@graphorin/cli 0.5.0

package/dist/internal/store-context.js

@@ -0,0 +1,69 @@
+import { loadConfig } from "./load-config.js";
+import { resolveSecret } from "@graphorin/security";
+import { parseServerConfig } from "@graphorin/server";
+import { createSqliteStore } from "@graphorin/store-sqlite";
+
+//#region src/internal/store-context.ts
+/**
+* Shared helper that loads `graphorin.config`, parses it through
+* `parseServerConfig(...)`, opens the SQLite store, optionally resolves
+* the server pepper, and returns a disposable handle for any Phase 15
+* subcommand that needs a live storage / auth context.
+*
+* Centralising the resource lifecycle here means every command (token,
+* audit, secrets, memory, triggers, storage, …) acquires + releases
+* the same way; tests only stub the loader once.
+*
+* @internal
+*/
+/**
+* Open the storage context for the provided config path. Throws on
+* Zod validation errors and on `requirePepper && !pepperRef`.
+*
+* @internal
+*/
+async function openStoreContext(options = {}) {
+	const loaded = await loadConfig(options.config);
+	const config = parseServerConfig(loaded.config);
+	const factory = options.storeFactory ?? createSqliteStore;
+	const storeOpts = {
+		path: config.storage.path,
+		mode: config.storage.mode
+	};
+	if (config.storage.encryption.enabled) {
+		if (config.storage.encryption.passphraseRef === void 0) throw new Error("[graphorin/cli] storage.encryption.enabled is true but no passphraseRef is configured.");
+		const { resolveSecret: resolveSecret$1 } = await import("@graphorin/security/secrets");
+		const passphrase = await resolveSecret$1(config.storage.encryption.passphraseRef);
+		storeOpts.encryption = {
+			enabled: true,
+			...config.storage.encryption.cipher !== void 0 ? { cipher: config.storage.encryption.cipher } : {},
+			passphraseResolver: async () => passphrase.use((v) => v)
+		};
+	}
+	const store = await factory(storeOpts);
+	if (options.skipInit !== true) await store.init();
+	let pepper;
+	if (options.requirePepper === true) {
+		if (config.auth.kind !== "token" || config.auth.pepperRef === void 0) {
+			await store.close();
+			throw new Error(`[graphorin/cli] this command requires auth.kind: 'token' + auth.pepperRef in '${loaded.path}'.`);
+		}
+		try {
+			pepper = await resolveSecret(config.auth.pepperRef);
+		} catch (err) {
+			await store.close();
+			throw new Error(`[graphorin/cli] failed to resolve auth.pepperRef '${config.auth.pepperRef}': ${err.message}`, { cause: err });
+		}
+	}
+	return Object.freeze({
+		configPath: loaded.path,
+		config,
+		store,
+		...pepper !== void 0 ? { pepper } : {},
+		close: () => store.close()
+	});
+}
+
+//#endregion
+export { openStoreContext };
+//# sourceMappingURL=store-context.js.map

