@ethlete/cli 2.0.1-next.2 → 2.1.0-next.11

package/src/lib/auth/auth-command.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authCommand = void 0;
+const tslib_1 = require("tslib");
+const auth_hint_1 = require("../api/auth-hint");
+const load_definitions_1 = require("../api/load-definitions");
+const resolve_checkout_1 = require("../api/resolve-checkout");
+const utils_1 = require("../utils");
+const composer_auth_1 = require("./composer-auth");
+const composer_repositories_1 = require("./composer-repositories");
+const gitlab_token_1 = require("./gitlab-token");
+const usage = (invocation) => [
+    `Usage: ${invocation} [host] <token>`,
+    '',
+    "Writes a GitLab token into composer's auth.json, which the API containers mount, so a",
+    'private dependency can be downloaded. The token is checked against the host first.',
+    '',
+    'The host is optional when every API in ethlete.apis.js sits on the same one.',
+    '',
+    'A host may be written as a url. Only its host name is used.',
+    '',
+    'Flags',
+    '  --force  Write the token even when the check says it cannot fetch code, and replace',
+    '           a token the file already holds for that host without asking',
+].join('\n');
+/**
+ * Every host in play, and the projects on each one that a token is needed for. The projects come from
+ * the `repositories` of each checkout's composer.json, never from the API's own repoUrl: a developer
+ * fetches that one with their own credential, while the token is for its private dependencies.
+ */
+const surveyHosts = (root) => {
+    var _a;
+    const loaded = (0, load_definitions_1.loadApiDefinitions)(root);
+    const hosts = new Set();
+    const projects = new Map();
+    if (!loaded.found)
+        return { hosts: [...hosts], projects };
+    for (const [name, api] of Object.entries(loaded.apis)) {
+        const apiHost = api.repoUrl ? (0, auth_hint_1.gitUrlHost)(api.repoUrl) : undefined;
+        if (apiHost)
+            hosts.add(apiHost);
+        const checkout = (0, resolve_checkout_1.resolveApiCheckout)({ root, name, api, needs: 'repo' });
+        if (!checkout.ok)
+            continue;
+        for (const url of (0, composer_repositories_1.composerGitRepositories)(checkout.checkout.repoPath)) {
+            const host = (0, auth_hint_1.gitUrlHost)(url);
+            const projectPath = (0, auth_hint_1.gitUrlProjectPath)(url);
+            if (!host || !projectPath)
+                continue;
+            hosts.add(host);
+            projects.set(host, ((_a = projects.get(host)) !== null && _a !== void 0 ? _a : new Set()).add(projectPath));
+        }
+    }
+    return { hosts: [...hosts], projects };
+};
+const describeClone = (check) => {
+    switch (check.state) {
+        case 'clonable':
+            return { line: 'can be fetched', ok: true };
+        case 'forbidden':
+            return { line: '403: this token cannot fetch it', ok: false };
+        case 'unauthorized':
+            return { line: '401: the token was rejected', ok: false };
+        case 'missing':
+            return { line: '404: this token cannot see it', ok: false };
+        case 'unreachable':
+            return { line: `not checked: ${check.reason}`, ok: true };
+    }
+};
+const printTokenLine = (host, token) => (0, gitlab_token_1.describeGitlabToken)({ host, token }).then((check) => {
+    if (check.state === 'unauthorized')
+        return false;
+    if (check.state === 'unreachable')
+        console.log(`  token     not checked: ${check.reason}`);
+    else if (check.state === 'undisclosed')
+        console.log('  token     accepted, and keeps its own details private');
+    else {
+        const named = check.name ? `"${check.name}", ` : '';
+        const expires = check.expiresAt ? `, expires ${check.expiresAt}` : '';
+        console.log(`  token     ${named}scopes: ${check.scopes.join(', ') || 'none'}${expires}`);
+    }
+    return true;
+});
+/** Writes a GitLab token into composer's auth.json, after asking the host whether it can fetch code. */
+const authCommand = (_a) => tslib_1.__awaiter(void 0, [_a], void 0, function* ({ argv, root = process.cwd(), invocation = 'et auth', home = (0, composer_auth_1.defaultComposerHome)(), }) {
