const dir = path.dirname(p);
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    writeFileSync(p, YAML.stringify({ current: file.current, envs: file.envs }), { mode: 0o600 });
-    chmodSync(p, 0o600);
-    return p;
-}
-// ─── accessors ───────────────────────────────────────────────────────
-export function currentEnvName(filePath) {
-    const f = loadAuthFile(filePath);
-    return f.current && f.envs[f.current] ? f.current : null;
-}
-/** The active environment's saved auth, or null if none is logged in. */
-export function currentEnv(filePath) {
-    const f = loadAuthFile(filePath);
-    return (f.current && f.envs[f.current]) || null;
-}
-export function listEnvs(filePath) {
-    const f = loadAuthFile(filePath);
-    return Object.entries(f.envs).map(([name, env]) => ({
-        name,
-        env,
-        current: name === f.current,
-    }));
-}
-/** Save an env (creating or overwriting) and optionally make it active. Returns the file path. */
-export function saveEnv(name, env, opts = {}) {
-    const f = loadAuthFile(opts.filePath);
-    f.envs[name] = env;
-    if (opts.setCurrent ?? true)
-        f.current = name;
-    if (!f.current)
-        f.current = name;
-    return writeAuthFile(f, opts.filePath);
-}
-/** Switch the active env. Returns false if the env isn't defined. */
-export function useEnv(name, filePath) {
-    const f = loadAuthFile(filePath);
-    if (!f.envs[name])
-        return false;
-    f.current = name;
-    writeAuthFile(f, filePath);
-    return true;
-}
-/** Remove one env. Returns false if it didn't exist. Picks a new current if needed. */
-export function removeEnv(name, filePath) {
-    const f = loadAuthFile(filePath);
-    if (!f.envs[name])
-        return false;
-    delete f.envs[name];
-    if (f.current === name)
-        f.current = Object.keys(f.envs)[0] ?? "";
-    const p = filePath ?? authFilePath();
-    if (Object.keys(f.envs).length === 0) {
-        if (existsSync(p))
-            rmSync(p);
-    }
-    else {
-        writeAuthFile(f, filePath);
-    }
-    return true;
-}