package/dist/internal/store-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-context.js","names":["storeOpts: CreateSqliteStoreOptions","resolveSecret","pepper: SecretValue | undefined"],"sources":["../../src/internal/store-context.ts"],"sourcesContent":["/**\n * Shared helper that loads `graphorin.config`, parses it through\n * `parseServerConfig(...)`, opens the SQLite store, optionally resolves\n * the server pepper, and returns a disposable handle for any Phase 15\n * subcommand that needs a live storage / auth context.\n *\n * Centralising the resource lifecycle here means every command (token,\n * audit, secrets, memory, triggers, storage, …) acquires + releases\n * the same way; tests only stub the loader once.\n *\n * @internal\n */\n\nimport { resolveSecret, type SecretValue } from '@graphorin/security';\nimport { parseServerConfig, type ServerConfigSpec } from '@graphorin/server';\nimport {\n  type CreateSqliteStoreOptions,\n  createSqliteStore,\n  type GraphorinSqliteStore,\n} from '@graphorin/store-sqlite';\n\nimport { loadConfig } from './load-config.js';\n\n/**\n * @internal\n */\nexport interface OpenStoreContextOptions {\n  /** Path to `graphorin.config.{ts,js,mjs,json}`. */\n  readonly config?: string;\n  /**\n   * When `true`, refuse to continue when `auth.pepperRef` cannot be\n   * resolved. Default `false` — callers that do not need the pepper\n   * (e.g. `graphorin audit verify`) skip resolution entirely.\n   */\n  readonly requirePepper?: boolean;\n  /**\n   * Override the store factory — tests inject a fake store so they\n   * can run subcommand integration without touching a real DB.\n   */\n  readonly storeFactory?: (options: CreateSqliteStoreOptions) => Promise<GraphorinSqliteStore>;\n  /**\n   * Skip migrations. Defaults to `false` so subcommands always operate\n   * against an initialized schema.\n   */\n  readonly skipInit?: boolean;\n}\n\n/**\n * @internal\n */\nexport interface StoreContext {\n  readonly configPath: string;\n  readonly config: ServerConfigSpec;\n  readonly store: GraphorinSqliteStore;\n  readonly pepper?: SecretValue;\n  /** Releases the underlying SQLite connection. */\n  close(): Promise<void>;\n}\n\n/**\n * Open the storage context for the provided config path. Throws on\n * Zod validation errors and on `requirePepper && !pepperRef`.\n *\n * @internal\n */\nexport async function openStoreContext(\n  options: OpenStoreContextOptions = {},\n): Promise<StoreContext> {\n  const loaded = await loadConfig(options.config);\n  const config = parseServerConfig(loaded.config);\n  const factory = options.storeFactory ?? createSqliteStore;\n  const storeOpts: CreateSqliteStoreOptions = {\n    path: config.storage.path,\n    mode: config.storage.mode,\n  };\n  // IP-1: the CLI honours the same encryption config as the server, so\n  // `graphorin` commands can open a database produced by\n  // `graphorin storage encrypt`.\n  if (config.storage.encryption.enabled) {\n    if (config.storage.encryption.passphraseRef === undefined) {\n      throw new Error(\n        '[graphorin/cli] storage.encryption.enabled is true but no passphraseRef is configured.',\n      );\n    }\n    const { resolveSecret } = await import('@graphorin/security/secrets');\n    const passphrase = await resolveSecret(config.storage.encryption.passphraseRef);\n    (storeOpts as { encryption?: unknown }).encryption = {\n      enabled: true,\n      ...(config.storage.encryption.cipher !== undefined\n        ? { cipher: config.storage.encryption.cipher }\n        : {}),\n      passphraseResolver: async () => passphrase.use((v: string) => v),\n    };\n  }\n  const store = await factory(storeOpts);\n  if (options.skipInit !== true) {\n    await store.init();\n  }\n\n  let pepper: SecretValue | undefined;\n  if (options.requirePepper === true) {\n    if (config.auth.kind !== 'token' || config.auth.pepperRef === undefined) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] this command requires auth.kind: 'token' + auth.pepperRef in '${loaded.path}'.`,\n      );\n    }\n    try {\n      pepper = await resolveSecret(config.auth.pepperRef);\n    } catch (err) {\n      await store.close();\n      throw new Error(\n        `[graphorin/cli] failed to resolve auth.pepperRef '${config.auth.pepperRef}': ${(err as Error).message}`,\n        { cause: err },\n      );\n    }\n  }\n\n  const ctx: StoreContext = Object.freeze({\n    configPath: loaded.path,\n    config,\n    store,\n    ...(pepper !== undefined ? { pepper } : {}),\n    close: () => store.close(),\n  });\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAiEA,eAAsB,iBACpB,UAAmC,EAAE,EACd;CACvB,MAAM,SAAS,MAAM,WAAW,QAAQ,OAAO;CAC/C,MAAM,SAAS,kBAAkB,OAAO,OAAO;CAC/C,MAAM,UAAU,QAAQ,gBAAgB;CACxC,MAAMA,YAAsC;EAC1C,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,QAAQ;EACtB;AAID,KAAI,OAAO,QAAQ,WAAW,SAAS;AACrC,MAAI,OAAO,QAAQ,WAAW,kBAAkB,OAC9C,OAAM,IAAI,MACR,yFACD;EAEH,MAAM,EAAE,mCAAkB,MAAM,OAAO;EACvC,MAAM,aAAa,MAAMC,gBAAc,OAAO,QAAQ,WAAW,cAAc;AAC/E,EAAC,UAAuC,aAAa;GACnD,SAAS;GACT,GAAI,OAAO,QAAQ,WAAW,WAAW,SACrC,EAAE,QAAQ,OAAO,QAAQ,WAAW,QAAQ,GAC5C,EAAE;GACN,oBAAoB,YAAY,WAAW,KAAK,MAAc,EAAE;GACjE;;CAEH,MAAM,QAAQ,MAAM,QAAQ,UAAU;AACtC,KAAI,QAAQ,aAAa,KACvB,OAAM,MAAM,MAAM;CAGpB,IAAIC;AACJ,KAAI,QAAQ,kBAAkB,MAAM;AAClC,MAAI,OAAO,KAAK,SAAS,WAAW,OAAO,KAAK,cAAc,QAAW;AACvE,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,iFAAiF,OAAO,KAAK,IAC9F;;AAEH,MAAI;AACF,YAAS,MAAM,cAAc,OAAO,KAAK,UAAU;WAC5C,KAAK;AACZ,SAAM,MAAM,OAAO;AACnB,SAAM,IAAI,MACR,qDAAqD,OAAO,KAAK,UAAU,KAAM,IAAc,WAC/F,EAAE,OAAO,KAAK,CACf;;;AAWL,QAP0B,OAAO,OAAO;EACtC,YAAY,OAAO;EACnB;EACA;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,aAAa,MAAM,OAAO;EAC3B,CAAC"}