+    var _b, _c, _d;
+    if (argv.includes('--help') || argv.includes('-h')) {
+        console.log(usage(invocation));
+        return 0;
+    }
+    const positional = argv.filter((arg) => !arg.startsWith('--'));
+    if (positional.length === 0 || positional.length > 2) {
+        console.error(usage(invocation));
+        return 1;
+    }
+    const force = argv.includes('--force');
+    const survey = surveyHosts(root);
+    const named = positional.length === 2;
+    const host = named ? (0, auth_hint_1.gitHostFromInput)((_b = positional[0]) !== null && _b !== void 0 ? _b : '') : survey.hosts[0];
+    const token = (_c = positional[named ? 1 : 0]) !== null && _c !== void 0 ? _c : '';
+    if (named && host === undefined) {
+        console.error(`"${positional[0]}" holds no host name. Name the host itself:\n\n  ${invocation} gitlab.example.com <token>`);
+        return 1;
+    }
+    if (host === undefined) {
+        console.error(`No host to write a token for. ethlete.apis.js declares no repoUrl, so name the host:\n\n` +
+            `  ${invocation} gitlab.example.com <token>`);
+        return 1;
+    }
+    if (!named && survey.hosts.length > 1) {
+        console.error(`${survey.hosts.length} hosts are in use, so name the one this token is for:\n\n` +
+            survey.hosts.map((known) => `  ${invocation} ${known} <token>`).join('\n'));
+        return 1;
+    }
+    console.log(`\n${host}`);
+    if (!(yield printTokenLine(host, token))) {
+        console.error('  token     rejected with 401. It is wrong, expired or revoked.\n\nNothing was written.');
+        return 1;
+    }
+    const projectPaths = [...((_d = survey.projects.get(host)) !== null && _d !== void 0 ? _d : [])];
+    let fetchable = projectPaths.length === 0;
+    if (projectPaths.length === 0) {
+        console.log('  fetch     no private dependency on that host to try');
+    }
+    for (const projectPath of projectPaths) {
+        const described = describeClone(yield (0, gitlab_token_1.checkGitCloneAccess)({ host, projectPath, token }));
+        fetchable = fetchable || described.ok;
+        console.log(`  fetch     ${projectPath} ${described.line}`);
+    }
+    if (!fetchable && !force) {
+        console.error(`\nNothing was written. A token that cannot fetch those repositories cannot install them.\n` +
+            `Give it read access to the code, or re-run with --force to write it anyway.`);
+        return 1;
+    }
+    const stored = (0, composer_auth_1.storedGitlabToken)({ home, host });
+    if (stored !== undefined && stored !== token && !force) {
+        const accepted = yield (0, utils_1.confirm)({
+            problem: `\n${(0, composer_auth_1.composerAuthPath)(home)} already holds a different token for ${host}.`,
+            question: 'Replace it?',
+            hint: 'Re-run in a terminal to answer the question, or re-run with --force to replace it.',
+            defaultsToYes: false,
+        });
+        if (!accepted) {
+            console.error('\nNothing was written. The token already in the file was kept.');
+            return 1;
+        }
+    }
+    const written = (0, composer_auth_1.writeGitlabToken)({ home, host, token });
+    if (!written.ok) {
+        console.error(`\n${written.problem}`);
+        return 1;
+    }
+    const strays = (0, composer_auth_1.gitlabTokenHosts)(home).filter((key) => key !== host && (0, auth_hint_1.gitHostFromInput)(key) === host);
+    const single = strays.length === 1;
+    const unused = single ? 'that entry is' : 'those entries are';
+    console.log(`\n${written.replaced ? 'Replaced' : 'Wrote'} the ${host} token in ${(0, composer_auth_1.composerAuthPath)(home)}.\n` +
+        `The API containers mount that directory, so composer inside them reads it.` +
+        (strays.length === 0
+            ? ''
+            : `\n\nThe file also holds ${strays.map((key) => `"${key}"`).join(', ')} for the same host. Composer ` +
+                `matches a gitlab-token by host name, so ${unused} never used. You can remove ${single ? 'it' : 'them'}.`));
+    return 0;
+});
+exports.authCommand = authCommand;
+//# sourceMappingURL=auth-command.js.map