package/dist/cli/auth/device-flow.js

@@ -1,134 +0,0 @@
-// Device authorization flow (RFC 8628) — port of dreamlake-py's
-// auth/device_flow.py.
-//
-//   1. start  → POST {VUER_AUTH}/api/device/start  → user_code + verification URI
-//   2. poll   → POST {VUER_AUTH}/api/device/poll   → access_token (when approved)
-//   3. exchange → POST {DL}/auth/exchange (Bearer)  → permanent dreamlake token
-import { vuerAuthUrl, CLIENT_ID, DEFAULT_SCOPE } from "./constants.js";
-import { hashDeviceSecret } from "./device-secret.js";
-export class DeviceFlowError extends Error {
-}
-export class DeviceCodeExpiredError extends DeviceFlowError {
-}
-export class AuthorizationDeniedError extends DeviceFlowError {
-}
-export class TokenExchangeError extends DeviceFlowError {
-}
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-export class DeviceFlowClient {
-    deviceSecret;
-    dreamlakeServerUrl;
-    authUrl;
-    constructor(deviceSecret, dreamlakeServerUrl, authUrl) {
-        this.deviceSecret = deviceSecret;
-        this.dreamlakeServerUrl = dreamlakeServerUrl;
-        this.dreamlakeServerUrl = dreamlakeServerUrl.replace(/\/+$/, "");
-        this.authUrl = vuerAuthUrl(authUrl);
-    }
-    /** Initiate device authorization flow with vuer-auth. */
-    async startDeviceFlow(scope = DEFAULT_SCOPE) {
-        const res = await fetch(`${this.authUrl}/api/device/start`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                client_id: CLIENT_ID,
-                scope,
-                device_secret_hash: hashDeviceSecret(this.deviceSecret),
-            }),
-            signal: AbortSignal.timeout(10000),
-        });
-        if (!res.ok) {
-            throw new DeviceFlowError(`device start failed (${res.status}): ${await res.text().catch(() => "")}`);
-        }
-        const data = (await res.json());
-        const userCode = String(data.user_code ?? "");
-        const verificationUri = String(data.verification_uri ?? "");
-        return {
-            userCode,
-            deviceCode: String(data.device_code ?? ""),
-            verificationUri,
-            verificationUriComplete: String(data.verification_uri_complete ??
-                `${verificationUri}?code=${userCode.replace(/-/g, "")}`),
-            expiresIn: Number(data.expires_in ?? 600),
-            interval: Number(data.interval ?? 5),
-        };
-    }
-    /**
-     * Poll vuer-auth for authorization completion. Resolves with the
-     * vuer-auth access token (JWT). `onTick(elapsedSeconds)` is called
-     * before each poll for progress display.
-     */
-    async pollForToken(maxAttempts = 120, onTick) {
-        const deviceSecretHash = hashDeviceSecret(this.deviceSecret);
-        for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            if (onTick)
-                onTick(attempt * 5);
-            try {
-                const res = await fetch(`${this.authUrl}/api/device/poll`, {
-                    method: "POST",
-                    headers: { "Content-Type": "application/json" },
-                    body: JSON.stringify({
-                        client_id: CLIENT_ID,
-                        device_secret_hash: deviceSecretHash,
-                    }),
-                    signal: AbortSignal.timeout(10000),
-                });
-                if (res.status === 200) {
-                    const body = (await res.json());
-                    const token = body.access_token;
-                    if (typeof token !== "string" || !token) {
-                        throw new TokenExchangeError(`device poll succeeded but no access_token in response (keys: ${Object.keys(body).join(", ")})`);
-                    }
-                    return token;
-                }
-                const error = (await res.json().catch(() => ({})))
-                    .error;
-                if (error === "authorization_pending") {
-                    await sleep(5000);
-                    continue;
-                }
-                if (error === "expired_token") {
-                    throw new DeviceCodeExpiredError("Device code expired. Please run 'dreamlake login' again.");
-                }
-                if (error === "access_denied") {
-                    throw new AuthorizationDeniedError("User denied authorization request.");
-                }
-                if (error === "slow_down") {
-                    await sleep(10000);
-                    continue;
-                }
-                throw new TokenExchangeError(`Device flow error: ${error}`);
-            }
-            catch (err) {
-                if (err instanceof DeviceFlowError)
-                    throw err;
-                // Network blip — retry.
-                await sleep(5000);
-            }
-        }
-        throw new DeviceFlowError("Authorization timed out after 10 minutes. Please run 'dreamlake login' again.");
-    }
-    /** Exchange a vuer-auth token for a permanent dreamlake token. */
-    async exchangeToken(vuerAuthToken) {
-        let res;
-        try {
-            res = await fetch(`${this.dreamlakeServerUrl}/auth/exchange`, {
-                method: "POST",
-                headers: { Authorization: `Bearer ${vuerAuthToken}` },
-                signal: AbortSignal.timeout(10000),
-            });
-        }
-        catch (err) {
-            throw new TokenExchangeError(`Network error during token exchange: ${err.message}`);
-        }
-        if (!res.ok) {
-            const body = await res.text().catch(() => "");
-            throw new TokenExchangeError(`Token exchange failed: ${res.status} ${body || "(empty response body)"}`);
-        }
-        const data = (await res.json());
-        if (!data.dreamlake_token) {
-            throw new TokenExchangeError("Server response missing dreamlake_token field");
-        }
-        return data.dreamlake_token;
-    }
-}