package/package.json

@@ -0,0 +1,79 @@
+{
+  "name": "@graphorin/cli",
+  "version": "0.5.0",
+  "description": "Operator CLI for the Graphorin framework. Phase 14a ships the minimal `graphorin` binary with three commands: `graphorin start` (boot the standalone server with lifecycle hooks + pre-bind validation + storage migrations + audit log), `graphorin init` (interactive prompts for cloud-upload consent, opt-in storage encryption, and one-shot bootstrap-token issuance; --non-interactive accepts every option as flags or env vars), and `graphorin migrate` (idempotent storage migrations against the configured SQLite store). Phase 15 extends the same binary with `doctor`, `token`, `secrets`, `storage`, `audit`, `memory`, `consolidator`, `triggers`, `auth`, `pricing`, `skills`, `traces`, `migrate-export`, `guard`, and `telemetry`. Created and maintained by Oleksiy Stepurenko.",
+  "license": "MIT",
+  "author": "Oleksiy Stepurenko",
+  "homepage": "https://github.com/o-stepper/graphorin/tree/main/packages/cli",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/o-stepper/graphorin.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/o-stepper/graphorin/issues"
+  },
+  "keywords": [
+    "graphorin",
+    "ai",
+    "agents",
+    "framework",
+    "cli",
+    "graphorin-start",
+    "graphorin-init",
+    "graphorin-migrate"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "graphorin": "./dist/bin/graphorin.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./commands": {
+      "types": "./dist/commands/index.d.ts",
+      "import": "./dist/commands/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "commander": "^10.0.0",
+    "@graphorin/core": "0.5.0",
+    "@graphorin/eslint-plugin": "0.5.0",
+    "@graphorin/memory": "0.5.0",
+    "@graphorin/pricing": "0.5.0",
+    "@graphorin/security": "0.5.0",
+    "@graphorin/server": "0.5.0",
+    "@graphorin/sessions": "0.5.0",
+    "@graphorin/skills": "0.5.0",
+    "@graphorin/store-sqlite": "0.5.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "devDependencies": {
+    "@graphorin/store-sqlite-encrypted": "0.5.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.tests.json",
+    "test": "vitest run",
+    "lint": "biome check .",
+    "clean": "rimraf dist .turbo *.tsbuildinfo"
+  }
+}