package/src/lib/auth/auth-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-command.js","sourceRoot":"","sources":["../../../../../../libs/cli/src/lib/auth/auth-command.ts"],"names":[],"mappings":";;;;AAAA,gDAAmF;AACnF,8DAA6D;AAC7D,8DAA6D;AAC7D,oCAAmC;AACnC,mDAMyB;AACzB,mEAAkE;AAClE,iDAAsF;AAYtF,MAAM,KAAK,GAAG,CAAC,UAAkB,EAAE,EAAE,CACnC;IACE,UAAU,UAAU,iBAAiB;IACrC,EAAE;IACF,uFAAuF;IACvF,oFAAoF;IACpF,EAAE;IACF,8EAA8E;IAC9E,EAAE;IACF,6DAA6D;IAC7D,EAAE;IACF,OAAO;IACP,uFAAuF;IACvF,wEAAwE;CACzE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEf;;;;GAIG;AACH,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE;;IACnC,MAAM,MAAM,GAAG,IAAA,qCAAkB,EAAC,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEhD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IAE1D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,sBAAU,EAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,IAAI,OAAO;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,IAAA,qCAAkB,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,SAAS;QAE3B,KAAK,MAAM,GAAG,IAAI,IAAA,+CAAuB,EAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,IAAA,sBAAU,EAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,WAAW,GAAG,IAAA,6BAAiB,EAAC,GAAG,CAAC,CAAC;YAE3C,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW;gBAAE,SAAS;YAEpC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAiB,EAAE,EAAE;IAC1C,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9C,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAChE,KAAK,cAAc;YACjB,OAAO,EAAE,IAAI,EAAE,6BAA6B,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC5D,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,+BAA+B,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC9D,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,gBAAgB,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CACrD,IAAA,kCAAmB,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;IAClD,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAEjD,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;SACtF,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;SAC1G,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,WAAW,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,wGAAwG;AACjG,MAAM,WAAW,GAAG,KAKa,EAAE,oDALR,EAChC,IAAI,EACJ,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,EACpB,UAAU,GAAG,SAAS,EACtB,IAAI,GAAG,IAAA,mCAAmB,GAAE,GACT;;IACnB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAE/B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QAEjC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,4BAAgB,EAAC,MAAA,UAAU,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,MAAA,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC;IAE9C,IAAI,KAAK,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CACX,IAAI,UAAU,CAAC,CAAC,CAAC,oDAAoD,UAAU,6BAA6B,CAC7G,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CACX,0FAA0F;YACxF,KAAK,UAAU,6BAA6B,CAC/C,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,2DAA2D;YAC/E,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,UAAU,IAAI,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7E,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAEzB,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,yFAAyF,CAAC,CAAC;QAEzG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,MAAA,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,SAAS,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC;IAE1C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,IAAA,kCAAmB,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAEzF,SAAS,GAAG,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;QAEtC,OAAO,CAAC,GAAG,CAAC,eAAe,WAAW,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CACX,4FAA4F;YAC1F,6EAA6E,CAChF,CAAC;QAEF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,iCAAiB,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAA,eAAO,EAAC;YAC7B,OAAO,EAAE,KAAK,IAAA,gCAAgB,EAAC,IAAI,CAAC,wCAAwC,IAAI,GAAG;YACnF,QAAQ,EAAE,aAAa;YACvB,IAAI,EAAE,oFAAoF;YAC1F,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;YAEhF,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,gCAAgB,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAExD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAEtC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,gCAAgB,EAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,IAAA,4BAAgB,EAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAE9D,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,QAAQ,IAAI,aAAa,IAAA,gCAAgB,EAAC,IAAI,CAAC,KAAK;QAC9F,4EAA4E;QAC5E,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAClB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,2BAA2B,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;gBACpG,2CAA2C,MAAM,+BAA+B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CACjH,CAAC;IAEF,OAAO,CAAC,CAAC;AACX,CAAC,CAAA,CAAC;AA3HW,QAAA,WAAW,eA2HtB"}