package/dist/cli/auth/device-secret.js

@@ -1,34 +0,0 @@
-// Device secret generation + persistence — port of dreamlake-py's
-// auth/device_secret.py. The secret is a stable per-machine identifier
-// used by the device-authorization flow; we persist it next to auth.yml
-// (instead of dreamlake-py's config.json) at ~/.config/dreamlake/device_secret.
-import { createHash, randomBytes } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import path from "node:path";
-import { configDir } from "./credentials.js";
-function deviceSecretPath() {
-    return path.join(configDir(), "device_secret");
-}
-/** Generate a cryptographically secure 64-char hex device secret (256 bits). */
-export function generateDeviceSecret() {
-    return randomBytes(32).toString("hex");
-}
-/** SHA256 hash of the device secret, as a hex string. */
-export function hashDeviceSecret(secret) {
-    return createHash("sha256").update(secret, "utf8").digest("hex");
-}
-/** Load the persisted device secret, generating and saving one if absent. */
-export function getOrCreateDeviceSecret() {
-    const p = deviceSecretPath();
-    if (existsSync(p)) {
-        const existing = readFileSync(p, "utf8").trim();
-        if (existing)
-            return existing;
-    }
-    const secret = generateDeviceSecret();
-    const dir = path.dirname(p);
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    writeFileSync(p, secret, { mode: 0o600 });
-    return secret;
-}

package/dist/cli/client.js

@@ -1,99 +0,0 @@
-// Thin fetch wrapper for dreamlake-server and BSS. Zero-dependency —
-// uses Node's global `fetch`. Mirrors the per-call httpx usage scattered
-// across dreamlake-py's cli/ modules, centralized here.
-//
-// On a non-2xx response we throw Error("(status) body") so callers get a
-// clean message (matching lakeshore's auth/commands.ts error style).
-// Callers that need to branch on status (404/409) catch HttpError and
-// inspect `.status`.
-export class HttpError extends Error {
-    status;
-    body;
-    constructor(status, body) {
-        super(`(${status}) ${HttpError.extractMessage(body)}`);
-        this.name = "HttpError";
-        this.status = status;
-        this.body = body;
-    }
-    /**
-     * Pull a human message out of an error body. The server returns
-     * `{ "error": "..." }` (or `{ "message": "..." }`); fall back to the
-     * raw text, trimmed, for non-JSON bodies (e.g. HTML 404 pages).
-     */
-    static extractMessage(body) {
-        if (!body)
-            return "request failed";
-        try {
-            const parsed = JSON.parse(body);
-            if (parsed.error)
-                return parsed.error;
-            if (parsed.message)
-                return parsed.message;
-        }
-        catch {
-            // not JSON
-        }
-        const oneLine = body.replace(/\s+/g, " ").trim();
-        return oneLine.length > 200 ? oneLine.slice(0, 200) + "…" : oneLine;
-    }
-}
-function buildUrl(base, path, query) {
-    const url = new URL(base.replace(/\/+$/, "") + path);
-    if (query) {
-        for (const [k, v] of Object.entries(query)) {
-            if (v === undefined || v === null)
-                continue;
-            url.searchParams.set(k, String(v));
-        }
-    }
-    return url.toString();
-}
-function authHeaders(token) {
-    return token ? { Authorization: `Bearer ${token}` } : {};
-}
-/**
- * Issue a request and parse a JSON response. Throws HttpError on non-2xx.
- * Returns the parsed JSON (or `undefined` for empty bodies).
- */
-export async function requestJson(base, path, opts = {}) {
-    const { method = "GET", json, query, token, headers = {}, timeoutMs = 30000 } = opts;
-    const init = {
-        method,
-        headers: {
-            ...authHeaders(token),
-            ...(json !== undefined ? { "Content-Type": "application/json" } : {}),
-            ...headers,
-        },
-        signal: AbortSignal.timeout(timeoutMs),
-    };
-    if (json !== undefined)
-        init.body = JSON.stringify(json);
-    const res = await fetch(buildUrl(base, path, query), init);
-    if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        throw new HttpError(res.status, body);
-    }
-    const text = await res.text();
-    if (!text)
-        return undefined;
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return text;
-    }
-}
-/** GET a raw Response (for streaming downloads). Throws HttpError on non-2xx. */
-export async function requestRaw(url, opts = {}) {
-    const { token, timeoutMs = 300000, headers = {} } = opts;
-    const res = await fetch(url, {
-        headers: { ...authHeaders(token), ...headers },
-        redirect: "follow",
-        signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => "");
-        throw new HttpError(res.status, body);
-    }
-    return res;
-}