package/src/lib/auth/composer-auth.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The compose file of every API here mounts `$HOME/.composer` into its container, so this is the
+ * directory the container's composer reads, whatever `COMPOSER_HOME` says on the host.
+ */
+export declare const defaultComposerHome: () => string;
+export declare const composerAuthPath: (home: string) => string;
+export type WriteTokenResult = {
+    ok: true;
+    path: string;
+    replaced: boolean;
+} | {
+    ok: false;
+    problem: string;
+};
+/**
+ * Adds one host's GitLab token to composer's auth.json, keeping every other credential in the file.
+ * A file that cannot be parsed is reported rather than replaced, so nothing already in it is lost.
+ */
+export declare const writeGitlabToken: (options: {
+    home: string;
+    host: string;
+    token: string;
+}) => WriteTokenResult;
+/** The token composer already holds for one host, or undefined when it holds none. */
+export declare const storedGitlabToken: (options: {
+    home: string;
+    host: string;
+}) => string | undefined;
+/** The hosts composer already holds a GitLab token for. */
+export declare const gitlabTokenHosts: (home: string) => string[];

package/src/lib/auth/composer-auth.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gitlabTokenHosts = exports.storedGitlabToken = exports.writeGitlabToken = exports.composerAuthPath = exports.defaultComposerHome = void 0;
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+/**
+ * The compose file of every API here mounts `$HOME/.composer` into its container, so this is the
+ * directory the container's composer reads, whatever `COMPOSER_HOME` says on the host.
+ */
+const defaultComposerHome = () => (0, path_1.join)((0, os_1.homedir)(), '.composer');
+exports.defaultComposerHome = defaultComposerHome;
+const composerAuthPath = (home) => (0, path_1.join)(home, 'auth.json');
+exports.composerAuthPath = composerAuthPath;
+const GITLAB_TOKENS = 'gitlab-token';
+const storedTokens = (auth) => auth[GITLAB_TOKENS];
+const readAuth = (path) => {
+    if (!(0, fs_1.existsSync)(path))
+        return { auth: {} };
+    let parsed;
+    try {
+        parsed = JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch (error) {
+        return { unreadable: `${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}` };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return { unreadable: `${path} does not hold a JSON object.` };
+    }
+    return { auth: parsed };
+};
+/**
+ * Adds one host's GitLab token to composer's auth.json, keeping every other credential in the file.
+ * A file that cannot be parsed is reported rather than replaced, so nothing already in it is lost.
+ */
+const writeGitlabToken = (options) => {
+    const { home, host, token } = options;
+    const path = (0, exports.composerAuthPath)(home);
+    const read = readAuth(path);
+    if ('unreadable' in read) {
+        return { ok: false, problem: `${read.unreadable}\nFix it or move it aside, so no other credential in it is lost.` };
+    }
+    const tokens = Object.assign({}, storedTokens(read.auth));
+    const replaced = tokens[host] !== undefined && tokens[host] !== token;
+    tokens[host] = token;
+    (0, fs_1.mkdirSync)(home, { recursive: true });
+    (0, fs_1.writeFileSync)(path, `${JSON.stringify(Object.assign(Object.assign({}, read.auth), { [GITLAB_TOKENS]: tokens }), null, 4)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600,
+    });
+    // writeFileSync only applies mode when it creates the file, and this one usually already exists.
+    (0, fs_1.chmodSync)(path, 0o600);
+    return { ok: true, path, replaced };
+};
+exports.writeGitlabToken = writeGitlabToken;
+/** The token composer already holds for one host, or undefined when it holds none. */
+const storedGitlabToken = (options) => {
+    var _a;
+    const read = readAuth((0, exports.composerAuthPath)(options.home));
+    return 'unreadable' in read ? undefined : (_a = storedTokens(read.auth)) === null || _a === void 0 ? void 0 : _a[options.host];
+};
+exports.storedGitlabToken = storedGitlabToken;
+/** The hosts composer already holds a GitLab token for. */
+const gitlabTokenHosts = (home) => {
+    var _a;
+    const read = readAuth((0, exports.composerAuthPath)(home));
+    return 'unreadable' in read ? [] : Object.keys((_a = storedTokens(read.auth)) !== null && _a !== void 0 ? _a : {});
+};
+exports.gitlabTokenHosts = gitlabTokenHosts;
+//# sourceMappingURL=composer-auth.js.map

package/src/lib/auth/composer-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer-auth.js","sourceRoot":"","sources":["../../../../../../libs/cli/src/lib/auth/composer-auth.ts"],"names":[],"mappings":";;;AAAA,2BAAmF;AACnF,2BAA6B;AAC7B,+BAA4B;AAE5B;;;GAGG;AACI,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAAC,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,WAAW,CAAC,CAAC;AAAzD,QAAA,mBAAmB,uBAAsC;AAE/D,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAA,WAAI,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AAA7D,QAAA,gBAAgB,oBAA6C;AAE1E,MAAM,aAAa,GAAG,cAAc,CAAC;AAIrC,MAAM,YAAY,GAAG,CAAC,IAAkB,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAuC,CAAC;AAEvG,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAmD,EAAE;IACjF,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAE3C,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAChH,CAAC;IAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,+BAA+B,EAAE,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAsB,EAAE,CAAC;AAC1C,CAAC,CAAC;AAIF;;;GAGG;AACI,MAAM,gBAAgB,GAAG,CAAC,OAAsD,EAAoB,EAAE;IAC3G,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACtC,MAAM,IAAI,GAAG,IAAA,wBAAgB,EAAC,IAAI,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE5B,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,kEAAkE,EAAE,CAAC;IACtH,CAAC;IAED,MAAM,MAAM,qBAAQ,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC;IAEtE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAErB,IAAA,cAAS,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,IAAA,kBAAa,EAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,iCAAM,IAAI,CAAC,IAAI,KAAE,CAAC,aAAa,CAAC,EAAE,MAAM,KAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC7F,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,iGAAiG;IACjG,IAAA,cAAS,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC,CAAC;AAvBW,QAAA,gBAAgB,oBAuB3B;AAEF,sFAAsF;AAC/E,MAAM,iBAAiB,GAAG,CAAC,OAAuC,EAAE,EAAE;;IAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAA,wBAAgB,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,OAAO,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAA,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,0CAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC,CAAC;AAJW,QAAA,iBAAiB,qBAI5B;AAEF,2DAA2D;AACpD,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE;;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAA,wBAAgB,EAAC,IAAI,CAAC,CAAC,CAAC;IAE9C,OAAO,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAA,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAI,EAAE,CAAC,CAAC;AAChF,CAAC,CAAC;AAJW,QAAA,gBAAgB,oBAI3B"}

package/src/lib/auth/composer-repositories.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The git urls a checkout's composer.json pulls packages from. These are the repositories a token is
+ * needed for; the API's own repository is not one of them, because the developer already has it.
+ */
+export declare const composerGitRepositories: (repoPath: string) => string[];

package/src/lib/auth/composer-repositories.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.composerGitRepositories = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const urlOf = (entry) => typeof entry === 'object' && entry !== null ? entry['url'] : undefined;
+/**
+ * The git urls a checkout's composer.json pulls packages from. These are the repositories a token is
+ * needed for; the API's own repository is not one of them, because the developer already has it.
+ */
+const composerGitRepositories = (repoPath) => {
+    const path = (0, path_1.join)(repoPath, 'composer.json');
+    if (!(0, fs_1.existsSync)(path))
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse((0, fs_1.readFileSync)(path, 'utf8'));
+    }
+    catch (_a) {
+        return [];
+    }
+    const declared = typeof parsed === 'object' && parsed !== null ? parsed : {};
+    const repositories = declared['repositories'];
+    // composer accepts both a list and a name-keyed map here.
+    const entries = Array.isArray(repositories)
+        ? repositories
+        : typeof repositories === 'object' && repositories !== null
+            ? Object.values(repositories)
+            : [];
+    return entries.map(urlOf).filter((url) => typeof url === 'string');
+};
+exports.composerGitRepositories = composerGitRepositories;
+//# sourceMappingURL=composer-repositories.js.map

package/src/lib/auth/composer-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composer-repositories.js","sourceRoot":"","sources":["../../../../../../libs/cli/src/lib/auth/composer-repositories.ts"],"names":[],"mappings":";;;AAAA,2BAA8C;AAC9C,+BAA4B;AAE5B,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE,CAC/B,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAEtG;;;GAGG;AACI,MAAM,uBAAuB,GAAG,CAAC,QAAgB,EAAY,EAAE;IACpE,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAE7C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1G,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC9C,0DAA0D;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;YACzD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7B,CAAC,CAAC,EAAE,CAAC;IAET,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;AACpF,CAAC,CAAC;AAvBW,QAAA,uBAAuB,2BAuBlC"}

package/src/lib/auth/gitlab-token.d.ts

@@ -0,0 +1,43 @@
+export type TokenCheck = {
+    state: 'valid';
+    name?: string;
+    scopes: string[];
+    expiresAt?: string;
+} | {
+    state: 'undisclosed';
+} | {
+    state: 'unauthorized';
+} | {
+    state: 'unreachable';
+    reason: string;
+};
+/**
+ * Asks GitLab what the token is. A project or group access token answers 403 here, and so does a
+ * token without an api scope, so only 401 proves the token itself is wrong.
+ */
+export declare const describeGitlabToken: (options: {
+    host: string;
+    token: string;
+}) => Promise<TokenCheck>;
+export type CloneCheck = {
+    state: 'clonable';
+} | {
+    state: 'forbidden';
+} | {
+    state: 'unauthorized';
+} | {
+    state: 'missing';
+} | {
+    state: 'unreachable';
+    reason: string;
+};
+/**
+ * Asks the host for a repository's refs with the token as a basic credential. This is the first
+ * request `git clone` over https makes, so it proves the token can fetch code and needs no api scope,
+ * which a project access token does not have.
+ */
+export declare const checkGitCloneAccess: (options: {
+    host: string;
+    projectPath: string;
+    token: string;
+}) => Promise<CloneCheck>;