package/dist/cli/config.js

@@ -1,81 +0,0 @@
-// Shared connection config — TypeScript parity with dreamlake-py's
-// cli/_config.py. Resolution precedence (high → low):
-//
-//   remote/bss/token:  flag  →  env var  →  saved auth.yml  →  default
-//   namespace:         target's @ns  →  auth.yml  →  GET /auth/me  →  JWT decode
-//
-// Env vars: DREAMLAKE_REMOTE, DREAMLAKE_BSS_URL, DREAMLAKE_API_KEY
-// Defaults: dreamlake-server :10334, BSS :10234
-import { currentEnv } from "./auth/credentials.js";
-export const DEFAULT_REMOTE = "http://localhost:10334";
-export const DEFAULT_BSS = "http://localhost:10234";
-function stripTrailingSlash(url) {
-    return url.replace(/\/+$/, "");
-}
-/** dreamlake-server base URL. flag > env > active environment > default. */
-export function resolveRemote(flag) {
-    const v = flag ||
-        process.env.DREAMLAKE_REMOTE ||
-        currentEnv()?.server ||
-        DEFAULT_REMOTE;
-    return stripTrailingSlash(v);
-}
-/** BSS (big-streaming-server) base URL. */
-export function resolveBss(flag) {
-    const v = flag ||
-        process.env.DREAMLAKE_BSS_URL ||
-        currentEnv()?.bss ||
-        DEFAULT_BSS;
-    return stripTrailingSlash(v);
-}
-/** Bearer token, or null if unauthenticated. */
-export function resolveToken(flag) {
-    return flag || process.env.DREAMLAKE_API_KEY || currentEnv()?.token || null;
-}
-/** Decode a JWT payload without verifying the signature. Returns {} on failure. */
-export function decodeJwtPayload(token) {
-    try {
-        const part = token.split(".")[1];
-        if (!part)
-            return {};
-        const b64 = part.replace(/-/g, "+").replace(/_/g, "/");
-        const json = Buffer.from(b64, "base64").toString("utf8");
-        const parsed = JSON.parse(json);
-        return parsed && typeof parsed === "object" ? parsed : {};
-    }
-    catch {
-        return {};
-    }
-}
-/**
- * Resolve the current user's namespace slug. Mirrors _config.py:
- *   explicit (target @ns) → saved auth.yml → GET /auth/me → JWT decode.
- * Returns null when nothing resolves (caller prints the login hint).
- */
-export async function resolveNamespace(explicit, opts) {
-    if (explicit)
-        return explicit;
-    const saved = currentEnv();
-    if (saved?.namespace)
-        return saved.namespace;
-    // Query server for the authoritative slug.
-    try {
-        const res = await fetch(`${opts.remote}/auth/me`, {
-            headers: { Authorization: `Bearer ${opts.token}` },
-            signal: AbortSignal.timeout(5000),
-        });
-        if (res.ok) {
-            const body = (await res.json());
-            const slug = body.namespace?.slug;
-            if (slug)
-                return slug;
-        }
-    }
-    catch {
-        // fall through to JWT decode
-    }
-    // Fallback: decode from JWT (stale but better than nothing).
-    const payload = decodeJwtPayload(opts.token);
-    const fromJwt = payload.username ?? payload.sub;
-    return typeof fromJwt === "string" ? fromJwt : null;
-}