package/src/lib/auth/gitlab-token.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkGitCloneAccess = exports.describeGitlabToken = void 0;
+const tslib_1 = require("tslib");
+const TIMEOUT_MS = 10000;
+const request = (options) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
+    const { url, headers } = options;
+    try {
+        const response = yield fetch(url, { headers, signal: AbortSignal.timeout(TIMEOUT_MS) });
+        return { response };
+    }
+    catch (error) {
+        return { reason: error instanceof Error ? error.message : String(error) };
+    }
+});
+/**
+ * Asks GitLab what the token is. A project or group access token answers 403 here, and so does a
+ * token without an api scope, so only 401 proves the token itself is wrong.
+ */
+const describeGitlabToken = (options) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
+    const { host, token } = options;
+    const result = yield request({
+        url: `https://${host}/api/v4/personal_access_tokens/self`,
+        headers: { 'PRIVATE-TOKEN': token },
+    });
+    if ('reason' in result)
+        return { state: 'unreachable', reason: result.reason };
+    if (result.response.status === 401)
+        return { state: 'unauthorized' };
+    if (result.response.status === 403)
+        return { state: 'undisclosed' };
+    if (!result.response.ok) {
+        return { state: 'unreachable', reason: `${host} answered ${result.response.status} for the token itself.` };
+    }
+    const body = yield result.response.json().catch(() => undefined);
+    const record = typeof body === 'object' && body !== null ? body : {};
+    return {
+        state: 'valid',
+        name: typeof record['name'] === 'string' ? record['name'] : undefined,
+        scopes: Array.isArray(record['scopes']) ? record['scopes'].map(String) : [],
+        expiresAt: typeof record['expires_at'] === 'string' ? record['expires_at'] : undefined,
+    };
+});
+exports.describeGitlabToken = describeGitlabToken;
+/**
+ * Asks the host for a repository's refs with the token as a basic credential. This is the first
+ * request `git clone` over https makes, so it proves the token can fetch code and needs no api scope,
+ * which a project access token does not have.
+ */
+const checkGitCloneAccess = (options) => tslib_1.__awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const { host, projectPath, token } = options;
+    const result = yield request({
+        url: `https://${host}/${projectPath}.git/info/refs?service=git-upload-pack`,
+        headers: { Authorization: `Basic ${Buffer.from(`oauth2:${token}`).toString('base64')}` },
+    });
+    if ('reason' in result)
+        return { state: 'unreachable', reason: result.reason };
+    const { status } = result.response;
+    yield ((_a = result.response.body) === null || _a === void 0 ? void 0 : _a.cancel());
+    if (status === 200)
+        return { state: 'clonable' };
+    if (status === 401)
+        return { state: 'unauthorized' };
+    if (status === 403)
+        return { state: 'forbidden' };
+    if (status === 404)
+        return { state: 'missing' };
+    return { state: 'unreachable', reason: `${host} answered ${status} for ${projectPath}.` };
+});
+exports.checkGitCloneAccess = checkGitCloneAccess;
+//# sourceMappingURL=gitlab-token.js.map

package/src/lib/auth/gitlab-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitlab-token.js","sourceRoot":"","sources":["../../../../../../libs/cli/src/lib/auth/gitlab-token.ts"],"names":[],"mappings":";;;;AAAA,MAAM,UAAU,GAAG,KAAM,CAAC;AAI1B,MAAM,OAAO,GAAG,CAAO,OAAyD,EAA0B,EAAE;IAC1G,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAExF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC,CAAA,CAAC;AAQF;;;GAGG;AACI,MAAM,mBAAmB,GAAG,CAAO,OAAwC,EAAuB,EAAE;IACzG,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC3B,GAAG,EAAE,WAAW,IAAI,qCAAqC;QACzD,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;KACpC,CAAC,CAAC;IAEH,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC/E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAEpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,aAAa,MAAM,CAAC,QAAQ,CAAC,MAAM,wBAAwB,EAAE,CAAC;IAC9G,CAAC;IAED,MAAM,IAAI,GAAY,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;IAElG,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC3E,SAAS,EAAE,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;KACvF,CAAC;AACJ,CAAC,CAAA,CAAC;AAxBW,QAAA,mBAAmB,uBAwB9B;AASF;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,CAAO,OAIzC,EAAuB,EAAE;;IACxB,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;QAC3B,GAAG,EAAE,WAAW,IAAI,IAAI,WAAW,wCAAwC;QAC3E,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;KACzF,CAAC,CAAC;IAEH,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAE/E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAEnC,MAAM,CAAA,MAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,0CAAE,MAAM,EAAE,CAAA,CAAC;IAErC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACrD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAEhD,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,aAAa,MAAM,QAAQ,WAAW,GAAG,EAAE,CAAC;AAC5F,CAAC,CAAA,CAAC;AAvBW,QAAA,mBAAmB,uBAuB9B"}

package/src/lib/auth/index.d.ts

@@ -0,0 +1,4 @@
+export * from './auth-command';
+export * from './composer-auth';
+export * from './composer-repositories';
+export * from './gitlab-token';

package/src/lib/auth/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./auth-command"), exports);
+tslib_1.__exportStar(require("./composer-auth"), exports);
+tslib_1.__exportStar(require("./composer-repositories"), exports);
+tslib_1.__exportStar(require("./gitlab-token"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/cli/src/lib/auth/index.ts"],"names":[],"mappings":";;;AAAA,yDAA+B;AAC/B,0DAAgC;AAChC,kEAAwC;AACxC,yDAA+B"}

package/src/lib/config/diagnose.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Every problem with the repo topology config: a file that cannot be parsed, a key nothing reads, a
+ * checkout that is not there, and values still sitting in the file they moved out of.
+ */
+export declare const diagnoseLocalConfig: ({ root }: {
+    root: string;
+}) => string[];

package/src/lib/config/diagnose.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diagnoseLocalConfig = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const local_config_1 = require("./local-config");
+/** Marks a directory as an `ethlete-sdk` checkout rather than some other folder. */
+const SDK_CHECKOUT_MARKERS = ['libs/components', 'libs/core', 'libs/agent-rules'];
+const quoted = (keys) => keys.map((key) => `"${key}"`).join(', ');
+const describeSdkSourcePath = (options) => {
+    const { root, value, fileName } = options;
+    if (value === undefined)
+        return [];
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        return [`${fileName} has an invalid "sdkSourcePath" — use a path to an ethlete-sdk checkout.`];
+    }
+    const absolute = (0, local_config_1.resolveConfiguredPath)(root, value);
+    if (!(0, fs_1.existsSync)(absolute)) {
+        return [`${fileName} points "sdkSourcePath" at ${absolute}, which does not exist.`];
+    }
+    if (SDK_CHECKOUT_MARKERS.some((marker) => !(0, fs_1.existsSync)((0, path_1.join)(absolute, marker)))) {
+        return [`${fileName} points "sdkSourcePath" at ${absolute}, which is not an ethlete-sdk checkout.`];
+    }
+    return [];
+};
+const describeApiRepoPaths = (options) => {
+    const { root, value, fileName } = options;
+    if (value === undefined)
+        return [];
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return [
+            `${fileName} has an invalid "apiRepoPaths" value — use an object mapping an app name to its API repo path.`,
+        ];
+    }
+    return Object.entries(value).flatMap(([app, path]) => {
+        if (typeof path !== 'string' || path.trim().length === 0) {
+            return [`${fileName} has an invalid "apiRepoPaths.${app}" value — use a path to the API repo.`];
+        }
+        const absolute = (0, local_config_1.resolveConfiguredPath)(root, path);
+        if (!(0, fs_1.existsSync)(absolute)) {
+            return [`${fileName} points "apiRepoPaths.${app}" at ${absolute}, which does not exist.`];
+        }
+        if (!(0, fs_1.statSync)(absolute).isDirectory()) {
+            return [`${fileName} points "apiRepoPaths.${app}" at ${absolute}, which is not a directory.`];
+        }
+        return [];
+    });
+};
+const describeApiRepoBranches = (options) => {
+    const { value, fileName } = options;
+    if (value === undefined)
+        return [];
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return [
+            `${fileName} has an invalid "apiRepoBranches" value — use an object mapping an app name to its expected API branch.`,
+        ];
+    }
+    return Object.entries(value).flatMap(([app, branch]) => typeof branch === 'string' && branch.trim().length > 0
+        ? []
+        : [`${fileName} has an invalid "apiRepoBranches.${app}" value — use a non-empty branch name.`]);
+};
+const describeUpdateAgentCommand = (options) => {
+    const { value, fileName } = options;
+    if (value === undefined)
+        return [];
+    return typeof value === 'string' && value.trim().length > 0
+        ? []
+        : [`${fileName} has an invalid "updateAgentCommand" value — use the command that hands a prompt to an agent.`];
+};
+const describeValues = (options) => {
+    const { root, config, fileName } = options;
+    return [
+        ...describeSdkSourcePath({ root, value: config.sdkSourcePath, fileName }),
+        ...describeApiRepoPaths({ root, value: config.apiRepoPaths, fileName }),
+        ...describeApiRepoBranches({ value: config.apiRepoBranches, fileName }),
+        ...describeUpdateAgentCommand({ value: config.updateAgentCommand, fileName }),
+    ];
+};
+/**
+ * Every problem with the repo topology config: a file that cannot be parsed, a key nothing reads, a
+ * checkout that is not there, and values still sitting in the file they moved out of.
+ */
+const diagnoseLocalConfig = ({ root }) => {
+    const primary = (0, local_config_1.readLocalConfigFile)((0, path_1.join)(root, local_config_1.LOCAL_CONFIG_FILE_NAME));
+    if (primary.status === 'unreadable')
+        return [`${local_config_1.LOCAL_CONFIG_FILE_NAME} is not valid JSON.`];
+    if (primary.status === 'not-an-object')
+        return [`${local_config_1.LOCAL_CONFIG_FILE_NAME} is not a JSON object.`];
+    if (primary.status === 'ok') {
+        const unknownKeys = Object.keys(primary.config).filter((key) => !local_config_1.LOCAL_CONFIG_KEYS.includes(key));
+        return [
+            ...(unknownKeys.length > 0
+                ? [
+                    `${local_config_1.LOCAL_CONFIG_FILE_NAME} contains key(s) nothing reads: ${quoted(unknownKeys)} — it supports ${quoted(local_config_1.LOCAL_CONFIG_KEYS)}.`,
+                ]
+                : []),
+            ...describeValues({ root, config: primary.config, fileName: local_config_1.LOCAL_CONFIG_FILE_NAME }),
+        ];
+    }
+    const legacy = (0, local_config_1.readLocalConfigFile)((0, path_1.join)(root, local_config_1.LEGACY_LOCAL_CONFIG_FILE_NAME));
+    if (legacy.status !== 'ok')
+        return [];
+    const held = local_config_1.LOCAL_CONFIG_KEYS.filter((key) => legacy.config[key] !== undefined);
+    if (held.length === 0)
+        return [];
+    return [
+        `${local_config_1.LEGACY_LOCAL_CONFIG_FILE_NAME} still holds ${quoted(held)} — move ${held.length === 1 ? 'it' : 'them'} to ${local_config_1.LOCAL_CONFIG_FILE_NAME}.`,
+        ...describeValues({ root, config: legacy.config, fileName: local_config_1.LEGACY_LOCAL_CONFIG_FILE_NAME }),
+    ];
+};
+exports.diagnoseLocalConfig = diagnoseLocalConfig;
+//# sourceMappingURL=diagnose.js.map

package/src/lib/config/diagnose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnose.js","sourceRoot":"","sources":["../../../../../../libs/cli/src/lib/config/diagnose.ts"],"names":[],"mappings":";;;AAAA,2BAA0C;AAC1C,+BAA4B;AAC5B,iDAOwB;AAExB,oFAAoF;AACpF,MAAM,oBAAoB,GAAG,CAAC,iBAAiB,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AAElF,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE5E,MAAM,qBAAqB,GAAG,CAAC,OAA2D,EAAE,EAAE;IAC5F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,QAAQ,0EAA0E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,QAAQ,8BAA8B,QAAQ,yBAAyB,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,QAAQ,8BAA8B,QAAQ,yCAAyC,CAAC,CAAC;IACtG,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,OAA2D,EAAE,EAAE;IAC3F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,GAAG,QAAQ,gGAAgG;SAC5G,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;QACnD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,QAAQ,iCAAiC,GAAG,uCAAuC,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,oCAAqB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEnD,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,QAAQ,yBAAyB,GAAG,QAAQ,QAAQ,yBAAyB,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,QAAQ,yBAAyB,GAAG,QAAQ,QAAQ,6BAA6B,CAAC,CAAC;QAChG,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,OAA6C,EAAE,EAAE;IAChF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO;YACL,GAAG,QAAQ,yGAAyG;SACrH,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CACrD,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACpD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,QAAQ,oCAAoC,GAAG,wCAAwC,CAAC,CACjG,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC,OAA6C,EAAE,EAAE;IACnF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAEnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACzD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,GAAG,QAAQ,+FAA+F,CAAC,CAAC;AACnH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,OAAgE,EAAE,EAAE;IAC1F,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE3C,OAAO;QACL,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC;QACzE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC;QACvE,GAAG,uBAAuB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,CAAC;QACvE,GAAG,0BAA0B,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACI,MAAM,mBAAmB,GAAG,CAAC,EAAE,IAAI,EAAoB,EAAE,EAAE;IAChE,MAAM,OAAO,GAAG,IAAA,kCAAmB,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,qCAAsB,CAAC,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,CAAC,GAAG,qCAAsB,qBAAqB,CAAC,CAAC;IAE7F,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe;QAAE,OAAO,CAAC,GAAG,qCAAsB,wBAAwB,CAAC,CAAC;IAEnG,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CACpD,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,gCAAiB,CAAC,QAAQ,CAAC,GAAwB,CAAC,CAC/D,CAAC;QAEF,OAAO;YACL,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBACxB,CAAC,CAAC;oBACE,GAAG,qCAAsB,mCAAmC,MAAM,CAAC,WAAW,CAAC,kBAAkB,MAAM,CACrG,gCAAiB,CAClB,GAAG;iBACL;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,qCAAsB,EAAE,CAAC;SACtF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,kCAAmB,EAAC,IAAA,WAAI,EAAC,IAAI,EAAE,4CAA6B,CAAC,CAAC,CAAC;IAE9E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,IAAI,GAAG,gCAAiB,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;IAEjF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,OAAO;QACL,GAAG,4CAA6B,gBAAgB,MAAM,CAAC,IAAI,CAAC,WAC1D,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAC7B,OAAO,qCAAsB,GAAG;QAChC,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,4CAA6B,EAAE,CAAC;KAC5F,CAAC;AACJ,CAAC,CAAC;AAtCW,QAAA,mBAAmB,uBAsC9B"}

package/src/lib/config/index.d.ts

@@ -0,0 +1,2 @@
+export * from './diagnose';
+export * from './local-config';

package/src/lib/config/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./diagnose"), exports);
+tslib_1.__exportStar(require("./local-config"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/cli/src/lib/config/index.ts"],"names":[],"mappings":";;;AAAA,qDAA2B;AAC3B,yDAA+B"}